--- /dev/null
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 19. CUPS Printing Support in Samba 3.0</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><link rel="home" href="index.html" title="SAMBA Project Documentation"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="previous" href="printing.html" title="Chapter 18. Classical Printing Support"><link rel="next" href="VFS.html" title="Chapter 20. Stackable VFS modules"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 19. CUPS Printing Support in Samba 3.0</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="printing.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="VFS.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="CUPS-printing"></a>Chapter 19. CUPS Printing Support in Samba 3.0</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Kurt</span> <span class="surname">Pfeifle</span></h3><div class="affiliation"><span class="orgname"> Danka Deutschland GmbH <br></span><div class="address"><p><tt class="email"><<a href="mailto:kpfeifle@danka.de">kpfeifle@danka.de</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Ciprian</span> <span class="surname">Vizitiu</span></h3><span class="contrib">drawings</span><div class="affiliation"><div class="address"><p><tt class="email"><<a href="mailto:CVizitiu@gbif.org">CVizitiu@gbif.org</a>></tt></p></div></div></div></div><div><p class="pubdate"> (3 June 2003) </p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="CUPS-printing.html#id2956942">Introduction</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2956949">Features and Benefits</a></dt><dt><a href="CUPS-printing.html#id2956998">Overview</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2957049">Basic Configuration of CUPS support</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2957129">Linking of smbd with libcups.so</a></dt><dt><a href="CUPS-printing.html#id2950037">Simple smb.conf Settings for CUPS</a></dt><dt><a href="CUPS-printing.html#id2950100">More complex smb.conf Settings for
+CUPS</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2950199">Advanced Configuration</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2950220">Central spooling vs. "Peer-to-Peer" printing</a></dt><dt><a href="CUPS-printing.html#id2950247">CUPS/Samba as a "spooling-only" Print Server; "raw" printing
+with Vendor Drivers on Windows Clients</a></dt><dt><a href="CUPS-printing.html#id2950283">Driver Installation Methods on Windows Clients</a></dt><dt><a href="CUPS-printing.html#id2950342">Explicitly enable "raw" printing for
+application/octet-stream!</a></dt><dt><a href="CUPS-printing.html#id2950503">Three familiar Methods for driver upload plus a new one</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2950596">Using CUPS/Samba in an advanced Way -- intelligent printing
+with PostScript Driver Download</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2950671">GDI on Windows -- PostScript on Unix</a></dt><dt><a href="CUPS-printing.html#id2950716">Windows Drivers, GDI and EMF</a></dt><dt><a href="CUPS-printing.html#id2950814">Unix Printfile Conversion and GUI Basics</a></dt><dt><a href="CUPS-printing.html#id2950886">PostScript and Ghostscript</a></dt><dt><a href="CUPS-printing.html#id2950982">Ghostscript -- the Software RIP for non-PostScript Printers</a></dt><dt><a href="CUPS-printing.html#id2951078">PostScript Printer Description (PPD) Specification</a></dt><dt><a href="CUPS-printing.html#id2963900">CUPS can use all Windows-formatted Vendor PPDs</a></dt><dt><a href="CUPS-printing.html#id2963990">CUPS also uses PPDs for non-PostScript Printers</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2964013">The CUPS Filtering Architecture</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2964151">MIME types and CUPS Filters</a></dt><dt><a href="CUPS-printing.html#id2964338">MIME type Conversion Rules</a></dt><dt><a href="CUPS-printing.html#id2964455">Filter Requirements</a></dt><dt><a href="CUPS-printing.html#id2964624">Prefilters</a></dt><dt><a href="CUPS-printing.html#id2964708">pstops</a></dt><dt><a href="CUPS-printing.html#id2964812">pstoraster</a></dt><dt><a href="CUPS-printing.html#id2964968">imagetops and imagetoraster</a></dt><dt><a href="CUPS-printing.html#id2965023">rasterto [printerspecific]</a></dt><dt><a href="CUPS-printing.html#id2965107">CUPS Backends</a></dt><dt><a href="CUPS-printing.html#id2965422">cupsomatic/Foomatic -- how do they fit into the Picture?</a></dt><dt><a href="CUPS-printing.html#id2965524">The Complete Picture</a></dt><dt><a href="CUPS-printing.html#id2965540">mime.convs</a></dt><dt><a href="CUPS-printing.html#id2965593">"Raw" printing</a></dt><dt><a href="CUPS-printing.html#id2965647">"application/octet-stream" printing</a></dt><dt><a href="CUPS-printing.html#id2965862">PostScript Printer Descriptions (PPDs) for non-PS Printers</a></dt><dt><a href="CUPS-printing.html#id2966090">Difference between cupsomatic/foomatic-rip and
+native CUPS printing</a></dt><dt><a href="CUPS-printing.html#id2966247">Examples for filtering Chains</a></dt><dt><a href="CUPS-printing.html#id2966476">Sources of CUPS drivers / PPDs</a></dt><dt><a href="CUPS-printing.html#id2966601">Printing with Interface Scripts</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2966663">Network printing (purely Windows)</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2966679">From Windows Clients to an NT Print Server</a></dt><dt><a href="CUPS-printing.html#id2966718">Driver Execution on the Client</a></dt><dt><a href="CUPS-printing.html#id2966777">Driver Execution on the Server</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2966840">Network Printing (Windows clients -- UNIX/Samba Print
+Servers)</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2966861">From Windows Clients to a CUPS/Samba Print Server</a></dt><dt><a href="CUPS-printing.html#id2967021">Samba receiving Jobfiles and passing them to CUPS</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2967099">Network PostScript RIP: CUPS Filters on Server -- clients use
+PostScript Driver with CUPS-PPDs</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2967154">PPDs for non-PS Printers on UNIX</a></dt><dt><a href="CUPS-printing.html#id2967194">PPDs for non-PS Printers on Windows</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2967260">Windows Terminal Servers (WTS) as CUPS Clients</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2967277">Printer Drivers running in "Kernel Mode" cause many
+Problems</a></dt><dt><a href="CUPS-printing.html#id2967312">Workarounds impose Heavy Limitations</a></dt><dt><a href="CUPS-printing.html#id2967333">CUPS: a "Magical Stone"?</a></dt><dt><a href="CUPS-printing.html#id2967360">PostScript Drivers with no major problems -- even in Kernel
+Mode</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2967394"> Setting up CUPS for driver Download</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2967412">cupsaddsmb: the unknown Utility</a></dt><dt><a href="CUPS-printing.html#id2967504">Prepare your smb.conf for
+cupsaddsmb</a></dt><dt><a href="CUPS-printing.html#id2967550">CUPS Package of "PostScript Driver for WinNT/2k/XP"</a></dt><dt><a href="CUPS-printing.html#id2967748">Recognize the different Driver Files</a></dt><dt><a href="CUPS-printing.html#id2967806">Acquiring the Adobe Driver Files</a></dt><dt><a href="CUPS-printing.html#id2967838">ESP Print Pro Package of "PostScript Driver for
+WinNT/2k/XP"</a></dt><dt><a href="CUPS-printing.html#id2967888">Caveats to be considered</a></dt><dt><a href="CUPS-printing.html#id2968110">What are the Benefits of using the "CUPS PostScript Driver for
+Windows NT/2k/XP" as compared to the Adobe Driver?</a></dt><dt><a href="CUPS-printing.html#id2968291">Run "cupsaddsmb" (quiet Mode)</a></dt><dt><a href="CUPS-printing.html#id2968392">Run "cupsaddsmb" with verbose Output</a></dt><dt><a href="CUPS-printing.html#id2968534">Understanding cupsaddsmb</a></dt><dt><a href="CUPS-printing.html#id2968628">How to recognize if cupsaddsm completed successfully</a></dt><dt><a href="CUPS-printing.html#id2968716">cupsaddsmb with a Samba PDC</a></dt><dt><a href="CUPS-printing.html#id2968750">cupsaddsmb Flowchart</a></dt><dt><a href="CUPS-printing.html#id2968801">Installing the PostScript Driver on a Client</a></dt><dt><a href="CUPS-printing.html#id2968916">Avoiding critical PostScript Driver Settings on the
+Client</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2969051">Installing PostScript Driver Files manually (using
+rpcclient)</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2969166">A Check of the rpcclient man Page</a></dt><dt><a href="CUPS-printing.html#id2969278">Understanding the rpcclient man Page</a></dt><dt><a href="CUPS-printing.html#id2969357">Producing an Example by querying a Windows Box</a></dt><dt><a href="CUPS-printing.html#id2969447">What is required for adddriver and setdriver to succeed</a></dt><dt><a href="CUPS-printing.html#id2969609">Manual Commandline Driver Installation in 15 little Steps</a></dt><dt><a href="CUPS-printing.html#id2970229">Troubleshooting revisited</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2970331">The printing *.tdb Files</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2970434">Trivial DataBase Files</a></dt><dt><a href="CUPS-printing.html#id2970504">Binary Format</a></dt><dt><a href="CUPS-printing.html#id2970566">Losing *.tdb Files</a></dt><dt><a href="CUPS-printing.html#id2970624">Using tdbbackup</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2970686">CUPS Print Drivers from Linuxprinting.org</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2970793">foomatic-rip and Foomatic explained</a></dt><dt><a href="CUPS-printing.html#id2971421">foomatic-rip and Foomatic-PPD Download and Installation</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2971878">Page Accounting with CUPS</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2971910">Setting up Quotas</a></dt><dt><a href="CUPS-printing.html#id2971941">Correct and incorrect Accounting</a></dt><dt><a href="CUPS-printing.html#id2971982">Adobe and CUPS PostScript Drivers for Windows Clients</a></dt><dt><a href="CUPS-printing.html#id2972054">The page_log File Syntax</a></dt><dt><a href="CUPS-printing.html#id2972155">Possible Shortcomings</a></dt><dt><a href="CUPS-printing.html#id2972226">Future Developments</a></dt><dt><a href="CUPS-printing.html#id2972275">Other Accounting Tools</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2972290">Additional Material</a></dt><dt><a href="CUPS-printing.html#id2972483">Auto-Deletion or Preservation of CUPS Spool Files</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2972529">CUPS Configuration Settings explained</a></dt><dt><a href="CUPS-printing.html#id2972611">Pre-conditions</a></dt><dt><a href="CUPS-printing.html#id2972672">Manual Configuration</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2972690">When not to use Samba to print to
+CUPS</a></dt><dt><a href="CUPS-printing.html#id2972707">In Case of Trouble.....</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2972742">Where to find Documentation</a></dt><dt><a href="CUPS-printing.html#id2972755">How to ask for Help</a></dt><dt><a href="CUPS-printing.html#id2972768">Where to find Help</a></dt></dl></dd><dt><a href="CUPS-printing.html#id2972782">Appendix</a></dt><dd><dl><dt><a href="CUPS-printing.html#id2972789">Printing from CUPS to Windows attached
+Printers</a></dt><dt><a href="CUPS-printing.html#id2972982">More CUPS filtering Chains</a></dt><dt><a href="CUPS-printing.html#id2973237">Trouble Shooting Guidelines to fix typical Samba printing
+Problems</a></dt><dt><a href="CUPS-printing.html#id2974343">An Overview of the CUPS Printing Processes</a></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2956942"></a>Introduction</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2956949"></a>Features and Benefits</h3></div></div><div></div></div><p>
+ The Common Unix Print System (<a href="http://www.cups.org/" target="_top">CUPS</a>) has become very popular. All
+ big Linux distributions now ship it as their default printing
+ system. But to many it is still a very mystical tool. Normally it
+ "just works" (TM). People tend to regard it as a sort of "black box",
+ which they don't want to look into, as long as it works OK. But once
+ there is a little problem, they are in trouble to find out where to
+ start debugging it. Also, even the most recent and otherwise excellent
+ printed Samba documentation has only limited attention paid to CUPS
+ printing, leaving out important pieces or even writing plain wrong
+ things about it. This demands rectification. But before you dive into
+ this chapter, make sure that you don't forget to refer to the
+ "Classical Printing" chapter also. It contains a lot of information
+ that is relevant for CUPS too.
+ </p><p>
+ CUPS sports quite a few unique and powerful features. While their
+ basic functions may be grasped quite easily, they are also
+ new. Because they are different from other, more traditional printing
+ systems, it is best to try and not apply any prior knowledge about
+ printing upon this new system. Rather try to start understand CUPS
+ from the beginning. This documentation will lead you here to a
+ complete understanding of CUPS, if you study all of the material
+ contained. But lets start with the most basic things first. Maybe this
+ is all you need for now. Then you can skip most of the other
+ paragraphs.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2956998"></a>Overview</h3></div></div><div></div></div><p>
+ CUPS is more than just a print spooling system. It is a complete
+ printer management system that complies with the new IPP
+ (<span class="emphasis"><em>Internet Printing Protocol</em></span>). IPP is an industry
+ and IETF (<span class="emphasis"><em>Internet Engineering Task Force</em></span>)
+ standard for network printing. Many of its functions can be managed
+ remotely (or locally) via a web browser (giving you a
+ platform-independent access to the CUPS print server). In addition it
+ has the traditional commandline and several more modern GUI interfaces
+ (GUI interfaces developed by 3rd parties, like KDE's
+ overwhelming <a href="http://printing.kde.org/" target="_top">KDEPrint</a>).
+ </p><p>
+ CUPS allows creation of "raw" printers (ie: NO print file
+ format translation) as well as "smart" printers (i.e. CUPS does
+ file format conversion as required for the printer). In many ways
+ this gives CUPS similar capabilities to the MS Windows print
+ monitoring system. Of course, if you are a CUPS advocate, you would
+ argue that CUPS is better! In any case, let us now move on to
+ explore how one may configure CUPS for interfacing with MS Windows
+ print clients via Samba.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2957049"></a>Basic Configuration of CUPS support</h2></div></div><div></div></div><p>
+ Printing with CUPS in the most basic <tt class="filename">smb.conf</tt>
+ setup in Samba 3.0 (as was true for 2.2.x) only needs two
+ settings: <i class="parameter"><tt>printing = cups</tt></i> and <i class="parameter"><tt>printcap
+ = cups</tt></i>. CUPS itself doesn't need a printcap file
+ anymore. However, the <tt class="filename">cupsd.conf</tt> configuration
+ file knows two related directives: they control if such a file should
+ be automatically created and maintained by CUPS for the convenience of
+ third party applications (example: <i class="parameter"><tt>Printcap
+ /etc/printcap</tt></i> and <i class="parameter"><tt>PrintcapFormat
+ BSD</tt></i>). These legacy programs often require the existence of
+ printcap file containing printernames or they will refuse to
+ print. Make sure CUPS is set to generate and maintain a printcap! For
+ details see <b class="command">man cupsd.conf</b> and other CUPS-related
+ documentation, like the wealth of documents on your CUPS server
+ itself: <a href="http://localhost:631/documentation.html" target="_top">http://localhost:631/documentation.html</a>.
+ </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957129"></a>Linking of smbd with <tt class="filename">libcups.so</tt></h3></div></div><div></div></div><p>
+ Samba has a very special relationship to CUPS. The reason is: Samba
+ can be compiled with CUPS library support. Most recent installations
+ have this support enabled, and per default CUPS linking is compiled
+ into smbd and other Samba binaries. Of course, you can use CUPS even
+ if Samba is not linked against <tt class="filename">libcups.so</tt> -- but
+ there are some differences in required or supported configuration
+ then.
+ </p><p>
+ If SAMBA is compiled against libcups, then <i class="parameter"><tt>printcap =
+ cups</tt></i> uses the CUPS API to list printers, submit jobs,
+ query queues, etc. Otherwise it maps to the System V commands with an
+ additional <b class="command">-oraw</b> option for printing. On a Linux
+ system, you can use the <b class="command">ldd</b> utility to find out
+ details (ldd may not be present on other OS platforms, or its function
+ may be embodied by a different command):
+ </p><pre class="screen">
+ transmeta:/home/kurt # ldd `which smbd`
+ libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000)
+ libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
+ libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)
+ [....]
+ </pre><p>
+ The line <tt class="computeroutput">libcups.so.2 => /usr/lib/libcups.so.2
+ (0x40123000)</tt> shows there is CUPS support compiled
+ into this version of Samba. If this is the case, and printing = cups
+ is set, then <span class="emphasis"><em>any otherwise manually set print command in
+ <tt class="filename">smb.conf</tt> is ignored</em></span>. This is an
+ important point to remember!
+ </p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p> Should you require -- for any reason -- to set your own
+ print commands, you can still do this by setting <i class="parameter"><tt>printing =
+ sysv</tt></i>. However, you'll loose all the benefits from the
+ close CUPS/Samba integration. You are on your own then to manually
+ configure the rest of the printing system commands (most important:
+ <i class="parameter"><tt>print command</tt></i>; other commands are
+ <i class="parameter"><tt>lppause command, lpresume command, lpq command, lprm
+ command, queuepause command </tt></i> and <i class="parameter"><tt>queue resume
+ command</tt></i>).</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950037"></a>Simple <tt class="filename">smb.conf</tt> Settings for CUPS</h3></div></div><div></div></div><p>
+ To summarize, here is the simplest printing-related setup
+ for<tt class="filename">smb.conf</tt> to enable basic CUPS support:
+ </p><pre class="screen">
+
+ [global]
+ load printers = yes
+ printing = cups
+ printcap name = cups
+
+ [printers]
+ comment = All Printers
+ path = /var/spool/samba
+ browseable = no
+ public = yes
+ guest ok = yes
+ writable = no
+ printable = yes
+ printer admin = root, @ntadmins
+
+ </pre><p>
+ This is all you need for basic printing setup for CUPS. It will print
+ all Graphic, Text, PDF and PostScript file submitted from Windows
+ clients. However, most of your Windows users would not know how to
+ send these kind of files to print without opening a GUI
+ application. Windows clients tend to have local printer drivers
+ installed. And the GUI application's print buttons start a printer
+ driver. Your users also very rarely send files from the command
+ line. Unlike UNIX clients, they hardly submit graphic, text or PDF
+ formatted files directly to the spooler. They nearly exclusively print
+ from GUI applications, with a "printer driver" hooked in between the
+ applications native format and the print data stream. If the backend
+ printer is not a PostScript device, the print data stream is "binary",
+ sensible only for the target printer. Read on to learn which problem
+ this may cause and how to avoid it.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950100"></a>More complex <tt class="filename">smb.conf</tt> Settings for
+CUPS</h3></div></div><div></div></div><p>
+Here is a slightly more complex printing-related setup
+for<tt class="filename">smb.conf</tt>. It enables general CUPS printing
+support for all printers, but defines one printer share which is set
+up differently.
+</p><pre class="screen">
+
+ [global]
+ printing = cups
+ printcap name = cups
+ load printers = yes
+
+ [printers]
+ comment = All Printers
+ path = /var/spool/samba
+ public = yes
+ guest ok = yes
+ writable = no
+ printable = yes
+ printer admin = root, @ntadmins
+
+ [special_printer]
+ comment = A special printer with his own settings
+ path = /var/spool/samba-special
+ printing = sysv
+ printcap = lpstat
+ print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ;\
+ echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ;\
+ echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log :\
+ rm %f
+ public = no
+ guest ok = no
+ writeable = no
+ printable = yes
+ printer admin = kurt
+ hosts deny = 0.0.0.0
+ hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60
+
+</pre><p>
+This special share is only there for my testing purposes. It doesn't
+even write the printjob to a file. It just logs the job parameters
+known to Samba into the <tt class="filename">/tmp/smbprn.log</tt> file and
+deletes the jobfile. Moreover, the <i class="parameter"><tt>printer
+admin</tt></i> of this share is "kurt" (not the "@ntadmins" group);
+guest access is not allowed; the share isn't announced in Network
+Neighbourhood (so you need to know it is there), and it is only
+allowing access from three hosts. To prevent CUPS kicking in and
+taking over the print jobs for that share, we need to set
+<i class="parameter"><tt>printing = sysv</tt></i> and <i class="parameter"><tt>printcap =
+lpstat</tt></i>.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2950199"></a>Advanced Configuration</h2></div></div><div></div></div><p>
+Before we dive into all the configuration options, let's clarify a few
+points. <span class="emphasis"><em>Network printing needs to be organized and setup
+correctly</em></span>. Often this is not done correctly. Legacy systems
+or small LANs in business environments often lack a clear design and
+good housekeeping.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950220"></a>Central spooling vs. "Peer-to-Peer" printing</h3></div></div><div></div></div><p>
+Many small office or home networks, as well as badly organized larger
+environments, allow each client a direct access to available network
+printers. Generally, this is a bad idea. It often blocks one client's
+access to the printer when another client's job is printing. It also
+might freeze the first client's application while it is waiting to get
+rid of the job. Also, there are frequent complaints about various jobs
+being printed with their pages mixed with each other. A better concept
+is the usage of a "print server": it routes all jobs through one
+central system, which responds immediately, takes jobs from multiple
+concurrent clients at the same time and in turn transfers them to the
+printer(s) in the correct order.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950247"></a>CUPS/Samba as a "spooling-only" Print Server; "raw" printing
+with Vendor Drivers on Windows Clients</h3></div></div><div></div></div><p>
+Most traditionally configured Unix print servers acting on behalf of
+Samba's Windows clients represented a really simple setup. Their only
+task was to manage the "raw" spooling of all jobs handed to them by
+Samba. This approach meant that the Windows clients were expected to
+prepare the printjob file in such a way that it became fit to be fed to
+the printing device. Here a native (vendor-supplied) Windows printer
+driver for the target device needed to be installed on each and every
+client.
+</p><p>
+Of course you can setup CUPS, Samba and your Windows clients in the
+same, traditional and simple way. When CUPS printers are configured
+for RAW print-through mode operation it is the responsibility of the
+Samba client to fully render the print job (file). The file must be
+sent in a format that is suitable for direct delivery to the
+printer. Clients need to run the vendor-provided drivers to do
+this. In this case CUPS will NOT do any print file format conversion
+work.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950283"></a>Driver Installation Methods on Windows Clients</h3></div></div><div></div></div><p>
+The printer drivers on the Windows clients may be installed
+in two functionally different ways:
+</p><div class="itemizedlist"><ul type="disc"><li><p>manually install the drivers locally on each client,
+one by one; this yields the old <span class="emphasis"><em>LanMan</em></span> style
+printing; it uses a <tt class="filename">\\sambaserver\printershare</tt>
+type of connection.</p></li><li><p>deposit and prepare the drivers (for later download) on
+the print server (Samba); this enables the clients to use
+"Point'n'Print" to get drivers semi-automatically installed the
+first time they access the printer; with this method NT/2K/XP
+clients use the <span class="emphasis"><em>SPOOLSS/MS-RPC</em></span>
+type printing calls.</p></li></ul></div><p>
+The second method is recommended for use over the first.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950342"></a>Explicitly enable "raw" printing for
+<span class="emphasis"><em>application/octet-stream</em></span>!</h3></div></div><div></div></div><p>
+If you use the first option (drivers are installed on the client
+side), there is one setting to take care of: CUPS needs to be told
+that it should allow "raw" printing of deliberate (binary) file
+formats. The CUPS files that need to be correctly set for RAW mode
+printers to work are:
+</p><div class="itemizedlist"><ul type="disc"><li><p>/etc/cups/mime.types
+</p></li><li><p>/etc/cups/mime.convs</p></li></ul></div><p>
+Both contain entries (at the end of the respective files) which must
+be uncommented to allow RAW mode operation.
+In<tt class="filename">/etc/cups/mime.types</tt> make sure this line is
+present:
+</p><pre class="screen">
+
+ application/octet-stream
+
+</pre><p>
+In <tt class="filename">/etc/cups/mime.convs</tt>,
+have this line:
+</p><pre class="screen">
+
+ application/octet-stream application/vnd.cups-raw 0 -
+
+</pre><p>
+If these two files are not set up correctly for raw Windows client
+printing, you may encounter the dreaded <tt class="computeroutput">Unable to
+convert file 0</tt> in your CUPS error_log file.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>editing the <tt class="filename">mime.convs</tt> and the
+<tt class="filename">mime.types</tt> file does not
+<span class="emphasis"><em>enforce</em></span> "raw" printing, it only
+<span class="emphasis"><em>allows</em></span> it.
+</p></div><p><b>Background. </b>
+CUPS being a more security-aware printing system than traditional ones
+does not by default allow a user to send deliberate (possibly binary)
+data to printing devices. This could be easily abused to launch a
+"Denial of Service" attack on your printer(s), causing at the least
+the loss of a lot of paper and ink. "Unknown" data are tagged by CUPS
+as <span class="emphasis"><em>MIME type: application/octet-stream</em></span> and not
+allowed to go to the printer. By default, you can only send other
+(known) MIME types "raw". Sending data "raw" means that CUPS does not
+try to convert them and passes them to the printer untouched (see next
+chapter for even more background explanations).
+</p><p>
+This is all you need to know to get the CUPS/Samba combo printing
+"raw" files prepared by Windows clients, which have vendor drivers
+locally installed. If you are not interested in background information about
+more advanced CUPS/Samba printing, simply skip the remaining sections
+of this chapter.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950503"></a>Three familiar Methods for driver upload plus a new one</h3></div></div><div></div></div><p>
+If you want to use the MS-RPC type printing, you must upload the
+drivers onto the Samba server first (<i class="parameter"><tt>[print$]</tt></i>
+share). For a discussion on how to deposit printer drivers on the
+Samba host (so that the Windows clients can download and use them via
+"Point'n'Print") please also refer to the previous chapter of this
+HOWTO Collection. There you will find a description or reference to
+three methods of preparing the client drivers on the Samba server:
+</p><div class="itemizedlist"><ul type="disc"><li><p>the GUI, "Add Printer Wizard"
+<span class="emphasis"><em>upload-from-a-Windows-client</em></span>
+method;</p></li><li><p>the commandline, "smbclient/rpcclient"
+<span class="emphasis"><em>upload-from-a-UNIX-workstation</em></span>
+method;</p></li><li><p>the <span class="emphasis"><em>Imprints</em></span> Toolset
+method.</p></li></ul></div><p>
+These 3 methods apply to CUPS all the same. A new and more
+convenient way to load the Windows drivers into Samba is provided
+provided if you use CUPS:
+</p><div class="itemizedlist"><ul type="disc"><li><p>the <span class="emphasis"><em>cupsaddsmb</em></span>
+utility.</p></li></ul></div><p>
+cupsaddsmb is discussed in much detail further below. But we will
+first explore the CUPS filtering system and compare the Windows and
+UNIX printing architectures.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2950596"></a>Using CUPS/Samba in an advanced Way -- intelligent printing
+with PostScript Driver Download</h2></div></div><div></div></div><p>
+Still reading on? Good. Let's go into more detail then. We now know
+how to set up a "dump" printserver, that is, a server which is spooling
+printjobs "raw", leaving the print data untouched.
+</p><p>
+Possibly you need to setup CUPS in a more smart way. The reasons could
+be manifold:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Maybe your boss wants to get monthly statistics: Which
+printer did how many pages? What was the average data size of a job?
+What was the average print run per day? What are the typical hourly
+peaks in printing? Which departments prints how
+much?</p></li><li><p>Maybe you are asked to setup a print quota system:
+users should not be able to print more jobs, once they have surpassed
+a given limit per period?</p></li><li><p>Maybe your previous network printing setup is a mess
+and shall be re-organized from a clean beginning?</p></li><li><p>Maybe you have experiencing too many "Blue Screens",
+originating from poorly debugged printer drivers running in NT "kernel
+mode"?</p></li></ul></div><p>
+These goals cannot be achieved by a raw print server. To build a
+server meeting these requirements, you'll first need to learn about
+how CUPS works and how you can enable its features.
+</p><p>
+What follows is the comparison of some fundamental concepts for
+Windows and Unix printing; then is the time for a description of the
+CUPS filtering system, how it works and how you can tweak it.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950671"></a>GDI on Windows -- PostScript on Unix</h3></div></div><div></div></div><p>
+Network printing is one of the most complicated and error-prone
+day-to-day tasks any user or an administrator may encounter. This is
+true for all OS platforms. And there are reasons for this.
+</p><p>
+You can't expect for most file formats to just throw them towards
+printers and they get printed. There needs to be a file format
+conversion in between. The problem is: there is no common standard for
+print file formats across all manufacturers and printer types. While
+<span class="emphasis"><em>PostScript</em></span> (trademark held by Adobe), and to an
+extend<span class="emphasis"><em>PCL</em></span> (trademark held by HP), have developed
+into semi-official "standards", by being the most widely used PDLs
+(<span class="emphasis"><em>Page Description Languages</em></span>), there are still
+many manufacturers who "roll their own" (their reasons may be
+unacceptable license fees for using printer-embedded PostScript
+interpreters, etc.).
+</p></div><div xmlns:ns51="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950716"></a>Windows Drivers, GDI and EMF</h3></div></div><div></div></div><p>
+In Windows OS, the format conversion job is done by the printer
+drivers. On MS Windows OS platforms all application programmers have
+at their disposal a built-in API, the GDI (<span class="emphasis"><em>Graphical Device
+Interface</em></span>), as part and parcel of the OS itself, to base
+themselves on. This GDI core is used as one common unified ground, for
+all Windows programs, to draw pictures, fonts and documents
+<span class="emphasis"><em>on screen</em></span> as well as <span class="emphasis"><em>on
+paper</em></span> (=print). Therefore printer driver developers can
+standardize on a well-defined GDI output for their own driver
+input. Achieving WYSIWYG ("What You See Is What You Get") is
+relatively easy, because the on-screen graphic primitives, as well as
+the on-paper drawn objects, come from one common source. This source,
+the GDI, produces often a file format called EMF (<span class="emphasis"><em>Enhanced
+MetaFile</em></span>). The EMF is processed by the printer driver and
+converted to the printer-specific file format.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+To the GDI foundation in MS Windows, Apple has chosen to
+put paper and screen output on a common foundation for their
+(BSD-Unix-based, did you know??) Mac OS X and Darwin Operating
+Systems.Their <span class="emphasis"><em>Core Graphic Engine</em></span> uses a
+<span class="emphasis"><em>PDF</em></span> derivate for all display work.
+</p></div><ns51:p>
+
+</ns51:p><div class="figure"><a name="id2950780"></a><p class="title"><b>Figure 19.1. Windows Printing to a local Printer</b></p><div class="mediaobject"><img src="projdoc/imagefiles/1small.png" alt="Windows Printing to a local Printer"></div></div><ns51:p>
+</ns51:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950814"></a>Unix Printfile Conversion and GUI Basics</h3></div></div><div></div></div><p>
+In Unix and Linux, there is no comparable layer built into the OS
+kernel(s) or the X (screen display) server. Every application is
+responsible for itself to create its print output. Fortunately, most
+use PostScript. That gives at least some common ground. Unfortunately,
+there are many different levels of quality for this PostScript. And
+worse: there is a huge difference (and no common root) in the way how
+the same document is displayed on screen and how it is presented on
+paper. WYSIWYG is more difficult to achieve. This goes back to the
+time decades ago, when the predecessors of <span class="emphasis"><em>X.org</em></span>,
+designing the UNIX foundations and protocols for Graphical User
+Interfaces refused to take over responsibility for "paper output"
+also, as some had demanded at the time, and restricted itself to
+"on-screen only". (For some years now, the "Xprint" project has been
+under development, attempting to build printing support into the X
+framework, including a PostScript and a PCL driver, but it is not yet
+ready for prime time.) You can see this unfavorable inheritance up to
+the present day by looking into the various "font" directories on your
+system; there are separate ones for fonts used for X display and fonts
+to be used on paper.
+</p><p><b>Background. </b>
+The PostScript programming language is an "invention" by Adobe Inc.,
+but its specifications have been published to the full. Its strength
+lies in its powerful abilities to describe graphical objects (fonts,
+shapes, patterns, lines, curves, dots...), their attributes (color,
+linewidth...) and the way to manipulate (scale, distort, rotate,
+shift...) them. Because of its open specification, anybody with the
+skill can start writing his own implementation of a PostScript
+interpreter and use it to display PostScript files on screen or on
+paper. Most graphical output devices are based on the concept of
+"raster images" or "pixels" (one notable exception are pen
+plotters). Of course, you can look at a PostScript file in its textual
+form and you will be reading its PostScript code, the language
+instructions which need to be interpreted by a rasterizer. Rasterizers
+produce pixel images, which may be displayed on screen by a viewer
+program or on paper by a printer.
+</p></div><div xmlns:ns52="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950886"></a>PostScript and Ghostscript</h3></div></div><div></div></div><p>
+So, Unix is lacking a common ground for printing on paper and
+displaying on screen. Despite this unfavorable legacy for Unix, basic
+printing is fairly easy: if you have PostScript printers at your
+disposal! The reason is: these devices have a built-in PostScript
+language "interpreter", also called a <span class="emphasis"><em>Raster Image
+Processor</em></span> (RIP), (which makes them more expensive than
+other types of printers); throw PostScript towards them, and they will
+spit out your printed pages. Their RIP is doing all the hard work of
+converting the PostScript drawing commands into a bitmap picture as
+you see it on paper, in a resolution as done by your printer. This is
+no different to PostScript printing of a file from a Windows origin.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Traditional Unix programs and printing systems -- while
+using PostScript -- are largely not PPD-aware. PPDs are "PostScript
+Printer Description" files. They enable you to specify and control all
+options a printer supports: duplexing, stapling, punching... Therefore
+Unix users for a long time couldn't choose many of the supported
+device and job options, unlike Windows or Apple users. But now there
+is CUPS.... ;-)
+</p></div><ns52:p>
+</ns52:p><div class="figure"><a name="id2950932"></a><p class="title"><b>Figure 19.2. Printing to a Postscript Printer</b></p><div class="mediaobject"><img src="projdoc/imagefiles/2small.png" alt="Printing to a Postscript Printer"></div></div><ns52:p>
+</ns52:p><p>
+However, there are other types of printers out there. These don't know
+how to print PostScript. They use their own <span class="emphasis"><em>Page Description
+Language</em></span> (PDL, often proprietary). To print to them is much
+more demanding. Since your Unix applications mostly produce
+PostScript, and since these devices don't understand PostScript, you
+need to convert the printfiles to a format suitable for your printer
+on the host, before you can send it away.
+</p></div><div xmlns:ns53="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950982"></a>Ghostscript -- the Software RIP for non-PostScript Printers</h3></div></div><div></div></div><p>
+Here is where<span class="emphasis"><em>Ghostscript</em></span> kicks in. Ghostscript is
+the traditional (and quite powerful) PostScript interpreter used on
+Unix platforms. It is a RIP in software, capable to do a
+<span class="emphasis"><em>lot</em></span> of file format conversions, for a very broad
+spectrum of hardware devices as well as software file formats.
+Ghostscript technology and drivers is what enables PostScript printing
+to non-PostScript hardware.
+</p><ns53:p>
+</ns53:p><div class="figure"><a name="id2951012"></a><p class="title"><b>Figure 19.3. Ghostscript as a RIP for non-postscript printers</b></p><div class="mediaobject"><img src="projdoc/imagefiles/3small.png" alt="Ghostscript as a RIP for non-postscript printers"></div></div><ns53:p>
+</ns53:p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+Use the "gs -h" command to check for all built-in "devices" of your
+Ghostscript version. If you specify e.g. a parameter of
+<i class="parameter"><tt>-sDEVICE=png256</tt></i> on your Ghostscript command
+line, you are asking Ghostscript to convert the input into a PNG
+file. Naming a "device" on the commandline is the most important
+single parameter to tell Ghostscript how exactly it should render the
+input. New Ghostscript versions are released at fairly regular
+intervals, now by artofcode LLC. They are initially put under the
+"AFPL" license, but re-released under the GNU GPL as soon as the next
+AFPL version appears. GNU Ghostscript is probably the version
+installed on most Samba systems. But it has got some
+deficiencies. Therefore ESP Ghostscript was developed as an
+enhancement over GNU Ghostscript, with lots of bug-fixes, additional
+devices and improvements. It is jointly maintained by developers from
+CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes
+the "cups" device (essential to print to non-PS printers from CUPS).
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951078"></a>PostScript Printer Description (PPD) Specification</h3></div></div><div></div></div><p>
+While PostScript in essence is a <span class="emphasis"><em>Page Description
+Language</em></span> (PDL) to represent the page layout in a
+<span class="emphasis"><em>device independent</em></span> way, real world print jobs are
+always ending up to be output on a hardware with device-specific
+features. To take care of all the differences in hardware, and to
+allow for innovations, Adobe has specified a syntax and file format
+for <span class="emphasis"><em>PostScript Printer Description</em></span> (PPD)
+files. Every PostScript printer ships with one of these files.
+</p><p>
+PPDs contain all information about general and special features of the
+given printer model: Which different resolutions can it handle? Does
+it have a Duplexing Unit? How many paper trays are there? What media
+types and sizes does it take? For each item it also names the special
+command string to be sent to the printer (mostly inside the PostScript
+file) in order to enable it.
+</p><p>
+Information from these PPDs is meant to be taken into account by the
+printer drivers. Therefore, installed as part of the Windows
+PostScript driver for a given printer is the printer's PPD. Where it
+makes sense, the PPD features are presented in the drivers' UI dialogs
+to display to the user as choice of print options. In the end, the
+user selections are somehow written (in the form of special
+PostScript, PJL, JCL or vendor-dependent commands) into the PostScript
+file created by the driver.
+</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+A PostScript file that was created to contain device-specific commands
+for achieving a certain print job output (e.g. duplexed, stapled and
+punched) on a specific target machine, may not print as expected, or
+may not be printable at all on other models; it also may not be fit
+for further processing by software (e.g. by a PDF distilling program).
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2963900"></a>CUPS can use all Windows-formatted Vendor PPDs</h3></div></div><div></div></div><p>
+CUPS can handle all spec-compliant PPDs as supplied by the
+manufacturers for their PostScript models. Even if a
+Unix/Linux-illiterate vendor might not have mentioned our favorite
+OS in his manuals and brochures -- you can safely trust this:
+<span class="emphasis"><em>if you get hold of the Windows NT version of the PPD, you
+can use it unchanged in CUPS</em></span> and thus access the full
+power of your printer just like a Windows NT user could!
+</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+To check the spec compliance of any PPD online, go to <a href="http://www.cups.org/testppd.php" target="_top">http://www.cups.org/testppd.php</a>
+and upload your PPD. You will see the results displayed
+immediately. CUPS in all versions after 1.1.19 has a much more strict
+internal PPD parsing and checking code enabled; in case of printing
+trouble this online resource should be one of your first pitstops.
+</p></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+For real PostScript printers <span class="emphasis"><em>don't</em></span> use the
+<span class="emphasis"><em>Foomatic</em></span> or <span class="emphasis"><em>cupsomatic</em></span>
+PPDs from Linuxprinting.org. With these devices the original
+vendor-provided PPDs are always the first choice!
+</p></div><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+If you are looking for an original vendor-provided PPD of a specific
+device, and you know that an NT4 box (or any other Windows box) on
+your LAN has the PostScript driver installed, just use
+<b class="command">smbclient //NT4-box/print\$ -U username</b> to
+access the Windows directory where all printer driver files are
+stored. First look in the <tt class="filename">W32X86/2</tt> subdir for
+the PPD you are seeking.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2963990"></a>CUPS also uses PPDs for non-PostScript Printers</h3></div></div><div></div></div><p>
+CUPS also uses specially crafted PPDs to handle non-PostScript
+printers. These PPDs are usually not available from the vendors (and
+no, you can't just take the PPD of a Postscript printer with the same
+model name and hope it works for the non-PostScript version too). To
+understand how these PPDs work for non-PS printers we first need to
+dive deeply into the CUPS filtering and file format conversion
+architecture. Stay tuned.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2964013"></a>The CUPS Filtering Architecture</h2></div></div><div></div></div><p>
+The core of the CUPS filtering system is based on
+<span class="emphasis"><em>Ghostscript</em></span>. In addition to Ghostscript, CUPS
+uses some other filters of its own. You (or your OS vendor) may have
+plugged in even more filters. CUPS handles all data file formats under
+the label of various <span class="emphasis"><em>MIME types</em></span>. Every incoming
+printfile is subjected to an initial
+<span class="emphasis"><em>auto-typing</em></span>. The auto-typing determines its given
+MIME type. A given MIME type implies zero or more possible filtering
+chains relevant to the selected target printer. This section discusses
+how MIME types recognition and conversion rules interact. They are
+used by CUPS to automatically setup a working filtering chain for any
+given input data format.
+</p><p>
+If CUPS rasterizes a PostScript file <span class="emphasis"><em>natively</em></span> to
+a bitmap, this is done in 2 stages:
+</p><div class="itemizedlist"><ul type="disc"><li><p>the first stage uses a Ghostscript device named "cups"
+(this is since version 1.1.15) and produces a generic raster format
+called "CUPS raster".
+</p></li><li><p>the second stage uses a "raster driver" which converts
+the generic CUPS raster to a device specific raster.</p></li></ul></div><p>
+Make sure your Ghostscript version has the "cups" device compiled in
+(check with <b class="command">gs -h | grep cups</b>). Otherwise you
+may encounter the dreaded <tt class="computeroutput">Unable to convert file
+0</tt> in your CUPS error_log file. To have "cups" as a
+device in your Ghostscript, you either need to <span class="emphasis"><em>patch GNU
+Ghostscript</em></span> and re-compile or use <a href="http://www.cups.org/ghostscript.php" target="_top">ESP Ghostscript</a>. The
+superior alternative is ESP Ghostscript: it supports not just CUPS,
+but 300 other devices too (while GNU Ghostscript supports only about
+180). Because of this broad output device support, ESP Ghostscript is
+the first choice for non-CUPS spoolers too. It is now recommended by
+Linuxprinting.org for all spoolers.
+</p><p>
+CUPS printers may be setup to use <span class="emphasis"><em>external</em></span>
+rendering paths. One of the most common ones is provided by the
+<span class="emphasis"><em>Foomatic/cupsomatic</em></span> concept, from <a href="http://www.linuxprinting.org/" target="_top">Linuxprinting.org</a>. This
+uses the classical Ghostscript approach, doing everything in one
+step. It doesn't use the "cups" device, but one of the many
+others. However, even for Foomatic/cupsomatic usage, best results and
+broadest printer model support is provided by ESP Ghostscript (more
+about cupsomatic/Foomatic, particularly the new version called now
+<span class="emphasis"><em>foomatic-rip</em></span>, follows below).
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2964151"></a>MIME types and CUPS Filters</h3></div></div><div></div></div><p>
+CUPS reads the file <tt class="filename">/etc/cups/mime.types</tt>
+(and all other files carrying a <tt class="filename">*.types</tt> suffix
+in the same directory) upon startup. These files contain the MIME
+type recognition rules which are applied when CUPS runs its
+auto-typing routines. The rule syntax is explained in the man page
+for <tt class="filename">mime.types</tt> and in the comments section of the
+<tt class="filename">mime.types</tt> file itself. A simple rule reads
+like this:
+</p><pre class="screen">
+
+ application/pdf pdf string(0,%PDF)
+
+</pre><p>
+This means: if a filename has either a
+<tt class="filename">.pdf</tt> suffix, or if the magic
+string <span class="emphasis"><em>%PDF</em></span> is right at the
+beginning of the file itself (offset 0 from the start), then it is
+a PDF file (<span class="emphasis"><em>application/pdf</em></span>).
+Another rule is this:
+</p><pre class="screen">
+
+ application/postscript ai eps ps string(0,%!) string(0,<04>%!)
+
+</pre><p>
+Its meaning: if the filename has one of the suffixes
+<tt class="filename">.ai</tt>, <tt class="filename">.eps</tt>,
+<tt class="filename">.ps</tt> or if the file itself starts with one of the
+strings <span class="emphasis"><em>%!</em></span> or <span class="emphasis"><em><04>%!</em></span>, it
+is a generic PostScript file
+(<span class="emphasis"><em>application/postscript</em></span>).
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+There is a very important difference between two similar MIME type in
+CUPS: one is <span class="emphasis"><em>application/postscript</em></span>, the other is
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span>. While
+<span class="emphasis"><em>application/postscript</em></span> is meant to be device
+independent (job options for the file are still outside the PS file
+content, embedded in commandline or environment variables by CUPS),
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span> may have the job
+options inserted into the PostScript data itself (were
+applicable). The transformation of the generic PostScript
+(application/postscript) to the device-specific version
+(application/vnd.cups-postscript) is the responsibility of the
+CUPS <span class="emphasis"><em>pstops</em></span> filter. pstops uses information
+contained in the PPD to do the transformation.
+</p></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+Don't confuse the other mime.types file your system might be using
+with the one in the <tt class="filename">/etc/cups/</tt> directory.
+</p></div><p>
+CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a
+lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster,
+PNM, PBM, SGI-RGB and some more) and their associated MIME types
+with its filters.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2964338"></a>MIME type Conversion Rules</h3></div></div><div></div></div><p>
+CUPS reads the file <tt class="filename">/etc/cups/mime.convs</tt>
+(and all other files named with a <tt class="filename">*.convs</tt>
+suffix in the same directory) upon startup. These files contain
+lines naming an input MIME type, an output MIME type, a format
+conversion filter which can produce the output from the input type
+and virtual costs associated with this conversion. One example line
+reads like this:
+</p><pre class="screen">
+
+ application/pdf application/postscript 33 pdftops
+
+</pre><p>
+This means that the <span class="emphasis"><em>pdftops</em></span> filter will take
+<span class="emphasis"><em>application/pdf</em></span> as input and produce
+<span class="emphasis"><em>application/postscript</em></span> as output, the virtual
+cost of this operation is 33 CUPS-$. The next filter is more
+expensive, costing 66 CUPS-$:
+</p><pre class="screen">
+
+ application/vnd.hp-HPGL application/postscript 66 hpgltops
+
+</pre><p>
+This is the <span class="emphasis"><em>hpgltops</em></span>, which processes HP-GL
+plotter files to PostScript.
+</p><pre class="screen">
+
+ application/octet-stream
+
+</pre><p>
+Here are two more examples:
+</p><pre class="screen">
+
+ application/x-shell application/postscript 33 texttops
+ text/plain application/postscript 33 texttops
+
+</pre><p>
+The last two examples name the <span class="emphasis"><em>texttops</em></span> filter
+to work on "text/plain" as well as on "application/x-shell". (Hint:
+this differentiation is needed for the syntax highlighting feature of
+"texttops").
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2964455"></a>Filter Requirements</h3></div></div><div></div></div><p>
+There are many more combinations named in mime.convs. However, you
+are not limited to use the ones pre-defined there. You can plug in any
+filter you like into the CUPS framework. It must meet, or must be made
+to meet some minimal requirements. If you find (or write) a cool
+conversion filter of some kind, make sure it complies to what CUPS
+needs, and put in the right lines in <tt class="filename">mime.types</tt>
+and <tt class="filename">mime.convs</tt>, then it will work seamlessly
+inside CUPS!
+</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+The mentioned "CUPS requirements" for filters are simple. Take
+filenames or <tt class="filename">stdin</tt> as input and write to
+<tt class="filename">stdout</tt>. They should take these 5 or 6 arguments:
+<span class="emphasis"><em>printer job user title copies options [filename]</em></span>
+</p><div class="variablelist"><dl><dt><span class="term">Printer</span></dt><dd><p>The name of the printer queue (normally this is the
+name of the filter being run)</p></dd><dt><span class="term">job</span></dt><dd><p>The numeric job ID for the job being
+printed</p></dd><dt><span class="term">Printer</span></dt><dd><p>The string from the originating-user-name
+attribute</p></dd><dt><span class="term">Printer</span></dt><dd><p>The string from the job-name attribute</p></dd><dt><span class="term">Printer</span></dt><dd><p>The numeric value from the number-copies
+attribute</p></dd><dt><span class="term">Printer</span></dt><dd><p>The job options</p></dd><dt><span class="term">Printer</span></dt><dd><p>(Optionally) The print request file (if missing,
+filters expected data fed through <tt class="filename">stdin</tt>). In most
+cases it is very easy to write a simple wrapper script around existing
+filters to make them work with CUPS.</p></dd></dl></div></div></div><div xmlns:ns54="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2964624"></a>Prefilters</h3></div></div><div></div></div><p>
+As was said, PostScript is the central file format to any Unix based
+printing system. From PostScript, CUPS generates raster data to feed
+non-PostScript printers.
+</p><p>
+But what is happening if you send one of the supported non-PS formats
+to print? Then CUPS runs "pre-filters" on these input formats to
+generate PostScript first. There are pre-filters to create PS from
+ASCII text, PDF, DVI or HP-GL. The outcome of these filters is always
+of MIME type <span class="emphasis"><em>application/postscript</em></span> (meaning that
+any device-specific print options are not yet embedded into the
+PostScript by CUPS, and that the next filter to be called is
+pstops). Another pre-filter is running on all supported image formats,
+the <span class="emphasis"><em>imagetops</em></span> filter. Its outcome is always of
+MIME type <span class="emphasis"><em>application/vnd.cups-postscript</em></span>
+(<span class="emphasis"><em>not</em></span> application/postscript), meaning it has the
+print options already embedded into the file.
+</p><ns54:p>
+</ns54:p><div class="figure"><a name="id2964674"></a><p class="title"><b>Figure 19.4. Prefiltering in CUPS to form Postscript</b></p><div class="mediaobject"><img src="projdoc/imagefiles/4small.png" alt="Prefiltering in CUPS to form Postscript"></div></div><ns54:p>
+</ns54:p></div><div xmlns:ns55="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2964708"></a>pstops</h3></div></div><div></div></div><p>
+<span class="emphasis"><em>pstops</em></span>is the filter to convert
+<span class="emphasis"><em>application/postscript</em></span> to
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span>. It was said
+above that this filter inserts all device-specific print options
+(commands to the printer to ask for the duplexing of output, or
+stapling an punching it, etc.) into the PostScript file.
+</p><ns55:p>
+</ns55:p><div class="figure"><a name="id2964739"></a><p class="title"><b>Figure 19.5. Adding Device-specific Print Options</b></p><div class="mediaobject"><img src="projdoc/imagefiles/5small.png" alt="Adding Device-specific Print Options"></div></div><ns55:p>
+</ns55:p><p>
+This is not all: other tasks performed by it are:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+selecting the range of pages to be printed (if you choose to
+print only pages "3, 6, 8-11, 16, 19-21", or only the odd numbered
+ones)
+</p></li><li><p>
+putting 2 or more logical pages on one sheet of paper (the
+so-called "number-up" function)
+</p></li><li><p>counting the pages of the job to insert the accounting
+information into the <tt class="filename">/var/log/cups/page_log</tt>
+</p></li></ul></div></div><div xmlns:ns56="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2964812"></a>pstoraster</h3></div></div><div></div></div><p>
+<span class="emphasis"><em>pstoraster</em></span> is at the core of the CUPS filtering
+system. It is responsible for the first stage of the rasterization
+process. Its input is of MIME type application/vnd.cups-postscript;
+its output is application/vnd.cups-raster. This output format is not
+yet meant to be printable. Its aim is to serve as a general purpose
+input format for more specialized <span class="emphasis"><em>raster drivers</em></span>,
+that are able to generate device-specific printer data.
+</p><ns56:p>
+</ns56:p><div class="figure"><a name="id2964842"></a><p class="title"><b>Figure 19.6. Postscript to intermediate Raster format</b></p><div class="mediaobject"><img src="projdoc/imagefiles/6small.png" alt="Postscript to intermediate Raster format"></div></div><ns56:p>
+</ns56:p><p>
+CUPS raster is a generic raster format with powerful features. It is
+able to include per-page information, color profiles and more to be
+used by the following downstream raster drivers. Its MIME type is
+registered with IANA and its specification is of course completely
+open. It is designed to make it very easy and inexpensive for
+manufacturers to develop Linux and Unix raster drivers for their
+printer models, should they choose to do so. CUPS always takes care
+for the first stage of rasterization so these vendors don't need to care
+about Ghostscript complications (in fact, there is currently more
+than one vendor financing the development of CUPS raster drivers).
+</p><ns56:p>
+</ns56:p><div class="figure"><a name="id2964894"></a><p class="title"><b>Figure 19.7. CUPS-raster production using Ghostscript</b></p><div class="mediaobject"><img src="projdoc/imagefiles/7small.png" alt="CUPS-raster production using Ghostscript"></div></div><ns56:p>
+</ns56:p><p>
+CUPS versions before version 1.1.15 were shipping a binary (or source
+code) standalone filter, named "pstoraster". pstoraster was derived
+from GNU Ghostscript 5.50, and could be installed besides and in
+addition to any GNU or AFPL Ghostscript package without conflicting.
+</p><p>
+From version 1.1.15, this has changed. The functions for this has been
+integrated back into Ghostscript (now based on GNU Ghostscript version
+7.05). The "pstoraster" filter is now a simple shell script calling
+<b class="command">gs</b> with the <b class="command">-sDEVICE=cups</b>
+parameter. If your Ghostscript doesn't show a success on asking for
+<b class="command">gs -h |grep cups</b>, you might not be able to
+print. Update your Ghostscript then!
+</p></div><div xmlns:ns57="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2964968"></a>imagetops and imagetoraster</h3></div></div><div></div></div><p>
+Above in the section about prefilters, we mentioned the prefilter
+that generates PostScript from image formats. The imagetoraster
+filter is used to convert directly from image to raster, without the
+intermediate PostScript stage. It is used more often than the above
+mentioned prefilters. Here is a summarizing flowchart of image file
+filtering:
+</p><ns57:p>
+</ns57:p><div class="figure"><a name="id2964989"></a><p class="title"><b>Figure 19.8. Image format to CUPS-raster format conversion</b></p><div class="mediaobject"><img src="projdoc/imagefiles/8small.png" alt="Image format to CUPS-raster format conversion"></div></div><ns57:p>
+</ns57:p></div><div xmlns:ns58="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965023"></a>rasterto [printerspecific]</h3></div></div><div></div></div><p>
+CUPS ships with quite some different raster drivers processing CUPS
+raster. On my system I find in /usr/lib/cups/filter/ these:
+<i class="parameter"><tt>rastertoalps, rastertobj, rastertoepson, rastertoescp,
+rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo,
+rastertoescp, rastertohp</tt></i> and
+<i class="parameter"><tt>rastertoprinter</tt></i>. Don't worry if you have less
+than this; some of these are installed by commercial add-ons to CUPS
+(like <i class="parameter"><tt>rastertoturboprint</tt></i>), others (like
+<i class="parameter"><tt>rastertoprinter</tt></i>) by 3rd party driver
+development projects (such as Gimp-Print) wanting to cooperate as
+closely as possible with CUPS.
+</p><ns58:p>
+</ns58:p><div class="figure"><a name="id2965074"></a><p class="title"><b>Figure 19.9. Raster to Printer Specific formats</b></p><div class="mediaobject"><img src="projdoc/imagefiles/9small.png" alt="Raster to Printer Specific formats"></div></div><ns58:p>
+</ns58:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965107"></a>CUPS Backends</h3></div></div><div></div></div><p>
+The last part of any CUPS filtering chain is a "backend". Backends
+are special programs that send the print-ready file to the final
+device. There is a separate backend program for any transfer
+"protocol" of sending printjobs over the network, or for every local
+interface. Every CUPS printqueue needs to have a CUPS "device-URI"
+associated with it. The device URI is the way to encode the backend
+used to send the job to its destination. Network device-URIs are using
+two slashes in their syntax, local device URIs only one, as you can
+see from the following list. Keep in mind that local interface names
+may vary much from my examples, if your OS is not Linux:
+</p><div class="variablelist"><dl><dt><span class="term">usb</span></dt><dd><p>
+This backend sends printfiles to USB-connected printers. An
+example for the CUPS device-URI to use is:
+<tt class="filename">usb:/dev/usb/lp0</tt>
+</p></dd><dt><span class="term">serial</span></dt><dd><p>
+This backend sends printfiles to serially connected printers.
+An example for the CUPS device-URI to use is:
+<tt class="filename">serial:/dev/ttyS0?baud=11500</tt>
+</p></dd><dt><span class="term">parallel</span></dt><dd><p>
+This backend sends printfiles to printers connected to the
+parallel port. An example for the CUPS device-URI to use is:
+<tt class="filename">parallel:/dev/lp0</tt>
+</p></dd><dt><span class="term">scsi</span></dt><dd><p>
+This backend sends printfiles to printers attached to the
+SCSI interface. An example for the CUPS device-URI to use is:
+<tt class="filename">scsi:/dev/sr1</tt>
+</p></dd><dt><span class="term">lpd</span></dt><dd><p>
+This backend sends printfiles to LPR/LPD connected network
+printers. An example for the CUPS device-URI to use is:
+<tt class="filename">lpd://remote_host_name/remote_queue_name</tt>
+</p></dd><dt><span class="term">AppSocket/HP JetDirect</span></dt><dd><p>
+This backend sends printfiles to AppSocket (a.k.a. "HP
+JetDirect") connected network printers. An example for the CUPS
+device-URI to use is:
+<tt class="filename">socket://10.11.12.13:9100</tt>
+</p></dd><dt><span class="term">ipp</span></dt><dd><p>
+This backend sends printfiles to IPP connected network
+printers (or to other CUPS servers). Examples for CUPS device-URIs
+to use are:
+<tt class="filename">ipp:://192.193.194.195/ipp</tt>
+(for many HP printers) or
+<tt class="filename">ipp://remote_cups_server/printers/remote_printer_name</tt>
+</p></dd><dt><span class="term">http</span></dt><dd><p>
+This backend sends printfiles to HTTP connected printers.
+(The http:// CUPS backend is only a symlink to the ipp:// backend.)
+Examples for the CUPS device-URIs to use are:
+<tt class="filename">http:://192.193.194.195:631/ipp</tt>
+(for many HP printers) or
+<tt class="filename">http://remote_cups_server:631/printers/remote_printer_name</tt>
+</p></dd><dt><span class="term">smb</span></dt><dd><p>
+This backend sends printfiles to printers shared by a Windows
+host. An example for CUPS device-URIs to use are:
+<tt class="filename">smb://workgroup/server/printersharename</tt>
+Or
+<tt class="filename">Smb://server/printersharename</tt>
+or
+<tt class="filename">smb://username:password@workgroup/server/printersharename</tt>
+or
+<tt class="filename">smb://username:password@server/printersharename</tt>.
+The smb:// backend is a symlink to the Samba utility
+<span class="emphasis"><em>smbspool</em></span> (doesn't ship with CUPS). If the
+symlink is not present in your CUPS backend directory, have your
+root user create it: <b class="command">ln -s `which smbspool`
+/usr/lib/cups/backend/smb</b>.
+</p></dd></dl></div><p>
+It is easy to write your own backends as Shell or Perl scripts, if you
+need any modification or extension to the CUPS print system. One
+reason could be that you want to create "special" printers which send
+the printjobs as email (through a "mailto:/" backend), convert them to
+PDF (through a "pdfgen:/" backend) or dump them to "/dev/null" (In
+fact I have the system-wide default printer set up to be connected to
+a "devnull:/" backend: there are just too many people sending jobs
+without specifying a printer, or scripts and programs which don't name
+a printer. The system-wided default deletes the job and sends a polite
+mail back to the $USER asking him to alsways specify a correct
+printername).
+</p><p>
+Not all of the mentioned backends may be present on your system or
+usable (depending on your hardware configuration). One test for all
+available CUPS backends is provided by the <span class="emphasis"><em>lpinfo</em></span>
+utility. Used with the <i class="parameter"><tt>-v</tt></i> parameter, it lists
+all available backends:
+</p><pre class="screen">
+
+ lpinfo -v
+
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965422"></a>cupsomatic/Foomatic -- how do they fit into the Picture?</h3></div></div><div></div></div><p>
+"cupsomatic" filters may be the most widely used on CUPS
+installations. You must be clear about the fact that these were not
+developed by the CUPS people. They are a "Third Party" add-on to
+CUPS. They utilize the traditional Ghostscript devices to render jobs
+for CUPS. When troubleshooting, you should know about the
+difference. Here the whole rendering process is done in one stage,
+inside Ghostscript, using an appropriate "device" for the target
+printer. cupsomatic uses PPDs which are generated from the "Foomatic"
+Printer & Driver Database at Linuxprinting.org.
+</p><p>
+You can recognize these PPDs from the line calling the
+<span class="emphasis"><em>cupsomatic</em></span> filter:
+</p><pre class="screen">
+
+ *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic"
+
+</pre><p>
+This line you may find amongst the first 40 or so lines of the PPD
+file. If you have such a PPD installed, the printer shows up in the
+CUPS web interface with a <span class="emphasis"><em>foomatic</em></span> namepart for
+the driver description. cupsomatic is a Perlscript that runs
+Ghostscript, with all the complicated commandline options
+auto-constructed from the selected PPD and commandline options give to
+the printjob.
+</p><p>
+However, cupsomatic is now deprecated. Its PPDs (especially the first
+generation of them, still in heavy use out there) are not meeting the
+Adobe specifications. You might also suffer difficulties when you try
+to download them with "Point'n'Print" to Windows clients. A better,
+and more powerful successor is now in a very stable Beta-version
+available: it is called <span class="emphasis"><em>foomatic-rip</em></span>. To use
+foomatic-rip as a filter with CUPS, you need the new-type PPDs. These
+have a similar, but different line:
+</p><pre class="screen">
+
+ *cupsFilter: "application/vnd.cups-postscript 0 foomatic-rip"
+
+</pre><p>
+The PPD generating engine at Linuxprinting.org has been revamped.
+The new PPDs comply to the Adobe spec. On top, they also provide a
+new way to specify different quality levels (hi-res photo, normal
+color, grayscale, draft...) with a single click (whereas before you
+could have required 5 or more different selections (media type,
+resolution, inktype, dithering algorithm...). There is support for
+custom-size media built in. There is support to switch
+print-options from page to page, in the middle of a job. And the
+best thing is: the new foomatic-rip now works seamlessly with all
+legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing
+for them access to use PPDs for their printing!
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965524"></a>The Complete Picture</h3></div></div><div></div></div><p>
+If you want to see an overview over all the filters and how they
+relate to each other, the complete picture of the puzzle is at the end
+of this document.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965540"></a><tt class="filename">mime.convs</tt></h3></div></div><div></div></div><p>
+CUPS auto-constructs all possible filtering chain paths for any given
+MIME type, and every printer installed. But how does it decide in
+favor or against a specific alternative? (There may often be cases,
+where there is a choice of two or more possible filtering chains for
+the same target printer). Simple: you may have noticed the figures in
+the 3rd column of the mime.convs file. They represent virtual costs
+assigned to this filter. Every possible filtering chain will sum up to
+a total "filter cost". CUPS decides for the most "inexpensive" route.
+</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+The setting of <i class="parameter"><tt>FilterLimit 1000</tt></i> in
+<tt class="filename">cupsd.conf</tt> will not allow more filters to
+run concurrently than will consume a total of 1000 virtual filter
+cost. This is a very efficient way to limit the load of any CUPS
+server by setting an appropriate "FilterLimit" value. A FilterLimit of
+200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows
+approximately 5 jobs maximum at a time.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965593"></a>"Raw" printing</h3></div></div><div></div></div><p>
+You can tell CUPS to print (nearly) any file "raw". "Raw" means it
+will not be filtered. CUPS will send the file to the printer "as is"
+without bothering if the printer is able to digest it. Users need to
+take care themselves that they send sensible data formats only. Raw
+printing can happen on any queue if the "-o raw" option is specified
+on the command line. You can also set up raw-only queues by simply not
+associating any PPD with it. This command:
+</p><pre class="screen">
+
+ lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E
+
+</pre><p>
+sets up a queue named "rawprinter", connected via the "socket"
+protocol (a.k.a. "HP JetDirect") to the device at IP address
+11.12.1.3.14, using port 9100. (If you had added a PPD with
+<b class="command">-P /path/to/PPD</b> to this command line, you would
+have installed a "normal" printqueue.
+</p><p>
+CUPS will automatically treat each job sent to a queue as a "raw" one,
+if it can't find a PPD associated with the queue. However, CUPS will
+only send known MIME types (as defined in its own mime.types file) and
+refuse others.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965647"></a>"application/octet-stream" printing</h3></div></div><div></div></div><p>
+Any MIME type with no rule in the
+<tt class="filename">/etc/cups/mime.types</tt> file is regarded as unknown
+or <span class="emphasis"><em>application/octet-stream</em></span> and will not be
+sent. Because CUPS refuses to print unknown MIME types per default,
+you will probably have experienced the fact that printjobs originating
+from Windows clients were not printed. You may have found an error
+message in your CUPS logs like:
+</p><pre class="screen">
+
+ Unable to convert file 0 to printable format for job
+
+</pre><p>
+To enable the printing of "application/octet-stream" files, edit
+these two files:
+</p><div class="itemizedlist"><ul type="disc"><li><p><tt class="filename">/etc/cups/mime.convs</tt></p></li><li><p><tt class="filename">/etc/cups/mime.types</tt></p></li></ul></div><p>
+Both contain entries (at the end of the respective files) which must
+be uncommented to allow RAW mode operation for
+application/octet-stream. In <tt class="filename">/etc/cups/mime.types</tt>
+make sure this line is present:
+</p><pre class="screen">
+
+ application/octet-stream
+
+</pre><p>
+This line (with no specific auto-typing rule set) makes all files
+not otherwise auto-typed a member of application/octet-stream. In
+<tt class="filename">/etc/cups/mime.convs</tt>, have this
+line:
+</p><pre class="screen">
+
+ application/octet-stream application/vnd.cups-raw 0 -
+
+</pre><p>
+This line tells CUPS to use the <span class="emphasis"><em>Null Filter</em></span>
+(denoted as "-", doing... nothing at all) on
+<span class="emphasis"><em>application/octet-stream</em></span>, and tag the result as
+<span class="emphasis"><em>application/vnd.cups-raw</em></span>. This last one is
+always a green light to the CUPS scheduler to now hand the file over
+to the "backend" connecting to the printer and sending it over.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> Editing the <tt class="filename">mime.convs</tt> and the
+<tt class="filename">mime.types</tt> file does not
+<span class="emphasis"><em>enforce</em></span> "raw" printing, it only
+<span class="emphasis"><em>allows</em></span> it.
+</p></div><p><b>Background. </b>
+CUPS being a more security-aware printing system than traditional ones
+does not by default allow one to send deliberate (possibly binary)
+data to printing devices. (This could be easily abused to launch a
+Denial of Service attack on your printer(s), causing at least the loss
+of a lot of paper and ink...) "Unknown" data are regarded by CUPS
+as<span class="emphasis"><em>MIME type</em></span>
+<span class="emphasis"><em>application/octet-stream</em></span>. While you
+<span class="emphasis"><em>can</em></span> send data "raw", the MIME type for these must
+be one that is known to CUPS and an allowed one. The file
+<tt class="filename">/etc/cups/mime.types</tt> defines the "rules" how CUPS
+recognizes MIME types. The file
+<tt class="filename">/etc/cups/mime.convs</tt> decides which file
+conversion filter(s) may be applied to which MIME types.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965862"></a>PostScript Printer Descriptions (PPDs) for non-PS Printers</h3></div></div><div></div></div><p>
+Originally PPDs were meant to be used for PostScript printers
+only. Here, they help to send device-specific commands and settings
+to the RIP which processes the jobfile. CUPS has extended this
+scope for PPDs to cover non-PostScript printers too. This was not
+very difficult, because it is a standardized file format. In a way
+it was logical too: CUPS handles PostScript and uses a PostScript
+RIP (=Ghostscript) to process the jobfiles. The only difference is:
+a PostScript printer has the RIP built-in, for other types of
+printers the Ghostscript RIP runs on the host computer.
+</p><p>
+PPDs for a non-PS printer have a few lines that are unique to
+CUPS. The most important one looks similar to this:
+</p><pre class="screen">
+
+ *cupsFilter: application/vnd.cups-raster 66 rastertoprinter
+
+</pre><p>
+It is the last piece in the CUPS filtering puzzle. This line tells the
+CUPS daemon to use as a last filter "rastertoprinter". This filter
+should be served as input an "application/vnd.cups-raster" MIME type
+file. Therefore CUPS should auto-construct a filtering chain, which
+delivers as its last output the specified MIME type. This is then
+taken as input to the specified "rastertoprinter" filter. After this
+the last filter has done its work ("rastertoprinter" is a Gimp-Print
+filter), the file should go to the backend, which sends it to the
+output device.
+</p><p>
+CUPS by default ships only a few generic PPDs, but they are good for
+several hundred printer models. You may not be able to control
+different paper trays, or you may get larger margins than your
+specific model supports):
+</p><div class="variablelist"><dl><dt><span class="term">deskjet.ppd</span></dt><dd><p>older HP inkjet printers and compatible
+</p></dd><dt><span class="term">deskjet2.ppd</span></dt><dd><p>newer HP inkjet printers and compatible
+</p></dd><dt><span class="term">dymo.ppd</span></dt><dd><p>label printers
+</p></dd><dt><span class="term">epson9.ppd</span></dt><dd><p>Epson 24pin impact printers and compatible
+</p></dd><dt><span class="term">epson24.ppd</span></dt><dd><p>Epson 24pin impact printers and compatible
+</p></dd><dt><span class="term">okidata9.ppd</span></dt><dd><p>Okidata 9pin impact printers and compatible
+</p></dd><dt><span class="term">okidat24.ppd</span></dt><dd><p>Okidata 24pin impact printers and compatible
+</p></dd><dt><span class="term">stcolor.ppd</span></dt><dd><p>older Epson Stylus Color printers
+</p></dd><dt><span class="term">stcolor2.ppd</span></dt><dd><p>newer Epson Stylus Color printers
+</p></dd><dt><span class="term">stphoto.ppd</span></dt><dd><p>older Epson Stylus Photo printers
+</p></dd><dt><span class="term">stphoto2.ppd</span></dt><dd><p>newer Epson Stylus Photo printers
+</p></dd><dt><span class="term">laserjet.ppd</span></dt><dd><p>all PCL printersFurther below is a discussion
+of several other driver/PPD-packages suitable fur use with CUPS.
+</p></dd></dl></div></div><div xmlns:ns59="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2966090"></a>Difference between <span class="emphasis"><em>cupsomatic/foomatic-rip</em></span> and
+<span class="emphasis"><em>native CUPS</em></span> printing</h3></div></div><div></div></div><p>
+Native CUPS rasterization works in two steps.
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+First is the "pstoraster" step. It uses the special "cups"
+device from ESP Ghostscript 7.05.x as its tool
+</p></li><li><p>
+Second comes the "rasterdriver" step. It uses various
+device-specific filters; there are several vendors who provide good
+quality filters for this step, some are Free Software, some are
+Shareware/Non-Free, some are proprietary.</p></li></ul></div><p>
+Often this produces better quality (and has several more
+advantages) than other methods.
+</p><ns59:p>
+</ns59:p><div class="figure"><a name="id2966140"></a><p class="title"><b>Figure 19.10. cupsomatic/foomatic processing versus Native CUPS</b></p><div class="mediaobject"><img src="projdoc/imagefiles/10small.png" alt="cupsomatic/foomatic processing versus Native CUPS"></div></div><ns59:p>
+</ns59:p><p>
+One other method is the <span class="emphasis"><em>cupsomatic/foomatic-rip</em></span>
+way. Note that cupsomatic is <span class="emphasis"><em>not</em></span> made by the CUPS
+developers. It is an independent contribution to printing development,
+made by people from Linuxprinting.org (see also <a href="http://www.cups.org/cups-help.html" target="_top">http://www.cups.org/cups-help.html</a>).
+cupsomatic is no longer developed and maintained and is no longer
+supported. It has now been replaced by
+<span class="emphasis"><em>foomatic-rip</em></span>. foomatic-rip is a complete re-write
+of the old cupsomatic idea, but very much improved and generalized to
+other (non-CUPS) spoolers. An upgrade to foomatic-rip is strongly
+adviced, especially if you are upgrading to a recent version of CUPS
+too.
+</p><p>
+Both the cupsomatic (old) and the foomatic-rip (new) methods from
+Linuxprinting.org use the traditional Ghostscript print file
+processing, doing everything in a single step. It therefore relies on
+all the other devices built-in into Ghostscript. The quality is as
+good (or bad) as Ghostscript rendering is in other spoolers. The
+advantage is that this method supports many printer models not
+supported (yet) by the more modern CUPS method.
+</p><p>
+Of course, you can use both methods side by side on one system (and
+even for one printer, if you set up different queues), and find out
+which works best for you.
+</p><p>
+cupsomatic "kidnaps" the printfile after the
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span> stage and
+deviates it through the CUPS-external, systemwide Ghostscript
+installation: Therefore the printfile bypasses the "pstoraster" filter
+(and thus also bypasses the CUPS-raster-drivers
+"rastertosomething"). After Ghostscript finished its rasterization,
+cupsomatic hands the rendered file directly to the CUPS backend. The
+flowchart above illustrates the difference between native CUPS
+rendering and the Foomatic/cupsomatic method.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2966247"></a>Examples for filtering Chains</h3></div></div><div></div></div><p>
+Here are a few examples of commonly occurring filtering chains to
+illustrate the workings of CUPS.
+</p><p>
+Assume you want to print a PDF file to a HP JetDirect-connected
+PostScript printer, but you want to print the pages 3-5, 7, 11-13
+only, and you want to print them "2-up" and "duplex":
+</p><div class="itemizedlist"><ul type="disc"><li><p>your print options (page selection as required, 2-up,
+duplex) are passed to CUPS on the commandline;</p></li><li><p>the (complete) PDF file is sent to CUPS and autotyped as
+<span class="emphasis"><em>application/pdf</em></span>;</p></li><li><p>the file therefore first must pass the
+<span class="emphasis"><em>pdftops</em></span> pre-filter, which produces PostScript
+MIME type <span class="emphasis"><em>application/postscript</em></span> (a preview here
+would still show all pages of the original PDF);</p></li><li><p>the file then passes the <span class="emphasis"><em>pstops</em></span>
+filter which applies the commandline options: it selects the pages
+2-5, 7 and 11-13, creates and imposed layout "2 pages on 1 sheet" and
+inserts the correct "duplex" command (as is defined in the printer's
+PPD) into the new PostScript file; the file now is of PostScript MIME
+type
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span>;</p></li><li><p>the file goes to the <span class="emphasis"><em>socket</em></span>
+backend, which transfers the job to the printers.</p></li></ul></div><p>
+The resulting filter chain therefore is:
+</p><pre class="screen">
+pdftops --> pstops --> socket
+</pre><p>
+Assume your want to print the same filter to an USB-connected
+Epson Stylus Photo printer, installed with the CUPS
+<tt class="filename">stphoto2.ppd</tt>. The first few filtering stages
+are nearly the same:
+</p><div class="itemizedlist"><ul type="disc"><li><p>your print options (page selection as required, 2-up,
+duplex) are passed to CUPS on the commandline;</p></li><li><p>the (complete) PDF file is sent to CUPS and autotyped as
+<span class="emphasis"><em>application/pdf</em></span>;</p></li><li><p>the file therefore first must pass the
+<span class="emphasis"><em>pdftops</em></span> pre-filter, which produces PostScript
+MIME type <span class="emphasis"><em>application/postscript</em></span> (a preview here
+would still show all pages of the original PDF);</p></li><li><p>the file then passes the "pstops" filter which applies
+the commandline options: it selects the pages 2-5, 7 and 11-13,
+creates and imposed layout "2 pages on 1 sheet" and inserts the
+correct "duplex" command... (OOoops -- this printer and his PPD
+don't support duplex printing at all -- this option will be ignored
+then) into the new PostScript file; the file now is of PostScript
+MIME type
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span>;</p></li><li><p>the file then passes the
+<span class="emphasis"><em>pstoraster</em></span> stage and becomes MIME type
+<span class="emphasis"><em>application/cups-raster</em></span>;</p></li><li><p>finally, the <span class="emphasis"><em>rastertoepson</em></span> filter
+does its work (as is indicated in the printer's PPD), creating the
+printer-specific raster data and embedding any user-selected
+print-options into the print data stream;</p></li><li><p>the file goes to the <span class="emphasis"><em>usb</em></span> backend,
+which transfers the job to the printers.</p></li></ul></div><p>
+The resulting filter chain therefore is:
+</p><pre class="screen">
+pdftops --> pstops --> pstoraster --> rastertoepson --> usb
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2966476"></a>Sources of CUPS drivers / PPDs</h3></div></div><div></div></div><p>
+On the internet you can find now many thousand CUPS-PPD files
+(with their companion filters), in many national languages,
+supporting more than 1000 non-PostScript models.
+</p><div class="itemizedlist"><ul type="disc"><li><p><a href="http://wwwl.easysw.com/printpro/" target="_top">ESP
+PrintPro (http://wwwl.easysw.com/printpro/)</a> (commercial,
+non-Free) is packaged with more than 3000 PPDs, ready for
+successful use "out of the box" on Linux, Mac OS X, IBM-AIX,
+HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital Unix and some
+more commercial Unices (it is written by the CUPS developers
+themselves and its sales help finance the further development of
+CUPS, as they feed their creators).</p></li><li><p>the <a href="http://gimp-print.sourceforge.net/" target="_top">Gimp-Print-Project
+(http://gimp-print.sourceforge.net/)</a> (GPL, Free Software)
+provides around 140 PPDs (supporting nearly 400 printers, many driven
+to photo quality output), to be used alongside the Gimp-Print CUPS
+filters;</p></li><li><p><a href="http://www.turboprint.com/" target="_top">TurboPrint
+(http://www.turboprint.com/)</a> (Shareware, non-Free) supports
+roughly the same amount of printers in excellent
+quality;</p></li><li><p><a href="http://www-124.ibm.com/developerworks/oss/linux/projects/omni/" target="_top">OMNI
+(http://www-124.ibm.com/developerworks/oss/linux/projects/omni/)</a>
+(LPGL, Free) is a package made by IBM, now containing support for more
+than 400 printers, stemming from the inheritance of IBM OS/2 KnowHow
+ported over to Linux (CUPS support is in a Beta-stage at
+present);</p></li><li><p><a href="http://hpinkjet.sourceforge.net/" target="_top">HPIJS
+(http://hpinkjet.sourceforge.net/)</a> (BSD-style licenses, Free)
+supports around 150 of HP's own printers and is also providing
+excellent print quality now (currently available only via the Foomatic
+path);</p></li><li><p><a href="http://www.linuxprinting.org/" target="_top">Foomatic/cupsomatic
+(http://www.linuxprinting.org/)</a> (LPGL, Free) from
+Linuxprinting.org are providing PPDs for practically every Ghostscript
+filter known to the world (including Omni, Gimp-Print and
+HPIJS).</p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The cupsomatic/Foomatic trick from Linuxprinting.org works
+differently from the other drivers. This is explained elsewhere in this
+document.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2966601"></a>Printing with Interface Scripts</h3></div></div><div></div></div><p>
+CUPS also supports the usage of "interface scripts" as known from
+System V AT&T printing systems. These are often used for PCL
+printers, from applications that generate PCL print jobs. Interface
+scripts are specific to printer models. They have a similar role as
+PPDs for PostScript printers. Interface scripts may inject the Escape
+sequences as required into the print data stream, if the user has
+chosen to select a certain paper tray, or print landscape, or use A3
+paper, etc. Interfaces scripts are practically unknown in the Linux
+realm. On HP-UX platforms they are more often used. You can use any
+working interface script on CUPS too. Just install the printer with
+the <b class="command">-i</b> option:
+</p><pre class="screen">
+
+ lpadmin -p pclprinter -v socket://11.12.13.14:9100 -i /path/to/interface-script
+
+</pre><p>
+Interface scripts might be the "unknown animal" to many. However,
+with CUPS they provide the most easy way to plug in your own
+custom-written filtering script or program into one specific print
+queue (some information about the traditional usage of interface scripts is
+to be found at <a href="http://playground.sun.com/printing/documentation/interface.html" target="_top">http://playground.sun.com/printing/documentation/interface.html</a>).
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2966663"></a>Network printing (purely Windows)</h2></div></div><div></div></div><p>
+Network printing covers a lot of ground. To understand what exactly
+goes on with Samba when it is printing on behalf of its Windows
+clients, let's first look at a "purely Windows" setup: Windows clients
+with a Windows NT print server.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2966679"></a>From Windows Clients to an NT Print Server</h3></div></div><div></div></div><p>
+Windows clients printing to an NT-based print server have two
+options. They may
+</p><div class="itemizedlist"><ul type="disc"><li><p>execute the driver locally and render the GDI output
+(EMF) into the printer specific format on their own,
+or</p></li><li><p>send the GDI output (EMF) to the server, where the
+driver is executed to render the printer specific
+output.</p></li></ul></div><p>
+Both print paths are shown in the flowcharts below.
+</p></div><div xmlns:ns60="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2966718"></a>Driver Execution on the Client</h3></div></div><div></div></div><p>
+In the first case the print server must spool the file as "raw",
+meaning it shouldn't touch the jobfile and try to convert it in any
+way. This is what traditional Unix-based print server can do too; and
+at a better performance and more reliably than NT print server. This
+is what most Samba administrators probably are familiar with. One
+advantage of this setup is that this "spooling-only" print server may
+be used even if no driver(s) for Unix are available it is sufficient
+to have the Windows client drivers available and installed on the
+clients.
+</p><ns60:p>
+</ns60:p><div class="figure"><a name="id2966743"></a><p class="title"><b>Figure 19.11. Print Driver execution on the Client</b></p><div class="mediaobject"><img src="projdoc/imagefiles/11small.png" alt="Print Driver execution on the Client"></div></div><ns60:p>
+</ns60:p></div><div xmlns:ns61="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2966777"></a>Driver Execution on the Server</h3></div></div><div></div></div><p>
+The other path executes the printer driver on the server. The clients
+transfers print files in EMF format to the server. The server uses the
+PostScript, PCL, ESC/P or other driver to convert the EMF file into
+the printer-specific language. It is not possible for Unix to do the
+same. Currently there is no program or method to convert a Windows
+client's GDI output on a Unix server into something a printer could
+understand.
+</p><ns61:p>
+</ns61:p><div class="figure"><a name="id2966799"></a><p class="title"><b>Figure 19.12. Print Driver execution on the Server</b></p><div class="mediaobject"><img src="projdoc/imagefiles/12small.png" alt="Print Driver execution on the Server"></div></div><ns61:p>
+</ns61:p><p>
+However, there is something similar possible with CUPS. Read on...
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2966840"></a>Network Printing (Windows clients -- UNIX/Samba Print
+Servers)</h2></div></div><div></div></div><p>
+Since UNIX print servers <span class="emphasis"><em>cannot</em></span> execute the Win32
+program code on their platform, the picture is somewhat
+different. However, this doesn't limit your options all that
+much. In the contrary, you may have a way here to implement printing
+features which are not possible otherwise.
+</p><div xmlns:ns62="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2966861"></a>From Windows Clients to a CUPS/Samba Print Server</h3></div></div><div></div></div><p>
+Here is a simple recipe showing how you can take advantage of CUPS
+powerful features for the benefit of your Windows network printing
+clients:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Let the Windows clients send PostScript to the CUPS
+server.</p></li><li><p>Let the CUPS server render the PostScript into device
+specific raster format.</p></li></ul></div><p>
+This requires the clients to use a PostScript driver (even if the
+printer is a non-PostScript model. It also requires that you have a
+"driver" on the CUPS server.
+</p><p>
+Firstly, to enable CUPS based printing through Samba the
+following options should be set in your <tt class="filename">smb.conf</tt> file [globals]
+section:
+</p><div class="itemizedlist"><ul type="disc"><li><p><i class="parameter"><tt>printing = CUPS</tt></i></p></li><li><p><i class="parameter"><tt>printcap = CUPS</tt></i></p></li></ul></div><p>
+When these parameters are specified, all manually set print directives
+(like <i class="parameter"><tt>print command =...</tt></i>, or <i class="parameter"><tt>lppause
+command =...</tt></i>) in <tt class="filename">smb.conf</tt> (as well as
+in samba itself) will be ignored. Instead, Samba will directly
+interface with CUPS through it's application program interface (API) -
+as long as Samba has been compiled with CUPS library (libcups)
+support. If Samba has NOT been compiled with CUPS support, and if no
+other print commands are set up, then printing will use the
+<span class="emphasis"><em>System V</em></span> AT&T command set, with the -oraw
+option automatically passing through (if you want your own defined
+print commands to work with a Samba that has CUPS support compiled in,
+simply use <i class="parameter"><tt>printing = sysv</tt></i>).
+</p><ns62:p>
+</ns62:p><div class="figure"><a name="id2966987"></a><p class="title"><b>Figure 19.13. Printing via CUPS/samba server</b></p><div class="mediaobject"><img src="projdoc/imagefiles/13small.png" alt="Printing via CUPS/samba server"></div></div><ns62:p>
+</ns62:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967021"></a>Samba receiving Jobfiles and passing them to CUPS</h3></div></div><div></div></div><p>
+Samba<span class="emphasis"><em>must</em></span> use its own spool directory (it is set
+by a line similar to <i class="parameter"><tt>path = /var/spool/samba</tt></i>,
+in the <i class="parameter"><tt>[printers]</tt></i> or
+<i class="parameter"><tt>[printername]</tt></i> section of
+<tt class="filename">smb.conf</tt>). Samba receives the job in its own
+spool space and passes it into the spool directory of CUPS (the CUPS
+spooling directory is set by the <i class="parameter"><tt>RequestRoot</tt></i>
+directive, in a line that defaults to <i class="parameter"><tt>RequestRoot
+/var/spool/cups</tt></i>). CUPS checks the access rights of its
+spool dir and resets it to healthy values with every re-start. We have
+seen quite some people who had used a common spooling space for Samba
+and CUPS, and were struggling for weeks with this "problem".
+</p><p>
+A Windows user authenticates only to Samba (by whatever means is
+configured). If Samba runs on the same host as CUPS, you only need to
+allow "localhost" to print. If they run on different machines, you
+need to make sure the Samba host gets access to printing on CUPS.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2967099"></a>Network PostScript RIP: CUPS Filters on Server -- clients use
+PostScript Driver with CUPS-PPDs</h2></div></div><div></div></div><p>
+PPDs can control all print device options. They are usually provided
+by the manufacturer; if you own a PostScript printer, that is. PPD
+files (PostScript Printer Descriptions) are always a component of
+PostScript printer drivers on MS Windows or Apple Mac OS systems. They
+are ASCII files containing user-selectable print options, mapped to
+appropriate PostScript, PCL or PJL commands for the target
+printer. Printer driver GUI dialogs translate these options
+"on-the-fly" into buttons and drop-down lists for the user to select.
+</p><p>
+CUPS can load, without any conversions, the PPD file from any Windows
+(NT is recommended) PostScript driver and handle the options. There is
+a web browser interface to the print options (select <a href="http://localhost:631/printers/" target="_top">http://localhost:631/printers/</a>
+and click on one <span class="emphasis"><em>Configure Printer</em></span> button to see
+it), or a commandline interface (see <b class="command">man lpoptions</b>
+or see if you have lphelp on your system). There are also some
+different GUI frontends on Linux/UNIX, which can present PPD options
+to users. PPD options are normally meant to be evaluated by the
+PostScript RIP on the real PostScript printer.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967154"></a>PPDs for non-PS Printers on UNIX</h3></div></div><div></div></div><p>
+CUPS doesn't limit itself to "real" PostScript printers in its usage
+of PPDs. The CUPS developers have extended the scope of the PPD
+concept, to also describe available device and driver options for
+non-PostScript printers through CUPS-PPDs.
+</p><p>
+This is logical, as CUPS includes a fully featured PostScript
+interpreter (RIP). This RIP is based on Ghostscript. It can process
+all received PostScript (and additionally many other file formats)
+from clients. All CUPS-PPDs geared to non-PostScript printers contain
+an additional line, starting with the keyword
+<i class="parameter"><tt>*cupsFilter</tt></i> . This line tells the CUPS print
+system which printer-specific filter to use for the interpretation of
+the supplied PostScript. Thus CUPS lets all its printers appear as
+PostScript devices to its clients, because it can act as a PostScript
+RIP for those printers, processing the received PostScript code into a
+proper raster print format.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967194"></a>PPDs for non-PS Printers on Windows</h3></div></div><div></div></div><p>
+CUPS-PPDs can also be used on Windows-Clients, on top of a
+"core" PostScript driver (now recommended is the "CUPS PostScript
+Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with
+limitations). This feature enables CUPS to do a few tricks no other
+spooler can do:
+</p><div class="itemizedlist"><ul type="disc"><li><p>act as a networked PostScript RIP (Raster Image
+Processor), handling printfiles from all client platforms in a uniform
+way;</p></li><li><p>act as a central accounting and billing server, since
+all files are passed through the pstops filter and are therefore
+logged in the CUPS <tt class="filename">page_log</tt> file.
+<span class="emphasis"><em>NOTE:</em></span> this can not happen with "raw" print jobs,
+which always remain unfiltered per definition;</p></li><li><p>enable clients to consolidate on a single PostScript
+driver, even for many different target printers.</p></li></ul></div><p>
+Using CUPS PPDs on Windows clients enables these to control
+all print job settings just as a UNIX client can do too.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2967260"></a>Windows Terminal Servers (WTS) as CUPS Clients</h2></div></div><div></div></div><p>
+This setup may be of special interest to people experiencing major
+problems in WTS environments. WTS need often a multitude of
+non-PostScript drivers installed to run their clients' variety of
+different printer models. This often imposes the price of much
+increased instability.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967277"></a>Printer Drivers running in "Kernel Mode" cause many
+Problems</h3></div></div><div></div></div><p>
+The reason is that in Win NT printer drivers run in "Kernel
+Mode", this introduces a high risk for the stability of the system
+if the driver is not really stable and well-tested. And there are a
+lot of bad drivers out there! Especially notorious is the example
+of the PCL printer driver that had an additional sound module
+running, to notify users via soundcard of their finished jobs. Do I
+need to say that this one was also reliably causing "Blue Screens
+of Death" on a regular basis?
+</p><p>
+PostScript drivers generally are very well tested. They are not known
+to cause any problems, even though they run in Kernel Mode too. This
+might be because there have so far only been 2 different PostScript
+drivers the ones from Adobe and the one from Microsoft. Both are
+very well tested and are as stable as you ever can imagine on
+Windows. The CUPS driver is derived from the Microsoft one.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967312"></a>Workarounds impose Heavy Limitations</h3></div></div><div></div></div><p>
+In many cases, in an attempt to work around this problem, site
+administrators have resorted to restrict the allowed drivers installed
+on their WTS to one generic PCL- and one PostScript driver. This
+however restricts the clients in the amount of printer options
+available for them; often they can't get out more than simplex
+prints from one standard paper tray, while their devices could do much
+better, if driven by a different driver! )
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967333"></a>CUPS: a "Magical Stone"?</h3></div></div><div></div></div><p>
+Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very
+elegant way to overcome all these shortcomings. There are, depending
+on the version of Windows OS you use, up to 3 different PostScript
+drivers available: Adobe, Microsoft and CUPS PostScript drivers. None
+of them is known to cause major stability problems on WTS (even if
+used with many different PPDs). The clients will be able to (again)
+chose paper trays, duplex printing and other settings. However, there
+is a certain price for this too: a CUPS server acting as a PostScript
+RIP for its clients requires more CPU and RAM than when just acting as
+a "raw spooling" device. Plus, this setup is not yet widely tested,
+although the first feedbacks look very promising.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967360"></a>PostScript Drivers with no major problems -- even in Kernel
+Mode</h3></div></div><div></div></div><p>
+More recent printer drivers on W2K and XP don't run in Kernel mode
+(unlike Win NT) any more. However, both operating systems can still
+use the NT drivers, running in Kernel mode (you can roughly tell which
+is which as the drivers in subdirectory "2" of "W32X86" are "old"
+ones). As was said before, the Adobe as well as the Microsoft
+PostScript drivers are not known to cause any stability problems. The
+CUPS driver is derived from the Microsoft one. There is a simple
+reason for this: The MS DDK (Device Development Kit) for Win NT (which
+used to be available at no cost to licensees of Visual Studio)
+includes the source code of the Microsoft driver, and licensees of
+Visual Studio are allowed to use and modify it for their own driver
+development efforts. This is what the CUPS people have done. The
+license doesn't allow them to publish the whole of the source code.
+However, they have released the "diff" under the GPL, and if you are
+owner of an "MS DDK for Win NT", you can check the driver yourself.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2967394"></a> Setting up CUPS for driver Download</h2></div></div><div></div></div><p>
+As we have said before: all previously known methods to prepare client
+printer drivers on the Samba server for download and "Point'n'Print"
+convenience of Windows workstations are working with CUPS too. These
+methods were described in the previous chapter. In reality, this is a
+pure Samba business, and only relates to the Samba/Win client
+relationship.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967412"></a><span class="emphasis"><em>cupsaddsmb</em></span>: the unknown Utility</h3></div></div><div></div></div><p>
+The cupsaddsmb utility (shipped with all current CUPS versions) is an
+alternative method to transfer printer drivers into the Samba
+<i class="parameter"><tt>[print$]</tt></i> share. Remember, this share is where
+clients expect drivers deposited and setup for download and
+installation. It makes the sharing of any (or all) installed CUPS
+printers very easy. cupsaddsmb can use the Adobe PostScript driver as
+well as the newly developed <span class="emphasis"><em>CUPS PostScript Driver for
+WinNT/2K/XP</em></span>. Note, that cupsaddsmb does
+<span class="emphasis"><em>not</em></span> work with arbitrary vendor printer drivers,
+but only with the <span class="emphasis"><em>exact</em></span> driver files that are
+named in its man page.
+</p><p>
+The CUPS printer driver is available from the CUPS download site. Its
+package name is <tt class="filename">cups-samba-[version].tar.gz</tt> . It
+is prefered over the Adobe drivers since it has a number of
+advantages:
+</p><div class="itemizedlist"><ul type="disc"><li><p>it supports a much more accurate page
+accounting;</p></li><li><p>it supports banner pages, and page labels on all
+printers;</p></li><li><p>it supports the setting of a number of job IPP
+attributes (such as job-priority, page-label and
+job-billing)</p></li></ul></div><p>
+However, currently only Windows NT, 2000, and XP are supported by the
+CUPS drivers. You will need to get the respective part of Adobe driver
+too if you need to support Windows 95, 98, and ME clients.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967504"></a>Prepare your <tt class="filename">smb.conf</tt> for
+cupsaddsmb</h3></div></div><div></div></div><p>
+Prior to running cupsaddsmb, you need the following settings in
+<tt class="filename">smb.conf</tt>:
+</p><pre class="screen">
+
+ [global]
+ load printers = yes
+ printing = cups
+ printcap name = cups
+
+ [printers]
+ comment = All Printers
+ path = /var/spool/samba
+ browseable = no
+ public = yes
+ guest ok = yes # setting depends on your requirements
+ writable = no
+ printable = yes
+ printer admin = root
+
+ [print$]
+ comment = Printer Drivers
+ path = /etc/samba/drivers
+ browseable = yes
+ guest ok = no
+ read only = yes
+ write list = root
+
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967550"></a>CUPS Package of "PostScript Driver for WinNT/2k/XP"</h3></div></div><div></div></div><p>
+CUPS users may get the exactly same packages from<a href="http://www.cups.org/software.html" target="_top"><span class="emphasis"><em>http://www.cups.org/software.html</em></span></a>.
+It is a separate package from the CUPS base software files, tagged as
+<span class="emphasis"><em>CUPS 1.1.x Windows NT/2k/XP Printer Driver for SAMBA
+(tar.gz, 192k)</em></span>. The filename to download is
+<tt class="filename">cups-samba-1.1.x.tar.gz</tt>. Upon untar-/unzip-ing,
+it will reveal these files:
+</p><pre class="screen">
+
+# tar xvzf cups-samba-1.1.19.tar.gz
+
+ cups-samba.install
+ cups-samba.license
+ cups-samba.readme
+ cups-samba.remove
+ cups-samba.ss
+
+</pre><p>
+These have been packaged with the ESP meta packager software
+"EPM". The <tt class="filename">*.install</tt> and
+<tt class="filename">*.remove</tt> files are simple shell scripts, which
+untars the <tt class="filename">*.ss</tt> (the <tt class="filename">*.ss</tt> is
+nothing else but a tar-archive, which can be untar-ed by "tar"
+too). Then it puts the content into
+<tt class="filename">/usr/share/cups/drivers/</tt>. This content includes 3
+files:
+</p><pre class="screen">
+
+# tar tv cups-samba.ss
+
+ cupsdrvr.dll
+ cupsui.dll
+ cups.hlp
+
+</pre><p>
+The <span class="emphasis"><em>cups-samba.install</em></span> shell scripts is easy to
+handle:
+</p><pre class="screen">
+
+# ./cups-samba.install
+
+ [....]
+ Installing software...
+ Updating file permissions...
+ Running post-install commands...
+ Installation is complete.
+
+</pre><p>
+The script should automatically put the driver files into the
+<tt class="filename">/usr/share/cups/drivers/</tt> directory.
+</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+Due to a bug, one recent CUPS release puts the
+<tt class="filename">cups.hlp</tt> driver file
+into<tt class="filename">/usr/share/drivers/</tt> instead of
+<tt class="filename">/usr/share/cups/drivers/</tt>. To work around this,
+copy/move the file (after running the
+<b class="command">./cups-samba.install</b> script) manually to the
+right place.
+</p></div><pre class="screen">
+
+ cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
+
+</pre><p>
+This new CUPS PostScript driver is currently binary-only, but free of
+charge. No complete source code is provided (yet). The reason is this:
+it has been developed with the help of the <span class="emphasis"><em>Microsoft Driver
+Developer Kit</em></span> (DDK) and compiled with Microsoft Visual
+Studio 6. Driver developers are not allowed to distribute the whole of
+the source code as Free Software. However, CUPS developers released
+the "diff" in source code under the GPL, so anybody with a license of
+Visual Studio and a DDK will be able to compile for him/herself.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967748"></a>Recognize the different Driver Files</h3></div></div><div></div></div><p>
+The CUPS drivers don't support the "older" Windows 95/98/ME, but only
+the Windows NT/2000/XP client:
+</p><pre class="screen">
+
+ [Windows NT, 2000, and XP are supported by:]
+ cups.hlp
+ cupsdrvr.dll
+ cupsui.dll
+
+</pre><p>
+Adobe drivers are available for the older Windows 95/98/ME as well as
+the Windows NT/2000/XP clients. The set of files is different for the
+different platforms.
+</p><pre class="screen">
+
+ [Windows 95, 98, and Me are supported by:]
+ ADFONTS.MFM
+ ADOBEPS4.DRV
+ ADOBEPS4.HLP
+ DEFPRTR2.PPD
+ ICONLIB.DLL
+ PSMON.DLL
+
+ [Windows NT, 2000, and XP are supported by:]
+ ADOBEPS5.DLL
+ ADOBEPSU.DLL
+ ADOBEPSU.HLP
+
+</pre><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+If both, the Adobe driver files and the CUPS driver files for the
+support of WinNT/2k/XP are present in , the Adobe ones will be ignored
+and the CUPS ones will be used. If you prefer -- for whatever reason
+-- to use Adobe-only drivers, move away the 3 CUPS driver files. The
+Win95/98/ME clients use the Adobe drivers in any case.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967806"></a>Acquiring the Adobe Driver Files</h3></div></div><div></div></div><p>
+Acquiring the Adobe driver files seems to be unexpectedly difficult
+for many users. They are not available on the Adobe website as single
+files and the self-extracting and/or self-installing Windows-exe is
+not easy to locate either. Probably you need to use the included
+native installer and run the installation process on one client
+once. This will install the drivers (and one Generic PostScript
+printer) locally on the client. When they are installed, share the
+Generic PostScript printer. After this, the client's
+<i class="parameter"><tt>[print$]</tt></i> share holds the Adobe files, from
+where you can get them with smbclient from the CUPS host. A more
+detailed description about this is in the next (the CUPS printing)
+chapter.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967838"></a>ESP Print Pro Package of "PostScript Driver for
+WinNT/2k/XP"</h3></div></div><div></div></div><p>
+Users of the ESP Print Pro software are able to install their "Samba
+Drivers" package for this purpose with no problem. Retrieve the driver
+files from the normal download area of the ESP Print Pro software
+at<a href="http://www.easysw.com/software.html" target="_top">http://www.easysw.com/software.html</a>.
+You need to locate the link labelled "SAMBA" amongst the
+<span class="emphasis"><em>Download Printer Drivers for ESP Print Pro 4.x</em></span>
+area and download the package. Once installed, you can prepare any
+driver by simply highlighting the printer in the Printer Manager GUI
+and select <span class="emphasis"><em>Export Driver...</em></span> from the menu. Of
+course you need to have prepared Samba beforehand too to handle the
+driver files; i.e. mainly setup the <i class="parameter"><tt>[print$]</tt></i>
+share, etc. The ESP Print Pro package includes the CUPS driver files
+as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME
+client family.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2967888"></a>Caveats to be considered</h3></div></div><div></div></div><p>
+Once you have run the install script (and possibly manually
+moved the <tt class="filename">cups.hlp</tt> file to
+<tt class="filename">/usr/share/cups/drivers/</tt>), the driver is
+ready to be put into Samba's <i class="parameter"><tt>[print$]</tt></i> share (which often maps to
+<tt class="filename">/etc/samba/drivers/</tt> and contains a subdir
+tree with <span class="emphasis"><em>WIN40</em></span> and
+<span class="emphasis"><em>W32X86</em></span> branches): You do this by running
+"cupsaddsmb" (see also <b class="command">man cupsaddsmb</b> for
+CUPS since release 1.1.16).
+</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+You may need to put root into the smbpasswd file by running
+<b class="command">smbpasswd</b>; this is especially important if you
+should run this whole procedure for the first time, and are not
+working in an environment where everything is configured for
+<span class="emphasis"><em>Single Sign On</em></span> to a Windows Domain Controller.
+</p></div><p>
+Once the driver files are in the <i class="parameter"><tt>[print$]</tt></i> share
+and are initialized, they are ready to be downloaded and installed by
+the Win NT/2k/XP clients.
+</p><div xmlns:ns63="" class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><ns63:p>
+</ns63:p><div class="orderedlist"><ol type="1"><li><p>
+Win 9x/ME clients won't work with the CUPS PostScript driver. For
+these you'd still need to use the <tt class="filename">ADOBE*.*</tt>
+drivers as previously.
+</p></li><li><p>
+It is not harmful if you still have the
+<tt class="filename">ADOBE*.*</tt> driver files from previous
+installations in the <tt class="filename">/usr/share/cups/drivers/</tt>
+directory. The new <span class="emphasis"><em>cupsaddsmb</em></span> (from 1.1.16) will
+automatically prefer "its own" drivers if it finds both.
+</p></li><li><p>
+Should your Win clients have had the old <tt class="filename">ADOBE*.*</tt>
+files for the Adobe PostScript driver installed, the download and
+installation of the new CUPS PostScript driver for Windows NT/2k/XP
+will fail at first. You need to wipe the old driver from the clients
+first. It is not enough to "delete" the printer, as the driver files
+will still be kept by the clients and re-used if you try to re-install
+the printer. To really get rid of the Adobe driver files on the
+clients, open the "Printers" folder (possibly via <span class="emphasis"><em>Start
+--> Settings --> Control Panel --> Printers</em></span>),
+right-click onto the folder background and select <span class="emphasis"><em>Server
+Properties</em></span>. When the new dialog opens, select the
+<span class="emphasis"><em>Drivers</em></span> tab. On the list select the driver you
+want to delete and click on the <span class="emphasis"><em>Delete</em></span>
+button. This will only work if there is not one single printer left
+which uses that particular driver. You need to "delete" all printers
+using this driver in the "Printers" folder first. You will need
+Administrator privileges to do this.
+</p></li><li><p>
+Once you have successfully downloaded the CUPS PostScript driver to a
+client, you can easily switch all printers to this one by proceeding
+as described elsewhere in the "Samba HOWTO Collection": either change
+a driver for an existing printer by running the "Printer Properties"
+dialog, or use <b class="command">rpcclient</b> with the
+<b class="command">setdriver</b> sub-command.
+</p></li></ol></div><ns63:p>
+</ns63:p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2968110"></a>What are the Benefits of using the "CUPS PostScript Driver for
+Windows NT/2k/XP" as compared to the Adobe Driver?</h3></div></div><div></div></div><p>
+You are interested in a comparison between the CUPS and the Adobe
+PostScript drivers? For our purposes these are the most important
+items which weigh in favor of the CUPS ones:
+</p><div class="itemizedlist"><ul type="disc"><li><p>no hassle with the Adobe EULA</p></li><li><p>no hassle with the question “<span class="quote">Where do I
+get the ADOBE*.* driver files from?</span>”</p></li><li><p>the Adobe drivers (on request of the printer PPD
+associated with them) often put a PJL header in front of the main
+PostScript part of the print file. Thus the printfile starts with
+<i class="parameter"><tt><1B >%-12345X</tt></i> or
+<i class="parameter"><tt><escape>%-12345X</tt></i> instead
+of <i class="parameter"><tt>%!PS</tt></i>). This leads to the
+CUPS daemon auto-typing the incoming file as a print-ready file,
+not initiating a pass through the "pstops" filter (to speak more
+technically, it is not regarded as the generic MIME type
+<span class="emphasis"><em>application/postscript</em></span>, but as
+the more special MIME type
+<span class="emphasis"><em>application/cups.vnd-postscript</em></span>),
+which therefore also leads to the page accounting in
+<span class="emphasis"><em>/var/log/cups/page_log</em></span> not
+receiving the exact mumber of pages; instead the dummy page number
+of "1" is logged in a standard setup)</p></li><li><p>the Adobe driver has more options to "mis-configure" the
+PostScript generated by it (like setting it inadvertedly to
+<span class="emphasis"><em>Optimize for Speed</em></span>, instead of
+<span class="emphasis"><em>Optimize for Portability</em></span>, which
+could lead to CUPS being unable to process it)</p></li><li><p>the CUPS PostScript driver output sent by Windows
+clients to the CUPS server will be guaranteed to be auto-typed always
+as generic MIME type <span class="emphasis"><em>application/postscript</em></span>,
+thusly passing through the CUPS "pstops" filter and logging the
+correct number of pages in the <tt class="filename">page_log</tt> for
+accounting and quota purposes</p></li><li><p>the CUPS PostScript driver supports the sending of
+additional standard (IPP) print options by Win NT/2k/XP clients. Such
+additional print options are: naming the CUPS standard
+<span class="emphasis"><em>banner pages</em></span> (or the custom ones, should they be
+installed at the time of driver download), using the CUPS
+<span class="emphasis"><em>page-label</em></span> option, setting a
+<span class="emphasis"><em>job-priority</em></span> and setting the <span class="emphasis"><em>scheduled
+time of printing</em></span> (with the option to support additional
+useful IPP job attributes in the future).</p></li><li><p>the CUPS PostScript driver supports the inclusion of
+the new <span class="emphasis"><em>*cupsJobTicket</em></span> comments at the
+beginning of the PostScript file (which could be used in the future
+for all sort of beneficial extensions on the CUPS side, but which will
+not disturb any other applications as they will regard it as a comment
+and simply ignore it).</p></li><li><p>the CUPS PostScript driver will be the heart of the
+fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon
+(probably alongside the first Beta release for CUPS
+1.2).</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2968291"></a>Run "cupsaddsmb" (quiet Mode)</h3></div></div><div></div></div><p>
+The cupsaddsmb command copies the needed files into your
+<i class="parameter"><tt>[print$]</tt></i> share. Additionally, the PPD
+associated with this printer is copied from
+<tt class="filename">/etc/cups/ppd/</tt> to
+<i class="parameter"><tt>[print$]</tt></i>. There the files wait for convenient
+Windows client installations via Point'n'Print. Before we can run the
+command successfully, we need to be sure that we can authenticate
+towards Samba. If you have a small network you are probably using user
+level security (<i class="parameter"><tt>security = user</tt></i>). Probably your
+root has already a Samba account. Otherwise, create it now, using
+<b class="command">smbpasswd</b>:
+</p><pre class="screen">
+
+ # smbpasswd -a root
+ New SMB password: [type in password 'secret']
+ Retype new SMB password: [type in password 'secret']
+
+</pre><p>
+Here is an example of a successfully run cupsaddsmb command.
+</p><pre class="screen">
+
+ # cupsaddsmb -U root infotec_IS2027
+ Password for root required to access localhost via SAMBA: [type in password 'secret']
+
+</pre><p>
+To share<span class="emphasis"><em>all</em></span> printers and drivers, use the
+<i class="parameter"><tt>-a</tt></i> parameter instead of a printer name. Since
+cupsaddsmb "exports" the printer drivers to Samba, it should be
+obvious that it only works for queues with a CUPS driver associated.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2968392"></a>Run "cupsaddsmb" with verbose Output</h3></div></div><div></div></div><p>
+Probably you want to see what's going on. Use the
+<i class="parameter"><tt>-v</tt></i> parameter to get a more verbose output. The
+output below was edited for better readability: all "\" at the end of
+a line indicate that I inserted an artificial line break plus some
+indentation here:
+</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+You will see the root password for the Samba account printed on
+screen. If you use remote access, the password will go over the wire
+unencrypted!
+</p></div><pre class="screen">
+
+ # cupsaddsmb -U root -v infotec_2105
+ Password for root required to access localhost via SAMBA:
+ Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put \
+ /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd;put \
+ /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll;put \
+ /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll;put \
+ /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp'
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+ NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
+ putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd (2328.8 kb/s) \
+ (average 2328.8 kb/s)
+ putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll (9374.3 kb/s) \
+ (average 5206.6 kb/s)
+ putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll (8107.2 kb/s) \
+ (average 5984.1 kb/s)
+ putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp (3475.0 kb/s) \
+ (average 5884.7 kb/s)
+
+ Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86" \
+ "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \
+ RAW:NULL"'
+ cmd = adddriver "Windows NT x86" "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll: \
+ cups.hlp:NULL:RAW:NULL"
+ Printer Driver infotec_2105 successfully installed.
+
+ Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put \
+ /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; put \
+ /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put \
+ /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put \
+ /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put \
+ /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put \
+ /usr/share/cups/drivers/ICONLIB.DLL
+ WIN40/ICONLIB.DLL;put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+ NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40
+ putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD (2328.8 kb/s) \
+ (average 2328.8 kb/s)
+ putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (9368.0 kb/s) \
+ (average 6469.6 kb/s)
+ putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (9958.2 kb/s) \
+ (average 8404.3 kb/s)
+ putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (8341.5 kb/s) \
+ (average 8398.6 kb/s)
+ putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (2195.9 kb/s) \
+ (average 8254.3 kb/s)
+ putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (8239.9 kb/s) \
+ (average 8253.6 kb/s)
+ putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (6222.2 kb/s) \
+ (average 8188.5 kb/s)
+
+ Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0" \
+ "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \
+ PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \
+ ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
+ cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL: \
+ ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP, \
+ PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
+ Printer Driver infotec_2105 successfully installed.
+
+ Running command: rpcclient localhost -N -U'root%secret' \
+ -c 'setdriver infotec_2105 infotec_2105'
+ cmd = setdriver infotec_2105 infotec_2105
+ Succesfully set infotec_2105 to driver infotec_2105.
+
+</pre><p>
+If you look closely, you'll discover your root password was transfered
+unencrypted over the wire, so beware! Also, if you look further her,
+you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in
+between. They occur, because the directories WIN40 and W32X86 already
+existed in the <i class="parameter"><tt>[print$]</tt></i> driver download share
+(from a previous driver installation). They are harmless here.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2968534"></a>Understanding cupsaddsmb</h3></div></div><div></div></div><p>
+What has happened? What did cupsaddsmb do? There are five stages of
+the procedure
+</p><div class="orderedlist"><ol type="1"><li><p>call the CUPS server via IPP and request the
+driver files and the PPD file for the named printer;</p></li><li><p>store the files temporarily in the local
+TEMPDIR (as defined in
+<tt class="filename">cupsd.conf</tt>);</p></li><li><p>connect via smbclient to the Samba server's
+ <i class="parameter"><tt>[print$]</tt></i> share and put the files into the
+ share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub
+ directories;</p></li><li><p>connect via rpcclient to the Samba server and
+execute the "adddriver" command with the correct
+parameters;</p></li><li><p>connect via rpcclient to the Samba server a second
+time and execute the "setdriver" command.</p></li></ol></div><p>
+Note, that you can run the cupsaddsmb utility with parameters to
+specify one remote host as Samba host and a second remote host as CUPS
+host. Especially if you want to get a deeper understanding, it is a
+good idea try it and see more clearly what is going on (though in real
+life most people will have their CUPS and Samba servers run on the
+same host):
+</p><pre class="screen">
+
+ # cupsaddsmb -H sambaserver -h cupsserver -v printername
+
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2968628"></a>How to recognize if cupsaddsm completed successfully</h3></div></div><div></div></div><p>
+You <span class="emphasis"><em>must</em></span> always check if the utility completed
+successfully in all fields. You need as a minimum these 3 messages
+amongst the output:
+</p><div class="orderedlist"><ol type="1"><li><p><span class="emphasis"><em>Printer Driver infotec_2105 successfully
+installed.</em></span> # (for the W32X86 == WinNT/2K/XP
+architecture...)</p></li><li><p><span class="emphasis"><em>Printer Driver infotec_2105 successfully
+installed.</em></span> # (for the WIN40 == Win9x/ME
+architecture...)</p></li><li><p><span class="emphasis"><em>Succesfully set [printerXPZ] to driver
+[printerXYZ].</em></span></p></li></ol></div><p>
+These messages probably not easily recognized in the general
+output. If you run cupsaddsmb with the <i class="parameter"><tt>-a</tt></i>
+parameter (which tries to prepare <span class="emphasis"><em>all</em></span> active CUPS
+printer drivers for download), you might miss if individual printers
+drivers had problems to install properly. Here a redirection of the
+output will help you analyze the results in retrospective.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+It is impossible to see any diagnostic output if you don't run
+cupsaddsmb in verbose mode. Therefore we strongly recommend to not
+use the default quiet mode. It will hide any problems from you which
+might occur.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2968716"></a>cupsaddsmb with a Samba PDC</h3></div></div><div></div></div><p>
+You can't get the standard cupsaddsmb command to run on a Samba PDC?
+You are asked for the password credential all over again and again and
+the command just will not take off at all? Try one of these
+variations:
+</p><pre class="screen">
+
+ # cupsaddsmb -U DOMAINNAME\\root -v printername
+ # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -v printername
+ # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -h cups-server -v printername
+
+</pre><p>
+(Note the two backslashes: the first one is required to
+"escape" the second one).
+</p></div><div xmlns:ns64="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2968750"></a>cupsaddsmb Flowchart</h3></div></div><div></div></div><p>
+Here is a chart about the procedures, commandflows and
+dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is
+not intended to, and does not work with, "raw" queues!
+</p><ns64:p>
+</ns64:p><div class="figure"><a name="id2968768"></a><p class="title"><b>Figure 19.14. cupsaddsmb flowchart</b></p><div class="mediaobject"><img src="projdoc/imagefiles/1small.png" alt="cupsaddsmb flowchart"></div></div><ns64:p>
+</ns64:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2968801"></a>Installing the PostScript Driver on a Client</h3></div></div><div></div></div><p>
+After cupsaddsmb completed, your driver is prepared for the clients to
+use. Here are the steps you must perform to download and install it
+via "Point'n'Print". From a Windows client, browse to the CUPS/Samba
+server;
+</p><div class="itemizedlist"><ul type="disc"><li><p>open the <span class="emphasis"><em>Printers</em></span>
+share of Samba in Network Neighbourhood;</p></li><li><p>right-click on the printer in
+question;</p></li><li><p>from the opening context-menu select
+<span class="emphasis"><em>Install...</em></span> or
+<span class="emphasis"><em>Connect...</em></span> (depending on the Windows version you
+use).</p></li></ul></div><p>
+After a few seconds, there should be a new printer in your
+client's <span class="emphasis"><em>local</em></span> "Printers" folder: On Windows
+XP it will follow a naming convention of <span class="emphasis"><em>PrinterName on
+SambaServer</em></span>. (In my current case it is "infotec_2105 on
+kde-bitshop"). If you want to test it and send your first job from
+an application like Winword, the new printer will appears in a
+<tt class="filename">\\SambaServer\PrinterName</tt> entry in the
+dropdown list of available printers.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher
+and Samba from 2.2.4. If it doesn't work, or if the automatic printer
+driver download to the clients doesn't succeed, you can still manually
+install the CUPS printer PPD on top of the Adobe PostScript driver on
+clients. Then point the client's printer queue to the Samba printer
+share for a UNC type of connection:
+</p></div><pre class="screen">
+
+ net use lpt1: \\sambaserver\printershare /user:ntadmin
+
+</pre><p>
+should you desire to use the CUPS networked PostScript RIP
+functions. (Note that user "ntadmin" needs to be a valid Samba user
+with the required privileges to access the printershare) This would
+set up the printer connection in the traditional
+<span class="emphasis"><em>LanMan</em></span> way (not using MS-RPC).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2968916"></a>Avoiding critical PostScript Driver Settings on the
+Client</h3></div></div><div></div></div><p>
+Soooo: printing works, but there are still problems. Most jobs print
+well, some don't print at all. Some jobs have problems with fonts,
+which don't look very good. Some jobs print fast, and some are
+dead-slow. Many of these problems can be greatly reduced or even
+completely eliminated if you follow a few guidelines. Remember, if
+your print device is not PostScript-enabled, you are treating your
+Ghostscript installation on your CUPS host with the output your client
+driver settings produce. Treat it well:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Avoid the <span class="emphasis"><em>PostScript Output Option: Optimize
+for Speed</em></span> settting. Rather use the <span class="emphasis"><em>Optimize for
+Portability</em></span> instead (Adobe PostScript
+driver).</p></li><li><p>Don't use the <span class="emphasis"><em>Page Independence:
+NO</em></span> setting. Instead use <span class="emphasis"><em>Page Independence
+YES</em></span> (CUPS PostScript Driver)</p></li><li><p>Recommended is the <span class="emphasis"><em>True Type Font
+Downloading Option: Native True Type</em></span> over
+<span class="emphasis"><em>Automatic</em></span> and <span class="emphasis"><em>Outline</em></span>; you
+should by all means avoid <span class="emphasis"><em>Bitmap</em></span> (Adobe
+PostScript Driver)</p></li><li><p>Choose <span class="emphasis"><em>True Type Font: Download as Softfont
+into Printer</em></span> over the default <span class="emphasis"><em>Replace by Device
+Font</em></span> (for exotic fonts you may need to change it back to
+get a printout at all) (Adobe)</p></li><li><p>Sometimes you can choose <span class="emphasis"><em>PostScript Language
+Level</em></span>: in case of problems try <span class="emphasis"><em>2</em></span>
+instead of <span class="emphasis"><em>3</em></span> (the latest ESP Ghostscript package
+handels Level 3 PostScript very well) (Adobe).</p></li><li><p>Say <span class="emphasis"><em>Yes</em></span> to <span class="emphasis"><em>PostScript
+Error Handler</em></span> (Adobe)</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2969051"></a>Installing PostScript Driver Files manually (using
+rpcclient)</h2></div></div><div></div></div><p>
+Of course you can run all the commands which are embedded into the
+cupsaddsmb convenience utility yourself, one by one, and hereby upload
+and prepare the driver files for future client downloads.
+</p><div class="orderedlist"><ol type="1"><li><p>prepare Samba (a CUPS printqueue with the name of the
+printer should be there. We are providing the driver
+now);</p></li><li><p>copy all files to
+<i class="parameter"><tt>[print$]:</tt></i></p></li><li><p>run <b class="command">rpcclient adddriver</b>
+(for each client architecture you want to support):</p></li><li><p>run <b class="command">rpcclient
+setdriver.</b></p></li></ol></div><p>
+We are going to do this now. First, read the man page on "rpcclient"
+to get a first idea. Look at all the printing related
+sub-commands. <b class="command">enumprinters</b>,
+<b class="command">enumdrivers</b>, <b class="command">enumports</b>,
+<b class="command">adddriver</b>, <b class="command">setdriver</b> are amongst
+the most interesting ones. rpcclient implements an important part of
+the MS-RPC protocol. You can use it to query (and command) a Win NT
+(or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other
+things, to benefit from the "Point'n' Print" features. Samba can now
+mimic this too.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2969166"></a>A Check of the rpcclient man Page</h3></div></div><div></div></div><p>
+First let's have a little check of the rpcclient man page. Here are
+two relevant passages:
+</p><p>
+<b class="command">adddriver <arch> <config></b> Execute an
+AddPrinterDriver() RPC to install the printer driver information on
+the server. Note that the driver files should already exist in the
+directory returned by <b class="command">getdriverdir</b>. Possible
+values for <i class="parameter"><tt>arch</tt></i> are the same as those for the
+<b class="command">getdriverdir</b> command. The
+<i class="parameter"><tt>config</tt></i> parameter is defined as follows:
+</p><pre class="screen">
+Long Printer Name:\
+Driver File Name:\
+Data File Name:\
+Config File Name:\
+Help File Name:\
+Language Monitor Name:\
+Default Data Type:\
+Comma Separated list of Files
+</pre><p>Any empty fields should be enter as the string "NULL". </p><p>Samba does not need to support the concept of Print Monitors
+since these only apply to local printers whose driver can make use of
+a bi-directional link for communication. This field should be "NULL".
+On a remote NT print server, the Print Monitor for a driver must
+already be installed prior to adding the driver or else the RPC will
+fail
+</p><p>
+<b class="command">setdriver <printername> <drivername></b>
+Execute a <b class="command">SetPrinter()</b> command to update the
+printer driver associated with an installed printer. The printer
+driver must already be correctly installed on the print server.
+</p><p> See also the enumprinters and enumdrivers commands for
+obtaining a list of installed printers and drivers.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2969278"></a>Understanding the rpcclient man Page</h3></div></div><div></div></div><p>
+The <span class="emphasis"><em>exact</em></span> format isn't made too clear by the man
+page, since you have to deal with some parameters containing
+spaces. Here is a better description for it. We have line-broken the
+command and indicated the breaks with "\". Usually you would type the
+command in one line without the linebreaks:
+</p><pre class="screen">
+
+ adddriver "Architecture" \
+ "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
+ LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
+
+</pre><p>
+What the man pages denotes as a simple <config>
+keyword, does in reality consist of 8 colon-separated fields. The
+last field may take multiple (in some, very insane, cases, even
+20 different additional files. This might sound confusing at first.
+Note, that what the man pages names the "LongPrinterName" in
+reality should rather be called the "Driver Name". You can name it
+anything you want, as long as you use this name later in the
+<span class="emphasis"><em>rpcclient ... setdriver</em></span> command. For
+practical reasons, many name the driver the same as the
+printer.
+</p><p>
+True: it isn't simple at all. I hear you asking:
+<span class="emphasis"><em>How do I know which files are "Driver
+File", "Data File", "Config File", "Help File" and "Language
+Monitor File" in each case?</em></span> -- For an answer you may
+want to have a look at how a Windows NT box with a shared printer
+presents the files to us. Remember, that this whole procedure has
+to be developed by the Samba Team by overhearing the traffic caused
+by Windows computers on the wire. We may as well turn to a Windows
+box now, and access it from a UNIX workstation. We will query it
+with <b class="command">rpcclient</b> to see what it tells us and
+try to understand the man page more clearly which we've read just
+now.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2969357"></a>Producing an Example by querying a Windows Box</h3></div></div><div></div></div><p>
+We could run <b class="command">rpcclient</b> with a
+<b class="command">getdriver</b> or a <b class="command">getprinter</b>
+subcommand (in level 3 verbosity) against it. Just sit down at UNIX or
+Linux workstation with the Samba utilities installed. Then type the
+following command:
+</p><pre class="screen">
+
+ rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3'
+
+</pre><p>
+From the result it should become clear which is which. Here is an
+example from my installation:
+</p><pre class="screen">
+
+# rpcclient -U'Danka%xxxx' W2KSERVER -c'getdriver "DANKA InfoStream Virtual Printer" 3'
+ cmd = getdriver "DANKA InfoStream Virtual Printer" 3
+
+ [Windows NT x86]
+ Printer Driver Info 3:
+ Version: [2]
+ Driver Name: [DANKA InfoStream]
+ Architecture: [Windows NT x86]
+ Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.DLL]
+ Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\INFOSTRM.PPD]
+ Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRPTUI.DLL]
+ Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.HLP]
+
+ Dependentfiles: []
+ Dependentfiles: []
+ Dependentfiles: []
+ Dependentfiles: []
+ Dependentfiles: []
+ Dependentfiles: []
+ Dependentfiles: []
+
+ Monitorname: []
+ Defaultdatatype: []
+
+</pre><p>
+Some printer drivers list additional files under the label
+"Dependentfiles": these would go into the last field
+<span class="emphasis"><em>ListOfFiles,Comma-separated</em></span>. For the CUPS
+PostScript drivers we don't need any (nor would we for the Adobe
+PostScript driver): therefore the field will get a "NULL" entry.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2969447"></a>What is required for adddriver and setdriver to succeed</h3></div></div><div></div></div><p>
+From the manpage (and from the quoted output
+of<span class="emphasis"><em>cupsaddsmb</em></span>, above) it becomes clear that you
+need to have certain conditions in order to make the manual uploading
+and initializing of the driver files succeed. The two rpcclient
+subcommands (<b class="command">adddriver</b> and
+<b class="command">setdriver</b>) need to encounter the following
+pre-conditions to complete successfully:
+</p><div class="itemizedlist"><ul type="disc"><li><p>you are connected as "printer admin", or root (note,
+that this is <span class="emphasis"><em>not</em></span> the "Printer Operators" group in
+NT, but the <span class="emphasis"><em>printer admin</em></span> group, as defined in
+the <i class="parameter"><tt>[global]</tt></i> section of
+<tt class="filename">smb.conf</tt>);</p></li><li><p>copy all required driver files to
+<tt class="filename">\\sambaserver\print$\w32x86</tt> and
+<tt class="filename">\\sambaserver\print$\win40</tt> as appropriate. They
+will end up in the "0" respective "2" subdirectories later -- for now
+<span class="emphasis"><em>don't</em></span> put them there, they'll be automatically
+used by the <b class="command">adddriver</b> subcommand.! (if you use
+"smbclient" to put the driver files into the share, note that you need
+to escape the "$": <b class="command">smbclient //sambaserver/print\$ -U
+root</b>);</p></li><li><p>the user you're connecting as must be able to write to
+the <i class="parameter"><tt>[print$]</tt></i> share and create
+subdirectories;</p></li><li><p>the printer you are going to setup for the Windows
+clients, needs to be installed in CUPS already;</p></li><li><p>the CUPS printer must be known to Samba, otherwise the
+<b class="command">setdriver</b> subcommand fails with an
+NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by
+Samba you may use the <b class="command">enumprinters</b> subcommand to
+rpcclient. A long-standing bug prevented a proper update of the
+printer list until every smbd process had received a SIGHUP or was
+restarted. Remember this in case you've created the CUPS printer just
+shortly ago and encounter problems: try restarting
+Samba.</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2969609"></a>Manual Commandline Driver Installation in 15 little Steps</h3></div></div><div></div></div><p>
+We are going to install a printer driver now by manually executing all
+required commands. As this may seem a rather complicated process at
+first, we go through the procedure step by step, explaining every
+single action item as it comes up.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2969625"></a>First Step: Install the Printer on CUPS</h4></div></div><div></div></div><pre class="screen">
+
+# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P /home/kurt/canonIR85.ppd
+
+</pre><p>
+This installs printer with the name <span class="emphasis"><em>mysmbtstprn</em></span>
+to the CUPS system. The printer is accessed via a socket
+(a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root
+for this step
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2969656"></a>Second Step (optional): Check if the Printer is recognized by
+Samba</h4></div></div><div></div></div><pre class="screen">
+
+ # rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn
+
+ flags:[0x800000]
+ name:[\\kde-bitshop\mysmbtstprn]
+ description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
+ comment:[mysmbtstprn]
+
+</pre><p>
+This should show the printer in the list. If not, stop and re-start
+the Samba daemon (smbd), or send a HUP signal: <b class="command">kill -HUP
+`pidof smbd`</b>. Check again. Troubleshoot and repeat until
+success. Note the "empty" field between the two commas in the
+"description" line. Here would the driver name appear if there was one
+already. You need to know root's Samba password (as set by the
+<b class="command">smbpasswd</b> command) for this step and most of the
+following steps. Alternatively you can authenticate as one of the
+users from the "write list" as defined in <tt class="filename">smb.conf</tt> for
+<i class="parameter"><tt>[print$]</tt></i>.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2969719"></a>Third Step (optional): Check if Samba knows a Driver for the
+Printer</h4></div></div><div></div></div><pre class="screen">
+
+# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
+ drivername:[]
+
+# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
+ servername:[\\kde-bitshop]
+ printername:[\\kde-bitshop\mysmbtstprn]
+ sharename:[mysmbtstprn]
+ portname:[Samba Printer Port]
+ drivername:[]
+ comment:[mysmbtstprn]
+ location:[]
+ sepfile:[]
+ printprocessor:[winprint]
+
+# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+ result was WERR_UNKNOWN_PRINTER_DRIVER
+
+</pre><p>
+Neither method of the three commands shown above should show a driver.
+This step was done for the purpose of demonstrating this condition. An
+attempt to connect to the printer at this stage will prompt the
+message along the lines: "The server has not the required printer
+driver installed".
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2969757"></a>Fourth Step: Put all required Driver Files into Samba's
+[print$]</h4></div></div><div></div></div><pre class="screen">
+
+# smbclient //localhost/print\$ -U 'root%xxxx' \
+ -c 'cd W32X86; \
+ put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD; \
+ put /usr/share/cups/drivers/cupsui.dll cupsui.dll; \
+ put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
+ put /usr/share/cups/drivers/cups.hlp cups.hlp'
+
+</pre><p>
+(Note that this command should be entered in one long single
+line. Line-breaks and the line-end indicating "\" has been inserted
+for readability reasons.) This step is <span class="emphasis"><em>required</em></span>
+for the next one to succeed. It makes the driver files physically
+present in the <i class="parameter"><tt>[print$]</tt></i> share. However, clients
+would still not be able to install them, because Samba does not yet
+treat them as driver files. A client asking for the driver would still
+be presented with a "not installed here" message.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2969808"></a>Fifth Step: Verify where the Driver Files are now</h4></div></div><div></div></div><pre class="screen">
+
+# ls -l /etc/samba/drivers/W32X86/
+ total 669
+ drwxr-sr-x 2 root ntadmin 532 May 25 23:08 2
+ drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3
+ -rwxr--r-- 1 root ntadmin 14234 May 25 23:21 cups.hlp
+ -rwxr--r-- 1 root ntadmin 278380 May 25 23:21 cupsdrvr.dll
+ -rwxr--r-- 1 root ntadmin 215848 May 25 23:21 cupsui.dll
+ -rwxr--r-- 1 root ntadmin 169458 May 25 23:21 mysmbtstprn.PPD
+
+</pre><p>
+The driver files now are in the W32X86 architecture "root" of
+<i class="parameter"><tt>[print$]</tt></i>.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2969846"></a>Sixth Step: Tell Samba that these are
+<span class="emphasis"><em>Driver</em></span> Files
+(<b class="command">adddriver</b>)</h4></div></div><div></div></div><pre class="screen">
+
+# rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \
+ cupsdrvr.dll:mysmbtstprn.PPD: \
+ cupsui.dll:cups.hlp:NULL:RAW[<span class="citation">:</span>]NULL" \
+ localhost
+
+ Printer Driver mydrivername successfully installed.
+
+</pre><p>
+Note that your cannot repeat this step if it fails. It could fail even
+as a result of a simple typo. It will most likely have moved a part of
+the driver files into the "2" subdirectory. If this step fails, you
+need to go back to the fourth step and repeat it, before you can try
+this one again. In this step you need to choose a name for your
+driver. It is normally a good idea to use the same name as is used for
+the printername; however, in big installations you may use this driver
+for a number of printers which have obviously different names. So the
+name of the driver is not fixed.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2969900"></a>Seventh Step: Verify where the Driver Files are now</h4></div></div><div></div></div><pre class="screen">
+
+# ls -l /etc/samba/drivers/W32X86/
+ total 1
+ drwxr-sr-x 2 root ntadmin 532 May 25 23:22 2
+ drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3
+
+
+# ls -l /etc/samba/drivers/W32X86/2
+ total 5039
+ [....]
+ -rwxr--r-- 1 root ntadmin 14234 May 25 23:21 cups.hlp
+ -rwxr--r-- 1 root ntadmin 278380 May 13 13:53 cupsdrvr.dll
+ -rwxr--r-- 1 root ntadmin 215848 May 13 13:53 cupsui.dll
+ -rwxr--r-- 1 root ntadmin 169458 May 25 23:21 mysmbtstprn.PPD
+
+</pre><p>
+Notice how step 6 did also move the driver files to the appropriate
+subdirectory. Compare with the situation after step 5.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2969934"></a>Eighth Step (optional): Verify if Samba now recognizes the
+Driver</h4></div></div><div></div></div><pre class="screen">
+
+# rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost | grep -B2 -A5 mydrivername
+
+ Printer Driver Info 3:
+ Version: [2]
+ Driver Name: [mydrivername]
+ Architecture: [Windows NT x86]
+ Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+ Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+ Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+ Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
+
+</pre><p>
+Remember, this command greps for the name you did choose for the
+driver in step Six. This command must succeed before you can proceed.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2969967"></a>Ninth Step: Tell Samba which Printer should use these Driver
+Files (<b class="command">setdriver</b>)</h4></div></div><div></div></div><pre class="screen">
+
+# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
+
+ Successfully set mysmbtstprn to driver mydrivername
+
+</pre><p>
+Since you can bind any printername (=printqueue) to any driver, this
+is a very convenient way to setup many queues which use the same
+driver. You don't need to repeat all the previous steps for the
+setdriver command to succeed. The only pre-conditions are:
+<b class="command">enumdrivers</b> must find the driver and
+<b class="command">enumprinters</b> must find the printer.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2970017"></a>Tenth Step (optional): Verify if Samba has this Association
+recognized</h4></div></div><div></div></div><pre class="screen">
+
+# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
+ drivername:[mydrivername]
+
+# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
+ servername:[\\kde-bitshop]
+ printername:[\\kde-bitshop\mysmbtstprn]
+ sharename:[mysmbtstprn]
+ portname:[Done]
+ drivername:[mydrivername]
+ comment:[mysmbtstprn]
+ location:[]
+ sepfile:[]
+ printprocessor:[winprint]
+
+# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+ [Windows NT x86]
+ Printer Driver Info 3:
+ Version: [2]
+ Driver Name: [mydrivername]
+ Architecture: [Windows NT x86]
+ Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+ Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+ Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+ Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
+ Monitorname: []
+ Defaultdatatype: [RAW]
+ Monitorname: []
+ Defaultdatatype: [RAW]
+
+# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn
+ name:[\\kde-bitshop\mysmbtstprn]
+ description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
+ comment:[mysmbtstprn]
+
+</pre><p>
+Compare these results with the ones from steps 2 and 3. Note that
+every single of these commands show the driver is installed. Even
+the <b class="command">enumprinters</b> command now lists the driver
+on the "description" line.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2970073"></a>Eleventh Step (optional): Tickle the Driver into a correct
+Device Mode</h4></div></div><div></div></div><p>
+You certainly know how to install the driver on the client. In case
+you are not particularly familiar with Windows, here is a short
+recipe: browse the Network Neighbourhood, go to the Samba server, look
+for the shares. You should see all shared Samba printers.
+Double-click on the one in question. The driver should get
+installed, and the network connection set up. An alternative way is to
+open the "Printers (and Faxes)" folder, right-click on the printer in
+question and select "Connect" or "Install". As a result, a new printer
+should have appeared in your client's local "Printers (and Faxes)"
+folder, named something like "printersharename on Sambahostname".
+</p><p>
+It is important that you execute this step as a Samba printer admin
+(as defined in <tt class="filename">smb.conf</tt>). Here is another method
+to do this on Windows XP. It uses a commandline, which you may type
+into the "DOS box" (type root's smbpassword when prompted):
+</p><pre class="screen">
+
+ C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n \\sambacupsserver\mysmbtstprn"
+
+</pre><p>
+Change any printer setting once (like <span class="emphasis"><em>"portrait"
+--> "landscape"</em></span>), click "Apply"; change the setting
+back.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2970135"></a>Twelveth Step: Install the Printer on a Client
+("Point'n'Print")</h4></div></div><div></div></div><pre class="screen">
+
+ C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
+
+</pre><p>
+If it doesn't work it could be a permission problem with the
+<i class="parameter"><tt>[print$]</tt></i> share.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2970166"></a>Thirteenth Step (optional): Print a Test Page</h4></div></div><div></div></div><pre class="screen">
+
+ C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"
+
+</pre><p>
+Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again
+and march to the printer.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2970191"></a>Fourteenth Step (recommended): Study the Test Page</h4></div></div><div></div></div><p>
+Hmmm.... just kidding! By now you know everything about printer
+installations and you don't need to read a word. Just put it in a
+frame and bolt it to the wall with the heading "MY FIRST
+RPCCLIENT-INSTALLED PRINTER" - why not just throw it away!
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2970208"></a>Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your
+Success</h4></div></div><div></div></div><pre class="screen">
+
+# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd
+
+</pre></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2970229"></a>Troubleshooting revisited</h3></div></div><div></div></div><p>
+The setdriver command will fail, if in Samba's mind the queue is not
+already there. You had promising messages about the:
+</p><pre class="screen">
+
+ Printer Driver ABC successfully installed.
+
+</pre><p>
+after the "adddriver" parts of the procedure? But you are also seeing
+a disappointing message like this one beneath?
+</p><pre class="screen">
+
+ result was NT_STATUS_UNSUCCESSFUL
+
+</pre><p>
+It is not good enough that <span class="emphasis"><em>you</em></span>
+can see the queue <span class="emphasis"><em>in CUPS</em></span>, using
+the <b class="command">lpstat -p ir85wm</b> command. A
+bug in most recent versions of Samba prevents the proper update of
+the queuelist. The recognition of newly installed CUPS printers
+fails unless you re-start Samba or send a HUP to all smbd
+processes. To verify if this is the reason why Samba doesn't
+execute the setdriver command successfully, check if Samba "sees"
+the printer:
+</p><pre class="screen">
+
+# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep ir85wm
+ printername:[ir85wm]
+
+</pre><p>
+An alternative command could be this:
+</p><pre class="screen">
+
+# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm'
+ cmd = getprinter ir85wm
+ flags:[0x800000]
+ name:[\\transmeta\ir85wm]
+ description:[\\transmeta\ir85wm,ir85wm,DPD]
+ comment:[CUPS PostScript-Treiber for WinNT/2K/XP]
+
+</pre><p>
+BTW, you can use these commands, plus a few more, of course,
+to install drivers on remote Windows NT print servers too!
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2970331"></a>The printing <tt class="filename">*.tdb</tt> Files</h2></div></div><div></div></div><p>
+Some mystery is associated with the series of files with a
+tdb-suffix appearing in every Samba installation. They are
+<tt class="filename">connections.tdb</tt>,
+<tt class="filename">printing.tdb</tt>,
+<tt class="filename">share_info.tdb</tt> ,
+<tt class="filename">ntdrivers.tdb</tt>,
+<tt class="filename">unexpected.tdb</tt>,
+<tt class="filename">brlock.tdb</tt> ,
+<tt class="filename">locking.tdb</tt>,
+<tt class="filename">ntforms.tdb</tt>,
+<tt class="filename">messages.tdb</tt> ,
+<tt class="filename">ntprinters.tdb</tt>,
+<tt class="filename">sessionid.tdb</tt> and
+<tt class="filename">secrets.tdb</tt>. What is their purpose?
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2970434"></a>Trivial DataBase Files</h3></div></div><div></div></div><p>
+A Windows NT (Print) Server keeps track of all information needed to serve
+its duty toward its clients by storing entries in the Windows
+"Registry". Client queries are answered by reading from the registry,
+Administrator or user configuration settings are saved by writing into
+the Registry. Samba and Unix obviously don't have such a kind of
+Registry. Samba instead keeps track of all client related information in a
+series of <tt class="filename">*.tdb</tt> files. (TDB = Trivial Data
+Base). These are often located in <tt class="filename">/var/lib/samba/</tt>
+or <tt class="filename">/var/lock/samba/</tt> . The printing related files
+are <tt class="filename">ntprinters.tdb</tt>,
+<tt class="filename">printing.tdb</tt>,<tt class="filename">ntforms.tdb</tt> and
+<tt class="filename">ntdrivers.tdb</tt>.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2970504"></a>Binary Format</h3></div></div><div></div></div><p>
+<tt class="filename">*.tdb</tt> files are not human readable. They are
+written in a binary format. "Why not ASCII?", you may ask. "After all,
+ASCII configuration files are a good and proofed tradition on UNIX."
+-- The reason for this design decision by the Samba Team is mainly
+performance. Samba needs to be fast; it runs a separate
+<b class="command">smbd</b> process for each client connection, in some
+environments many thousand of them. Some of these smbds might need to
+write-access the same <tt class="filename">*.tdb</tt> file <span class="emphasis"><em>at the
+same time</em></span>. The file format of Samba's
+<tt class="filename">*.tdb</tt> files allows for this provision. Many smbd
+processes may write to the same <tt class="filename">*.tdb</tt> file at the
+same time. This wouldn't be possible with pure ASCII files.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2970566"></a>Losing <tt class="filename">*.tdb</tt> Files</h3></div></div><div></div></div><p>
+It is very important that all <tt class="filename">*.tdb</tt> files remain
+consistent over all write and read accesses. However, it may happen
+that these files <span class="emphasis"><em>do</em></span> get corrupted. (A
+<b class="command">kill -9 `pidof smbd`</b> while a write access is in
+progress could do the damage as well as a power interruption,
+etc.). In cases of trouble, a deletion of the old printing-related
+<tt class="filename">*.tdb</tt> files may be the only option. You need to
+re-create all print related setup after that. Or you have made a
+backup of the <tt class="filename">*.tdb</tt> files in time.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2970624"></a>Using <span class="emphasis"><em>tdbbackup</em></span></h3></div></div><div></div></div><p>
+Samba ships with a little utility which helps the root user of your
+system to back up your <tt class="filename">*.tdb</tt> files. If you run it
+with no argument, it prints a little usage message:
+</p><pre class="screen">
+
+# tdbbackup
+ Usage: tdbbackup [options] <fname...>
+
+ Version:3.0a
+ -h this help message
+ -s suffix set the backup suffix
+ -v veryify mode (restore if corrupt)
+
+</pre><p>
+Here is how I backed up my printing.tdb file:
+</p><pre class="screen">
+
+# ls
+ . browse.dat locking.tdb ntdrivers.tdb printing.tdb share_info.tdb
+ .. connections.tdb messages.tdb ntforms.tdb printing.tdbkp unexpected.tdb
+ brlock.tdb gmon.out namelist.debug ntprinters.tdb sessionid.tdb
+
+ kde-bitshop:/var/lock/samba # tdbbackup -s .bak printing.tdb
+ printing.tdb : 135 records
+
+ kde-bitshop:/var/lock/samba # ls -l printing.tdb*
+ -rw------- 1 root root 40960 May 2 03:44 printing.tdb
+ -rw------- 1 root root 40960 May 2 03:44 printing.tdb.bak
+
+</pre></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2970686"></a>CUPS Print Drivers from Linuxprinting.org</h2></div></div><div></div></div><p>
+CUPS ships with good support for HP LaserJet type printers. You can
+install the generic driver as follows:
+</p><pre class="screen">
+
+lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
+
+</pre><p>
+The <i class="parameter"><tt>-m</tt></i> switch will retrieve the
+<tt class="filename">laserjet.ppd</tt> from the standard repository for
+not-yet-installed-PPDs, which CUPS typically stores in
+<tt class="filename">/usr/share/cups/model</tt>. Alternatively, you may use
+<i class="parameter"><tt>-P /path/to/your.ppd</tt></i>.
+</p><p>
+The generic laserjet.ppd however does not support every special option
+for every LaserJet-compatible model. It constitutes a sort of "least
+denominator" of all the models. If for some reason it is ruled out to
+you to pay for the commercially available ESP Print Pro drivers, your
+first move should be to consult the database on <a href="http://www.linuxprinting.org/printer_list.cgi" target="_top">http://www.linuxprinting.org/printer_list.cgi</a>.
+Linuxprinting.org has excellent recommendations about which driver is
+best used for each printer. Its database is kept current by the
+tireless work of Till Kamppeter from MandrakeSoft, who is also the
+principal author of the foomatic-rip utility.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The former "cupsomatic" concept is now be replaced by the new, much
+more powerful "foomatic-rip". foomatic-rip is the successor of
+cupsomatic. cupsomatic is no longer maintained. Here is the new URL
+to the Foomatic-3.0 database:<a href="http://www.linuxprinting.org/driver_list.cgi" target="_top">http://www.linuxprinting.org/driver_list.cgi</a>.
+If you upgrade to foomatic-rip, don't forget to also upgrade to the
+new-style PPDs for your foomatic-driven printers. foomatic-rip will
+not work with PPDs generated for the old cupsomatic. The new-style
+PPDs are 100% compliant to the Adobe PPD specification. They are
+intended to be used by Samba and the cupsaddsmb utility also, to
+provide the driver files for the Windows clients also!
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2970793"></a>foomatic-rip and Foomatic explained</h3></div></div><div></div></div><p>
+Nowadays most Linux distros rely on the utilities of Linuxprinting.org
+to create their printing related software (which, BTW, works on all
+UNIXes and on Mac OS X or Darwin too). It is not known as well as it
+should be, that it also has a very end-user friendly interface which
+allows for an easy update of drivers and PPDs, for all supported
+models, all spoolers, all operatings systems and all package formats
+(because there is none). Its history goes back a few years.
+</p><p>
+Recently Foomatic has achieved the astonishing milestone of <a href="http://www.linuxprinting.org/printer_list.cgi?make=Anyone" target="_top">1000
+listed</a> printer models. Linuxprinting.org keeps all the
+important facts about printer drivers, supported models and which
+options are available for the various driver/printer combinations in
+its <a href="http://www.linuxprinting.org/foomatic.html" target="_top">Foomatic</a>
+database. Currently there are <a href="http://www.linuxprinting.org/driver_list.cgi" target="_top">245 drivers</a>
+in the database: many drivers support various models, and many models
+may be driven by different drivers; it's your choice!
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2970847"></a>690 "perfect" Printers</h4></div></div><div></div></div><p>
+At present there are 690 devices dubbed as working "perfectly", 181
+"mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind
+that most of these are non-PostScript models (PostScript printers are
+automatically supported supported by CUPS to perfection, by using
+their own manufacturer-provided Windows-PPD...), and that a
+multifunctional device never qualifies as working "perfectly" if it
+doesn't also scan and copy and fax under GNU/Linux: then this is a
+truely astonishing achievement. Three years ago the number was not
+more than 500, and Linux or UNIX "printing" at the time wasn't
+anywhere near the quality it is today!
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2970872"></a>How the "Printing HOWTO" started it all</h4></div></div><div></div></div><p>
+A few years ago <a href="http://www2.picante.com:81/~gtaylor/" target="_top">Grant Taylor</a>
+started it all. The roots of today's Linuxprinting.org are in the
+first <a href="http://www.linuxprinting.org/foomatic2.9/howto/" target="_top">Linux Printing
+HOWTO</a> which he authored. As a side-project to this document,
+which served many Linux users and admins to guide their first steps in
+this complicated and delicate setup (to a scientist, printing is
+"applying a structured deposition of distinct patterns of ink or toner
+particles on paper substrates" <span class="emphasis"><em>;-)</em></span>, he started to
+build in a little Postgres database with information about the
+hardware and driver zoo that made up Linux printing of the time. This
+database became the core component of today's Foomatic collection of
+tools and data. In the meantime it has moved to an XML representation
+of the data.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2970918"></a>Foomatic's strange Name</h4></div></div><div></div></div><p>
+"Why the funny name?", you ask. When it really took off, around spring
+2000, CUPS was far less popular than today, and most systems used LPD,
+LPRng or even PDQ to print. CUPS shipped with a few generic "drivers"
+(good for a few hundred different printer models). These didn't
+support many device-specific options. CUPS also shipped with its own
+built-in rasterization filter ("pstoraster", derived from
+Ghostscript). On the other hand, CUPS provided brilliant support for
+<span class="emphasis"><em>controlling</em></span> all printer options through
+standardized and well-defined "PPD files" (PostScript Printers
+Description files). Plus, CUPS was designed to be easily extensible.
+</p><p>
+Grant already had in his database a respectable compilation
+of facts about a many more printers, and the Ghostscript "drivers"
+they run with. His idea, to generate PPDs from the database info
+and use them to make standard Ghostscript filters work within CUPS,
+proved to work very well. It also "killed several birds with one
+stone":
+</p><div class="itemizedlist"><ul type="disc"><li><p>It made all current and future Ghostscript filter
+developments available for CUPS;</p></li><li><p>It made available a lot of additional printer models
+to CUPS users (because often the "traditional" Ghostscript way of
+printing was the only one available);</p></li><li><p>It gave all the advanced CUPS options (web interface,
+GUI driver configurations) to users wanting (or needing) to use
+Ghostscript filters.</p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2970984"></a>cupsomatic, pdqomatic, lpdomatic, directomatic</h4></div></div><div></div></div><p>
+CUPS worked through a quickly-hacked up filter script named <a href="http://www.linuxprinting.org/download.cgi?filename=cupsomatic&show=0" target="_top">cupsomatic</a>.
+cupsomatic ran the printfile through Ghostscript, constructing
+automatically the rather complicated command line needed. It just
+required to be copied into the CUPS system to make it work. To
+"configure" the way cupsomatic controls the Ghostscript rendering
+process, it needs a CUPS-PPD. This PPD is generated directly from the
+contents of the database. For CUPS and the respective printer/filter
+combo another Perl script named "CUPS-O-Matic" did the PPD
+generation. After that was working, Grant implemented within a few
+days a similar thing for two other spoolers. Names chosen for the
+config-generator scripts were <a href="http://www.linuxprinting.org/download.cgi?filename=lpdomatic&show=0" target="_top">PDQ-O-Matic</a>
+(for PDQ) and <a href="http://www.linuxprinting.org/download.cgi?filename=lpdomatic&show=0" target="_top">LPD-O-Matic</a>
+(for - you guessed it - LPD); the configuration here didn't use PPDs
+but other spooler-specific files.
+</p><p>
+From late summer of that year, <a href="http://www.linuxprinting.org/till/" target="_top">Till Kamppeter</a>
+started to put work into the database. Till had been newly employed by
+<a href="http://www.mandrakesoft.com/" target="_top">MandrakeSoft</a> to
+convert their printing system over to CUPS, after they had seen his
+<a href="http://www.fltk.org/" target="_top">FLTK</a>-based <a href="http://cups.sourceforge.net/xpp/" target="_top">XPP</a> (a GUI frontend to
+the CUPS lp-command). He added a huge amount of new information and new
+printers. He also developed the support for other spoolers, like
+<a href="http://ppr.sourceforge.net/" target="_top">PPR</a> (via ppromatic),
+<a href="http://sourceforge.net/projects/lpr/" target="_top">GNUlpr</a> and
+<a href="http://www.lprng.org/" target="_top">LPRng</a> (both via an extended
+lpdomatic) and "spoolerless" printing (<a href="http://www.linuxprinting.org/download.cgi?filename=directomatic&show=0" target="_top">directomatic</a>)....
+</p><p>
+So, to answer your question: "Foomatic" is the general name for all
+the overlapping code and data behind the "*omatic" scripts.... --
+Foomatic up to versions 2.0.x required (ugly) Perl data structures
+attached the Linuxprinting.org PPDs for CUPS. It had a different
+"*omatic" script for every spooler, as well as different printer
+configuration files..
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2971117"></a>7.13.1.5.The <span class="emphasis"><em>Grand Unification</em></span>
+achieved...</h4></div></div><div></div></div><p>
+This all has changed in Foomatic versions 2.9 (Beta) and released as
+"stable" 3.0. This has now achieved the convergence of all *omatic
+scripts: it is called the <a href="http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0" target="_top">foomatic-rip</a>.
+This single script is the unification of the previously different
+spooler-specific *omatic scripts. foomatic-rip is used by all the
+different spoolers alike. Because foomatic-rip can read PPDs (both the
+original PostScript printer PPDs and the Linuxprinting.org-generated
+ones), all of a sudden all supported spoolers can have the power of
+PPDs at their disposal; users only need to plug "foomatic-rip" into
+their system.... For users there is improved media type and source
+support; paper sizes and trays are easier to configure.
+</p><p>
+Also, the New Generation of Linuxprinting.org PPDs doesn't contain
+Perl data structures any more. If you are a distro maintainer and have
+used the previous version of Foomatic, you may want to give the new
+one a spin: but don't forget to generate a new-version set of PPDs,
+via the new <a href="http://www.linuxprinting.org/download/foomatic/foomatic-db-engine-3.0.0beta1.tar.gz" target="_top">foomatic-db-engine</a>!
+Individual users just need to generate a single new PPD specific to
+their model by <a href="http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/II.Foomatic-User/II.tutorial-handout-foomatic-user.html" target="_top">following
+the steps</a> outlined in the Foomatic tutorial or further
+below. This new development is truly amazing.
+</p><p>
+foomatic-rip is a very clever wrapper around the need to run
+Ghostscript with a different syntax, different options, different
+device selections and/or different filters for each different printer
+or different spooler. At the same time it can read the PPD associated
+with a print queue and modify the print job according to the user
+selections. Together with this comes the 100% compliance of the new
+Foomatic PPDs with the Adobe spec. Some really innovative features of
+the Foomatic concept will surprise users: it will support custom paper
+sizes for many printers; and it will support printing on media drawn
+from different paper trays within the same job (in both cases: even
+where there is no support for this from Windows-based vendor printer
+drivers).
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2971204"></a>Driver Development outside</h4></div></div><div></div></div><p>
+Most driver development itself does not happen within
+Linuxprinting.org. Drivers are written by independent maintainers.
+Linuxprinting.org just pools all the information, and stores it in its
+database. In addition, it also provides the Foomatic glue to integrate
+the many drivers into any modern (or legacy) printing system known to
+the world.
+</p><p>
+Speaking of the different driver development groups: most of
+the work is currently done in three projects. These are:
+</p><div class="itemizedlist"><ul type="disc"><li><p><a href="http://www-124.ibm.com/developerworks/oss/linux/projects/omni/" target="_top">Omni</a>
+-- a Free Software project by IBM which tries to convert their printer
+driver knowledge from good-ol' OS/2 times into a modern, modular,
+universal driver architecture for Linux/Unix (still Beta). This
+currently supports 437 models.</p></li><li><p><a href="http://hpinkjet.sf.net/" target="_top">HPIJS</a> --
+a Free Software project by HP to provide the support for their own
+range of models (very mature, printing in most cases is perfect and
+provides true photo quality). This currently supports 369
+models.</p></li><li><p><a href="http://gimp-print.sf.net/" target="_top">Gimp-Print</a> -- a Free software
+effort, started by Michael Sweet (also lead developer for CUPS), now
+directed by Robert Krawitz, which has achieved an amazing level of
+photo print quality (many Epson users swear that its quality is
+better than the vendor drivers provided by Epson for the Microsoft
+platforms). This currently supports 522 models.</p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2971283"></a>Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and
+commercial Unix</h4></div></div><div></div></div><p>
+Linuxprinting.org today is the one-stop "shop" to download printer
+drivers. Look for printer information and <a href="http://www.linuxprinting.org//kpfeifle/LinuxKongress2002/Tutorial/" target="_top">tutorials</a>
+or solve printing problems in its popular <a href="http://www.linuxprinting.org/newsportal/" target="_top">forums</a>. But
+it's not just for GNU/Linux: users and admins of <a href="http://www.linuxprinting.org/macosx/" target="_top">commercial UNIX
+systems</a> are also going there, and the relatively new <a href="http://www.linuxprinting.org/newsportal/thread.php3?name=linuxprinting.macosx.general" target="_top">Mac
+OS X forum</a> has turned out to be one of the most frequented
+fora after only a few weeks.
+</p><p>
+Linuxprinting.org and the Foomatic driver wrappers around Ghostscript
+are now a standard toolchain for printing on all the important
+distros. Most of them also have CUPS underneath. While in recent years
+most printer data had been added by Till (who works at Mandrake), many
+additional contributions came from engineers with SuSE, RedHat,
+Connectiva, Debian and others. Vendor-neutrality is an important goal
+of the Foomatic project.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Till Kamppeter from MandrakeSoft is doing an excellent job in his
+spare time to maintain Linuxprinting.org and Foomatic. So if you use
+it often, please send him a note showing your appreciation.
+</p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2971356"></a>Foomatic Database generated PPDs</h4></div></div><div></div></div><p>
+The Foomatic database is an amazing piece of ingenuity in itself. Not
+only does it keep the printer and driver information, but it is
+organized in a way that it can generate "PPD" files "on the fly" from
+its internal XML-based datasets. While these PPDs are modelled to the
+Adobe specification of "PostScript Printer Descriptions" (PPDs), the
+Linuxprinting.org/Foomatic-PPDs don't normally drive PostScript
+printers: they are used to describe all the bells and whistles you
+could ring or blow on an Epson Stylus inkjet, or a HP Photosmart or
+what-have-you. The main "trick" is one little additional line, not
+envisaged by the PPD specification, starting with the "*cupsFilter"
+keyword: it tells the CUPS daemon how to proceed with the PostScript
+print file (old-style Foomatic-PPDs named the
+<span class="emphasis"><em>cupsomatic</em></span> filter script, while the new-style
+PPDs now call <span class="emphasis"><em>foomatic-rip</em></span>). This filter
+script calls Ghostscript on the host system (the recommended variant
+is ESP Ghostscript) to do the rendering work. foomatic-rip knows which
+filter or internal device setting it should ask from Ghostscript to
+convert the PostScript printjob into a raster format ready for the
+target device. This usage of PPDs to describe the options of non-PS
+printers was the invention of the CUPS developers. The rest is easy:
+GUI tools (like KDE's marvellous <a href="http://printing.kde.org/overview/kprinter.phtml" target="_top">"kprinter"</a>,
+or the GNOME <a href="http://gtklp.sourceforge.net/" target="_top">"gtklp"</a>, "xpp" and the CUPS
+web interface) read the PPD too and use this information to present
+the available settings to the user as an intuitive menu selection.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2971421"></a>foomatic-rip and Foomatic-PPD Download and Installation</h3></div></div><div></div></div><p>
+Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus"
+compatible printer in CUPS (note that recent distributions of SuSE,
+UnitedLinux and Mandrake may ship with a complete package of
+Foomatic-PPDs plus the foomatic-rip utility. going directly to
+Linuxprinting.org ensures you to get the latest driver/PPD files):
+</p><div class="itemizedlist"><ul type="disc"><li><p>Surf to <a href="http://www.linuxprinting.org/printer_list.cgi" target="_top">http://www.linuxprinting.org/printer_list.cgi</a>
+</p></li><li><p>Check the complete list of printers in the database:
+<a href="http://www.linuxprinting.org/printer_list.cgi?make=Anyone" target="_top">http://www.linuxprinting.org/printer_list.cgi?make=Anyone</a>
+</p></li><li><p>There select your model and click on the
+link.</p></li><li><p>You'll arrive at a page listing all drivers working
+with this model (for all printers, there will always be
+<span class="emphasis"><em>one</em></span> recommended driver. Try this one
+first).</p></li><li><p>In our case ("HP LaserJet 4 Plus"), we'll arrive here:
+<a href="http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus" target="_top">http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus</a>
+</p></li><li><p>The recommended driver is "ljet4".</p></li><li><p>There are several links provided here. You should
+visit them all, if you are not familiar with the Linuxprinting.org
+database.</p></li><li><p>There is a link to the database page for the "ljet4":
+<a href="http://www.linuxprinting.org/show_driver.cgi?driver=ljet4" target="_top">http://www.linuxprinting.org/show_driver.cgi?driver=ljet4</a>
+On the driver's page, you'll find important and detailed information
+about how to use that driver within the various available
+spoolers.</p></li><li><p>Another link may lead you to the homepage of the
+driver author or the driver.</p></li><li><p>Important links are the ones which provide hints with
+setup instructions for CUPS (<a href="http://www.linuxprinting.org/cups-doc.html" target="_top">http://www.linuxprinting.org/cups-doc.html</a>),
+PDQ (<a href="http://www.linuxprinting.org/pdq-doc.html" target="_top">http://www.linuxprinting.org/pdq-doc.html</a>),
+LPD, LPRng and GNUlpr (<a href="http://www.linuxprinting.org/lpd-doc.html" target="_top">http://www.linuxprinting.org/lpd-doc.html</a>)
+as well as PPR (<a href="http://www.linuxprinting.org/ppr-doc.html" target="_top">http://www.linuxprinting.org/ppr-doc.html)</a>
+or "spooler-less" printing (<a href="http://www.linuxprinting.org/direct-doc.html" target="_top">http://www.linuxprinting.org/direct-doc.html</a>
+).</p></li><li><p>You can view the PPD in your browser through this
+link: <a href="http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1" target="_top">http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1</a>
+</p></li><li><p>You can also (most importantly)
+generate and download the PPD: <a href="http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0" target="_top">http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0</a>
+</p></li><li><p>The PPD contains all the information needed to use our
+model and the driver; this is, once installed, working transparently
+for the user. Later you'll only need to choose resolution, paper size
+etc. from the web-based menu, or from the print dialog GUI, or from
+the commandline.</p></li><li><p>Should you have ended up on the driver's page (<a href="http://www.linuxprinting.org/show_driver.cgi?driver=ljet4" target="_top">http://www.linuxprinting.org/show_driver.cgi?driver=ljet4</a>),
+you can choose to use the "PPD-O-Matic" online PPD generator
+program.</p></li><li><p>Select the exact model and check either "download" or
+"display PPD file" and click on "Generate PPD file".</p></li><li><p>If you save the PPD file from the browser view, please
+don't use "cut'n'past" (since it could possibly damage line endings
+and tabs, which makes the PPD likely to fail its duty), but use "Save
+as..." in your browser's menu. (Best is to use the "download" option
+from the web page directly).</p></li><li><p>Another very interesting part on each driver page is
+the <span class="emphasis"><em>Show execution details</em></span> button. If you
+select your printer model and click that button, you will get
+displayed a complete Ghostscript command line, enumerating all options
+available for that driver/printermodel combo. This is a great way to
+"Learn Ghostscript By Doing". It is also an excellent "cheat sheet"
+for all experienced users who need to re-construct a good command line
+for that damn printing script, but can't remember the exact
+syntax. ;-)</p></li><li><p>Some time during your visit to Linuxprinting.org, save
+the PPD to a suitable place on your harddisk, say
+<tt class="filename">/path/to/my-printer.ppd</tt> (if you prefer to install
+your printers with the help of the CUPS web interface, save the PPD to
+the <tt class="filename">/usr/share/cups/model/</tt> path and re-start
+cupsd).</p></li><li><p>Then install the printer with a suitable commandline,
+e.g.:
+</p><pre class="screen">
+
+lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd
+
+</pre></li><li><p>Note again this: for all the new-style "Foomatic-PPDs"
+from Linuxprinting.org, you also need a special "CUPS filter" named
+"foomatic-rip".Get the latest version of "foomatic-rip" from: <a href="http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0" target="_top">http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0</a>
+</p></li><li><p>The foomatic-rip Perlscript itself also makes some
+interesting reading (<a href="http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1" target="_top">http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1</a>),
+because it is very well documented by Till's inline comments (even
+non-Perl hackers will learn quite a bit about printing by reading
+it... ;-)</p></li><li><p>Save foomatic-rip either directly in
+<tt class="filename">/usr/lib/cups/filter/foomatic-rip</tt> or somewhere in
+your $PATH (and don't forget to make it world-executable). Again,
+don't save by "copy'n'paste" but use the appropriate link, or the
+"Save as..." menu item in your browser.</p></li><li><p>If you save foomatic-rip in your $PATH, create a symlink:
+<b class="command">cd /usr/lib/cups/filter/ ; ln -s `which
+foomatic-rip`</b>. For CUPS to discover this new
+available filter at startup, you need to re-start
+cupsd.</p></li></ul></div><p>
+Once you print to a printqueue set up with the Foomatic-PPD, CUPS will
+insert the appropriate commands and comments into the resulting
+PostScript jobfile. foomatic-rip is able to read and act upon
+these. foomatic-rip uses some specially encoded Foomatic comments,
+embedded in the jobfile. These in turn are used to construct
+(transparently for you, the user) the complicated ghostscript command
+line telling for the printer driver how exactly the resulting raster
+data should look like and which printer commands to embed into the
+data stream.
+</p><p>
+You need:
+</p><div class="itemizedlist"><ul type="disc"><li><p>A "foomatic+something" PPD -- but it this not enough
+to print with CUPS (it is only <span class="emphasis"><em>one</em></span> important
+component)</p></li><li><p>The "foomatic-rip" filter script (Perl) in
+/usr/lib/cups/filters/</p></li><li><p>Perl to make foomatic-rip run</p></li><li><p>Ghostscript (because it is doing the main work,
+controlled by the PPD/foomatic-rip combo) to produce the raster data
+fit for your printermodel's consumption</p></li><li><p>Ghostscript <span class="emphasis"><em>must</em></span> (depending on
+the driver/model) contain support for a certain "device", representing
+the selected "driver" for your model (as shown by "gs
+-h")</p></li><li><p>foomatic-rip needs a new version of PPDs (PPD versions
+produced for cupsomatic don't work with
+foomatic-rip).</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2971878"></a>Page Accounting with CUPS</h2></div></div><div></div></div><p>
+Often there are questions regarding "print quotas" wherein Samba users
+(that is, Windows clients) should not be able to print beyond a
+certain amount of pages or data volume per day, week or month. This
+feature is dependent on the real print subsystem you're using.
+Samba's part is always to receive the job files from the clients
+(filtered <span class="emphasis"><em>or</em></span> unfiltered) and hand it over to this
+printing subsystem.
+</p><p>
+Of course one could "hack" things with one's own scripts. But then
+there is CUPS. CUPS supports "quotas" which can be based on sizes of
+jobs or on the number of pages or both, and are spanning any time
+period you want.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2971910"></a>Setting up Quotas</h3></div></div><div></div></div><p>
+This is an example command how root would set a print quota in CUPS,
+assuming an existing printer named "quotaprinter":
+</p><pre class="screen">
+
+ lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100
+
+</pre><p>
+This would limit every single user to print 100 pages or 1024 KB of
+data (whichever comes first) within the last 604,800 seconds ( = 1
+week).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2971941"></a>Correct and incorrect Accounting</h3></div></div><div></div></div><p>
+For CUPS to count correctly, the printfile needs to pass the CUPS
+"pstops" filter, otherwise it uses a "dummy" count of "1". Some
+printfiles don't pass it (eg: image files) but then those are mostly 1
+page jobs anyway. This also means that proprietary drivers for the
+target printer running on the client computers and CUPS/Samba, which
+then spool these files as "raw" (i.e. leaving them untouched, not
+filtering them), will be counted as "1-pagers" too!
+</p><p>
+You need to send PostScript from the clients (i.e. run a PostScript
+driver there) to have the chance to get accounting done. If the
+printer is a non-PostScript model, you need to let CUPS do the job to
+convert the file to a print-ready format for the target printer. This
+will be working for currently about 1,000 different printer models,
+see <a href="http://www.linuxprinting.org/printer_list.cgi" target="_top">http://www.linuxprinting.org/printer_list.cgi</a>).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2971982"></a>Adobe and CUPS PostScript Drivers for Windows Clients</h3></div></div><div></div></div><p>
+Before CUPS-1.1.16 your only option was to use the Adobe PostScript
+Driver on the Windows clients. The output of this driver was not
+always passed through the "pstops" filter on the CUPS/Samba side, and
+therefore was not counted correctly (the reason is that it often,
+depending on the "PPD" being used, wrote a "PJL"-header in front of
+the real PostScript which caused CUPS to skip pstops and go directly
+to the "pstoraster" stage).
+</p><p>
+From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for
+Windows NT/2K/XP clients" (which is tagged in the download area of
+http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does
+<span class="emphasis"><em>not</em></span> work for Win9x/ME clients. But it guarantees:
+</p><div class="itemizedlist"><ul type="disc"><li><p>to not write an PJL-header</p></li><li><p>to still read and support all PJL-options named in the
+driver PPD with its own means</p></li><li><p> that the file will pass through the "pstops" filter
+on the CUPS/Samba server</p></li><li><p>to page-count correctly the
+printfile</p></li></ul></div><p>
+You can read more about the setup of this combination in the manpage
+for "cupsaddsmb" (which is only present with CUPS installed, and only
+current from CUPS 1.1.16).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972054"></a>The page_log File Syntax</h3></div></div><div></div></div><p>
+These are the items CUPS logs in the "page_log" for every
+single <span class="emphasis"><em>page</em></span> of a job:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Printer name</p></li><li><p>User name</p></li><li><p>Job ID</p></li><li><p>Time of printing</p></li><li><p>the page number</p></li><li><p>the number of copies</p></li><li><p>a billing information string
+(optional)</p></li><li><p>the host which sent the job (included since version
+1.1.19)</p></li></ul></div><p>
+Here is an extract of my CUPS server's page_log file to illustrate the
+format and included items:
+</p><pre class="screen">
+
+ infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
+ infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
+ infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
+ infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
+ DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
+
+</pre><p>
+This was job ID "401", printed on "infotec_IS2027" by user "kurt", a
+64-page job printed in 3 copies and billed to "#marketing", sent
+from IP address 10.160.50.13. The next job had ID "402", was sent by
+user "boss" from IP address 10.160.51.33,printed from one page 440
+copies and is set to be billed to "finance-dep".
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972155"></a>Possible Shortcomings</h3></div></div><div></div></div><p>
+What flaws or shortcomings are there with this quota system?
+</p><div class="itemizedlist"><ul type="disc"><li><p>the ones named above (wrongly logged job in case of
+printer hardware failure, etc.)</p></li><li><p>in reality, CUPS counts the job pages that are being
+processed in <span class="emphasis"><em>software</em></span> (that is, going through the
+"RIP") rather than the physical sheets successfully leaving the
+printing device. Thus if there is a jam while printing the 5th sheet out
+of 1000 and the job is aborted by the printer, the "page count" will
+still show the figure of 1000 for that job</p></li><li><p>all quotas are the same for all users (no flexibility
+to give the boss a higher quota than the clerk) no support for
+groups</p></li><li><p>no means to read out the current balance or the
+"used-up" number of current quota</p></li><li><p>a user having used up 99 sheets of 100 quota will
+still be able to send and print a 1,000 sheet job</p></li><li><p>a user being denied a job because of a filled-up quota
+doesn't get a meaningful error message from CUPS other than
+"client-error-not-possible".</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972226"></a>Future Developments</h3></div></div><div></div></div><p>
+This is the best system currently available, and there are huge
+improvements under development for CUPS 1.2:
+</p><div class="itemizedlist"><ul type="disc"><li><p>page counting will go into the "backends" (these talk
+directly to the printer and will increase the count in sync with the
+actual printing process: thus a jam at the 5th sheet will lead to a
+stop in the counting)</p></li><li><p>quotas will be handled more flexibly</p></li><li><p>probably there will be support for users to inquire
+their "accounts" in advance</p></li><li><p>probably there will be support for some other tools
+around this topic</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972275"></a>Other Accounting Tools</h3></div></div><div></div></div><p>
+PrintAnalyzer, pyKota, printbill, LogReport.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2972290"></a>Additional Material</h2></div></div><div></div></div><p>
+A printer queue with <span class="emphasis"><em>no</em></span> PPD associated to it is a
+"raw" printer and all files will go directly there as received by the
+spooler. The exceptions are file types "application/octet-stream"
+which need "passthrough feature" enabled. "Raw" queues don't do any
+filtering at all, they hand the file directly to the CUPS backend.
+This backend is responsible for the sending of the data to the device
+(as in the "device URI" notation: <tt class="filename">lpd://, socket://,
+smb://, ipp://, http://, parallel:/, serial:/, usb:/</tt> etc.)
+</p><p>
+"cupsomatic"/Foomatic are <span class="emphasis"><em>not</em></span> native CUPS drivers
+and they don't ship with CUPS. They are a Third Party add-on,
+developed at Linuxprinting.org. As such, they are a brilliant hack to
+make all models (driven by Ghostscript drivers/filters in traditional
+spoolers) also work via CUPS, with the same (good or bad!) quality as
+in these other spoolers. "cupsomatic" is only a vehicle to execute a
+ghostscript commandline at that stage in the CUPS filtering chain,
+where "normally" the native CUPS "pstoraster" filter would kick
+in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS
+away and re-directs it to go through Ghostscript. CUPS accepts this,
+because the associated CUPS-O-Matic-/Foomatic-PPD specifies:
+</p><pre class="screen">
+
+ *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic"
+
+</pre><p>
+This line persuades CUPS to hand the file to cupsomatic, once it has
+successfully converted it to the MIME type
+"application/vnd.cups-postscript". This conversion will not happen for
+Jobs arriving from Windows which are auto-typed
+"application/octet-stream", with the according changes in
+<tt class="filename">/etc/cups/mime.types</tt> in place.
+</p><p>
+CUPS is widely configurable and flexible, even regarding its filtering
+mechanism. Another workaround in some situations would be to have in
+<tt class="filename">/etc/cups/mime.types</tt> entries as follows:
+</p><pre class="screen">
+
+ application/postscript application/vnd.cups-raw 0 -
+ application/vnd.cups-postscript application/vnd.cups-raw 0 -
+
+</pre><p>
+This would prevent all Postscript files from being filtered (rather,
+they will through the virtual <span class="emphasis"><em>nullfilter</em></span>
+denoted with "-"). This could only be useful for PS printers. If you
+want to print PS code on non-PS printers (provided they support ASCII
+text printing) an entry as follows could be useful:
+</p><pre class="screen">
+
+ */* application/vnd.cups-raw 0 -
+
+</pre><p>
+and would effectively send <span class="emphasis"><em>all</em></span> files to the
+backend without further processing.
+</p><p>
+Lastly, you could have the following entry:
+</p><pre class="screen">
+
+ application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter
+
+</pre><p>
+You will need to write a <span class="emphasis"><em>my_PJL_stripping_filter</em></span>
+(could be a shellscript) that parses the PostScript and removes the
+unwanted PJL. This would need to conform to CUPS filter design
+(mainly, receive and pass the parameters printername, job-id,
+username, jobtitle, copies, print options and possibly the
+filename). It would be installed as world executable into
+<tt class="filename">/usr/lib/cups/filters/</tt> and will be called by CUPS
+if it encounters a MIME type "application/vnd.cups-postscript".
+</p><p>
+CUPS can handle <span class="emphasis"><em>-o job-hold-until=indefinite</em></span>.
+This keeps the job in the queue "on hold". It will only be printed
+upon manual release by the printer operator. This is a requirement in
+many "central reproduction departments", where a few operators manage
+the jobs of hundreds of users on some big machine, where no user is
+allowed to have direct access (such as when the operators often need
+to load the proper paper type before running the 10,000 page job
+requested by marketing for the mailing, etc.).
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2972483"></a>Auto-Deletion or Preservation of CUPS Spool Files</h2></div></div><div></div></div><p>
+Samba print files pass through two "spool" directories. One is the
+incoming directory managed by Samba, (set in the <span class="emphasis"><em>path =
+/var/spool/samba</em></span> directive in the
+<span class="emphasis"><em>[printers]</em></span> section of
+<tt class="filename">smb.conf</tt>). The other is the spool directory of
+your UNIX print subsystem. For CUPS it is normally
+<tt class="filename">/var/spool/cups/</tt>, as set by the cupsd.conf
+directive <tt class="filename">RequestRoot /var/spool/cups</tt>.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972529"></a>CUPS Configuration Settings explained</h3></div></div><div></div></div><p>
+Some important parameter settings in the CUPS configuration file
+<tt class="filename">cupsd.conf</tt> are:
+</p><div class="variablelist"><dl><dt><span class="term">PreserveJobHistory Yes</span></dt><dd><p>
+This keeps some details of jobs in cupsd's mind (well it keeps the
+"c12345", "c12346" etc. files in the CUPS spool directory, which do a
+similar job as the old-fashioned BSD-LPD control files). This is set
+to "Yes" as a default.
+</p></dd><dt><span class="term">PreserveJobFiles Yes</span></dt><dd><p>
+This keeps the job files themselves in cupsd's mind
+(well it keeps the "d12345", "d12346" etc. files in the CUPS spool
+directory...). This is set to "No" as the CUPS
+default.
+</p></dd><dt><span class="term"><span class="emphasis"><em>"MaxJobs 500"</em></span></span></dt><dd><p>
+This directive controls the maximum number of jobs
+that are kept in memory. Once the number of jobs reaches the limit,
+the oldest completed job is automatically purged from the system to
+make room for the new one. If all of the known jobs are still
+pending or active then the new job will be rejected. Setting the
+maximum to 0 disables this functionality. The default setting is
+0.
+</p></dd></dl></div><p>
+(There are also additional settings for "MaxJobsPerUser" and
+"MaxJobsPerPrinter"...)
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972611"></a>Pre-conditions</h3></div></div><div></div></div><p>
+For everything to work as announced, you need to have three
+things:
+</p><div class="itemizedlist"><ul type="disc"><li><p>a Samba-smbd which is compiled against "libcups" (Check
+on Linux by running "ldd `which smbd`")</p></li><li><p>a Samba-<tt class="filename">smb.conf</tt> setting of
+"printing = cups"</p></li><li><p>another Samba-<tt class="filename">smb.conf</tt> setting of
+"printcap = cups"</p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+In this case all other manually set printing-related commands (like
+"print command", "lpq command", "lprm command", "lppause command" or
+"lpresume command") are ignored and they should normally have no
+influence what-so-ever on your printing.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972672"></a>Manual Configuration</h3></div></div><div></div></div><p>
+If you want to do things manually, replace the "printing =
+cups" by "printing = bsd". Then your manually set commands may work
+(haven't tested this), and a "print command = lp -d %P %s; rm %s"
+may do what you need.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2972690"></a>When <span class="emphasis"><em>not</em></span> to use Samba to print to
+CUPS</h2></div></div><div></div></div><p>
+[TO BE DONE]
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2972707"></a>In Case of Trouble.....</h2></div></div><div></div></div><p>
+If you have more problems, post the output of these commands
+to the CUPS or Samba mailing lists (choose the one which seems more
+relevant to your problem):
+</p><pre class="screen">
+
+ grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
+ grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
+
+</pre><p>
+(adapt paths as needed). These commands leave out the empty
+lines and lines with comments, providing the "naked settings" in a
+compact way. Don't forget to name the CUPS and Samba versions you
+are using! This saves bandwidth and makes for easier readability
+for experts (and you are expecting experts to read them, right?
+;-)
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972742"></a>Where to find Documentation</h3></div></div><div></div></div><p>
+[TO BE DONE]
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972755"></a>How to ask for Help</h3></div></div><div></div></div><p>
+[TO BE DONE]
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972768"></a>Where to find Help</h3></div></div><div></div></div><p>
+[TO BE DONE]
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2972782"></a>Appendix</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972789"></a>Printing <span class="emphasis"><em>from</em></span> CUPS to Windows attached
+Printers</h3></div></div><div></div></div><p>
+From time to time the question arises, how you can print
+<span class="emphasis"><em>to</em></span> a Windows attached printer
+<span class="emphasis"><em>from</em></span> Samba. Normally the local connection
+"Windows host <--> printer" would be done by USB or parallel
+cable, but this doesn't matter to Samba. From here only an SMB
+connection needs to be opened to the Windows host. Of course, this
+printer must be "shared" first. As you have learned by now, CUPS uses
+<span class="emphasis"><em>backends</em></span> to talk to printers and other
+servers. To talk to Windows shared printers you need to use the
+<span class="emphasis"><em>smb</em></span> (surprise, surprise!) backend. Check if this
+is in the CUPS backend directory. This resides usually in
+<tt class="filename">/usr/lib/cups/backend/</tt>. You need to find a "smb"
+file there. It should be a symlink to <tt class="filename">smbspool</tt>
+which file must exist and be executable:
+</p><pre class="screen">
+
+ # ls -l /usr/lib/cups/backend/
+ total 253
+ drwxr-xr-x 3 root root 720 Apr 30 19:04 .
+ drwxr-xr-x 6 root root 125 Dec 19 17:13 ..
+ -rwxr-xr-x 1 root root 10692 Feb 16 21:29 canon
+ -rwxr-xr-x 1 root root 10692 Feb 16 21:29 epson
+ lrwxrwxrwx 1 root root 3 Apr 17 22:50 http -> ipp
+ -rwxr-xr-x 1 root root 17316 Apr 17 22:50 ipp
+ -rwxr-xr-x 1 root root 15420 Apr 20 17:01 lpd
+ -rwxr-xr-x 1 root root 8656 Apr 20 17:01 parallel
+ -rwxr-xr-x 1 root root 2162 Mar 31 23:15 pdfdistiller
+ lrwxrwxrwx 1 root root 25 Apr 30 19:04 ptal -> /usr/local/sbin/ptal-cups
+ -rwxr-xr-x 1 root root 6284 Apr 20 17:01 scsi
+ lrwxrwxrwx 1 root root 17 Apr 2 03:11 smb -> /usr/bin/smbspool
+ -rwxr-xr-x 1 root root 7912 Apr 20 17:01 socket
+ -rwxr-xr-x 1 root root 9012 Apr 20 17:01 usb
+
+# ls -l `which smbspool`
+ -rwxr-xr-x 1 root root 563245 Dec 28 14:49 /usr/bin/smbspool
+
+</pre><p>
+If this symlink doesn't exist, create it:
+</p><pre class="screen">
+
+# ln -s `which smbspool` /usr/lib/cups/backend/smb
+
+</pre><p>
+smbspool has been written by Mike Sweet from the CUPS folks. It is
+included and ships with Samba. It may also be used with print
+subsystems other than CUPS, to spool jobs to Windows printer shares. To
+set up printer "winprinter" on CUPS, you need to have a "driver" for
+it. Essentially this means to convert the print data on the CUPS/Samba
+host to a format that the printer can digest (the Windows host is
+unable to convert any files you may send). This also means you should
+be able to print to the printer if it were hooked directly at your
+Samba/CUPS host. For troubleshooting purposes, this is what you
+should do, to determine if that part of the process chain is in
+order. Then proceed to fix the network connection/authentication to
+the Windows host, etc.
+</p><p>
+To install a printer with the smb backend on CUPS, use this command:
+</p><pre class="screen">
+
+# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename -P /path/to/PPD
+
+</pre><p>
+The <span class="emphasis"><em>PPD</em></span> must be able to direct CUPS to generate
+the print data for the target model. For PostScript printers just use
+the PPD that would be used with the Windows NT PostScript driver. But
+what can you do if the printer is only accessible with a password? Or
+if the printer's host is part of another workgroup? This is provided
+for: you can include the required parameters as part of the
+<tt class="filename">smb://</tt> device-URI. Like this:
+</p><pre class="screen">
+
+ smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename
+ smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename
+ smb://username:password@WINDOWSNETBIOSNAME/printersharename
+
+</pre><p>
+Note that the device-URI will be visible in the process list of the
+Samba server (e.g. when someone uses the <b class="command">ps -aux</b>
+command on Linux), even if the username and passwords are sanitized
+before they get written into the log files. So this is an inherently
+insecure option. However it is the only one. Don't use it if you want
+to protect your passwords. Better share the printer in a way that
+doesn't require a password! Printing will only work if you have a
+working netbios name resolution up and running. Note that this is a
+feature of CUPS and you don't necessarily need to have smbd running
+(but who wants that? :-).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972982"></a>More CUPS filtering Chains</h3></div></div><div></div></div><p>
+The following diagrams reveal how CUPS handles print jobs.
+</p><pre class="screen">
+#########################################################################
+#
+# CUPS in and of itself has this (general) filter chain (CAPITAL
+# letters are FILE-FORMATS or MIME types, other are filters (this is
+# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT
+# |
+# V
+# pstoraster # as shipped with CUPS, independent from any Ghostscipt
+# | # installation on the system
+# | (= "postscipt interpreter")
+# V
+# APPLICATION/VND.CUPS-RASTER
+# |
+# V
+# rastertosomething (e.g. Gimp-Print filters may be plugged in here)
+# | (= "raster driver")
+# V
+# SOMETHING-DEVICE-SPECIFIC
+# |
+# V
+# backend
+#
+#
+# ESP PrintPro has some enhanced "rastertosomething" filters as compared to
+# CUPS, and also a somewhat improved "pstoraster" filter.
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+</pre><pre class="screen">
+#########################################################################
+#
+# This is how "cupsomatic" comes into play:
+# =========================================
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
+# | V
+# V cupsomatic
+# pstoraster (constructs complicated
+# | (= "postscipt interpreter") Ghostscript commandline
+# | to let the file be
+# V processed by a
+# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th."
+# | call...)
+# V |
+# rastertosomething V
+# | (= "raster driver") +-------------------------+
+# | | Ghostscript at work.... |
+# V | |
+# SOMETHING-DEVICE-SPECIFIC *-------------------------+
+# | |
+# V |
+# backend <------------------------------------+
+# |
+# V
+# THE PRINTER
+#
+#
+# Note, that cupsomatic "kidnaps" the printfile after the
+# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it gh
+# the CUPS-external, systemwide Ghostscript installation, bypassing the
+# "pstoraster" filter (therefore also bypassing the CUPS-raster-drivers
+# "rastertosomething", and hands the rasterized file directly to the CUPS
+# backend...
+#
+# cupsomatic is not made by the CUPS developers. It is an independent
+# contribution to printing development, made by people from
+# Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+</pre><pre class="screen">
+#########################################################################
+#
+# And this is how it works for ESP PrintPro from 4.3:
+# ===================================================
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT
+# |
+# V
+# gsrip
+# | (= "postscipt interpreter")
+# V
+# APPLICATION/VND.CUPS-RASTER
+# |
+# V
+# rastertosomething (e.g. Gimp-Print filters may be plugged in here)
+# | (= "raster driver")
+# V
+# SOMETHING-DEVICE-SPECIFIC
+# |
+# V
+# backend
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+</pre><pre class="screen">
+#########################################################################
+#
+# This is how "cupsomatic" would come into play with ESP PrintPro:
+# ================================================================
+#
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
+# | V
+# V cupsomatic
+# gsrip (constructs complicated
+# | (= "postscipt interpreter") Ghostscript commandline
+# | to let the file be
+# V processed by a
+# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th."
+# | call...)
+# V |
+# rastertosomething V
+# | (= "raster driver") +-------------------------+
+# | | Ghostscript at work.... |
+# V | |
+# SOMETHING-DEVICE-SPECIFIC *-------------------------+
+# | |
+# V |
+# backend <------------------------------------+
+# |
+# V
+# THE PRINTER
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+</pre><pre class="screen">
+#########################################################################
+#
+# And this is how it works for CUPS from 1.1.15:
+# ==============================================
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+# +------------------v------------------------------+
+# | Ghostscript |
+# | at work... |
+# | (with |
+# | "-sDEVICE=cups") |
+# | |
+# | (= "postscipt interpreter") |
+# | |
+# +------------------v------------------------------+
+# |
+# APPLICATION/VND.CUPS-RASTER >-------+
+# |
+# V
+# rastertosomething
+# | (= "raster driver")
+# V
+# SOMETHING-DEVICE-SPECIFIC
+# |
+# V
+# backend
+#
+#
+# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to
+# Ghostscript. GNU Ghostscript needs to be patched to handle the
+# CUPS requirement; ESP Ghostscript has this builtin. In any case,
+# "gs -h" needs to show up a "cups" device. pstoraster is now a
+# calling an appropriate "gs -sDEVICE=cups..." commandline to do
+# the job. It will output "application/vnd.cup-raster", which will
+# be finally processed by a CUPS raster driver "rastertosomething"
+# Note the difference to "cupsomatic", which will <span class="emphasis"><em>not</em></span> output
+# CUPS-raster, but a final version of the printfile, ready to be
+# sent to the printer. cupsomatic also doesn't use the "cups"
+# devicemode in Ghostscript, but one of the classical devicemodes....
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+</pre><pre class="screen">
+#########################################################################
+#
+# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
+# ========================================================================
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+# +------------------v------------------------------+
+# | Ghostscript . Ghostscript at work.... |
+# | at work... . (with "-sDEVICE= |
+# | (with . s.th." |
+# | "-sDEVICE=cups") . |
+# | . |
+# | (CUPS standard) . (cupsomatic) |
+# | . |
+# | (= "postscript interpreter") |
+# | . |
+# +------------------v--------------v---------------+
+# | |
+# APPLICATION/VND.CUPS-RASTER >-------+ |
+# | |
+# V |
+# rastertosomething |
+# | (= "raster driver") |
+# V |
+# SOMETHING-DEVICE-SPECIFIC >------------------------+
+# |
+# V
+# backend
+#
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+##########################################################################
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2973237"></a>Trouble Shooting Guidelines to fix typical Samba printing
+Problems</h3></div></div><div></div></div><p>
+This is a short description of how to debug printing problems
+with Samba. This describes how to debug problems with printing from
+a SMB client to a Samba server, not the other way around.
+</p><div class="variablelist"><dl><dt><span class="term">Win9x client can't install driver</span></dt><dd><p>For Win9x clients require the printer names to be 8
+chars (or "8 plus 3 chars suffix") max; otherwise the driver files
+won't get transferred when you want to download them from
+Samba.</p></dd><dt><span class="term">testparm</span></dt><dd><p>Run <b class="command">testparm</b>: It will tell you if
+<tt class="filename">smb.conf</tt> parameters are in the wrong
+section. Many people have had the "printer admin" parameter in the
+<i class="parameter"><tt>[printers]</tt></i> section and experienced
+problems. "testparm" will tell you if it sees
+this.</p></dd><dt><span class="term">"cupsaddsmb" keeps asking for a root password in a
+neverending loop</span></dt><dd><p>Have you <i class="parameter"><tt>security = user</tt></i>? Have
+you used <b class="command">smbpasswd</b> to give root a Samba account?
+You can do 2 things: open another terminal and execute
+<b class="command">smbpasswd -a root</b> to create the account, and
+continue with entering the password into the first terminal. Or break
+out of the loop by hitting ENTER twice (without trying to type a
+password).</p></dd><dt><span class="term">"cupsaddsmb" gives "No PPD file for printer..."
+message (but I swear there is one!)</span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Have you enabled printer sharing on CUPS? This means:
+do you have a <i class="parameter"><tt><Location
+/printers>....</Location></tt></i> section in CUPS
+server's <tt class="filename">cupsd.conf</tt> which doesn't deny access to
+the host you run "cupsaddsmb" from? It <span class="emphasis"><em>could</em></span> be
+an issue if you use cupsaddsmb remotely, or if you use it with a
+<i class="parameter"><tt>-h</tt></i> parameter: <b class="command">cupsaddsmb -H
+sambaserver -h cupsserver -v printername</b>.
+</p></li><li><p>Is your
+"TempDir" directive in
+<span class="emphasis"><em>cupsd.conf</em></span>
+set to a valid value and is it writeable?
+</p></li></ul></div></dd><dt><span class="term">I can't connect client to Samba printer.</span></dt><dd><p>Use <b class="command">smbstatus</b> to check which user
+you are from Samba's point of view. Do you have the privileges to
+write into the <i class="parameter"><tt>[print$]</tt></i>
+share?</p></dd><dt><span class="term">I can't reconnect to Samba under a new account
+from Win2K/XP</span></dt><dd><p>Once you are connected as the "wrong" user (for
+example as "nobody", which often occurs if you have <i class="parameter"><tt>map to
+guest = bad user</tt></i>), Windows Explorer will not accept an
+attempt to connect again as a different user. There won't be any byte
+transfered on the wire to Samba, but still you'll see a stupid error
+message which makes you think that Samba has denied access. Use
+<b class="command">smbstatus</b> to check for active connections. Kill the
+PIDs. You still can't re-connect and get the dreaded
+<tt class="computeroutput">You can't connect with a second account from the same
+machine</tt> message, as soon as you are trying? And you
+don't see any single byte arriving at Samba (see logs; use "ethereal")
+indicating a renewed connection attempt? Shut all Explorer Windows.
+This makes Windows forget what it has cached in its memory as
+established connections. Then re-connect as the right user. Best
+method is to use a DOS terminal window and <span class="emphasis"><em>first</em></span>
+do <b class="command">net use z: \\SAMBAHOST\print$ /user:root</b>. Check
+with <b class="command">smbstatus</b> that you are connected under a
+different account. Now open the "Printers" folder (on the Samba server
+in the <span class="emphasis"><em>Network Neighbourhood</em></span>), right-click the
+printer in question and select
+<span class="emphasis"><em>Connect...</em></span></p></dd><dt><span class="term">Avoid being connected to the Samba server as the
+"wrong" user</span></dt><dd><p>You see per <b class="command">smbstatus</b> that you are
+connected as user "nobody"; while you wanted to be "root" or
+"printeradmin"? This is probably due to <i class="parameter"><tt>map to guest = bad
+user</tt></i>, which silently connects you under the guest account,
+when you gave (maybe by accident) an incorrect username. Remove
+<i class="parameter"><tt>map to guest</tt></i>, if you want to prevent
+this.</p></dd><dt><span class="term">Upgrading to CUPS drivers from Adobe drivers on
+NT/2K/XP clients gives problems</span></dt><dd><p>First delete all "old" Adobe-using printers. Then
+delete all "old" Adobe drivers. (On Win2K/XP, right-click in
+background of "Printers" folder, select "Server Properties...", select
+tab "Drivers" and delete here).</p></dd><dt><span class="term">I can't use "cupsaddsmb"on a Samba server which is
+a PDC</span></dt><dd><p>Do you use the "naked" root user name? Try to do it
+this way: <span class="emphasis"><em>cupsaddsmb -U DOMAINNAME\\root -v
+printername</em></span> (note the two backslashes: the first one is
+required to "escape" the second one).</p></dd><dt><span class="term">I deleted a printer on Win2K; but I still see
+its driver</span></dt><dd><p>Deleting a printer on the client won't delete the
+driver too (to verify, right-click on the white background of the
+"Printers" folder, select "Server Properties" and click on the
+"Drivers" tab). These same old drivers will be re-used when you try to
+install a printer with the same name. If you want to update to a new
+driver, delete the old ones first. Deletion is only possible if no
+other printer uses the same driver.</p></dd><dt><span class="term">Win2K/XP "Local Security
+Policies"</span></dt><dd><p><span class="emphasis"><em>Local Security Policies</em></span> may not
+allow the installation of unsigned drivers. "Local Security Policies"
+may not allow the installation of printer drivers at
+all.</p></dd><dt><span class="term">WinXP clients: "Administrator can not install
+printers for all local users"</span></dt><dd><p>Windows XP handles SMB printers on a "per-user" basis.
+This means every user needs to install the printer himself. To have a
+printer available for everybody, you might want to use the built-in
+IPP client capabilities of WinXP. Add a printer with the print path of
+<span class="emphasis"><em>http://cupsserver:631/printers/printername</em></span>.
+Still looking into this one: maybe a "logon script" could
+automatically install printers for all
+users.</p></dd><dt><span class="term">"Print Change Notify" functions on
+NT-clients</span></dt><dd><p>For "print change notify" functions on NT++ clients,
+these need to run the "Server" service first (re-named to
+<span class="emphasis"><em>File & Print Sharing for MS Networks</em></span> in
+XP).</p></dd><dt><span class="term">WinXP-SP1</span></dt><dd><p>WinXP-SP1 introduced a <span class="emphasis"><em>Point and Print
+Restriction Policy</em></span> (this restriction doesn't apply to
+"Administrator" or "Power User" groups of users). In Group Policy
+Object Editor: go to <span class="emphasis"><em>User Configuration -->
+Administrative Templates --> Control Panel -->
+Printers</em></span>. The policy is automatically set to
+<span class="emphasis"><em>Enabled</em></span> and the <span class="emphasis"><em>Users can only Point
+and Print to machines in their Forest</em></span> . You probably need
+to change it to <span class="emphasis"><em>Disabled</em></span> or <span class="emphasis"><em>Users can
+only Point and Print to these servers</em></span> in order to make
+driver downloads from Samba possible.</p></dd><dt><span class="term">I can't set and save default print options for all
+users on Win2K/XP</span></dt><dd><p>How are you doing it? I bet the wrong way (it is not
+very easy to find out, though). There are 3 different ways to bring
+you to a dialog that <span class="emphasis"><em>seems</em></span> to set everything. All
+three dialogs <span class="emphasis"><em>look</em></span> the same. Only one of them
+<span class="emphasis"><em>does</em></span> what you intend. You need to be
+Administrator or Print Administrator to do this for all users. Here
+is how I do in on XP:
+</p><div class="orderedlist"><ol type="A"><li xmlns:ns65=""><ns65:p>The first "wrong" way:
+
+</ns65:p><div class="orderedlist"><ol type="1"><li><p>Open the <span class="emphasis"><em>Printers</em></span>
+folder.</p></li><li><p>Right-click on the printer
+(<span class="emphasis"><em>remoteprinter on cupshost</em></span>) and
+select in context menu <span class="emphasis"><em>Printing
+Preferences...</em></span></p></li><li><p>Look at this dialog closely and remember what it looks
+like.</p></li></ol></div><ns65:p>
+</ns65:p></li><li xmlns:ns66=""><ns66:p>The second "wrong" way:
+
+</ns66:p><div class="orderedlist"><ol type="1"><li><p>Open the <span class="emphasis"><em>Printers</em></span>
+folder.</p></li><li><p>Right-click on the printer (<span class="emphasis"><em>remoteprinter on
+cupshost</em></span>) and select in the context menu
+<span class="emphasis"><em>Properties</em></span></p></li><li><p>Click on the <span class="emphasis"><em>General</em></span>
+tab</p></li><li><p>Click on the button <span class="emphasis"><em>Printing
+Preferences...</em></span></p></li><li><p>A new dialog opens. Keep this dialog open and go back
+to the parent dialog.</p></li></ol></div><ns66:p>
+</ns66:p></li><li xmlns:ns67=""><ns67:p>The third, the "correct" way: (should you do
+this from the beginning, just carry out steps 1. and 2. from second
+"way" above)
+
+</ns67:p><div class="orderedlist"><ol type="1"><li><p>Click on the <span class="emphasis"><em>Advanced</em></span>
+tab. (Hmmm... if everything is "Grayed Out", then you are not logged
+in as a user with enough privileges).</p></li><li><p>Click on the <span class="emphasis"><em>Printing
+Defaults...</em></span> button.</p></li><li><p>On any of the two new tabs, click on the
+<span class="emphasis"><em>Advanced...</em></span>
+button.</p></li><li><p>A new dialog opens. Compare this one to the other,
+identical looking one from "B.5" or A.3".</p></li></ol></div><ns67:p>
+</ns67:p></li></ol></div><p>
+Do you see any difference? I don't either... However, only the last
+one, which you arrived at with steps "C.1.-6." will save any settings
+permanently and be the defaults for new users. If you want all clients
+to get the same defaults, you need to conduct these steps <span class="emphasis"><em>as
+Administrator</em></span> (<i class="parameter"><tt>printer admin</tt></i> in
+<tt class="filename">smb.conf</tt>) <span class="emphasis"><em>before</em></span> a client
+downloads the driver (the clients can later set their own
+<span class="emphasis"><em>per-user defaults</em></span> by following the
+procedures <span class="emphasis"><em>A.</em></span> or <span class="emphasis"><em>B.</em></span>
+above).</p></dd><dt><span class="term">What are the most common blunders in driver
+settings on Windows clients?</span></dt><dd><p>Don't use <span class="emphasis"><em>Optimize for
+Speed</em></span>: use <span class="emphasis"><em>Optimize for
+Portability</em></span> instead (Adobe PS Driver) Don't use
+<span class="emphasis"><em>Page Independence: No</em></span>: always
+settle with <span class="emphasis"><em>Page Independence:
+Yes</em></span> (Microsoft PS Driver and CUPS PS Driver for
+WinNT/2K/XP) If there are problems with fonts: use
+<span class="emphasis"><em>Download as Softfont into
+printer</em></span> (Adobe PS Driver). For
+<span class="emphasis"><em>TrueType Download Options</em></span>
+choose <span class="emphasis"><em>Outline</em></span>. Use PostScript
+Level 2, if you are having trouble with a non-PS printer, and if
+there is a choice.</p></dd><dt><span class="term">I can't make <b class="command">cupsaddsmb</b> work
+with newly installed printer</span></dt><dd><p>Symptom: the last command of
+<b class="command">cupsaddsmb</b> doesn't complete successfully:
+<b class="command">cmd = setdriver printername printername</b> result was
+NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet
+"recognized" by Samba. Did it show up in <span class="emphasis"><em>Network
+Neighbourhood</em></span>? Did it show up in <b class="command">rpcclient
+hostname -c 'enumprinters'</b>? Restart smbd (or send a
+<b class="command">kill -HUP</b> to all processes listed by
+<b class="command">smbstatus</b> and try
+again.</p></dd><dt><span class="term">My permissions on
+<tt class="filename">/var/spool/samba/</tt> get reset after each
+reboot</span></dt><dd><p>Have you by accident set the CUPS spool directory to
+the same location? (<i class="parameter"><tt>RequestRoot
+/var/spool/samba/</tt></i> in <tt class="filename">cupsd.conf</tt> or
+the other way round: <tt class="filename">/var/spool/cups/</tt> is set as
+<i class="parameter"><tt>path</tt></i> in the <i class="parameter"><tt>[printers]</tt></i>
+section). These <span class="emphasis"><em>must</em></span> be different. Set
+<i class="parameter"><tt>RequestRoot /var/spool/cups/</tt></i> in
+<tt class="filename">cupsd.conf</tt> and <i class="parameter"><tt>path =
+/var/spool/samba</tt></i> in the <i class="parameter"><tt>[printers]</tt></i>
+section of <tt class="filename">smb.conf</tt>. Otherwise cupsd will
+sanitize permissions to its spool directory with each restart, and
+printing will not work reliably.</p></dd><dt><span class="term">My printers work fine: just the printer named "lp"
+intermittently swallows jobs and spits out completely different
+ones</span></dt><dd><p>It is a very bad idea to name any printer "lp". This
+is the traditional Unix name for the default printer. CUPS may be set
+up to do an automatic creation of "Implicit Classes". This means, to
+group all printers with the same name to a pool of devices, and
+loadbalancing the jobs across them in a round-robin fashion. Chances
+are high that someone else has an "lp" named printer too. You may
+receive his jobs and send your own to his device unwittingly. To have
+tight control over the printer names, set <i class="parameter"><tt>BrowseShortNames
+No</tt></i>. It will present any printer as "printername@cupshost"
+then, giving you a better control over what may happen in a large
+networked environment.</p></dd><dt><span class="term">How do I "watch" my Samba server?</span></dt><dd><p>You can use <b class="command">tail -f
+/var/log/samba/log.smbd</b> (you may need a different path) to
+see a live scrolling of all log messages. <b class="command">smbcontrol smbd
+debuglevel</b> tells you which verbosity goes into the
+logs. <b class="command">smbcontrol smbd debug 3</b> sets the verbosity to
+a quite high level (you can choose from 0 to 10 or 100). This works
+"on the fly", without the need to restart the smbd daemon. Don't use
+more than 3 initially; or you'll drown in an ocean of
+messages.</p></dd><dt><span class="term">I can't use Samba from my WinXP Home box, while
+access from WinXP Prof works flawlessly</span></dt><dd><p>You have our condolences! WinXP home has been
+completely neutered by Microsoft as compared to WinXP Prof: you can
+not log into a WinNT domain. It cannot join a Win NT domain as a
+member server. While it is possible to access domain resources, users
+don't have "single sign-on". They need to supply username and password
+each time they connect to a resource. Logon scripts and roaming
+profiles are not supported. It can serve file and print shares; but
+only in "share-mode security" level. It can not use "user-mode
+security" (what Windows 95/98/ME still can
+do).</p></dd><dt><span class="term">Where do I find the Adobe PostScript driver files
+I need for "cupsaddsmb"?</span></dt><dd><p>Use <b class="command">smbclient</b> to connect to any
+Windows box with a shared PostScript printer: <b class="command">smbclient
+//windowsbox/print\$ -U guest</b>. You can navigate to the
+<tt class="filename">W32X86/2</tt> subdir to <b class="command">mget ADOBE*</b>
+and other files or to <tt class="filename">WIN40/0</tt> to do the same. --
+Another option is to download the <tt class="filename">*.exe</tt> packaged
+files from the Adobe website.</p></dd></dl></div></div><div xmlns:ns68="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2974343"></a>An Overview of the CUPS Printing Processes</h3></div></div><div></div></div><ns68:p>
+</ns68:p><div class="figure"><a name="id2974353"></a><p class="title"><b>Figure 19.15. CUPS Printing Overview</b></p><div class="mediaobject"><img src="projdoc/imagefiles/a_small.png" alt="CUPS Printing Overview"></div></div><ns68:p>
+</ns68:p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="printing.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="VFS.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 18. Classical Printing Support </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 20. Stackable VFS modules</td></tr></table></div></body></html>
--- /dev/null
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>SAMBA Project Documentation</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><meta name="description" content="
+This book is a collection of HOWTOs added to Samba documentation over the years.
+Samba is always under development, and so is its' documentation. This release of the
+documentation represents a major revision or layout as well as contents.
+The most recent version of this document can be found at
+http://www.samba.org/
+on the "Documentation" page. Please send updates to
+Jelmer Vernooij,
+John H. Terpstra or
+Gerald (Jerry) Carter.
+
+The Samba-Team would like to express sincere thanks to the many people who have with
+or without their knowledge contributed to this update. The size and scope of this
+project would not have been possible without significant community contribution. A not
+insignificant number of ideas for inclusion (if not content itself) has been obtained
+from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered.
+Please keep publishing your Unofficial HOWTO's - they are a source of inspiration and
+application knowledge that is most to be desired by many Samba users and administrators.
+"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="book" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="Samba-HOWTO-Collection"></a>SAMBA Project Documentation</h1></div><div><div class="authorgroup"><h4 class="editedby">Edited by</h4><h3 class="editor"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><h3 class="editor"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><h3 class="editor"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3></div></div><div><div xmlns:ns1="" class="legalnotice"><p>
+This documentation is distributed under the GNU General Public License (GPL)
+version 2. A copy of the license is included with the Samba source
+distribution. A copy can be found on-line at <a href="http://www.fsf.org/licenses/gpl.txt" target="_top">http://www.fsf.org/licenses/gpl.txt</a>
+</p><ns1:p><b>Attributions. </b>
+ </ns1:p><div class="variablelist"><dl><dt><span class="term"><a href="#IntroSMB" title="Chapter 1. Introduction to Samba">Introduction to Samba</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>David Lechnyr <<a href="mailto:david@lechnyr.com" target="_top">david@lechnyr.com</a>></p></li></ul></div></dd><dt><span class="term"><a href="#install" title="Chapter 2. How to Install and Test SAMBA">How to Install and Test SAMBA</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Karl Auer</p></li></ul></div></dd><dt><span class="term"><a href="#FastStart" title="Chapter 3. FastStart for the Impatient">FastStart for the Impatient</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#ServerType" title="Chapter 4. Server Types and Security Modes">Server Types and Security Modes</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#samba-pdc" title="Chapter 5. Domain Control">Domain Control</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li><li><p>David Bannon <<a href="mailto:dbannon@samba.org" target="_top">dbannon@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#samba-bdc" title="Chapter 6. Backup Domain Control">Backup Domain Control</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Volker Lendecke <<a href="mailto:Volker.Lendecke@SerNet.DE" target="_top">Volker.Lendecke@SerNet.DE</a>></p></li></ul></div></dd><dt><span class="term"><a href="#domain-member" title="Chapter 7. Domain Membership">Domain Membership</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Jeremy Allison <<a href="mailto:jra@samba.org" target="_top">jra@samba.org</a>></p></li><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#StandAloneServer" title="Chapter 8. Stand-Alone Servers">Stand-Alone Servers</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#ClientConfig" title="Chapter 9. MS Windows Network Configuration Guide">MS Windows Network Configuration Guide</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#NetworkBrowsing" title="Chapter 10. Samba / MS Windows Network Browsing Guide">Samba / MS Windows Network Browsing Guide</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#passdb" title="Chapter 11. Account Information Databases">Account Information Databases</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li><li><p>Jeremy Allison <<a href="mailto:jra@samba.org" target="_top">jra@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Olivier (lem) Lemaire <<a href="mailto:olem@IDEALX.org" target="_top">olem@IDEALX.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#groupmapping" title="Chapter 12. Mapping MS Windows and Unix Groups">Mapping MS Windows and Unix Groups</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jean François Micouleau</p></li><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#AccessControls" title="Chapter 13. File, Directory and Share Access Controls">File, Directory and Share Access Controls</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Jeremy Allison <<a href="mailto:jra@samba.org" target="_top">jra@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#locking" title="Chapter 14. File and Record Locking">File and Record Locking</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jeremy Allison <<a href="mailto:jra@samba.org" target="_top">jra@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Eric Roseme <<a href="mailto:eric.roseme@hp.com" target="_top">eric.roseme@hp.com</a>></p></li></ul></div></dd><dt><span class="term"><a href="#securing-samba" title="Chapter 15. Securing Samba">Securing Samba</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#InterdomainTrusts" title="Chapter 16. Interdomain Trust Relationships">Interdomain Trust Relationships</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Rafal Szczesniak <<a href="mailto:mimir@samba.org" target="_top">mimir@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#msdfs" title="Chapter 17. Hosting a Microsoft Distributed File System tree on Samba">Hosting a Microsoft Distributed File System tree on Samba</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Shirish Kalele <<a href="mailto:samba@samba.org" target="_top">samba@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#printing" title="Chapter 18. Classical Printing Support">Classical Printing Support</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Kurt Pfeifle <<a href="mailto:kpfeifle@danka.de" target="_top">kpfeifle@danka.de</a>></p></li><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#CUPS-printing" title="Chapter 19. CUPS Printing Support in Samba 3.0">CUPS Printing Support in Samba 3.0</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Kurt Pfeifle <<a href="mailto:kpfeifle@danka.de" target="_top">kpfeifle@danka.de</a>></p></li><li><p>Ciprian Vizitiu <<a href="mailto:CVizitiu@gbif.org" target="_top">CVizitiu@gbif.org</a>> (drawings) </p></li></ul></div></dd><dt><span class="term"><a href="#VFS" title="Chapter 20. Stackable VFS modules">Stackable VFS modules</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Alexander Bokovoy</p></li><li><p>Tim Potter</p></li><li><p>Simo Sorce</p></li></ul></div></dd><dt><span class="term"><a href="#winbind" title="Chapter 21. Integrated Logon Support using Winbind">Integrated Logon Support using Winbind</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Tim Potter <<a href="mailto:tpot@linuxcare.com.au" target="_top">tpot@linuxcare.com.au</a>></p></li><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>Naag Mummaneni <<a href="mailto:getnag@rediffmail.com" target="_top">getnag@rediffmail.com</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#AdvancedNetworkManagement" title="Chapter 22. Advanced Network Manangement">Advanced Network Manangement</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#PolicyMgmt" title="Chapter 23. System and Account Policies">System and Account Policies</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#ProfileMgmt" title="Chapter 24. Desktop Profile Management">Desktop Profile Management</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#pam" title="Chapter 25. PAM based Distributed Authentication">PAM based Distributed Authentication</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li><li><p>Stephen Langasek <<a href="mailto:vorlon@netexpress.net" target="_top">vorlon@netexpress.net</a>></p></li></ul></div></dd><dt><span class="term"><a href="#integrate-ms-networks" title="Chapter 26. Integrating MS Windows networks with Samba">Integrating MS Windows networks with Samba</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#unicode" title="Chapter 27. Unicode/Charsets">Unicode/Charsets</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>TAKAHASHI Motonobu <<a href="mailto:monyo@home.monyo.com" target="_top">monyo@home.monyo.com</a>></p></li></ul></div></dd><dt><span class="term"><a href="#Backup" title="Chapter 28. Samba Backup Techniques">Samba Backup Techniques</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#SambaHA" title="Chapter 29. High Availability Options">High Availability Options</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#upgrading-to-3.0" title="Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0">Upgrading from Samba-2.x to Samba-3.0.0</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#NT4Migration" title="Chapter 31. Migration from NT4 PDC to Samba-3 PDC">Migration from NT4 PDC to Samba-3 PDC</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#SWAT" title="Chapter 32. SWAT - The Samba Web Administration Tool">SWAT - The Samba Web Administration Tool</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#diagnosis" title="Chapter 33. The samba checklist">The samba checklist</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Andrew Tridgell <<a href="mailto:tridge@samba.org" target="_top">tridge@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#problems" title="Chapter 34. Analysing and solving samba problems">Analysing and solving samba problems</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Gerald Carter <<a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>David Bannon <<a href="mailto:dbannon@samba.org" target="_top">dbannon@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#bugreport" title="Chapter 35. Reporting Bugs">Reporting Bugs</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p> Someone; Tridge or Karl Auer perhaps?</p></li></ul></div></dd><dt><span class="term"><a href="#compiling" title="Chapter 36. How to compile SAMBA">How to compile SAMBA</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p> Someone; Jerry perhaps?</p></li></ul></div></dd><dt><span class="term"><a href="#Portability" title="Chapter 37. Portability">Portability</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#Other-Clients" title="Chapter 38. Samba and other CIFS clients">Samba and other CIFS clients</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jim McDonough <<a href="mailto:jmcd@us.ibm.com" target="_top">jmcd@us.ibm.com</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#speed" title="Chapter 39. Samba Performance Tuning">Samba Performance Tuning</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Paul Cochrane <<a href="mailto:paulc@dth.scot.nhs.uk" target="_top">paulc@dth.scot.nhs.uk</a>></p></li><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#DNSDHCP" title="Chapter 40. DNS and DHCP Configuration Guide">DNS and DHCP Configuration Guide</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>John Terpstra <<a href="mailto:jht@samba.org" target="_top">jht@samba.org</a>></p></li></ul></div></dd><dt><span class="term"><a href="#Further-Resources" title="Chapter 41. Further Resources">Further Resources</a></span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Jelmer Vernooij <<a href="mailto:jelmer@samba.org" target="_top">jelmer@samba.org</a>></p></li><li><p>David Lechnyr <<a href="mailto:david@lechnyr.com" target="_top">david@lechnyr.com</a>></p></li></ul></div></dd></dl></div><ns1:p>
+
+ </ns1:p></div></div><div><p class="pubdate">Monday April 21, 2003</p></div><div><div class="abstract"><p class="title"><b>Abstract</b></p><p>
+This book is a collection of HOWTOs added to Samba documentation over the years.
+Samba is always under development, and so is its' documentation. This release of the
+documentation represents a major revision or layout as well as contents.
+The most recent version of this document can be found at
+<a href="http://www.samba.org/" target="_top">http://www.samba.org/</a>
+on the "Documentation" page. Please send updates to
+<a href="mailto:jelmer@samba.org" target="_top">Jelmer Vernooij</a>,
+<a href="mailto:jht@samba.org" target="_top">John H. Terpstra</a> or
+<a href="mailto:jerry@samba.org" target="_top">Gerald (Jerry) Carter</a>.
+</p><p>
+The Samba-Team would like to express sincere thanks to the many people who have with
+or without their knowledge contributed to this update. The size and scope of this
+project would not have been possible without significant community contribution. A not
+insignificant number of ideas for inclusion (if not content itself) has been obtained
+from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered.
+Please keep publishing your Unofficial HOWTO's - they are a source of inspiration and
+application knowledge that is most to be desired by many Samba users and administrators.
+</p></div></div></div><div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt>I. <a href="#introduction">General Installation</a></dt><dd><dl><dt>1. <a href="#IntroSMB">Introduction to Samba</a></dt><dd><dl><dt><a href="#id2867729">Background</a></dt><dt><a href="#id2867783">Terminology</a></dt><dt><a href="#id2866506">Related Projects</a></dt><dt><a href="#id2866575">SMB Methodology</a></dt><dt><a href="#id2866662">Epilogue</a></dt><dt><a href="#id2866735">Miscellaneous</a></dt></dl></dd><dt>2. <a href="#install">How to Install and Test SAMBA</a></dt><dd><dl><dt><a href="#id2867501">Obtaining and installing samba</a></dt><dt><a href="#id2867544">Configuring samba (smb.conf)</a></dt><dd><dl><dt><a href="#id2867117">Example Configuration</a></dt><dt><a href="#id2867260">SWAT</a></dt></dl></dd><dt><a href="#id2867305">Try listing the shares available on your
+ server</a></dt><dt><a href="#id2866810">Try connecting with the unix client</a></dt><dt><a href="#id2866912">Try connecting from a DOS, WfWg, Win9x, WinNT,
+ Win2k, OS/2, etc... client</a></dt><dt><a href="#id2866973">What If Things Don't Work?</a></dt><dt><a href="#id2867003">Common Errors</a></dt><dd><dl><dt><a href="#id2867016">Why are so many smbd processes eating memory?</a></dt><dt><a href="#id2868395">I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs</a></dt></dl></dd></dl></dd><dt>3. <a href="#FastStart">FastStart for the Impatient</a></dt><dd><dl><dt><a href="#id2868843">Note</a></dt></dl></dd></dl></dd><dt>II. <a href="#type">Server Configuration Basics</a></dt><dd><dl><dt>4. <a href="#ServerType">Server Types and Security Modes</a></dt><dd><dl><dt><a href="#id2871915">Features and Benefits</a></dt><dt><a href="#id2872007">Server Types</a></dt><dt><a href="#id2872088">Samba Security Modes</a></dt><dd><dl><dt><a href="#id2868518">User Level Security</a></dt><dt><a href="#id2868651">Share Level Security</a></dt><dt><a href="#id2869720">Domain Security Mode (User Level Security)</a></dt><dt><a href="#id2869962">ADS Security Mode (User Level Security)</a></dt><dt><a href="#id2870046">Server Security (User Level Security)</a></dt></dl></dd><dt><a href="#id2870271">Seamless Windows Network Integration</a></dt><dt><a href="#id2870448">Common Errors</a></dt><dd><dl><dt><a href="#id2870476">What makes Samba a SERVER?</a></dt><dt><a href="#id2870509">What makes Samba a Domain Controller?</a></dt><dt><a href="#id2870537">What makes Samba a Domain Member?</a></dt><dt><a href="#id2872449">Constantly Losing Connections to Password Server</a></dt></dl></dd></dl></dd><dt>5. <a href="#samba-pdc">Domain Control</a></dt><dd><dl><dt><a href="#id2875080">Features and Benefits</a></dt><dt><a href="#id2872678">Basics of Domain Control</a></dt><dd><dl><dt><a href="#id2872693">Domain Controller Types</a></dt><dt><a href="#id2872892">Preparing for Domain Control</a></dt></dl></dd><dt><a href="#id2873207">Domain Control - Example Configuration</a></dt><dt><a href="#id2873503">Samba ADS Domain Control</a></dt><dt><a href="#id2873526">Domain and Network Logon Configuration</a></dt><dd><dl><dt><a href="#id2873540">Domain Network Logon Service</a></dt><dt><a href="#id2876260">Security Mode and Master Browsers</a></dt></dl></dd><dt><a href="#id2876365">Common Problems and Errors</a></dt><dd><dl><dt><a href="#id2876372">I cannot include a '$' in a machine name</a></dt><dt><a href="#id2876411">I get told "You already have a connection to the Domain...."
+or "Cannot join domain, the credentials supplied conflict with an
+existing set.." when creating a machine trust account.</a></dt><dt><a href="#id2876460">The system can not log you on (C000019B)....</a></dt><dt><a href="#id2876531">The machine trust account for this computer either does not
+exist or is not accessible.</a></dt><dt><a href="#id2876588">When I attempt to login to a Samba Domain from a NT4/W2K workstation,
+I get a message about my account being disabled.</a></dt><dt><a href="#id2876615">Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"</a></dt></dl></dd></dl></dd><dt>6. <a href="#samba-bdc">Backup Domain Control</a></dt><dd><dl><dt><a href="#id2878646">Features And Benefits</a></dt><dt><a href="#id2878811">Essential Background Information</a></dt><dd><dl><dt><a href="#id2878839">MS Windows NT4 Style Domain Control</a></dt><dt><a href="#id2876805">Active Directory Domain Control</a></dt><dt><a href="#id2876826">What qualifies a Domain Controller on the network?</a></dt><dt><a href="#id2876850">How does a Workstation find its domain controller?</a></dt></dl></dd><dt><a href="#id2876875">Backup Domain Controller Configuration</a></dt><dd><dl><dt><a href="#id2876945">Example Configuration</a></dt></dl></dd><dt><a href="#id2876995">Common Errors</a></dt><dd><dl><dt><a href="#id2877009">Machine Accounts keep expiring, what can I do?</a></dt><dt><a href="#id2877034">Can Samba be a Backup Domain Controller to an NT4 PDC?</a></dt><dt><a href="#id2877067">How do I replicate the smbpasswd file?</a></dt><dt><a href="#id2877096">Can I do this all with LDAP?</a></dt></dl></dd></dl></dd><dt>7. <a href="#domain-member">Domain Membership</a></dt><dd><dl><dt><a href="#id2877621">Features and Benefits</a></dt><dt><a href="#id2877192">MS Windows Workstation/Server Machine Trust Accounts</a></dt><dd><dl><dt><a href="#id2877352">Manual Creation of Machine Trust Accounts</a></dt><dt><a href="#id2879134">Using NT4 Server Manager to Add Machine Accounts to the Domain</a></dt><dt><a href="#id2879331">"On-the-Fly" Creation of Machine Trust Accounts</a></dt><dt><a href="#id2879386">Making an MS Windows Workstation or Server a Domain Member</a></dt></dl></dd><dt><a href="#id2879531">Domain Member Server</a></dt><dd><dl><dt><a href="#id2879579">Joining an NT4 type Domain with Samba-3</a></dt><dt><a href="#id2882177">Why is this better than security = server?</a></dt></dl></dd><dt><a href="#ads-member">Samba ADS Domain Membership</a></dt><dd><dl><dt><a href="#id2882315">Setup your smb.conf</a></dt><dt><a href="#id2882398">Setup your /etc/krb5.conf</a></dt><dt><a href="#ads-create-machine-account">Create the computer account</a></dt><dt><a href="#ads-test-server">Test your server setup</a></dt><dt><a href="#ads-test-smbclient">Testing with smbclient</a></dt><dt><a href="#id2882740">Notes</a></dt></dl></dd><dt><a href="#id2882762">Common Errors</a></dt><dd><dl><dt><a href="#id2882784">Can Not Add Machine Back to Domain</a></dt><dt><a href="#id2882816">Adding Machine to Domain Fails</a></dt></dl></dd></dl></dd><dt>8. <a href="#StandAloneServer">Stand-Alone Servers</a></dt><dd><dl><dt><a href="#id2884259">Features and Benefits</a></dt><dt><a href="#id2884297">Background</a></dt><dt><a href="#id2884365">Example Configuration</a></dt><dd><dl><dt><a href="#id2882967">Reference Documentation Server</a></dt><dt><a href="#id2883015">Central Print Serving</a></dt></dl></dd><dt><a href="#id2883221">Common Errors</a></dt></dl></dd><dt>9. <a href="#ClientConfig">MS Windows Network Configuration Guide</a></dt><dd><dl><dt><a href="#id2883589">Note</a></dt></dl></dd></dl></dd><dt>III. <a href="#optional">Advanced Configuration</a></dt><dd><dl><dt>10. <a href="#NetworkBrowsing">Samba / MS Windows Network Browsing Guide</a></dt><dd><dl><dt><a href="#id2883706">Features and Benefits</a></dt><dt><a href="#id2883784">What is Browsing?</a></dt><dt><a href="#id2883967">Discussion</a></dt><dd><dl><dt><a href="#id2883983">NetBIOS over TCP/IP</a></dt><dt><a href="#id2883290">TCP/IP - without NetBIOS</a></dt><dt><a href="#id2883418">DNS and Active Directory</a></dt></dl></dd><dt><a href="#id2883554">How Browsing Functions</a></dt><dd><dl><dt><a href="#id2884860">Setting up WORKGROUP Browsing</a></dt><dt><a href="#id2885066">Setting up DOMAIN Browsing</a></dt><dt><a href="#browse-force-master">Forcing samba to be the master</a></dt><dt><a href="#id2885332">Making samba the domain master</a></dt><dt><a href="#id2888727">Note about broadcast addresses</a></dt><dt><a href="#id2888744">Multiple interfaces</a></dt><dt><a href="#id2888773">Use of the Remote Announce parameter</a></dt><dt><a href="#id2888877">Use of the Remote Browse Sync parameter</a></dt></dl></dd><dt><a href="#id2888938">WINS - The Windows Internetworking Name Server</a></dt><dd><dl><dt><a href="#id2889089">Setting up a WINS server</a></dt><dt><a href="#id2889284">WINS Replication</a></dt><dt><a href="#id2889309">Static WINS Entries</a></dt></dl></dd><dt><a href="#id2889340">Helpful Hints</a></dt><dd><dl><dt><a href="#id2889353">Windows Networking Protocols</a></dt><dt><a href="#id2889420">Name Resolution Order</a></dt></dl></dd><dt><a href="#id2889541">Technical Overview of browsing</a></dt><dd><dl><dt><a href="#id2889588">Browsing support in samba</a></dt><dt><a href="#id2889695">Problem resolution</a></dt><dt><a href="#id2889774">Browsing across subnets</a></dt></dl></dd><dt><a href="#id2890391">Common Errors</a></dt><dd><dl><dt><a href="#id2890406">How can one flush the Samba NetBIOS name cache without restarting samba?</a></dt><dt><a href="#id2890435">My client reports "This server is not configured to list shared resources"</a></dt></dl></dd></dl></dd><dt>11. <a href="#passdb">Account Information Databases</a></dt><dd><dl><dt><a href="#id2890530">Features and Benefits</a></dt><dt><a href="#id2890854">Technical Information</a></dt><dd><dl><dt><a href="#id2890917">Important Notes About Security</a></dt><dt><a href="#id2891160">Mapping User Identifiers between MS Windows and Unix</a></dt></dl></dd><dt><a href="#id2891216">Account Management Tools</a></dt><dd><dl><dt><a href="#id2891247">The smbpasswd Command</a></dt><dt><a href="#id2891513">The pdbedit Command</a></dt></dl></dd><dt><a href="#id2891647">Password Backends</a></dt><dd><dl><dt><a href="#id2895859">Plain Text</a></dt><dt><a href="#id2895899">smbpasswd - Encrypted Password Database</a></dt><dt><a href="#id2896006">tdbsam</a></dt><dt><a href="#id2896034">ldapsam</a></dt><dt><a href="#id2897524">MySQL</a></dt><dt><a href="#XMLpassdb">XML</a></dt></dl></dd><dt><a href="#id2898328">Common Errors</a></dt><dd><dl><dt><a href="#id2898335">Users can not logon - Users not in Samba SAM</a></dt><dt><a href="#id2898350">Users are being added to the wrong backend database</a></dt><dt><a href="#id2898409">auth methods does not work</a></dt></dl></dd></dl></dd><dt>12. <a href="#groupmapping">Mapping MS Windows and Unix Groups</a></dt><dd><dl><dt><a href="#id2898582">Features and Benefits</a></dt><dt><a href="#id2898682">Discussion</a></dt><dd><dl><dt><a href="#id2898871">Example Configuration</a></dt></dl></dd><dt><a href="#id2898936">Configuration Scripts</a></dt><dd><dl><dt><a href="#id2898950">Sample smb.conf add group script</a></dt><dt><a href="#id2899017">Script to configure Group Mapping</a></dt></dl></dd><dt><a href="#id2899091">Common Errors</a></dt><dd><dl><dt><a href="#id2899107">Adding Groups Fails</a></dt><dt><a href="#id2899167">Adding MS Windows Groups to MS Windows Groups Fails</a></dt></dl></dd></dl></dd><dt>13. <a href="#AccessControls">File, Directory and Share Access Controls</a></dt><dd><dl><dt><a href="#id2902353">Features and Benefits</a></dt><dt><a href="#id2902478">File System Access Controls</a></dt><dd><dl><dt><a href="#id2902496">MS Windows NTFS Comparison with Unix File Systems</a></dt><dt><a href="#id2899413">Managing Directories</a></dt><dt><a href="#id2899508">File and Directory Access Control</a></dt></dl></dd><dt><a href="#id2899915">Share Definition Access Controls</a></dt><dd><dl><dt><a href="#id2899943">User and Group Based Controls</a></dt><dt><a href="#id2900215">File and Directory Permissions Based Controls</a></dt><dt><a href="#id2900461">Miscellaneous Controls</a></dt></dl></dd><dt><a href="#id2905044">Access Controls on Shares</a></dt><dd><dl><dt><a href="#id2905115">Share Permissions Management</a></dt></dl></dd><dt><a href="#id2905414">MS Windows Access Control Lists and Unix Interoperability</a></dt><dd><dl><dt><a href="#id2905422">Managing UNIX permissions Using NT Security Dialogs</a></dt><dt><a href="#id2905460">Viewing File Security on a Samba Share</a></dt><dt><a href="#id2905539">Viewing file ownership</a></dt><dt><a href="#id2905661">Viewing File or Directory Permissions</a></dt><dt><a href="#id2905889">Modifying file or directory permissions</a></dt><dt><a href="#id2906041">Interaction with the standard Samba create mask
+ parameters</a></dt><dt><a href="#id2906370">Interaction with the standard Samba file attribute
+ mapping</a></dt></dl></dd><dt><a href="#id2906446">Common Errors</a></dt><dd><dl><dt><a href="#id2906460">Users can not write to a public share</a></dt><dt><a href="#id2906838">I have set force user and samba still makes root the owner of all the files
+ I touch!</a></dt></dl></dd></dl></dd><dt>14. <a href="#locking">File and Record Locking</a></dt><dd><dl><dt><a href="#id2908960">Features and Benefits</a></dt><dt><a href="#id2909016">Discussion</a></dt><dd><dl><dt><a href="#id2906890">Opportunistic Locking Overview</a></dt></dl></dd><dt><a href="#id2907521">Samba Opportunistic Locking Control</a></dt><dd><dl><dt><a href="#id2907630">Example Configuration</a></dt></dl></dd><dt><a href="#id2907890">MS Windows Opportunistic Locking and Caching Controls</a></dt><dd><dl><dt><a href="#id2910326">Workstation Service Entries</a></dt><dt><a href="#id2910353">Server Service Entries</a></dt></dl></dd><dt><a href="#id2910432">Persistent Data Corruption</a></dt><dt><a href="#id2910463">Common Errors</a></dt><dd><dl><dt><a href="#id2910536">locking.tdb error messages</a></dt></dl></dd><dt><a href="#id2910566">Additional Reading</a></dt></dl></dd><dt>15. <a href="#securing-samba">Securing Samba</a></dt><dd><dl><dt><a href="#id2911991">Introduction</a></dt><dt><a href="#id2912024">Features and Benefits</a></dt><dt><a href="#id2910684">Technical Discussion of Protective Measures and Issues</a></dt><dd><dl><dt><a href="#id2910702">Using host based protection</a></dt><dt><a href="#id2910771">User based protection</a></dt><dt><a href="#id2910822">Using interface protection</a></dt><dt><a href="#id2910872">Using a firewall</a></dt><dt><a href="#id2910929">Using a IPC$ share deny</a></dt><dt><a href="#id2910994">NTLMv2 Security</a></dt></dl></dd><dt><a href="#id2911033">Upgrading Samba</a></dt><dt><a href="#id2911056">Common Errors</a></dt><dd><dl><dt><a href="#id2911075">Smbclient works on localhost, but the network is dead</a></dt><dt><a href="#id2911100">Why can users access home directories of other users?</a></dt></dl></dd></dl></dd><dt>16. <a href="#InterdomainTrusts">Interdomain Trust Relationships</a></dt><dd><dl><dt><a href="#id2911618">Features and Benefits</a></dt><dt><a href="#id2911646">Trust Relationship Background</a></dt><dt><a href="#id2911730">Native MS Windows NT4 Trusts Configuration</a></dt><dd><dl><dt><a href="#id2911742">NT4 as the Trusting Domain (ie. creating the trusted account)</a></dt><dt><a href="#id2913717">NT4 as the Trusted Domain (ie. creating trusted account's password)</a></dt></dl></dd><dt><a href="#id2913754">Configuring Samba NT-style Domain Trusts</a></dt><dd><dl><dt><a href="#id2913781">Samba-3 as the Trusting Domain</a></dt><dt><a href="#id2913908">Samba-3 as the Trusted Domain</a></dt></dl></dd><dt><a href="#id2911286">Common Errors</a></dt><dd><dl><dt><a href="#id2911301">Tell me about Trust Relationships using Samba</a></dt></dl></dd></dl></dd><dt>17. <a href="#msdfs">Hosting a Microsoft Distributed File System tree on Samba</a></dt><dd><dl><dt><a href="#id2911399">Features and Benefits</a></dt><dt><a href="#id2912809">Common Errors</a></dt></dl></dd><dt>18. <a href="#printing">Classical Printing Support</a></dt><dd><dl><dt><a href="#id2914332">Features and Benefits</a></dt><dt><a href="#id2914396">Technical Introduction</a></dt><dd><dl><dt><a href="#id2914432">What happens if you send a Job from a Client</a></dt><dt><a href="#id2914502">Printing Related Configuration Parameters</a></dt><dt><a href="#id2917610">Parameters Recommended for Use</a></dt><dt><a href="#id2912970">Parameters for Backwards Compatibility</a></dt><dt><a href="#id2913079">Parameters no longer in use</a></dt></dl></dd><dt><a href="#id2913172">A simple Configuration to Print with Samba-3</a></dt><dd><dl><dt><a href="#id2915178">Verification of "Settings in Use" with testparm</a></dt><dt><a href="#id2915261">A little Experiment to warn you</a></dt></dl></dd><dt><a href="#id2915568">Extended Sample Configuration to Print with Samba-3</a></dt><dt><a href="#id2915660">Detailed Explanation of the Example's Settings</a></dt><dd><dl><dt><a href="#id2915673">The [global] Section</a></dt><dt><a href="#id2925133">The [printers] Section</a></dt><dt><a href="#id2925462">Any [my_printer_name] Section</a></dt><dt><a href="#id2925683">Print Commands</a></dt><dt><a href="#id2925734">Default Print Commands for various Unix Print Subsystems</a></dt><dt><a href="#id2926260">Setting up your own Print Commands</a></dt></dl></dd><dt><a href="#id2926537">Innovations in Samba Printing since 2.2</a></dt><dd><dl><dt><a href="#id2926691">Client Drivers on Samba Server for Point'n'Print</a></dt><dt><a href="#id2926842">The [printer$] Section is removed from Samba-3</a></dt><dt><a href="#id2926955">Creating the [print$] Share</a></dt><dt><a href="#id2927026">Parameters in the [print$] Section</a></dt><dt><a href="#id2927247">Subdirectory Structure in [print$]</a></dt></dl></dd><dt><a href="#id2927408">Installing Drivers into [print$]</a></dt><dd><dl><dt><a href="#id2927502">Setting Drivers for existing Printers with a Client GUI</a></dt><dt><a href="#id2927686">Setting Drivers for existing Printers with
+rpcclient</a></dt></dl></dd><dt><a href="#id2929284">"The Proof of the Pudding lies in the Eating" (Client Driver Insta
+Procedure)</a></dt><dd><dl><dt><a href="#id2929305">The first Client Driver Installation</a></dt><dt><a href="#id2929502">IMPORTANT! Setting Device Modes on new Printers</a></dt><dt><a href="#id2929792">Further Client Driver Install Procedures</a></dt><dt><a href="#id2929887">Always make first Client Connection as root or "printer admin"</a></dt></dl></dd><dt><a href="#id2930029">Other Gotchas</a></dt><dd><dl><dt><a href="#id2930062">Setting Default Print Options for the Client Drivers</a></dt><dt><a href="#id2930496">Supporting large Numbers of Printers</a></dt><dt><a href="#id2930798">Adding new Printers with the Windows NT APW</a></dt><dt><a href="#id2931042">Weird Error Message Cannot connect under a
+different Name</a></dt><dt><a href="#id2931140">Be careful when assembling Driver Files</a></dt><dt><a href="#id2931411">Samba and Printer Ports</a></dt><dt><a href="#id2931481">Avoiding the most common Misconfigurations of the Client Driver</a></dt></dl></dd><dt><a href="#id2931504">The Imprints Toolset</a></dt><dd><dl><dt><a href="#id2931549">What is Imprints?</a></dt><dt><a href="#id2931590">Creating Printer Driver Packages</a></dt><dt><a href="#id2931609">The Imprints Server</a></dt><dt><a href="#id2931634">The Installation Client</a></dt></dl></dd><dt><a href="#id2931786">Add Network Printers at Logon without User Interaction</a></dt><dt><a href="#id2932115">The addprinter command</a></dt><dt><a href="#id2932160">Migration of "Classical" printing to Samba-3</a></dt><dt><a href="#id2932329">Publishing Printer Information in Active Directory or LDAP</a></dt><dt><a href="#id2932343">Common Errors and Problems</a></dt><dd><dl><dt><a href="#id2932356">I give my root password but I don't get access</a></dt><dt><a href="#id2932390">My printjobs get spooled into the spooling directory, but then get lost</a></dt></dl></dd></dl></dd><dt>19. <a href="#CUPS-printing">CUPS Printing Support in Samba 3.0</a></dt><dd><dl><dt><a href="#id2939414">Introduction</a></dt><dd><dl><dt><a href="#id2939421">Features and Benefits</a></dt><dt><a href="#id2939469">Overview</a></dt></dl></dd><dt><a href="#id2939521">Basic Configuration of CUPS support</a></dt><dd><dl><dt><a href="#id2939600">Linking of smbd with libcups.so</a></dt><dt><a href="#id2932509">Simple smb.conf Settings for CUPS</a></dt><dt><a href="#id2932572">More complex smb.conf Settings for
+CUPS</a></dt></dl></dd><dt><a href="#id2932671">Advanced Configuration</a></dt><dd><dl><dt><a href="#id2932692">Central spooling vs. "Peer-to-Peer" printing</a></dt><dt><a href="#id2932719">CUPS/Samba as a "spooling-only" Print Server; "raw" printing
+with Vendor Drivers on Windows Clients</a></dt><dt><a href="#id2932755">Driver Installation Methods on Windows Clients</a></dt><dt><a href="#id2932814">Explicitly enable "raw" printing for
+application/octet-stream!</a></dt><dt><a href="#id2932975">Three familiar Methods for driver upload plus a new one</a></dt></dl></dd><dt><a href="#id2933068">Using CUPS/Samba in an advanced Way -- intelligent printing
+with PostScript Driver Download</a></dt><dd><dl><dt><a href="#id2933143">GDI on Windows -- PostScript on Unix</a></dt><dt><a href="#id2933188">Windows Drivers, GDI and EMF</a></dt><dt><a href="#id2933286">Unix Printfile Conversion and GUI Basics</a></dt><dt><a href="#id2933358">PostScript and Ghostscript</a></dt><dt><a href="#id2933454">Ghostscript -- the Software RIP for non-PostScript Printers</a></dt><dt><a href="#id2933550">PostScript Printer Description (PPD) Specification</a></dt><dt><a href="#id2946373">CUPS can use all Windows-formatted Vendor PPDs</a></dt><dt><a href="#id2946462">CUPS also uses PPDs for non-PostScript Printers</a></dt></dl></dd><dt><a href="#id2946485">The CUPS Filtering Architecture</a></dt><dd><dl><dt><a href="#id2946623">MIME types and CUPS Filters</a></dt><dt><a href="#id2946811">MIME type Conversion Rules</a></dt><dt><a href="#id2946927">Filter Requirements</a></dt><dt><a href="#id2947096">Prefilters</a></dt><dt><a href="#id2947181">pstops</a></dt><dt><a href="#id2947284">pstoraster</a></dt><dt><a href="#id2947440">imagetops and imagetoraster</a></dt><dt><a href="#id2947495">rasterto [printerspecific]</a></dt><dt><a href="#id2947580">CUPS Backends</a></dt><dt><a href="#id2947894">cupsomatic/Foomatic -- how do they fit into the Picture?</a></dt><dt><a href="#id2947997">The Complete Picture</a></dt><dt><a href="#id2948012">mime.convs</a></dt><dt><a href="#id2948065">"Raw" printing</a></dt><dt><a href="#id2948120">"application/octet-stream" printing</a></dt><dt><a href="#id2948335">PostScript Printer Descriptions (PPDs) for non-PS Printers</a></dt><dt><a href="#id2948562">Difference between cupsomatic/foomatic-rip and
+native CUPS printing</a></dt><dt><a href="#id2948719">Examples for filtering Chains</a></dt><dt><a href="#id2948948">Sources of CUPS drivers / PPDs</a></dt><dt><a href="#id2949073">Printing with Interface Scripts</a></dt></dl></dd><dt><a href="#id2949135">Network printing (purely Windows)</a></dt><dd><dl><dt><a href="#id2949151">From Windows Clients to an NT Print Server</a></dt><dt><a href="#id2949190">Driver Execution on the Client</a></dt><dt><a href="#id2949249">Driver Execution on the Server</a></dt></dl></dd><dt><a href="#id2949312">Network Printing (Windows clients -- UNIX/Samba Print
+Servers)</a></dt><dd><dl><dt><a href="#id2949333">From Windows Clients to a CUPS/Samba Print Server</a></dt><dt><a href="#id2949493">Samba receiving Jobfiles and passing them to CUPS</a></dt></dl></dd><dt><a href="#id2949571">Network PostScript RIP: CUPS Filters on Server -- clients use
+PostScript Driver with CUPS-PPDs</a></dt><dd><dl><dt><a href="#id2949626">PPDs for non-PS Printers on UNIX</a></dt><dt><a href="#id2949667">PPDs for non-PS Printers on Windows</a></dt></dl></dd><dt><a href="#id2949732">Windows Terminal Servers (WTS) as CUPS Clients</a></dt><dd><dl><dt><a href="#id2949750">Printer Drivers running in "Kernel Mode" cause many
+Problems</a></dt><dt><a href="#id2949784">Workarounds impose Heavy Limitations</a></dt><dt><a href="#id2949805">CUPS: a "Magical Stone"?</a></dt><dt><a href="#id2949832">PostScript Drivers with no major problems -- even in Kernel
+Mode</a></dt></dl></dd><dt><a href="#id2949866"> Setting up CUPS for driver Download</a></dt><dd><dl><dt><a href="#id2949885">cupsaddsmb: the unknown Utility</a></dt><dt><a href="#id2949976">Prepare your smb.conf for
+cupsaddsmb</a></dt><dt><a href="#id2950023">CUPS Package of "PostScript Driver for WinNT/2k/XP"</a></dt><dt><a href="#id2950220">Recognize the different Driver Files</a></dt><dt><a href="#id2950278">Acquiring the Adobe Driver Files</a></dt><dt><a href="#id2950311">ESP Print Pro Package of "PostScript Driver for
+WinNT/2k/XP"</a></dt><dt><a href="#id2950361">Caveats to be considered</a></dt><dt><a href="#id2950582">What are the Benefits of using the "CUPS PostScript Driver for
+Windows NT/2k/XP" as compared to the Adobe Driver?</a></dt><dt><a href="#id2950763">Run "cupsaddsmb" (quiet Mode)</a></dt><dt><a href="#id2950864">Run "cupsaddsmb" with verbose Output</a></dt><dt><a href="#id2951007">Understanding cupsaddsmb</a></dt><dt><a href="#id2951101">How to recognize if cupsaddsm completed successfully</a></dt><dt><a href="#id2951188">cupsaddsmb with a Samba PDC</a></dt><dt><a href="#id2951223">cupsaddsmb Flowchart</a></dt><dt><a href="#id2951274">Installing the PostScript Driver on a Client</a></dt><dt><a href="#id2951389">Avoiding critical PostScript Driver Settings on the
+Client</a></dt></dl></dd><dt><a href="#id2951523">Installing PostScript Driver Files manually (using
+rpcclient)</a></dt><dd><dl><dt><a href="#id2951638">A Check of the rpcclient man Page</a></dt><dt><a href="#id2951750">Understanding the rpcclient man Page</a></dt><dt><a href="#id2951829">Producing an Example by querying a Windows Box</a></dt><dt><a href="#id2951919">What is required for adddriver and setdriver to succeed</a></dt><dt><a href="#id2952081">Manual Commandline Driver Installation in 15 little Steps</a></dt><dt><a href="#id2952701">Troubleshooting revisited</a></dt></dl></dd><dt><a href="#id2952803">The printing *.tdb Files</a></dt><dd><dl><dt><a href="#id2952906">Trivial DataBase Files</a></dt><dt><a href="#id2952976">Binary Format</a></dt><dt><a href="#id2953038">Losing *.tdb Files</a></dt><dt><a href="#id2953097">Using tdbbackup</a></dt></dl></dd><dt><a href="#id2953159">CUPS Print Drivers from Linuxprinting.org</a></dt><dd><dl><dt><a href="#id2953265">foomatic-rip and Foomatic explained</a></dt><dt><a href="#id2953893">foomatic-rip and Foomatic-PPD Download and Installation</a></dt></dl></dd><dt><a href="#id2954351">Page Accounting with CUPS</a></dt><dd><dl><dt><a href="#id2954382">Setting up Quotas</a></dt><dt><a href="#id2954413">Correct and incorrect Accounting</a></dt><dt><a href="#id2954454">Adobe and CUPS PostScript Drivers for Windows Clients</a></dt><dt><a href="#id2954526">The page_log File Syntax</a></dt><dt><a href="#id2954628">Possible Shortcomings</a></dt><dt><a href="#id2954699">Future Developments</a></dt><dt><a href="#id2954747">Other Accounting Tools</a></dt></dl></dd><dt><a href="#id2954762">Additional Material</a></dt><dt><a href="#id2954956">Auto-Deletion or Preservation of CUPS Spool Files</a></dt><dd><dl><dt><a href="#id2955001">CUPS Configuration Settings explained</a></dt><dt><a href="#id2955083">Pre-conditions</a></dt><dt><a href="#id2955144">Manual Configuration</a></dt></dl></dd><dt><a href="#id2955162">When not to use Samba to print to
+CUPS</a></dt><dt><a href="#id2955180">In Case of Trouble.....</a></dt><dd><dl><dt><a href="#id2955214">Where to find Documentation</a></dt><dt><a href="#id2955227">How to ask for Help</a></dt><dt><a href="#id2955240">Where to find Help</a></dt></dl></dd><dt><a href="#id2955254">Appendix</a></dt><dd><dl><dt><a href="#id2955261">Printing from CUPS to Windows attached
+Printers</a></dt><dt><a href="#id2955455">More CUPS filtering Chains</a></dt><dt><a href="#id2955709">Trouble Shooting Guidelines to fix typical Samba printing
+Problems</a></dt><dt><a href="#id2956815">An Overview of the CUPS Printing Processes</a></dt></dl></dd></dl></dd><dt>20. <a href="#VFS">Stackable VFS modules</a></dt><dd><dl><dt><a href="#id2958218">Features and Benefits</a></dt><dt><a href="#id2958235">Discussion</a></dt><dt><a href="#id2958286">Included modules</a></dt><dd><dl><dt><a href="#id2956883">audit</a></dt><dt><a href="#id2956922">extd_audit</a></dt><dt><a href="#id2957044">fake_perms</a></dt><dt><a href="#id2957063">recycle</a></dt><dt><a href="#id2957202">netatalk</a></dt></dl></dd><dt><a href="#id2957247">VFS modules available elsewhere</a></dt><dd><dl><dt><a href="#id2957269">DatabaseFS</a></dt><dt><a href="#id2957323">vscan</a></dt></dl></dd><dt><a href="#id2957352">Common Errors</a></dt></dl></dd><dt>21. <a href="#winbind">Integrated Logon Support using Winbind</a></dt><dd><dl><dt><a href="#id2957847">Features and Benefits</a></dt><dt><a href="#id2957875">Introduction</a></dt><dt><a href="#id2959857">What Winbind Provides</a></dt><dd><dl><dt><a href="#id2959916">Target Uses</a></dt></dl></dd><dt><a href="#id2959947">How Winbind Works</a></dt><dd><dl><dt><a href="#id2959975">Microsoft Remote Procedure Calls</a></dt><dt><a href="#id2960008">Microsoft Active Directory Services</a></dt><dt><a href="#id2960031">Name Service Switch</a></dt><dt><a href="#id2957393">Pluggable Authentication Modules</a></dt><dt><a href="#id2957465">User and Group ID Allocation</a></dt><dt><a href="#id2957499">Result Caching</a></dt></dl></dd><dt><a href="#id2957528">Installation and Configuration</a></dt><dd><dl><dt><a href="#id2957555">Introduction</a></dt><dt><a href="#id2957630">Requirements</a></dt><dt><a href="#id2958907">Testing Things Out</a></dt></dl></dd><dt><a href="#id2963255">Conclusion</a></dt><dt><a href="#id2963274">Common Errors</a></dt></dl></dd><dt>22. <a href="#AdvancedNetworkManagement">Advanced Network Manangement</a></dt><dd><dl><dt><a href="#id2964647">Features and Benefits</a></dt><dt><a href="#id2964678">Remote Server Administration</a></dt><dt><a href="#id2963360">Remote Desktop Management</a></dt><dd><dl><dt><a href="#id2963377">Remote Management from NoMachines.Com</a></dt></dl></dd><dt><a href="#id2963579">Network Logon Script Magic</a></dt><dd><dl><dt><a href="#id2963774">Adding printers without user intervention</a></dt></dl></dd><dt><a href="#id2963806">Common Errors</a></dt></dl></dd><dt>23. <a href="#PolicyMgmt">System and Account Policies</a></dt><dd><dl><dt><a href="#id2964204">Features and Benefits</a></dt><dt><a href="#id2964256">Creating and Managing System Policies</a></dt><dd><dl><dt><a href="#id2964367">Windows 9x/Me Policies</a></dt><dt><a href="#id2963915">Windows NT4 Style Policy Files</a></dt><dt><a href="#id2964048">MS Windows 200x / XP Professional Policies</a></dt></dl></dd><dt><a href="#id2965490">Managing Account/User Policies</a></dt><dd><dl><dt><a href="#id2965591">Samba Editreg Toolset</a></dt><dt><a href="#id2965611">Windows NT4/200x</a></dt><dt><a href="#id2965631">Samba PDC</a></dt></dl></dd><dt><a href="#id2965676">System Startup and Logon Processing Overview</a></dt><dt><a href="#id2965823">Common Errors</a></dt><dd><dl><dt><a href="#id2965837">Policy Does Not Work</a></dt></dl></dd></dl></dd><dt>24. <a href="#ProfileMgmt">Desktop Profile Management</a></dt><dd><dl><dt><a href="#id2965940">Features and Benefits</a></dt><dt><a href="#id2965973">Roaming Profiles</a></dt><dd><dl><dt><a href="#id2966014">Samba Configuration for Profile Handling</a></dt><dt><a href="#id2971377">Windows Client Profile Configuration Information</a></dt><dt><a href="#id2972314">Sharing Profiles between W9x/Me and NT4/200x/XP workstations</a></dt><dt><a href="#id2972378">Profile Migration from Windows NT4/200x Server to Samba</a></dt></dl></dd><dt><a href="#id2972638">Mandatory profiles</a></dt><dt><a href="#id2972696">Creating/Managing Group Profiles</a></dt><dt><a href="#id2972742">Default Profile for Windows Users</a></dt><dd><dl><dt><a href="#id2972762">MS Windows 9x/Me</a></dt><dt><a href="#id2972910">MS Windows NT4 Workstation</a></dt><dt><a href="#id2973464">MS Windows 200x/XP</a></dt></dl></dd><dt><a href="#id2973968">Common Errors</a></dt><dd><dl><dt><a href="#id2973980">How does one set up roaming profiles for just one (or a few) user/s or group/s?</a></dt><dt><a href="#id2974043">Can NOT use Roaming Profiles</a></dt><dt><a href="#id2974262">Changing the default profile</a></dt></dl></dd></dl></dd><dt>25. <a href="#pam">PAM based Distributed Authentication</a></dt><dd><dl><dt><a href="#id2975719">Features and Benefits</a></dt><dt><a href="#id2974574">Technical Discussion</a></dt><dd><dl><dt><a href="#id2974590">PAM Configuration Syntax</a></dt><dt><a href="#id2975256">Example System Configurations</a></dt><dt><a href="#id2977688">smb.conf PAM Configuration</a></dt><dt><a href="#id2977745">Remote CIFS Authentication using winbindd.so</a></dt><dt><a href="#id2977829">Password Synchronization using pam_smbpass.so</a></dt></dl></dd><dt><a href="#id2978196">Common Errors</a></dt><dd><dl><dt><a href="#id2978209">pam_winbind problem</a></dt></dl></dd></dl></dd><dt>26. <a href="#integrate-ms-networks">Integrating MS Windows networks with Samba</a></dt><dd><dl><dt><a href="#id2979952">Features and Benefits</a></dt><dt><a href="#id2979977">Background Information</a></dt><dt><a href="#id2980022">Name Resolution in a pure Unix/Linux world</a></dt><dd><dl><dt><a href="#id2980073">/etc/hosts</a></dt><dt><a href="#id2980198">/etc/resolv.conf</a></dt><dt><a href="#id2978348">/etc/host.conf</a></dt><dt><a href="#id2978390">/etc/nsswitch.conf</a></dt></dl></dd><dt><a href="#id2978479">Name resolution as used within MS Windows networking</a></dt><dd><dl><dt><a href="#id2978604">The NetBIOS Name Cache</a></dt><dt><a href="#id2978648">The LMHOSTS file</a></dt><dt><a href="#id2978762">HOSTS file</a></dt><dt><a href="#id2978795">DNS Lookup</a></dt><dt><a href="#id2978820">WINS Lookup</a></dt></dl></dd><dt><a href="#id2978890">Common Errors</a></dt><dd><dl><dt><a href="#id2978906">My Boomerang Won't Come Back</a></dt><dt><a href="#id2978938">Very Slow Network Connections</a></dt><dt><a href="#id2978989">Samba server name change problem</a></dt></dl></dd></dl></dd><dt>27. <a href="#unicode">Unicode/Charsets</a></dt><dd><dl><dt><a href="#id2979144">Features and Benefits</a></dt><dt><a href="#id2979186">What are charsets and unicode?</a></dt><dt><a href="#id2979255">Samba and charsets</a></dt><dt><a href="#id2979355">Conversion from old names</a></dt><dt><a href="#id2979401">Japanese charsets</a></dt></dl></dd><dt>28. <a href="#Backup">Samba Backup Techniques</a></dt><dd><dl><dt><a href="#id2981995">Note</a></dt><dt><a href="#id2982016">Features and Benefits</a></dt></dl></dd><dt>29. <a href="#SambaHA">High Availability Options</a></dt><dd><dl><dt><a href="#id2981826">Note</a></dt></dl></dd></dl></dd><dt>IV. <a href="#migration">Migration and Updating</a></dt><dd><dl><dt>30. <a href="#upgrading-to-3.0">Upgrading from Samba-2.x to Samba-3.0.0</a></dt><dd><dl><dt><a href="#id2983161">Charsets</a></dt><dt><a href="#id2983184">Obsolete configuration options</a></dt><dt><a href="#id2983238">Password Backend</a></dt></dl></dd><dt>31. <a href="#NT4Migration">Migration from NT4 PDC to Samba-3 PDC</a></dt><dd><dl><dt><a href="#id2982481">Planning and Getting Started</a></dt><dd><dl><dt><a href="#id2982505">Objectives</a></dt><dt><a href="#id2981433">Steps In Migration Process</a></dt></dl></dd><dt><a href="#id2983650">Migration Options</a></dt><dd><dl><dt><a href="#id2983731">Planning for Success</a></dt><dt><a href="#id2983972">Samba Implementation Choices</a></dt></dl></dd></dl></dd><dt>32. <a href="#SWAT">SWAT - The Samba Web Administration Tool</a></dt><dd><dl><dt><a href="#id2984279">Features and Benefits</a></dt><dd><dl><dt><a href="#id2984129">Enabling SWAT for use</a></dt><dt><a href="#id2985018">Securing SWAT through SSL</a></dt><dt><a href="#id2985131">The SWAT Home Page</a></dt><dt><a href="#id2985194">Global Settings</a></dt><dt><a href="#id2985300">Share Settings</a></dt><dt><a href="#id2985365">Printers Settings</a></dt><dt><a href="#id2985429">The SWAT Wizard</a></dt><dt><a href="#id2985477">The Status Page</a></dt><dt><a href="#id2985529">The View Page</a></dt><dt><a href="#id2985552">The Password Change Page</a></dt></dl></dd></dl></dd></dl></dd><dt>V. <a href="#troubleshooting">Troubleshooting</a></dt><dd><dl><dt>33. <a href="#diagnosis">The samba checklist</a></dt><dd><dl><dt><a href="#id2985673">Introduction</a></dt><dt><a href="#id2985707">Assumptions</a></dt><dt><a href="#id2985879">The tests</a></dt><dt><a href="#id2989430">Still having troubles?</a></dt></dl></dd><dt>34. <a href="#problems">Analysing and solving samba problems</a></dt><dd><dl><dt><a href="#id2990823">Diagnostics tools</a></dt><dt><a href="#id2989549">Installing 'Network Monitor' on an NT Workstation or a Windows 9x box</a></dt><dt><a href="#id2989832">Useful URL's</a></dt><dt><a href="#id2989876">Getting help from the mailing lists</a></dt><dt><a href="#id2990029">How to get off the mailinglists</a></dt></dl></dd><dt>35. <a href="#bugreport">Reporting Bugs</a></dt><dd><dl><dt><a href="#id2992343">Introduction</a></dt><dt><a href="#id2992402">General info</a></dt><dt><a href="#id2992438">Debug levels</a></dt><dt><a href="#id2990534">Internal errors</a></dt><dt><a href="#id2990642">Attaching to a running process</a></dt><dt><a href="#id2990144">Patches</a></dt></dl></dd></dl></dd><dt>VI. <a href="#Appendixes">Appendixes</a></dt><dd><dl><dt>36. <a href="#compiling">How to compile SAMBA</a></dt><dd><dl><dt><a href="#id2990261">Access Samba source code via CVS</a></dt><dd><dl><dt><a href="#id2990268">Introduction</a></dt><dt><a href="#id2990297">CVS Access to samba.org</a></dt></dl></dd><dt><a href="#id2991766">Accessing the samba sources via rsync and ftp</a></dt><dt><a href="#id2991814">Verifying Samba's PGP signature</a></dt><dt><a href="#id2991949">Building the Binaries</a></dt><dd><dl><dt><a href="#id2992086">Compiling samba with Active Directory support</a></dt></dl></dd><dt><a href="#id2992982">Starting the smbd and nmbd</a></dt><dd><dl><dt><a href="#id2993073">Starting from inetd.conf</a></dt><dt><a href="#id2993277">Alternative: starting it as a daemon</a></dt></dl></dd><dt><a href="#id2993372">Common Errors</a></dt></dl></dd><dt>37. <a href="#Portability">Portability</a></dt><dd><dl><dt><a href="#id2994651">HPUX</a></dt><dt><a href="#id2994736">SCO Unix</a></dt><dt><a href="#id2994764">DNIX</a></dt><dt><a href="#id2994934">RedHat Linux Rembrandt-II</a></dt><dt><a href="#id2994978">AIX</a></dt><dd><dl><dt><a href="#id2994984">Sequential Read Ahead</a></dt></dl></dd><dt><a href="#id2995010">Solaris</a></dt><dd><dl><dt><a href="#id2995017">Locking improvements</a></dt><dt><a href="#winbind-solaris9">Winbind on Solaris 9</a></dt></dl></dd></dl></dd><dt>38. <a href="#Other-Clients">Samba and other CIFS clients</a></dt><dd><dl><dt><a href="#id2995794">Macintosh clients?</a></dt><dt><a href="#id2995866">OS2 Client</a></dt><dd><dl><dt><a href="#id2995873">How can I configure OS/2 Warp Connect or
+ OS/2 Warp 4 as a client for Samba?</a></dt><dt><a href="#id2995488">How can I configure OS/2 Warp 3 (not Connect),
+ OS/2 1.2, 1.3 or 2.x for Samba?</a></dt><dt><a href="#id2995548">How do I get printer driver download working
+ for OS/2 clients?</a></dt></dl></dd><dt><a href="#id2995645">Windows for Workgroups</a></dt><dd><dl><dt><a href="#id2995107">Use latest TCP/IP stack from Microsoft</a></dt><dt><a href="#id2995197">Delete .pwl files after password change</a></dt><dt><a href="#id2995227">Configure WfW password handling</a></dt><dt><a href="#id2995273">Case handling of passwords</a></dt><dt><a href="#id2995303">Use TCP/IP as default protocol</a></dt><dt><a href="#id2995320">Speed improvement</a></dt></dl></dd><dt><a href="#id2995367">Windows '95/'98</a></dt><dd><dl><dt><a href="#id2996396">Speed improvement</a></dt></dl></dd><dt><a href="#id2996420">Windows 2000 Service Pack 2</a></dt><dt><a href="#id2996531">Windows NT 3.1</a></dt></dl></dd><dt>39. <a href="#speed">Samba Performance Tuning</a></dt><dd><dl><dt><a href="#id2996649">Comparisons</a></dt><dt><a href="#id2996693">Socket options</a></dt><dt><a href="#id2996767">Read size</a></dt><dt><a href="#id2996811">Max xmit</a></dt><dt><a href="#id2996864">Log level</a></dt><dt><a href="#id2996886">Read raw</a></dt><dt><a href="#id2997829">Write raw</a></dt><dt><a href="#id2997871">Slow Logins</a></dt><dt><a href="#id2997892">LDAP</a></dt><dt><a href="#id2997917">Client tuning</a></dt><dt><a href="#id2997940">Samba performance problem due changing kernel</a></dt><dt><a href="#id2997973">Corrupt tdb Files</a></dt></dl></dd><dt>40. <a href="#DNSDHCP">DNS and DHCP Configuration Guide</a></dt><dd><dl><dt><a href="#id2998691">Note</a></dt></dl></dd><dt>41. <a href="#Further-Resources">Further Resources</a></dt><dd><dl><dt><a href="#id2998110">Websites</a></dt><dt><a href="#id2998494">Related updates from microsoft</a></dt><dt><a href="#id2998561">Books</a></dt></dl></dd></dl></dd><dt><a href="#id2998572">Index</a></dt></dl></div><div class="list-of-figures"><p><b>List of Figures</b></p><dl><dt>19.1. <a href="#id2933252">Windows Printing to a local Printer</a></dt><dt>19.2. <a href="#id2933404">Printing to a Postscript Printer</a></dt><dt>19.3. <a href="#id2933484">Ghostscript as a RIP for non-postscript printers</a></dt><dt>19.4. <a href="#id2947147">Prefiltering in CUPS to form Postscript</a></dt><dt>19.5. <a href="#id2947212">Adding Device-specific Print Options</a></dt><dt>19.6. <a href="#id2947314">Postscript to intermediate Raster format</a></dt><dt>19.7. <a href="#id2947366">CUPS-raster production using Ghostscript</a></dt><dt>19.8. <a href="#id2947461">Image format to CUPS-raster format conversion</a></dt><dt>19.9. <a href="#id2947546">Raster to Printer Specific formats</a></dt><dt>19.10. <a href="#id2948613">cupsomatic/foomatic processing versus Native CUPS</a></dt><dt>19.11. <a href="#id2949215">Print Driver execution on the Client</a></dt><dt>19.12. <a href="#id2949271">Print Driver execution on the Server</a></dt><dt>19.13. <a href="#id2949459">Printing via CUPS/samba server</a></dt><dt>19.14. <a href="#id2951240">cupsaddsmb flowchart</a></dt><dt>19.15. <a href="#id2956826">CUPS Printing Overview</a></dt></dl></div><div class="list-of-tables"><p><b>List of Tables</b></p><dl><dt>7.1. <a href="#id2879589">Assumptions</a></dt><dt>10.1. <a href="#id2889940">Browse subnet example 1</a></dt><dt>10.2. <a href="#id2890050">Browse subnet example 2</a></dt><dt>10.3. <a href="#id2890149">Browse subnet example 3</a></dt><dt>10.4. <a href="#id2890249">Browse subnet example 4</a></dt><dt>11.1. <a href="#id2896974">Attributes in the sambaAccount objectclass (LDAP)</a></dt><dt>11.2. <a href="#id2897685">Basic smb.conf options for MySQL passdb backend</a></dt><dt>11.3. <a href="#id2897810">MySQL field names for MySQL passdb backend</a></dt><dt>13.1. <a href="#id2899431">Managing directories with unix and windows</a></dt><dt>13.2. <a href="#id2900001">User and Group Based Controls</a></dt><dt>13.3. <a href="#id2900234">File and Directory Permission Based Controls</a></dt><dt>13.4. <a href="#id2900482">Other Controls</a></dt><dt>20.1. <a href="#id2956961">Extended Auditing Log Information</a></dt><dt>24.1. <a href="#id2973257">User Shell Folder registry keys default values</a></dt><dt>24.2. <a href="#id2973402">Defaults of profile settings registry keys</a></dt><dt>24.3. <a href="#id2973656">Defaults of default user profile paths registry keys</a></dt><dt>25.1. <a href="#id2977860">Options recognized by pam_smbpass</a></dt><dt>31.1. <a href="#id2983665">The 3 Major Site Types</a></dt><dt>31.2. <a href="#id2983801">Nature of the Conversion Choices</a></dt></dl></div><div class="list-of-examples"><p><b>List of Examples</b></p><dl><dt>12.1. <a href="#id2898973">smbgrpadd.sh</a></dt><dt>13.1. <a href="#id2899836">Example File</a></dt></dl></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="introduction"></a>General Installation</h1></div></div><div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id2866390"></a>Preparing Samba for Configuration</h1></div></div><div></div></div><p>This section of the Samba-HOWTO-Collection contains general info on how to install samba
+and how to configure the parts of samba you will most likely need.
+PLEASE read this.</p><div class="toc"><p><b>Table of Contents</b></p><dl><dt>1. <a href="#IntroSMB">Introduction to Samba</a></dt><dd><dl><dt><a href="#id2867729">Background</a></dt><dt><a href="#id2867783">Terminology</a></dt><dt><a href="#id2866506">Related Projects</a></dt><dt><a href="#id2866575">SMB Methodology</a></dt><dt><a href="#id2866662">Epilogue</a></dt><dt><a href="#id2866735">Miscellaneous</a></dt></dl></dd><dt>2. <a href="#install">How to Install and Test SAMBA</a></dt><dd><dl><dt><a href="#id2867501">Obtaining and installing samba</a></dt><dt><a href="#id2867544">Configuring samba (smb.conf)</a></dt><dd><dl><dt><a href="#id2867117">Example Configuration</a></dt><dt><a href="#id2867260">SWAT</a></dt></dl></dd><dt><a href="#id2867305">Try listing the shares available on your
+ server</a></dt><dt><a href="#id2866810">Try connecting with the unix client</a></dt><dt><a href="#id2866912">Try connecting from a DOS, WfWg, Win9x, WinNT,
+ Win2k, OS/2, etc... client</a></dt><dt><a href="#id2866973">What If Things Don't Work?</a></dt><dt><a href="#id2867003">Common Errors</a></dt><dd><dl><dt><a href="#id2867016">Why are so many smbd processes eating memory?</a></dt><dt><a href="#id2868395">I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs</a></dt></dl></dd></dl></dd><dt>3. <a href="#FastStart">FastStart for the Impatient</a></dt><dd><dl><dt><a href="#id2868843">Note</a></dt></dl></dd></dl></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="IntroSMB"></a>Chapter 1. Introduction to Samba</h2></div><div><div class="author"><h3 class="author"><span class="firstname">David</span> <span class="surname">Lechnyr</span></h3><div class="affiliation"><span class="orgname">Unofficial HOWTO<br></span><div class="address"><p><tt class="email"><<a href="mailto:david@lechnyr.com">david@lechnyr.com</a>></tt></p></div></div></div></div><div><p class="pubdate">April 14, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2867729">Background</a></dt><dt><a href="#id2867783">Terminology</a></dt><dt><a href="#id2866506">Related Projects</a></dt><dt><a href="#id2866575">SMB Methodology</a></dt><dt><a href="#id2866662">Epilogue</a></dt><dt><a href="#id2866735">Miscellaneous</a></dt></dl></div><p>“<span class="quote">
+"If you understand what you're doing, you're not learning anything."
+-- Anonymous
+</span>”</p><p>
+Samba is a file and print server for Windows-based clients using TCP/IP as the underlying
+transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of Samba's big
+strengths is that you can use it to blend your mix of Windows and Linux machines together
+without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed
+by a global team of about 30 active programmers and was originally developed by Andrew Tridgell.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2867729"></a>Background</h2></div></div><div></div></div><p>
+Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed
+Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was
+originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only
+ran over UDP. When there was a need to run it over TCP so that it would be compatible
+with DECnet 3.0, it was redesigned, submitted to The Open Group, and officially became
+known as DCE/RPC. Microsoft came along and decided, rather than pay $20 per seat to
+license this technology, to reimplement DCE/RPC themselves as MSRPC. From this, the
+concept continued in the form of SMB (Server Message Block, or the "what") using the
+NetBIOS (Network Basic Input/Output System, or the "how") compatibility layer. You can
+run SMB (i.e., transport) over several different protocols; many different implementations
+arose as a result, including NBIPX (NetBIOS over IPX, NwLnkNb, or NWNBLink) and NBT
+(NetBIOS over TCP/IP, or NetBT). As the years passed, NBT became the most common form
+of implementation until the advance of "Direct-Hosted TCP" -- the Microsoft marketing
+term for eliminating NetBIOS entirely and running SMB by itself across TCP port 445
+only. As of yet, direct-hosted TCP has yet to catch on.
+</p><p>
+Perhaps the best summary of the origins of SMB are voiced in the 1997 article titled, CIFS:
+Common Insecurities Fail Scrutiny:
+</p><p><span class="emphasis"><em>
+Several megabytes of NT-security archives, random whitepapers, RFCs, the CIFS spec, the Samba
+stuff, a few MS knowledge-base articles, strings extracted from binaries, and packet dumps have
+been dutifully waded through during the information-gathering stages of this project, and there
+are *still* many missing pieces... While often tedious, at least the way has been generously
+littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they
+thinking?
+</em></span></p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2867783"></a>Terminology</h2></div></div><div></div></div><div class="itemizedlist"><ul type="disc"><li><p>
+ SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol.
+ </p></li><li><p>
+ CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently
+ decided that SMB needed the word "Internet" in it, so they changed it to CIFS.
+ </p></li><li><p>
+ Direct-Hosted: A method of providing file/printer sharing services over port 445/tcp
+ only using DNS for name resolution instead of WINS.
+ </p></li><li><p>
+ IPC: Acronym for "Inter-Process Communication". A method to communicate specific
+ information between programs.
+ </p></li><li><p>
+ Marshalling: - A method of serializing (i.e., sequential ordering of) variable data
+ suitable for transmission via a network connection or storing in a file. The source
+ data can be re-created using a similar process called unmarshalling.
+ </p></li><li><p>
+ NetBIOS: Acronym for "Network Basic Input/Output System". This is not a protocol;
+ it is a method of communication across an existing protocol. This is a standard which
+ was originally developed for IBM by Sytek in 1983. To exaggerate the analogy a bit,
+ it can help to think of this in comparison your computer's BIOS -- it controls the
+ essential functions of your input/output hardware -- whereas NetBIOS controls the
+ essential functions of your input/output traffic via the network. Again, this is a bit
+ of an exaggeration but it should help that paradigm shift. What is important to realize
+ is that NetBIOS is a transport standard, not a protocol. Unfortunately, even technically
+ brilliant people tend to interchange NetBIOS with terms like NetBEUI without a second
+ thought; this will cause no end (and no doubt) of confusion.
+ </p></li><li><p>
+ NetBEUI: Acronym for the "NetBIOS Extended User Interface". Unlike NetBIOS, NetBEUI
+ is a protocol, not a standard. It is also not routable, so traffic on one side of a
+ router will be unable to communicate with the other side. Understanding NetBEUI is
+ not essential to deciphering SMB; however it helps to point out that it is not the
+ same as NetBIOS and to improve your score in trivia at parties. NetBEUI was originally
+ referred to by Microsoft as "NBF", or "The Windows NT NetBEUI Frame protocol driver".
+ It is not often heard from these days.
+ </p></li><li><p>
+ NBT: Acronym for "NetBIOS over TCP"; also known as "NetBT". Allows the continued use
+ of NetBIOS traffic proxied over TCP/IP. As a result, NetBIOS names are made
+ to IP addresses and NetBIOS name types are conceptually equivalent to TCP/IP ports.
+ This is how file and printer sharing are accomplished in Windows 95/98/ME. They
+ traditionally rely on three ports: NetBIOS Name Service (nbname) via UDP port 137,
+ NetBIOS Datagram Service (nbdatagram) via UDP port 138, and NetBIOS Session Service
+ (nbsession) via TCP port 139. All name resolution is done via WINS, NetBIOS broadcasts,
+ and DNS. NetBIOS over TCP is documented in RFC 1001 (Concepts and methods) and RFC 1002
+ (Detailed specifications).
+ </p></li><li><p>
+ W2K: Acronym for Windows 2000 Professional or Server
+ </p></li><li><p>
+ W3K: Acronym for Windows 2003 Server
+ </p></li></ul></div><p>If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at
+<a href="http://www.samba.org/" target="_top">http://www.samba.org</a>).
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2866506"></a>Related Projects</h2></div></div><div></div></div><p>
+There are currently two network filesystem client projects for Linux that are directly
+related to Samba: SMBFS and CIFS VFS. These are both available in the Linux kernel itself.
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ SMBFS (Server Message Block File System) allows you to mount SMB shares (the protocol
+ that Microsoft Windows and OS/2 Lan Manager use to share files and printers
+ over local networks) and access them just like any other Unix directory. This is useful
+ if you just want to mount such filesystems without being a SMBFS server.
+ </p></li><li><p>
+ CIFS VFS (Common Internet File System Virtual File System) is the successor to SMBFS, and
+ is being actively developed for the upcoming version of the Linux kernel. The intent of this module
+ is to provide advanced network file system functionality including support for dfs (heirarchical
+ name space), secure per-user session establishment, safe distributed caching (oplock),
+ optional packet signing, Unicode and other internationalization improvements, and optional
+ Winbind (nsswitch) integration.
+ </p></li></ul></div><p>
+Again, it's important to note that these are implementations for client filesystems, and have
+nothing to do with acting as a file and print server for SMB/CIFS clients.
+</p><p>
+There are other Open Source CIFS client implementations, such as the
+<a href="http://jcifs.samba.org/" target="_top">jCIFS project</a>
+which provides an SMB client toolkit written in Java.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2866575"></a>SMB Methodology</h2></div></div><div></div></div><p>
+Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns),
+UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS
+session service, or netbios-ssn). Anyone looking at their network with a good
+packet sniffer will be amazed at the amount of traffic generated by just opening
+up a single file. In general, SMB sessions are established in the following order:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ "TCP Connection" - establish 3-way handshake (connection) to port 139/tcp
+ or 445/tcp.
+ </p></li><li><p>
+ "NetBIOS Session Request" - using the following "Calling Names": The local
+ machine's NetBIOS name plus the 16th character 0x00; The server's NetBIOS
+ name plus the 16th character 0x20
+ </p></li><li><p>
+ "SMB Negotiate Protocol" - determine the protocol dialect to use, which will
+ be one of the following: PC Network Program 1.0 (Core) - share level security
+ mode only; Microsoft Networks 1.03 (Core Plus) - share level security
+ mode only; Lanman1.0 (LAN Manager 1.0) - uses Challenge/Response
+ Authentication; Lanman2.1 (LAN Manager 2.1) - uses Challenge/Response
+ Authentication; NT LM 0.12 (NT LM 0.12) - uses Challenge/Response
+ Authentication
+ </p></li><li><p>
+ SMB Session Startup. Passwords are encrypted (or not) according to one of
+ the following methods: Null (no encryption); Cleartext (no encryption); LM
+ and NTLM; NTLM; NTLMv2
+ </p></li><li><p>
+ SMB Tree Connect: Connect to a share name (e.g., \\servername\share); Connect
+ to a service type (e.g., IPC$ named pipe)
+ </p></li></ul></div><p>
+A good way to examine this process in depth is to try out
+<a href="http://www.securityfriday.com/ToolDownload/SWB/swb_doc.html" target="_top">SecurityFriday's SWB program</a>.
+It allows you to walk through the establishment of a SMB/CIFS session step by step.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2866662"></a>Epilogue</h2></div></div><div></div></div><p>“<span class="quote">
+What's fundamentally wrong is that nobody ever had any taste when they
+did it. Microsoft has been very much into making the user interface look good,
+but internally it's just a complete mess. And even people who program for Microsoft
+and who have had years of experience, just don't know how it works internally.
+Worse, nobody dares change it. Nobody dares to fix bugs because it's such a
+mess that fixing one bug might just break a hundred programs that depend on
+that bug. And Microsoft isn't interested in anyone fixing bugs -- they're interested
+in making money. They don't have anybody who takes pride in Windows 95 as an
+operating system.
+</span>”</p><p>“<span class="quote">
+People inside Microsoft know it's a bad operating system and they still
+continue obviously working on it because they want to get the next version out
+because they want to have all these new features to sell more copies of the
+system.
+</span>”</p><p>“<span class="quote">
+The problem with that is that over time, when you have this kind of approach,
+and because nobody understands it, because nobody REALLY fixes bugs (other than
+when they're really obvious), the end result is really messy. You can't trust
+it because under certain circumstances it just spontaneously reboots or just
+halts in the middle of something that shouldn't be strange. Normally it works
+fine and then once in a blue moon for some completely unknown reason, it's dead,
+and nobody knows why. Not Microsoft, not the experienced user and certainly
+not the completely clueless user who probably sits there shivering thinking
+"What did I do wrong?" when they didn't do anything wrong at all.
+</span>”</p><p>“<span class="quote">
+That's what's really irritating to me."
+</span>”</p><p>--
+<a href="http://hr.uoregon.edu/davidrl/boot.txt" target="_top">Linus Torvalds, from an interview with BOOT Magazine, Sept 1998</a>
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2866735"></a>Miscellaneous</h2></div></div><div></div></div><p>
+This chapter is Copyright 2003 David Lechnyr (david at lechnyr dot com).
+Permission is granted to copy, distribute and/or modify this document under the terms
+of the GNU Free Documentation License, Version 1.2 or any later version published by the Free
+Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt.
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="install"></a>Chapter 2. How to Install and Test SAMBA</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:tridge@samba.org">tridge@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Karl</span> <span class="surname">Auer</span></h3></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2867501">Obtaining and installing samba</a></dt><dt><a href="#id2867544">Configuring samba (smb.conf)</a></dt><dd><dl><dt><a href="#id2867117">Example Configuration</a></dt><dt><a href="#id2867260">SWAT</a></dt></dl></dd><dt><a href="#id2867305">Try listing the shares available on your
+ server</a></dt><dt><a href="#id2866810">Try connecting with the unix client</a></dt><dt><a href="#id2866912">Try connecting from a DOS, WfWg, Win9x, WinNT,
+ Win2k, OS/2, etc... client</a></dt><dt><a href="#id2866973">What If Things Don't Work?</a></dt><dt><a href="#id2867003">Common Errors</a></dt><dd><dl><dt><a href="#id2867016">Why are so many smbd processes eating memory?</a></dt><dt><a href="#id2868395">I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs</a></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2867501"></a>Obtaining and installing samba</h2></div></div><div></div></div><p>
+ Binary packages of samba are included in almost any Linux or
+ Unix distribution. There are also some packages available at
+ <a href="http://samba.org/" target="_top">the samba homepage</a>.
+ </p><p>If you need to compile samba from source, check the
+ <a href="#compiling" title="Chapter 36. How to compile SAMBA">appropriate appendix chapter</a>.</p><p>If you have already installed samba, or if your operating system
+ was pre-installed with samba, then you may not need to bother with this
+ chapter. On the other hand, you may want to read this chapter anyhow
+ for information about updating samba.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2867544"></a>Configuring samba (smb.conf)</h2></div></div><div></div></div><p>
+ Samba's configuration is stored in the <tt class="filename">smb.conf</tt> file,
+ that usually resides in <tt class="filename">/etc/samba/smb.conf</tt>
+ or <tt class="filename">/usr/local/samba/lib/smb.conf</tt>. You can either
+ edit this file yourself or do it using one of the many graphical
+ tools that are available, such as the web-based interface swat, that
+ is included with samba.
+ </p><div xmlns:ns2="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2867117"></a>Example Configuration</h3></div></div><div></div></div><p>
+ There are sample configuration files in the examples subdirectory in the
+ distribution. I suggest you read them carefully so you can see how the options
+ go together in practice. See the man page for all the options.
+ </p><p>
+ The simplest useful configuration file would be something like this:
+ </p><ns2:p>
+ </ns2:p><pre class="programlisting">
+ [global]
+ workgroup = MYGROUP
+
+ [homes]
+ guest ok = no
+ read only = no
+ </pre><ns2:p>
+ </ns2:p><p>
+ This will allow connections by anyone with an account on the server, using either
+ their login name or "<i class="parameter"><tt>homes</tt></i>" as the service name.
+ (Note that the workgroup that Samba must also be set.)
+ </p><p>
+ Make sure you put the <tt class="filename">smb.conf</tt> file in the same place
+ you specified in the<tt class="filename">Makefile</tt> (the default is to
+ look for it in <tt class="filename">/usr/local/samba/lib/</tt>).
+ </p><p>
+ For more information about security settings for the
+ <i class="parameter"><tt>[homes]</tt></i> share please refer to the chapter
+ <a href="#securing-samba" title="Chapter 15. Securing Samba">Securing Samba</a>.
+ </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2867207"></a>Test your config file with <b class="command">testparm</b></h4></div></div><div></div></div><p>
+ It's important that you test the validity of your <tt class="filename">smb.conf</tt>
+ file using the <span class="application">testparm</span> program. If testparm runs OK
+ then it will list the loaded services. If not it will give an error message.
+ </p><p>
+ Make sure it runs OK and that the services look reasonable before proceeding.
+ </p><p>
+ Always run testparm again when you change <tt class="filename">smb.conf</tt>!
+ </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2867260"></a>SWAT</h3></div></div><div></div></div><p>
+ SWAT is a web-based interface that helps you configure samba.
+ SWAT might not be available in the samba package on your platform,
+ but in a separate package. Please read the swat manpage
+ on compiling, installing and configuring swat from source.
+ </p><p>
+ To launch SWAT just run your favorite web browser and
+ point it at <a href="http://localhost:901/" target="_top">http://localhost:901/</a>. Replace
+ <i class="replaceable"><tt>localhost</tt></i>
+ with the name of the computer you are running samba on if you
+ are running samba on a different computer than your browser.
+ </p><p>
+ Note that you can attach to SWAT from any IP connected
+ machine but connecting from a remote machine leaves your
+ connection open to password sniffing as passwords will be sent
+ in the clear over the wire.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2867305"></a>Try listing the shares available on your
+ server</h2></div></div><div></div></div><p><tt class="prompt">$ </tt><b class="userinput"><tt>smbclient -L
+ <i class="replaceable"><tt>yourhostname</tt></i></tt></b></p><p>You should get back a list of shares available on
+ your server. If you don't then something is incorrectly setup.
+ Note that this method can also be used to see what shares
+ are available on other LanManager clients (such as WfWg).</p><p>If you choose user level security then you may find
+ that Samba requests a password before it will list the shares.
+ See the <b class="command">smbclient</b> man page for details. (you
+ can force it to list the shares without a password by
+ adding the option -U% to the command line. This will not work
+ with non-Samba servers)</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2866810"></a>Try connecting with the unix client</h2></div></div><div></div></div><p><tt class="prompt">$ </tt><b class="userinput"><tt>smbclient <i class="replaceable"><tt>
+ //yourhostname/aservice</tt></i></tt></b></p><p>Typically the <i class="replaceable"><tt>yourhostname</tt></i>
+ would be the name of the host where you installed <span class="application">smbd</span>.
+ The <i class="replaceable"><tt>aservice</tt></i> is
+ any service you have defined in the <tt class="filename">smb.conf</tt>
+ file. Try your user name if you just have a <i class="parameter"><tt>[homes]</tt></i>
+ section
+ in <tt class="filename">smb.conf</tt>.</p><p>For example if your unix host is <i class="replaceable"><tt>bambi</tt></i>
+ and your login name is <i class="replaceable"><tt>fred</tt></i> you would type:</p><p><tt class="prompt">$ </tt><b class="userinput"><tt>smbclient //<i class="replaceable"><tt>bambi</tt></i>/<i class="replaceable"><tt>fred</tt></i>
+ </tt></b></p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2866912"></a>Try connecting from a DOS, WfWg, Win9x, WinNT,
+ Win2k, OS/2, etc... client</h2></div></div><div></div></div><p>Try mounting disks. eg:</p><p><tt class="prompt">C:\WINDOWS\> </tt><b class="userinput"><tt>net use d: \\servername\service
+ </tt></b></p><p>Try printing. eg:</p><p><tt class="prompt">C:\WINDOWS\> </tt><b class="userinput"><tt>net use lpt1:
+ \\servername\spoolservice</tt></b></p><p><tt class="prompt">C:\WINDOWS\> </tt><b class="userinput"><tt>print filename
+ </tt></b></p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2866973"></a>What If Things Don't Work?</h2></div></div><div></div></div><p>Then you might read the file chapter
+ <a href="#diagnosis" title="Chapter 33. The samba checklist">Diagnosis</a> and the
+ FAQ. If you are still stuck then try to follow
+ the <a href="#problems" title="Chapter 34. Analysing and solving samba problems">Analysing and Solving Problems chapter</a>
+ Samba has been successfully installed at thousands of sites worldwide,
+ so maybe someone else has hit your problem and has overcome it. </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2867003"></a>Common Errors</h2></div></div><div></div></div><p>
+The following questions and issues get raised on the samba mailing list over and over again.
+</p><div xmlns:ns3="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2867016"></a>Why are so many smbd processes eating memory?</h3></div></div><div></div></div><p>
+“<span class="quote">
+Site that is running Samba on an AIX box. They are sharing out about 2 terabytes using samba.
+Samba was installed using smitty and the binaries. We seem to be experiencing a memory problem
+with this box. When I do a <b class="command">svmon -Pu</b> the monitoring program shows that <span class="application">smbd</span> has several
+processes of smbd running:
+</span>”
+</p><p>
+ “<span class="quote">
+Is samba suppose to start this many different smbd processes? Or does it run as one smbd process? Also
+is it normal for it to be taking up this much memory?
+</span>”
+</p><ns3:p>
+</ns3:p><pre class="screen">
+Inuse * 4096 = amount of memory being used by this process
+
+ Pid Command Inuse Pin Pgsp Virtual 64-bit Mthrd
+ 20950 smbd 33098 1906 181 5017 N N
+ 22262 smbd 9104 1906 5410
+ 21060 smbd 9048 1906 181 5479 N N
+ 25972 smbd 8678 1906 181 5109 N N
+ 24524 smbd 8674 1906 181 5105 N N
+ 19262 smbd 8582 1906 181 5013 N N
+ 20722 smbd 8572 1906 181 5003 N N
+ 21454 smbd 8572 1906 181 5003 N N
+ 28946 smbd 8567 1906 181 4996 N N
+ 24076 smbd 8566 1906 181 4996 N N
+ 20138 smbd 8566 1906 181 4996 N N
+ 17608 smbd 8565 1906 181 4996 N N
+ 21820 smbd 8565 1906 181 4996 N N
+ 26940 smbd 8565 1906 181 4996 N N
+ 19884 smbd 8565 1906 181 4996 N N
+ 9912 smbd 8565 1906 181 4996 N N
+ 25800 smbd 8564 1906 181 4995 N N
+ 20452 smbd 8564 1906 181 4995 N N
+ 18592 smbd 8562 1906 181 4993 N N
+ 28216 smbd 8521 1906 181 4954 N N
+ 19110 smbd 8404 1906 181 4862 N N
+
+ Total memory used: 841,592,832 bytes
+</pre><ns3:p>
+</ns3:p><p>
+Samba consists on three core programs:
+<span class="application">nmbd</span>, <span class="application">smbd</span>, <span class="application">winbindd</span>. <span class="application">nmbd</span> is the name server message daemon,
+<span class="application">smbd</span> is the server message daemon, <span class="application">winbindd</span> is the daemon that
+handles communication with Domain Controllers.
+</p><p>
+If your system is NOT running as a WINS server, then there will be one (1) single instance of
+ <span class="application">nmbd</span> running on your system. If it is running as a WINS server then there will be
+two (2) instances - one to handle the WINS requests.
+</p><p>
+<span class="application">smbd</span> handles ALL connection requests and then spawns a new process for each client
+connection made. That is why you are seeing so many of them, one (1) per client connection.
+</p><p>
+<span class="application">winbindd</span> will run as one or two daemons, depending on whether or not it is being
+run in "split mode" (in which case there will be two instances).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2868395"></a>I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs</h3></div></div><div></div></div><p>Your loopback device isn't working correctly. Make sure it's running. </p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="FastStart"></a>Chapter 3. FastStart for the Impatient</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2868843">Note</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2868843"></a>Note</h2></div></div><div></div></div><p>
+This chapter did not make it into this release.
+It is planned for the published release of this document.
+</p></div></div></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="type"></a>Server Configuration Basics</h1></div></div><div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id2868870"></a>First Steps in Server Configuration</h1></div></div><div></div></div><p>
+Samba can operate in various modes within SMB networks. This HOWTO section contains information on
+configuring samba to function as the type of server your network requires. Please read this
+section carefully.
+</p><div class="toc"><p><b>Table of Contents</b></p><dl><dt>4. <a href="#ServerType">Server Types and Security Modes</a></dt><dd><dl><dt><a href="#id2871915">Features and Benefits</a></dt><dt><a href="#id2872007">Server Types</a></dt><dt><a href="#id2872088">Samba Security Modes</a></dt><dd><dl><dt><a href="#id2868518">User Level Security</a></dt><dt><a href="#id2868651">Share Level Security</a></dt><dt><a href="#id2869720">Domain Security Mode (User Level Security)</a></dt><dt><a href="#id2869962">ADS Security Mode (User Level Security)</a></dt><dt><a href="#id2870046">Server Security (User Level Security)</a></dt></dl></dd><dt><a href="#id2870271">Seamless Windows Network Integration</a></dt><dt><a href="#id2870448">Common Errors</a></dt><dd><dl><dt><a href="#id2870476">What makes Samba a SERVER?</a></dt><dt><a href="#id2870509">What makes Samba a Domain Controller?</a></dt><dt><a href="#id2870537">What makes Samba a Domain Member?</a></dt><dt><a href="#id2872449">Constantly Losing Connections to Password Server</a></dt></dl></dd></dl></dd><dt>5. <a href="#samba-pdc">Domain Control</a></dt><dd><dl><dt><a href="#id2875080">Features and Benefits</a></dt><dt><a href="#id2872678">Basics of Domain Control</a></dt><dd><dl><dt><a href="#id2872693">Domain Controller Types</a></dt><dt><a href="#id2872892">Preparing for Domain Control</a></dt></dl></dd><dt><a href="#id2873207">Domain Control - Example Configuration</a></dt><dt><a href="#id2873503">Samba ADS Domain Control</a></dt><dt><a href="#id2873526">Domain and Network Logon Configuration</a></dt><dd><dl><dt><a href="#id2873540">Domain Network Logon Service</a></dt><dt><a href="#id2876260">Security Mode and Master Browsers</a></dt></dl></dd><dt><a href="#id2876365">Common Problems and Errors</a></dt><dd><dl><dt><a href="#id2876372">I cannot include a '$' in a machine name</a></dt><dt><a href="#id2876411">I get told "You already have a connection to the Domain...."
+or "Cannot join domain, the credentials supplied conflict with an
+existing set.." when creating a machine trust account.</a></dt><dt><a href="#id2876460">The system can not log you on (C000019B)....</a></dt><dt><a href="#id2876531">The machine trust account for this computer either does not
+exist or is not accessible.</a></dt><dt><a href="#id2876588">When I attempt to login to a Samba Domain from a NT4/W2K workstation,
+I get a message about my account being disabled.</a></dt><dt><a href="#id2876615">Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"</a></dt></dl></dd></dl></dd><dt>6. <a href="#samba-bdc">Backup Domain Control</a></dt><dd><dl><dt><a href="#id2878646">Features And Benefits</a></dt><dt><a href="#id2878811">Essential Background Information</a></dt><dd><dl><dt><a href="#id2878839">MS Windows NT4 Style Domain Control</a></dt><dt><a href="#id2876805">Active Directory Domain Control</a></dt><dt><a href="#id2876826">What qualifies a Domain Controller on the network?</a></dt><dt><a href="#id2876850">How does a Workstation find its domain controller?</a></dt></dl></dd><dt><a href="#id2876875">Backup Domain Controller Configuration</a></dt><dd><dl><dt><a href="#id2876945">Example Configuration</a></dt></dl></dd><dt><a href="#id2876995">Common Errors</a></dt><dd><dl><dt><a href="#id2877009">Machine Accounts keep expiring, what can I do?</a></dt><dt><a href="#id2877034">Can Samba be a Backup Domain Controller to an NT4 PDC?</a></dt><dt><a href="#id2877067">How do I replicate the smbpasswd file?</a></dt><dt><a href="#id2877096">Can I do this all with LDAP?</a></dt></dl></dd></dl></dd><dt>7. <a href="#domain-member">Domain Membership</a></dt><dd><dl><dt><a href="#id2877621">Features and Benefits</a></dt><dt><a href="#id2877192">MS Windows Workstation/Server Machine Trust Accounts</a></dt><dd><dl><dt><a href="#id2877352">Manual Creation of Machine Trust Accounts</a></dt><dt><a href="#id2879134">Using NT4 Server Manager to Add Machine Accounts to the Domain</a></dt><dt><a href="#id2879331">"On-the-Fly" Creation of Machine Trust Accounts</a></dt><dt><a href="#id2879386">Making an MS Windows Workstation or Server a Domain Member</a></dt></dl></dd><dt><a href="#id2879531">Domain Member Server</a></dt><dd><dl><dt><a href="#id2879579">Joining an NT4 type Domain with Samba-3</a></dt><dt><a href="#id2882177">Why is this better than security = server?</a></dt></dl></dd><dt><a href="#ads-member">Samba ADS Domain Membership</a></dt><dd><dl><dt><a href="#id2882315">Setup your smb.conf</a></dt><dt><a href="#id2882398">Setup your /etc/krb5.conf</a></dt><dt><a href="#ads-create-machine-account">Create the computer account</a></dt><dt><a href="#ads-test-server">Test your server setup</a></dt><dt><a href="#ads-test-smbclient">Testing with smbclient</a></dt><dt><a href="#id2882740">Notes</a></dt></dl></dd><dt><a href="#id2882762">Common Errors</a></dt><dd><dl><dt><a href="#id2882784">Can Not Add Machine Back to Domain</a></dt><dt><a href="#id2882816">Adding Machine to Domain Fails</a></dt></dl></dd></dl></dd><dt>8. <a href="#StandAloneServer">Stand-Alone Servers</a></dt><dd><dl><dt><a href="#id2884259">Features and Benefits</a></dt><dt><a href="#id2884297">Background</a></dt><dt><a href="#id2884365">Example Configuration</a></dt><dd><dl><dt><a href="#id2882967">Reference Documentation Server</a></dt><dt><a href="#id2883015">Central Print Serving</a></dt></dl></dd><dt><a href="#id2883221">Common Errors</a></dt></dl></dd><dt>9. <a href="#ClientConfig">MS Windows Network Configuration Guide</a></dt><dd><dl><dt><a href="#id2883589">Note</a></dt></dl></dd></dl></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ServerType"></a>Chapter 4. Server Types and Security Modes</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:tridge@samba.org">tridge@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2871915">Features and Benefits</a></dt><dt><a href="#id2872007">Server Types</a></dt><dt><a href="#id2872088">Samba Security Modes</a></dt><dd><dl><dt><a href="#id2868518">User Level Security</a></dt><dt><a href="#id2868651">Share Level Security</a></dt><dt><a href="#id2869720">Domain Security Mode (User Level Security)</a></dt><dt><a href="#id2869962">ADS Security Mode (User Level Security)</a></dt><dt><a href="#id2870046">Server Security (User Level Security)</a></dt></dl></dd><dt><a href="#id2870271">Seamless Windows Network Integration</a></dt><dt><a href="#id2870448">Common Errors</a></dt><dd><dl><dt><a href="#id2870476">What makes Samba a SERVER?</a></dt><dt><a href="#id2870509">What makes Samba a Domain Controller?</a></dt><dt><a href="#id2870537">What makes Samba a Domain Member?</a></dt><dt><a href="#id2872449">Constantly Losing Connections to Password Server</a></dt></dl></dd></dl></div><p>
+This chapter provides information regarding the types of server that Samba may be
+configured to be. A Microsoft network administrator who wishes to migrate to or to
+use Samba will want to know what, within a Samba context, terms familiar to MS Windows
+adminstrator mean. This means that it is essential also to define how critical security
+modes function BEFORE we get into the details of how to configure the server itself.
+</p><p>
+The chapter provides an overview of the security modes of which Samba is capable
+and how these relate to MS Windows servers and clients.
+</p><p>
+Firstly we should recognise the question so often asked, "Why would I want to use Samba?"
+So, in those chapters where the answer may be important you will see a section that highlights
+features and benefits. These may be for or against Samba.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2871915"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It
+hurt his toe and lodged in his sandle. He took the stone out and cursed it with a passion
+and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I
+can turn that into a precious gem and some day it will make a princess very happy!
+</p><p>
+The moral of this tale: Two men, two very different perspectives regarding the same stone.
+Like it or not, Samba is like that stone. Treat it the right way and it can bring great
+pleasure, but if you are forced upon it and have no time for its secrets then it can be
+a source of discomfort.
+</p><p>
+Samba started out as a project that sought to provide interoperability for MS Windows 3.x
+clients with a Unix server. It has grown up a lot since its humble beginnings and now provides
+features and functionality fit for large scale deployment. It also has some warts. In sections
+like this one we will tell of both.
+</p><p>
+So now, what are the benefits of features mentioned in this chapter?
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Samba-3 can replace an MS Windows NT4 Domain Controller
+ </p></li><li><p>
+ Samba-3 offers excellent interoperability with MS Windows NT4
+ style domains as well as natively with Microsoft Active
+ Directory domains.
+ </p></li><li><p>
+ Samba-3 permits full NT4 style Interdomain Trusts
+ </p></li><li><p>
+ Samba has security modes that permit more flexible
+ authentication than is possible with MS Windows NT4 Domain Controllers.
+ </p></li><li><p>
+ Samba-3 permits use of multiple account database backends
+ </p></li><li><p>
+ The account (password) database backends can be distributed
+ and replicated using multiple methods. This gives Samba-3
+ greater flexibility than MS Windows NT4 and in many cases a
+ significantly higher utility than Active Directory domains
+ with MS Windows 200x.
+ </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2872007"></a>Server Types</h2></div></div><div></div></div><p>Adminstrators of Microsoft networks often refer to three
+different type of servers:</p><div class="itemizedlist"><ul type="disc"><li><p>Domain Controller</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Primary Domain Controller</td></tr><tr><td>Backup Domain Controller</td></tr><tr><td>ADS Domain Controller</td></tr></table></li><li><p>Domain Member Server</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Active Directory Member Server</td></tr><tr><td>NT4 Style Domain Member Server</td></tr></table></li><li><p>Stand Alone Server</p></li></ul></div><p>
+The chapters covering Domain Control, Backup Domain Control and Domain Membership provide
+pertinent information regarding Samba-3 configuration for each of these server roles.
+The reader is strongly encouraged to become intimately familiar with the information
+presented.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2872088"></a>Samba Security Modes</h2></div></div><div></div></div><p>
+In this section the function and purpose of Samba's <i class="parameter"><tt>security</tt></i>
+modes are described. An accurate understanding of how Samba implements each security
+mode as well as how to configure MS Windows clients for each mode will significantly
+reduce user complaints and administrator heartache.
+</p><p>
+In the SMB/CIFS networking world, there are only two types of security: <span class="emphasis"><em>USER Level</em></span>
+and <span class="emphasis"><em>SHARE Level</em></span>. We refer to these collectively as <span class="emphasis"><em>security levels</em></span>. In implementing these two <span class="emphasis"><em>security levels</em></span> Samba provides flexibilities
+that are not available with Microsoft Windows NT4 / 200x servers. Samba knows of five (5)
+ways that allow the security levels to be implemented. In actual fact, Samba implements
+<span class="emphasis"><em>SHARE Level</em></span> security only one way, but has four ways of implementing
+<span class="emphasis"><em>USER Level</em></span> security. Collectively, we call the Samba implementations
+<span class="emphasis"><em>Security Modes</em></span>. These are: <span class="emphasis"><em>SHARE</em></span>, <span class="emphasis"><em>USER</em></span>, <span class="emphasis"><em>DOMAIN</em></span>,
+<span class="emphasis"><em>ADS</em></span>, and <span class="emphasis"><em>SERVER</em></span>
+modes. They are documented in this chapter.
+</p><p>
+A SMB server tells the client at startup what <i class="parameter"><tt>security level</tt></i>
+it is running. There are two options: <span class="emphasis"><em>share level</em></span> and
+<span class="emphasis"><em>user level</em></span>. Which of these two the client receives affects
+the way the client then tries to authenticate itself. It does not directly affect
+(to any great extent) the way the Samba server does security. This may sound strange,
+but it fits in with the client/server approach of SMB. In SMB everything is initiated
+and controlled by the client, and the server can only tell the client what is
+available and whether an action is allowed.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2868518"></a>User Level Security</h3></div></div><div></div></div><p>
+We will describe <i class="parameter"><tt>user level</tt></i> security first, as it's simpler.
+In <span class="emphasis"><em>user level</em></span> security, the client will send a
+<span class="emphasis"><em>session setup</em></span> command directly after the protocol negotiation.
+This contains a username and password. The server can either accept or reject that
+username/password combination. Note that at this stage the server has no idea what
+share the client will eventually try to connect to, so it can't base the
+<span class="emphasis"><em>accept/reject</em></span> on anything other than:
+</p><div class="orderedlist"><ol type="1"><li><p>The username/password</p></li><li><p>The name of the client machine</p></li></ol></div><p>
+If the server accepts the username/password then the client expects to be able to
+mount shares (using a <span class="emphasis"><em>tree connection</em></span>) without specifying a
+password. It expects that all access rights will be as the username/password
+specified in the <span class="emphasis"><em>session setup</em></span>.
+</p><p>
+It is also possible for a client to send multiple <span class="emphasis"><em>session setup</em></span>
+requests. When the server responds, it gives the client a <span class="emphasis"><em>uid</em></span> to use
+as an authentication tag for that username/password. The client can maintain multiple
+authentication contexts in this way (WinDD is an example of an application that does this).
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2868612"></a>Example Configuration</h4></div></div><div></div></div><p>
+The <tt class="filename">smb.conf</tt> parameter that sets <span class="emphasis"><em>User Level Security</em></span> is:
+</p><pre class="programlisting">
+ security = user
+</pre><p>
+This is the default setting since samba-2.2.x.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2868651"></a>Share Level Security</h3></div></div><div></div></div><p>
+Ok, now for share level security. In share level security, the client authenticates
+itself separately for each share. It will send a password along with each
+<span class="emphasis"><em>tree connection</em></span> (share mount). It does not explicitly send a
+username with this operation. The client expects a password to be associated
+with each share, independent of the user. This means that Samba has to work out what
+username the client probably wants to use. It is never explicitly sent the username.
+Some commercial SMB servers such as NT actually associate passwords directly with
+shares in share level security, but Samba always uses the unix authentication scheme
+where it is a username/password pair that is authenticated, not a share/password pair.
+</p><p>
+To gain understanding of the MS Windows networking parallels to this, one should think
+in terms of MS Windows 9x/Me where one can create a shared folder that provides read-only
+or full access, with or without a password.
+</p><p>
+Many clients send a <span class="emphasis"><em>session setup</em></span> even if the server is in share
+level security. They normally send a valid username but no password. Samba records
+this username in a list of <span class="emphasis"><em>possible usernames</em></span>. When the client
+then does a <span class="emphasis"><em>tree connection</em></span> it also adds to this list the name
+of the share they try to connect to (useful for home directories) and any users
+listed in the <i class="parameter"><tt>user =</tt></i> <tt class="filename">smb.conf</tt> line. The password is then checked
+in turn against these <span class="emphasis"><em>possible usernames</em></span>. If a match is found
+then the client is authenticated as that user.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2868731"></a>Example Configuration</h4></div></div><div></div></div><p>
+The <tt class="filename">smb.conf</tt> parameter that sets <span class="emphasis"><em>Share Level Security</em></span> is:
+</p><pre class="programlisting">
+ security = share
+</pre><p>
+Please note that there are reports that recent MS Windows clients do not like to work
+with share mode security servers. You are strongly discouraged from using share level security.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2869720"></a>Domain Security Mode (User Level Security)</h3></div></div><div></div></div><p>
+When Samba is operating in <i class="parameter"><tt>security = domain</tt></i> mode,
+the Samba server has a domain security trust account (a machine account) and will cause
+all authentication requests to be passed through to the domain controllers.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2869742"></a>Example Configuration</h4></div></div><div></div></div><p><span class="emphasis"><em>
+Samba as a Domain Member Server
+</em></span></p><p>
+This method involves addition of the following parameters in the <tt class="filename">smb.conf</tt> file:
+</p><pre class="programlisting">
+ security = domain
+ workgroup = "name_of_NT_domain"
+</pre><p>
+In order for this method to work, the Samba server needs to join the MS Windows NT
+security domain. This is done as follows:
+</p><div class="procedure"><ol type="1"><li><p>On the MS Windows NT domain controller, using
+ the Server Manager, add a machine account for the Samba server.
+ </p></li><li><p>Next, on the Unix/Linux system execute:</p><p><tt class="prompt">root# </tt><b class="userinput"><tt>smbpasswd -j DOMAIN_NAME -r PDC_NAME</tt></b> (samba-2.x)</p><p><tt class="prompt">root# </tt><b class="userinput"><tt>net join -U administrator%password</tt></b> (samba-3)</p></li></ol></div><div xmlns:ns4="" class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><ns4:p>
+As of Samba-2.2.4 the Samba 2.2.x series can auto-join a Windows NT4 style Domain just
+by executing:
+</ns4:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>smbpasswd -j <i class="replaceable"><tt>DOMAIN_NAME</tt></i> -r <i class="replaceable"><tt>PDC_NAME</tt></i> -U Administrator%<i class="replaceable"><tt>password</tt></i></tt></b>
+</pre><ns4:p>
+
+As of Samba-3 the same can be done by executing:
+</ns4:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>net join -U Administrator%<i class="replaceable"><tt>password</tt></i></tt></b>
+</pre><ns4:p>
+It is not necessary with Samba-3 to specify the <i class="replaceable"><tt>DOMAIN_NAME</tt></i> or the <i class="replaceable"><tt>PDC_NAME</tt></i> as it
+figures this out from the <tt class="filename">smb.conf</tt> file settings.
+</ns4:p></div><p>
+Use of this mode of authentication does require there to be a standard Unix account
+for each user in order to assign a uid once the account has been authenticated by
+the remote Windows DC. This account can be blocked to prevent logons by clients other than
+MS Windows through things such as setting an invalid shell in the
+<tt class="filename">/etc/passwd</tt> entry.
+</p><p>
+An alternative to assigning UIDs to Windows users on a Samba member server is
+presented in the <a href="#winbind" title="Chapter 21. Integrated Logon Support using Winbind">Winbind Overview</a> chapter
+in this HOWTO collection.
+</p><p>
+For more information of being a domain member, see the <a href="#domain-member" title="Chapter 7. Domain Membership">Domain
+Member</a> section of this Howto.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2869962"></a>ADS Security Mode (User Level Security)</h3></div></div><div></div></div><p>
+Both Samba 2.2 and 3.0 can join an Active Directory domain. This is
+possible even if the domain is run in native mode. Active Directory in
+native mode perfectly allows NT4-style domain members, contrary to
+popular belief. The only thing that Active Directory in native mode
+prohibits is Backup Domain Controllers running NT4.
+</p><p>
+If you are running Active Directory starting with Samba 3.0 you can
+however join as a native AD member. Why would you want to do that?
+Your security policy might prohibit the use of NT-compatible
+authentication protocols. All your machines are running Windows 2000
+and above and all use full Kerberos. In this case Samba as a NT4-style
+domain would still require NT-compatible authentication data. Samba in
+AD-member mode can accept Kerberos.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2869993"></a>Example Configuration</h4></div></div><div></div></div><pre class="programlisting">
+ realm = your.kerberos.REALM
+ security = ADS
+</pre><p>
+ The following parameter may be required:
+</p><pre class="programlisting">
+ ads server = your.kerberos.server
+</pre><p>
+Please refer to the <a href="#domain-member" title="Chapter 7. Domain Membership">Domain Membership</a> and <a href="#ads-member" title="Samba ADS Domain Membership">Active Directory
+Membership</a> sections for more information regarding this configuration option.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2870046"></a>Server Security (User Level Security)</h3></div></div><div></div></div><p>
+Server security mode is a left over from the time when Samba was not capable of acting
+as a domain member server. It is highly recommended NOT to use this feature. Server
+security mode has many draw backs. The draw backs include:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Potential Account Lockout on MS Windows NT4/200x password servers</td></tr><tr><td>Lack of assurance that the password server is the one specified</td></tr><tr><td>Does not work with Winbind, particularly needed when storing profiles remotely</td></tr><tr><td>This mode may open connections to the password server, and keep them open for extended periods.</td></tr><tr><td>Security on the Samba server breaks badly when the remote password server suddenly shuts down</td></tr><tr><td>With this mode there is NO security account in the domain that the password server belongs to for the Samba server.</td></tr></table><p>
+In server security mode the Samba server reports to the client that it is in user level
+security. The client then does a <span class="emphasis"><em>session setup</em></span> as described earlier.
+The Samba server takes the username/password that the client sends and attempts to login to the
+<i class="parameter"><tt>password server</tt></i> by sending exactly the same username/password that
+it got from the client. If that server is in user level security and accepts the password,
+then Samba accepts the clients connection. This allows the Samba server to use another SMB
+server as the <i class="parameter"><tt>password server</tt></i>.
+</p><p>
+You should also note that at the very start of all this, where the server tells the client
+what security level it is in, it also tells the client if it supports encryption. If it
+does then it supplies the client with a random cryptkey. The client will then send all
+passwords in encrypted form. Samba supports this type of encryption by default.
+</p><p>
+The parameter <i class="parameter"><tt>security = server</tt></i> means that Samba reports to clients that
+it is running in <span class="emphasis"><em>user mode</em></span> but actually passes off all authentication
+requests to another <span class="emphasis"><em>user mode</em></span> server. This requires an additional
+parameter <i class="parameter"><tt>password server</tt></i> that points to the real authentication server.
+That real authentication server can be another Samba server or can be a Windows NT server,
+the later natively capable of encrypted password support.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+When Samba is running in <span class="emphasis"><em>server security mode</em></span> it is essential that
+the parameter <span class="emphasis"><em>password server</em></span> is set to the precise NetBIOS machine
+name of the target authentication server. Samba can NOT determine this from NetBIOS name
+lookups because the choice of the target authentication server is arbitrary and can not
+be determined from a domain name. In essence, a Samba server that is in
+<span class="emphasis"><em>server security mode</em></span> is operating in what used to be known as
+workgroup mode.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2870203"></a>Example Configuration</h4></div></div><div></div></div><p><span class="emphasis"><em>
+Using MS Windows NT as an authentication server
+</em></span></p><p>
+This method involves the additions of the following parameters in the <tt class="filename">smb.conf</tt> file:
+</p><pre class="programlisting">
+ encrypt passwords = Yes
+ security = server
+ password server = "NetBIOS_name_of_a_DC"
+</pre><p>
+There are two ways of identifying whether or not a username and password pair was valid
+or not. One uses the reply information provided as part of the authentication messaging
+process, the other uses just an error code.
+</p><p>
+The down-side of this mode of configuration is the fact that for security reasons Samba
+will send the password server a bogus username and a bogus password and if the remote
+server fails to reject the username and password pair then an alternative mode of
+identification of validation is used. Where a site uses password lock out after a
+certain number of failed authentication attempts this will result in user lockouts.
+</p><p>
+Use of this mode of authentication does require there to be a standard Unix account
+for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients.
+</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2870271"></a>Seamless Windows Network Integration</h2></div></div><div></div></div><p>
+MS Windows clients may use encrypted passwords as part of a challenge/response
+authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple
+password based authentication. It should be realized that with the SMB protocol,
+the password is passed over the network either in plain text or encrypted, but
+not both in the same authentication request.
+</p><p>
+When encrypted passwords are used, a password that has been entered by the user
+is encrypted in two ways:
+</p><div class="itemizedlist"><ul type="disc"><li><p>An MD4 hash of the UNICODE of the password
+ string. This is known as the NT hash.
+ </p></li><li><p>The password is converted to upper case,
+ and then padded or trucated to 14 bytes. This string is
+ then appended with 5 bytes of NULL characters and split to
+ form two 56 bit DES keys to encrypt a "magic" 8 byte value.
+ The resulting 16 bytes form the LanMan hash.
+ </p></li></ul></div><p>
+MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0
+pre-service pack 3 will use either mode of password authentication. All
+versions of MS Windows that follow these versions no longer support plain
+text passwords by default.
+</p><p>
+MS Windows clients have a habit of dropping network mappings that have been idle
+for 10 minutes or longer. When the user attempts to use the mapped drive
+connection that has been dropped, the client re-establishes the connection using
+a cached copy of the password.
+</p><p>
+When Microsoft changed the default password mode, support was dropped for caching
+of the plain text password. This means that when the registry parameter is changed
+to re-enable use of plain text passwords it appears to work, but when a dropped
+service connection mapping attempts to revalidate it will fail if the remote
+authentication server does not support encrypted passwords. This means that it
+is definitely not a good idea to re-enable plain text password support in such clients.
+</p><p>
+The following parameters can be used to work around the issue of Windows 9x clients
+upper casing usernames and password before transmitting them to the SMB server
+when using clear text authentication.
+</p><pre class="programlisting">
+ <a href="smb.conf.5.html#PASSWORDLEVEL" target="_top">passsword level</a> = <i class="replaceable"><tt>integer</tt></i>
+ <a href="smb.conf.5.html#USERNAMELEVEL" target="_top">username level</a> = <i class="replaceable"><tt>integer</tt></i>
+</pre><p>
+By default Samba will lower case the username before attempting to lookup the user
+in the database of local system accounts. Because UNIX usernames conventionally
+only contain lower case character, the <i class="parameter"><tt>username level</tt></i> parameter
+is rarely needed.
+</p><p>
+However, passwords on UNIX systems often make use of mixed case characters.
+This means that in order for a user on a Windows 9x client to connect to a Samba
+server using clear text authentication, the <i class="parameter"><tt>password level</tt></i>
+must be set to the maximum number of upper case letter which <span class="emphasis"><em>could</em></span>
+appear is a password. Note that the server OS uses the traditional DES version
+of crypt(), a <i class="parameter"><tt>password level</tt></i> of 8 will result in case
+insensitive passwords as seen from Windows users. This will also result in longer
+login times as Samba has to compute the permutations of the password string and
+try them one by one until a match is located (or all combinations fail).
+</p><p>
+The best option to adopt is to enable support for encrypted passwords where ever
+Samba is used. Most attempts to apply the registry change to re-enable plain text
+passwords will eventually lead to user complaints and unhappiness.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2870448"></a>Common Errors</h2></div></div><div></div></div><p>
+We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places
+and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake
+made in a developmental test lab is expected.
+</p><p>
+Here we look at common mistakes and misapprehensions that have been the subject of discussions
+on the Samba mailing lists. Many of these are avoidable by doing you homework before attempting
+a Samba implementation. Some are the result of misundertanding of the English language. The
+English language has many turns of phrase that are potentially vague and may be highly confusing
+to those for whom English is not their native tongue.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2870476"></a>What makes Samba a SERVER?</h3></div></div><div></div></div><p>
+To some the nature of the Samba <span class="emphasis"><em>security</em></span> mode is very obvious, but entirely
+wrong all the same. It is assumed that <i class="parameter"><tt>security = server</tt></i> means that Samba
+will act as a server. Not so! See above - this setting means that Samba will <span class="emphasis"><em>try</em></span>
+to use another SMB server as its source of user authentication alone.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2870509"></a>What makes Samba a Domain Controller?</h3></div></div><div></div></div><p>
+The <tt class="filename">smb.conf</tt> parameter <i class="parameter"><tt>security = domain</tt></i> does NOT really make Samba behave
+as a Domain Controller! This setting means we want Samba to be a domain member!
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2870537"></a>What makes Samba a Domain Member?</h3></div></div><div></div></div><p>
+Guess! So many others do. But whatever you do, do NOT think that <i class="parameter"><tt>security = user</tt></i>
+makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See
+the <a href="#domain-member" title="Chapter 7. Domain Membership">Domain Member</a> section of this Howto for more information.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2872449"></a>Constantly Losing Connections to Password Server</h3></div></div><div></div></div><p>
+Why does server_validate() simply give up rather than re-establishing its connection to the
+password server? Though I am not fluent in the SMB protocol, perhaps the cluster server
+process passes along to its client workstation the session key it receives from the password
+server, which means the password hashes submitted by the client would not work on a subsequent
+connection, whose session key would be different. So server_validate() must give up.
+</p><p>
+Indeed. That's why security = server is at best a nasty hack. Please use security = domain.
+<i class="parameter"><tt>security = server</tt></i> mode is also known as pass-through authentication.
+</p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="samba-pdc"></a>Chapter 5. Domain Control</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jerry@samba.org">jerry@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">David</span> <span class="surname">Bannon</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:dbannon@samba.org">dbannon@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2875080">Features and Benefits</a></dt><dt><a href="#id2872678">Basics of Domain Control</a></dt><dd><dl><dt><a href="#id2872693">Domain Controller Types</a></dt><dt><a href="#id2872892">Preparing for Domain Control</a></dt></dl></dd><dt><a href="#id2873207">Domain Control - Example Configuration</a></dt><dt><a href="#id2873503">Samba ADS Domain Control</a></dt><dt><a href="#id2873526">Domain and Network Logon Configuration</a></dt><dd><dl><dt><a href="#id2873540">Domain Network Logon Service</a></dt><dt><a href="#id2876260">Security Mode and Master Browsers</a></dt></dl></dd><dt><a href="#id2876365">Common Problems and Errors</a></dt><dd><dl><dt><a href="#id2876372">I cannot include a '$' in a machine name</a></dt><dt><a href="#id2876411">I get told "You already have a connection to the Domain...."
+or "Cannot join domain, the credentials supplied conflict with an
+existing set.." when creating a machine trust account.</a></dt><dt><a href="#id2876460">The system can not log you on (C000019B)....</a></dt><dt><a href="#id2876531">The machine trust account for this computer either does not
+exist or is not accessible.</a></dt><dt><a href="#id2876588">When I attempt to login to a Samba Domain from a NT4/W2K workstation,
+I get a message about my account being disabled.</a></dt><dt><a href="#id2876615">Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"</a></dt></dl></dd></dl></div><p><b><span class="emphasis"><em>The Essence of Learning:</em></span> </b>
+There are many who approach MS Windows networking with incredible misconceptions.
+That's OK, because it gives the rest of us plenty of opportunity to be of assistance.
+Those who really want help would be well advised to become familiar with information
+that is already available.
+</p><p>
+The reader is advised NOT to tackle this section without having first understood
+and mastered some basics. MS Windows networking is not particularly forgiving of
+misconfiguration. Users of MS Windows networking are likely to complain bitterly
+of persistent niggles that may be caused by broken network or system configuration.
+To a great many people however, MS Windows networking starts with a domain controller
+that in some magical way is expected to solve all ills.
+</p><p>
+From the Samba mailing list one can readilly identify many common networking issues.
+If you are not clear on the following subjects, then it will do much good to read the
+sections of this HOWTO that deal with it. These are the most common causes of MS Windows
+networking problems:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Basic TCP/IP configuration</td></tr><tr><td>NetBIOS name resolution</td></tr><tr><td>Authentication configuration</td></tr><tr><td>User and Group configuration</td></tr><tr><td>Basic File and Directory Permission Control in Unix/Linux</td></tr><tr><td>Understanding of how MS Windows clients interoperate in a network
+ environment</td></tr></table><p>
+Do not be put off; on the surface of it MS Windows networking seems so simple that any fool
+can do it. In fact, it is not a good idea to set up an MS Windows network with
+inadequate training and preparation. But let's get our first indelible principle out of the
+way: <span class="emphasis"><em>It is perfectly OK to make mistakes!</em></span> In the right place and at
+the right time, mistakes are the essence of learning. It is <span class="emphasis"><em>very much</em></span>
+not ok to make mistakes that cause loss of productivity and impose an avoidable financial
+burden on an organisation.
+</p><p>
+Where is the right place to make mistakes? Only out of harm's way! If you are going to
+make mistakes, then please do this on a test network, away from users and in such a way as
+to not inflict pain on others. Do your learning on a test network.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2875080"></a>Features and Benefits</h2></div></div><div></div></div><p>
+<span class="emphasis"><em>What is the key benefit of Microsoft Domain security?</em></span>
+</p><p>
+In a word, <span class="emphasis"><em>Single Sign On</em></span>, or SSO for short. To many, this is the holy
+grail of MS Windows NT and beyond networking. SSO allows users in a well designed network
+to log onto any workstation that is a member of the domain that their user account is in
+(or in a domain that has an appropriate trust relationship with the domain they are visiting)
+and they will be able to log onto the network and access resources (shares, files, and printers)
+as if they are sitting at their home (personal) workstation. This is a feature of the Domain
+security protocols.
+</p><p>
+The benefits of Domain security are fully available to those sites that deploy a Samba PDC.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Network clients of an MS Windows Domain security environment must be Domain members to be
+able to gain access to the advanced features provided. Domain membership involves more than just
+setting the workgroup name to the Domain name. It requires the creation of a Domain trust account
+for the workstation (called a machine account). Please refer to the chapter on
+<a href="#domain-member" title="Chapter 7. Domain Membership">Domain Membership</a> for more information.
+</p></div><p>
+The following functionalities are new to the Samba-3 release:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Windows NT4 domain trusts
+ </p></li><li><p>
+ Adding users via the User Manager for Domains. This can be done on any MS Windows
+ client using the Nexus toolkit that is available from Microsoft's web site.
+ At some later date Samba-3 may get support for the use of the Microsoft Management
+ Console for user management.
+ </p></li><li><p>
+ Introduces replaceable and multiple user account (authentication)
+ back ends. In the case where the back end is placed in an LDAP database,
+ Samba-3 confers the benefits of a back end that can be distributed, replicated,
+ and is highly scalable.
+ </p></li><li><p>
+ Implements full Unicode support. This simplifies cross locale internationalisation
+ support. It also opens up the use of protocols that Samba-2.2.x had but could not use due
+ to the need to fully support Unicode.
+ </p></li></ul></div><p>
+The following functionalities are NOT provided by Samba-3:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ SAM replication with Windows NT4 Domain Controllers
+ (i.e. a Samba PDC and a Windows NT BDC or vice versa)
+ </p></li><li><p>
+ Acting as a Windows 2000 Domain Controller (i.e. Kerberos and
+ Active Directory) - In point of fact, Samba-3 DOES have some
+ Active Directory Domain Control ability that is at this time
+ purely experimental <span class="emphasis"><em>AND</em></span> that is certain
+ to change as it becomes a fully supported feature some time
+ during the Samba-3 (or later) life cycle.
+ </p></li></ul></div><p>
+Windows 9x / Me / XP Home clients are not true members of a domain for reasons outlined
+in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons
+is completely different from NT4 / Win2k type domain logons and has been officially supported
+for some time. These clients use the old LanMan Network Logon facilities that are supported
+in Samba since approximately the Samba-1.9.15 series.
+</p><p>
+Samba-3 has an implementation of group mapping between Windows NT groups
+and Unix groups (this is really quite complicated to explain in a short space). This is
+discussed more fully in the <a href="#groupmapping" title="Chapter 12. Mapping MS Windows and Unix Groups">Group Mapping</a> chapter.
+</p><p>
+Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store
+user and machine trust account information in a suitable backend data store. With Samba-3
+there can be multiple back-ends for this including:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ <span class="emphasis"><em>smbpasswd</em></span> - the plain ascii file stored used by
+ earlier versions of Samba. This file configuration option requires
+ a Unix/Linux system account for EVERY entry (ie: both for user and for
+ machine accounts). This file will be located in the <span class="emphasis"><em>private</em></span>
+ directory (default is /usr/local/samba/lib/private or on linux /etc/samba).
+ </p></li><li><p>
+ <span class="emphasis"><em>tdbsam</em></span> - a binary database backend that will be
+ stored in the <span class="emphasis"><em>private</em></span> directory in a file called
+ <span class="emphasis"><em>passdb.tdb</em></span>. The key benefit of this binary format
+ file is that it can store binary objects that can not be accomodated
+ in the traditional plain text smbpasswd file. These permit the extended
+ account controls that MS Windows NT4 and later also have.
+ </p></li><li><p>
+ <span class="emphasis"><em>ldapsam</em></span> - An LDAP based back-end. Permits the
+ LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com.
+ Like the tdbsam, ldapsam permits the storing of extended account attributes
+ for control of things like: Permitted access times, password activation and
+ expiry, permitted points of access (workstation names), per user profile
+ location, and much more.
+ </p></li><li><p>
+ <span class="emphasis"><em>ldapsam_compat</em></span> - An LDAP back-end that maintains backwards
+ compatibility with the behaviour of samba-2.2.x. You should use this in the process
+ of migrating from samba-2.2.x to samba-3 if you do not want to rebuild your LDAP
+ database.
+ </p></li></ul></div><p>
+Read the chapter about <a href="#passdb" title="Chapter 11. Account Information Databases">Account Information Database</a> for details
+regarding the choices available and how to configure them.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The new tdbsam and ldapsam account backends store substantially more information than
+smbpasswd is capable of. The new backend database includes capacity to specify
+per user settings for many parameters, over-riding global settings given in the
+<tt class="filename">smb.conf</tt> file. eg: logon drive, logon home, logon path, etc.
+Thus, with samba-3 it is possible to have a default system configuration for profiles,
+and on a per user basis to over-ride this for those users who should not be subject
+to the default configuration.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2872678"></a>Basics of Domain Control</h2></div></div><div></div></div><p>
+Over the years, public perceptions of what Domain Control really is has taken on an
+almost mystical nature. Before we branch into a brief overview of Domain Control,
+there are three basic types of domain controllers:
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2872693"></a>Domain Controller Types</h3></div></div><div></div></div><div class="itemizedlist"><ul type="disc"><li><p>Primary Domain Controller</p></li><li><p>Backup Domain Controller</p></li><li><p>ADS Domain Controller</p></li></ul></div><p>
+The <span class="emphasis"><em>Primary Domain Controller</em></span> or PDC plays an important role in the MS
+Windows NT4 and Windows 200x Domain Control architecture, but not in the manner that so many
+expect. There is folk lore that dictates that because of it's role in the MS Windows
+network, the PDC should be the most powerful and most capable machine in the network.
+As strange as it may seem to say this here, good over all network performance dictates that
+the entire infrastructure needs to be balanced. It is advisable to invest more in the Backup
+Domain Controllers and Stand-Alone (or Domain Member) servers than in the PDC.
+</p><p>
+In the case of MS Windows NT4 style domains, it is the PDC seeds the Domain Control database,
+a part of the Windows registry called the SAM (Security Account Manager). It plays a key
+part in NT4 type domain user authentication and in synchronisation of the domain authentication
+database with Backup Domain Controllers.
+</p><p>
+With MS Windows 200x Server based Active Directory domains, one domain controller seeds a potential
+hierachy of domain controllers, each with their own area of delegated control. The master domain
+controller has the ability to override any down-stream controller, but a down-line controller has
+control only over it's down-line. With Samba-3 this functionality can be implemented using an
+LDAP based user and machine account back end.
+</p><p>
+New to Samba-3 is the ability to use a back-end database that holds the same type of data as
+the NT4 style SAM (Security Account Manager) database (one of the registry files).
+The Samba-3 SAM can be specified via the smb.conf file parameter
+<i class="parameter"><tt>passwd backend</tt></i> and valid options include
+<span class="emphasis"><em>smbpasswd, tdbsam, ldapsam, nisplussam, xmlsam, mysqlsam, guest</em></span>.
+</p><p>
+The <span class="emphasis"><em>Backup Domain Controller</em></span> or BDC plays a key role in servicing network
+authentication requests. The BDC is biased to answer logon requests in preference to the PDC.
+On a network segment that has a BDC and a PDC the BDC will be most likely to service network
+logon requests. The PDC will answer network logon requests when the BDC is too busy (high load).
+A BDC can be promoted to a PDC. If the PDC is on line at the time that a BDC is promoted to
+PDC, the previous PDC is automatically demoted to a BDC. With Samba-3 this is NOT an automatic
+operation; the PDB and BDC must be manually configured and changes need to be made likewise.
+</p><p>
+With MS Windows NT4, it is an install time decision what type of machine the server will be.
+It is possible to change the promote a BDC to a PDC and vica versa only, but the only way
+to convert a domain controller to a domain member server or a stand-alone server is to
+reinstall it. The install time choices offered are:
+</p><div class="itemizedlist"><ul type="disc"><li><p><span class="emphasis"><em>Primary Domain Controller</em></span> - The one that seeds the domain SAM</p></li><li><p><span class="emphasis"><em>Backup Domain Controller</em></span> - One that obtains a copy of the domain SAM</p></li><li><p><span class="emphasis"><em>Domain Member Server</em></span> - One that has NO copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls.</p></li><li><p><span class="emphasis"><em>Stand-Alone Server</em></span> - One that plays NO part is SAM synchronisation, has it's own authentication database and plays no role in Domain security.</p></li></ul></div><p>
+With MS Windows 2000 the configuration of domain control is done after the server has been
+installed. Samba-3 is capable of acting fully as a native member of a Windows 200x server
+Active Directory domain.
+</p><p>
+New to Samba-3 is the ability to function fully as an MS Windows NT4 style Domain Controller,
+excluding the SAM replication components. However, please be aware that Samba-3 support the
+MS Windows 200x domain control protocols also.
+</p><p>
+At this time any appearance that Samba-3 is capable of acting as an
+<span class="emphasis"><em>ADS Domain Controller</em></span> is limited and experimental in nature.
+This functionality should not be used until the Samba-Team offers formal support for it.
+At such a time, the documentation will be revised to duly reflect all configuration and
+management requirements.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2872892"></a>Preparing for Domain Control</h3></div></div><div></div></div><p>
+There are two ways that MS Windows machines may interact with each other, with other servers,
+and with Domain Controllers: Either as <span class="emphasis"><em>Stand-Alone</em></span> systems, more commonly
+called <span class="emphasis"><em>Workgroup</em></span> members, or as full participants in a security system,
+more commonly called <span class="emphasis"><em>Domain</em></span> members.
+</p><p>
+It should be noted that <span class="emphasis"><em>Workgroup</em></span> membership involve no special configuration
+other than the machine being configured so that the network configuration has a commonly used name
+for it's workgroup entry. It is not uncommon for the name WORKGROUP to be used for this. With this
+mode of configuration there are NO machine trust accounts and any concept of membership as such
+is limited to the fact that all machines appear in the network neighbourhood to be logically
+grouped together. Again, just to be clear: <span class="emphasis"><em>workgroup mode does not involve any security machine
+accounts</em></span>.
+</p><p>
+Domain member machines have a machine account in the Domain accounts database. A special procedure
+must be followed on each machine to affect Domain membership. This procedure, which can be done
+only by the local machine Administrator account, will create the Domain machine account (if
+if does not exist), and then initializes that account. When the client first logs onto the
+Domain it triggers a machine password change.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured
+as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the
+Domain, then it will operate like a workgroup (stand-alone) machine. Please refer the
+<a href="#domain-member" title="Chapter 7. Domain Membership">Domain Membership</a> chapter for information regarding
+ HOW to make your MS Windows clients Domain members.
+</p></div><p>
+The following are necessary for configuring Samba-3 as an MS Windows NT4 style PDC for MS Windows
+NT4 / 200x / XP clients.
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Configuration of basic TCP/IP and MS Windows Networking</td></tr><tr><td>Correct designation of the Server Role (<i class="parameter"><tt>security = user</tt></i>)</td></tr><tr><td>Consistent configuration of Name Resolution (See chapter on <a href="#NetworkBrowsing" title="Chapter 10. Samba / MS Windows Network Browsing Guide">Browsing</a> and on
+ <a href="#integrate-ms-networks" title="Chapter 26. Integrating MS Windows networks with Samba">MS Windows network Integration</a>)</td></tr><tr><td>Domain logons for Windows NT4 / 200x / XP Professional clients</td></tr><tr><td>Configuration of Roaming Profiles or explicit configuration to force local profile usage</td></tr><tr><td>Configuration of Network/System Policies</td></tr><tr><td>Adding and managing domain user accounts</td></tr><tr><td>Configuring MS Windows client machines to become domain members</td></tr></table><p>
+The following provisions are required to serve MS Windows 9x / Me Clients:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Configuration of basic TCP/IP and MS Windows Networking</td></tr><tr><td>Correct designation of the Server Role (<i class="parameter"><tt>security = user</tt></i>)</td></tr><tr><td>Network Logon Configuration (Since Windows 9x / XP Home are not technically domain
+ members, they do not really particpate in the security aspects of Domain logons as such)</td></tr><tr><td>Roaming Profile Configuration</td></tr><tr><td>Configuration of System Policy handling</td></tr><tr><td>Installation of the Network driver "Client for MS Windows Networks" and configuration
+ to log onto the domain</td></tr><tr><td>Placing Windows 9x / Me clients in user level security - if it is desired to allow
+ all client share access to be controlled according to domain user / group identities.</td></tr><tr><td>Adding and managing domain user accounts</td></tr></table><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Roaming Profiles and System/Network policies are advanced network administration topics
+that are covered in the <a href="#ProfileMgmt" title="Chapter 24. Desktop Profile Management">Profile Management</a> and
+<a href="#PolicyMgmt" title="Chapter 23. System and Account Policies">Policy Management</a> chapters of this document. However, these are not necessarily specific
+to a Samba PDC as much as they are related to Windows NT networking concepts.
+</p></div><p>
+A Domain Controller is an SMB/CIFS server that:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Registers and advertises itself as a Domain Controller (through NetBIOS broadcasts
+ as well as by way of name registrations either by Mailslot Broadcasts over UDP broadcast,
+ to a WINS server over UDP unicast, or via DNS and Active Directory)
+ </p></li><li><p>
+ Provides the NETLOGON service (actually a collection of services that runs over
+ a number of protocols. These include the LanMan Logon service, the Netlogon service,
+ the Local Security Account service, and variations of them)
+ </p></li><li><p>
+ Provides a share called NETLOGON
+ </p></li></ul></div><p>
+For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide
+the NETLOGON service which Samba calls the <span class="emphasis"><em>domain logons</em></span> functionality
+(after the name of the parameter in the <tt class="filename">smb.conf</tt> file). Additionally, one (1) server in a Samba-3
+Domain must advertise itself as the domain master browser. This causes the Primary Domain Controller
+to claim domain specific NetBIOS name that identifies it as a domain master browser for its given
+domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets
+then ask for a complete copy of the browse list for the whole wide area network. Browser clients
+will then contact their local master browser, and will receive the domain-wide browse list,
+instead of just the list for their broadcast-isolated subnet.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2873207"></a>Domain Control - Example Configuration</h2></div></div><div></div></div><p>
+The first step in creating a working Samba PDC is to understand the parameters necessary
+in <tt class="filename">smb.conf</tt>. Here we attempt to explain the parameters that are covered in
+the <tt class="filename">smb.conf</tt> man page.
+</p><p>
+Here is an example <tt class="filename">smb.conf</tt> for acting as a PDC:
+</p><pre class="programlisting">
+ [global]
+ ; Basic server settings
+ <a href="smb.conf.5.html#NETBIOSNAME" target="_top">netbios name</a> = <i class="replaceable"><tt>POGO</tt></i>
+ <a href="smb.conf.5.html#WORKGROUP" target="_top">workgroup</a> = <i class="replaceable"><tt>NARNIA</tt></i>
+
+ ; User and Machine Account Backends
+ ; Choices are: tdbsam, smbpasswd, ldapsam, mysqlsam, xmlsam, guest
+ <a href="smb.conf.5.html#PASSDBBACKEND" target="_top">passdb backend</a> = ldapsam, guest
+
+ ; we should act as the domain and local master browser
+ <a href="smb.conf.5.html#OSLEVEL" target="_top">os level</a> = 64
+ <a href="smb.conf.5.html#PERFERREDMASTER" target="_top">preferred master</a> = yes
+ <a href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master</a> = yes
+ <a href="smb.conf.5.html#LOCALMASTER" target="_top">local master</a> = yes
+
+ ; security settings (must user security = user)
+ <a href="smb.conf.5.html#SECURITYEQUALSUSER" target="_top">security</a> = user
+
+ ; encrypted passwords are a requirement for a PDC (default = Yes)
+ <a href="smb.conf.5.html#ENCRYPTPASSWORDS" target="_top">encrypt passwords</a> = yes
+
+ ; support domain logons
+ <a href="smb.conf.5.html#DOMAINLOGONS" target="_top">domain logons</a> = yes
+
+ ; where to store user profiles?
+ <a href="smb.conf.5.html#LOGONPATH" target="_top">logon path</a> = \\%N\profiles\%u
+
+ ; where is a user's home directory and where should it be mounted at?
+ <a href="smb.conf.5.html#LOGONDRIVE" target="_top">logon drive</a> = H:
+ <a href="smb.conf.5.html#LOGONHOME" target="_top">logon home</a> = \\homeserver\%u\winprofile
+
+ ; specify a generic logon script for all users
+ ; this is a relative **DOS** path to the [netlogon] share
+ <a href="smb.conf.5.html#LOGONSCRIPT" target="_top">logon script</a> = logon.cmd
+
+ ; necessary share for domain controller
+ [netlogon]
+ <a href="smb.conf.5.html#PATH" target="_top">path</a> = /usr/local/samba/lib/netlogon
+ <a href="smb.conf.5.html#READONLY" target="_top">read only</a> = yes
+ <a href="smb.conf.5.html#WRITELIST" target="_top">write list</a> = <i class="replaceable"><tt>ntadmin</tt></i>
+
+ ; share for storing user profiles
+ [profiles]
+ <a href="smb.conf.5.html#PATH" target="_top">path</a> = /export/smb/ntprofile
+ <a href="smb.conf.5.html#READONLY" target="_top">read only</a> = no
+ <a href="smb.conf.5.html#CREATEMASK" target="_top">create mask</a> = 0600
+ <a href="smb.conf.5.html#DIRECTORYMASK" target="_top">directory mask</a> = 0700
+</pre><div xmlns:ns5="" class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><ns5:p>
+The above parameters make for a full set of parameters that may define the server's mode
+of operation. The following parameters are the essentials alone:
+
+</ns5:p><pre class="programlisting">
+ workgroup = NARNIA
+ domain logons = Yes
+ domain master = Yes
+ security = User
+</pre><ns5:p>
+
+The additional parameters shown in the longer listing above just makes for a
+more complete environment.
+</ns5:p></div><p>
+There are a couple of points to emphasize in the above configuration.
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Encrypted passwords must be enabled. For more details on how
+ to do this, refer to <a href="#passdb" title="Chapter 11. Account Information Databases">Account Information Database chapter</a>.
+ </p></li><li><p>
+ The server must support domain logons and have a
+ <i class="parameter"><tt>[netlogon]</tt></i> share
+ </p></li><li><p>
+ The server must be the domain master browser in order for Windows
+ client to locate the server as a DC. Please refer to the various
+ Network Browsing documentation included with this distribution for
+ details.
+ </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2873503"></a>Samba ADS Domain Control</h2></div></div><div></div></div><p>
+Samba-3 is not and can not act as an Active Directory Server. It can not truly function as
+an Active Directory Primary Domain Controller. The protocols for some of the functionality
+the Active Directory Domain Controllers is have been partially implemented on an experimental
+only basis. Please do NOT expect Samba-3 to support these protocols - nor should you depend
+on any such functionality either now or in the future. The Samba-Team may well remove such
+experiemental features or may change their behaviour.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2873526"></a>Domain and Network Logon Configuration</h2></div></div><div></div></div><p>
+The subject of Network or Domain Logons is discussed here because it rightly forms
+an integral part of the essential functionality that is provided by a Domain Controller.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2873540"></a>Domain Network Logon Service</h3></div></div><div></div></div><p>
+All Domain Controllers must run the netlogon service (<span class="emphasis"><em>domain logons</em></span>
+in Samba). One Domain Controller must be configured with <i class="parameter"><tt>domain master = Yes</tt></i>
+(the Primary Domain Controller); on ALL Backup Domain Controllers <i class="parameter"><tt>domain master = No</tt></i>
+must be set.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2873573"></a>Example Configuration</h4></div></div><div></div></div><pre class="programlisting">
+ [globals]
+ domain logons = Yes
+ domain master = (Yes on PDC, No on BDCs)
+
+ [netlogon]
+ comment = Network Logon Service
+ path = /var/lib/samba/netlogon
+ guest ok = Yes
+ browseable = No
+</pre></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2873592"></a>The Special Case of MS Windows XP Home Edition</h4></div></div><div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+MS Windows XP Home Edition does not have the ability to join any type of Domain
+security facility. Unlike, MS Windows 9x / Me, MS Windows XP Home Edition also completely
+lacks the ability to log onto a network.
+</p></div><p>
+To be completely clear: If you want MS Windows XP Home Edition to integrate with your
+MS Windows NT4 or Active Directory Domain security understand - IT CAN NOT BE DONE.
+Your only choice is to buy the upgrade pack from MS Windows XP Home Edition to
+MS Windows XP Professional.
+</p><p>
+Now that this has been said, please do NOT ask the mailing list, or email any of the
+Samba-Team members with your questions asking how to make this work. It can't be done.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2873628"></a>The Special Case of Windows 9x / Me</h4></div></div><div></div></div><p>
+A domain and a workgroup are exactly the same thing in terms of network
+browsing. The difference is that a distributable authentication
+database is associated with a domain, for secure login access to a
+network. Also, different access rights can be granted to users if they
+successfully authenticate against a domain logon server. Samba-3 does this
+now in the same way that MS Windows NT/2K.
+</p><p>
+The SMB client logging on to a domain has an expectation that every other
+server in the domain should accept the same authentication information.
+Network browsing functionality of domains and workgroups is identical and
+is explained in this documentation under the browsing discussions.
+It should be noted, that browsing is totally orthogonal to logon support.
+</p><p>
+Issues related to the single-logon network model are discussed in this
+section. Samba supports domain logons, network logon scripts, and user
+profiles for MS Windows for workgroups and MS Windows 9X/ME clients
+which are the focus of this section.
+</p><p>
+When an SMB client in a domain wishes to logon, it broadcasts requests for a
+logon server. The first one to reply gets the job, and validates its
+password using whatever mechanism the Samba administrator has installed.
+It is possible (but very stupid) to create a domain where the user
+database is not shared between servers, i.e. they are effectively workgroup
+servers advertising themselves as participating in a domain. This
+demonstrates how authentication is quite different from but closely
+involved with domains.
+</p><p>
+Using these features you can make your clients verify their logon via
+the Samba server; make clients run a batch file when they logon to
+the network and download their preferences, desktop and start menu.
+</p><p><span class="emphasis"><em>
+MS Windows XP Home edition is NOT able to join a domain and does not permit
+the use of domain logons.
+</em></span></p><p>
+Before launching into the configuration instructions, it is
+worthwhile to look at how a Windows 9x/ME client performs a logon:
+</p><div class="orderedlist"><ol type="1"><li><p>
+ The client broadcasts (to the IP broadcast address of the subnet it is in)
+ a NetLogon request. This is sent to the NetBIOS name DOMAIN<#1c> at the
+ NetBIOS layer. The client chooses the first response it receives, which
+ contains the NetBIOS name of the logon server to use in the format of
+ <tt class="filename">\\SERVER</tt>.
+ </p></li><li><p>
+ The client then connects to that server, logs on (does an SMBsessetupX) and
+ then connects to the IPC$ share (using an SMBtconX).
+ </p></li><li><p>
+ The client then does a NetWkstaUserLogon request, which retrieves the name
+ of the user's logon script.
+ </p></li><li><p>
+ The client then connects to the NetLogon share and searches for said script
+ and if it is found and can be read, is retrieved and executed by the client.
+ After this, the client disconnects from the NetLogon share.
+ </p></li><li><p>
+ The client then sends a NetUserGetInfo request to the server, to retrieve
+ the user's home share, which is used to search for profiles. Since the
+ response to the NetUserGetInfo request does not contain much more than
+ the user's home share, profiles for Win9X clients MUST reside in the user
+ home directory.
+ </p></li><li><p>
+ The client then connects to the user's home share and searches for the
+ user's profile. As it turns out, you can specify the user's home share as
+ a sharename and path. For example, <tt class="filename">\\server\fred\.winprofile</tt>.
+ If the profiles are found, they are implemented.
+ </p></li><li><p>
+ The client then disconnects from the user's home share, and reconnects to
+ the NetLogon share and looks for <tt class="filename">CONFIG.POL</tt>, the policies file. If this is
+ found, it is read and implemented.
+ </p></li></ol></div><p>
+The main difference between a PDC and a Windows 9x logon server configuration is that
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Password encryption is not required for a Windows 9x logon server. But note
+ that beginning with MS Windows 98 the default setting is that plain-text
+ password support has been disabled. It can be re-enabled with the registry
+ changes that are documented in the chapter on Policies.
+ </p></li><li><p>
+ Windows 9x/ME clients do not require and do not use machine trust accounts.
+ </p></li></ul></div><p>
+A Samba PDC will act as a Windows 9x logon server; after all, it does provide the
+network logon services that MS Windows 9x / Me expect to find.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876260"></a>Security Mode and Master Browsers</h3></div></div><div></div></div><p>
+There are a few comments to make in order to tie up some
+loose ends. There has been much debate over the issue of whether
+or not it is ok to configure Samba as a Domain Controller in security
+modes other than <tt class="constant">USER</tt>. The only security mode
+which will not work due to technical reasons is <tt class="constant">SHARE</tt>
+mode security. <tt class="constant">DOMAIN</tt> and <tt class="constant">SERVER</tt>
+mode security are really just a variation on SMB user level security.
+</p><p>
+Actually, this issue is also closely tied to the debate on whether
+or not Samba must be the domain master browser for its workgroup
+when operating as a DC. While it may technically be possible
+to configure a server as such (after all, browsing and domain logons
+are two distinctly different functions), it is not a good idea to do
+so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS
+name. This is the name used by Windows clients to locate the DC.
+Windows clients do not distinguish between the DC and the DMB.
+For this reason, it is very wise to configure the Samba DC as the DMB.
+</p><p>
+Now back to the issue of configuring a Samba DC to use a mode other
+than <i class="parameter"><tt>security = user</tt></i>. If a Samba host is configured to use
+another SMB server or DC in order to validate user connection
+requests, then it is a fact that some other machine on the network
+(the <i class="parameter"><tt>password server</tt></i>) knows more about the user than the Samba host.
+99% of the time, this other host is a domain controller. Now
+in order to operate in domain mode security, the <i class="parameter"><tt>workgroup</tt></i> parameter
+must be set to the name of the Windows NT domain (which already
+has a domain controller). If the domain does NOT already have a Domain Controller
+then you do not yet have a Domain!
+</p><p>
+Configuring a Samba box as a DC for a domain that already by definition has a
+PDC is asking for trouble. Therefore, you should always configure the Samba DC
+to be the DMB for its domain and set <i class="parameter"><tt>security = user</tt></i>.
+This is the only officially supported mode of operation.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2876365"></a>Common Problems and Errors</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876372"></a>I cannot include a '$' in a machine name</h3></div></div><div></div></div><p>
+A 'machine account', (typically) stored in <tt class="filename">/etc/passwd</tt>,
+takes the form of the machine name with a '$' appended. FreeBSD (and other BSD
+systems?) won't create a user with a '$' in their name.
+</p><p>
+The problem is only in the program used to make the entry. Once made, it works perfectly.
+Create a user without the '$'. Then use <b class="command">vipw</b> to edit the entry, adding
+the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID!
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876411"></a>I get told "You already have a connection to the Domain...."
+or "Cannot join domain, the credentials supplied conflict with an
+existing set.." when creating a machine trust account.</h3></div></div><div></div></div><p>
+This happens if you try to create a machine trust account from the
+machine itself and already have a connection (e.g. mapped drive)
+to a share (or IPC$) on the Samba PDC. The following command
+will remove all network drive connections:
+</p><pre class="screen">
+ <tt class="prompt">C:\WINNT\></tt> <b class="userinput"><tt>net use * /d</tt></b>
+</pre><p>
+Further, if the machine is already a 'member of a workgroup' that
+is the same name as the domain you are joining (bad idea) you will
+get this message. Change the workgroup name to something else, it
+does not matter what, reboot, and try again.
+</p></div><div xmlns:ns6="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876460"></a>The system can not log you on (C000019B)....</h3></div></div><div></div></div><p>I joined the domain successfully but after upgrading
+to a newer version of the Samba code I get the message, <span class="errorname">The system
+can not log you on (C000019B), Please try again or consult your
+system administrator</span> when attempting to logon.
+</p><p>
+This occurs when the domain SID stored in the secrets.tdb database
+is changed. The most common cause of a change in domain SID is when
+the domain name and/or the server name (NetBIOS name) is changed.
+The only way to correct the problem is to restore the original domain
+SID or remove the domain client from the domain and rejoin. The domain
+SID may be reset using either the net or rpcclient utilities.
+</p><ns6:p>
+The reset or change the domain SID you can use the net command as follows:
+
+</ns6:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>net getlocalsid 'OLDNAME'</tt></b>
+<tt class="prompt">root# </tt><b class="userinput"><tt>net setlocalsid 'SID'</tt></b>
+</pre><ns6:p>
+</ns6:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876531"></a>The machine trust account for this computer either does not
+exist or is not accessible.</h3></div></div><div></div></div><p>
+When I try to join the domain I get the message <span class="errorname">The machine account
+for this computer either does not exist or is not accessible</span>. What's
+wrong?
+</p><p>
+This problem is caused by the PDC not having a suitable machine trust account.
+If you are using the <i class="parameter"><tt>add machine script</tt></i> method to create
+accounts then this would indicate that it has not worked. Ensure the domain
+admin user system is working.
+</p><p>
+Alternatively if you are creating account entries manually then they
+have not been created correctly. Make sure that you have the entry
+correct for the machine trust account in smbpasswd file on the Samba PDC.
+If you added the account using an editor rather than using the smbpasswd
+utility, make sure that the account name is the machine NetBIOS name
+with a '$' appended to it ( i.e. computer_name$ ). There must be an entry
+in both /etc/passwd and the smbpasswd file.
+</p><p>
+Some people have also reported
+that inconsistent subnet masks between the Samba server and the NT
+client can cause this problem. Make sure that these are consistent
+for both client and server.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876588"></a>When I attempt to login to a Samba Domain from a NT4/W2K workstation,
+I get a message about my account being disabled.</h3></div></div><div></div></div><p>
+Enable the user accounts with <b class="userinput"><tt>smbpasswd -e <i class="replaceable"><tt>username</tt></i>
+</tt></b>, this is normally done as an account is created.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876615"></a>Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"</h3></div></div><div></div></div><p>
+ A domain controller has to announce on the network who it is. This usually takes a while.
+ </p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="samba-bdc"></a>Chapter 6. Backup Domain Control</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2878646">Features And Benefits</a></dt><dt><a href="#id2878811">Essential Background Information</a></dt><dd><dl><dt><a href="#id2878839">MS Windows NT4 Style Domain Control</a></dt><dt><a href="#id2876805">Active Directory Domain Control</a></dt><dt><a href="#id2876826">What qualifies a Domain Controller on the network?</a></dt><dt><a href="#id2876850">How does a Workstation find its domain controller?</a></dt></dl></dd><dt><a href="#id2876875">Backup Domain Controller Configuration</a></dt><dd><dl><dt><a href="#id2876945">Example Configuration</a></dt></dl></dd><dt><a href="#id2876995">Common Errors</a></dt><dd><dl><dt><a href="#id2877009">Machine Accounts keep expiring, what can I do?</a></dt><dt><a href="#id2877034">Can Samba be a Backup Domain Controller to an NT4 PDC?</a></dt><dt><a href="#id2877067">How do I replicate the smbpasswd file?</a></dt><dt><a href="#id2877096">Can I do this all with LDAP?</a></dt></dl></dd></dl></div><p>
+Before you continue reading in this section, please make sure that you are comfortable
+with configuring a Samba Domain Controller as described in the
+<a href="Samba-PDC-HOWTO.html" target="_top">Domain Control Chapter</a>.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2878646"></a>Features And Benefits</h2></div></div><div></div></div><p>
+This is one of the most difficult chapters to summarise. It matters not what we say here
+for someone will still draw conclusions and / or approach the Samba-Team with expectations
+that are either not yet capable of being delivered, or that can be achieved for more
+effectively using a totally different approach. Since this HOWTO is already so large and
+extensive, we have taken the decision to provide sufficient (but not comprehensive)
+information regarding Backup Domain Control. In the event that you should have a persistent
+concern that is not addressed in this HOWTO document then please email
+<a href="mailto:jht@samba.org" target="_top">John H Terpstra</a> clearly setting out your requirements
+and / or question and we will do our best to provide a solution.
+</p><p>
+Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain
+Controller. A Samba-3 PDC can operate with an LDAP Account backend. The Samba-3 BDC can
+operate with a slave LDAP server for the Account backend. This effectively gives samba a high
+degree of scalability. This is a very sweet (nice) solution for large organisations.
+</p><p>
+While it is possible to run a Samba-3 BDC with non-LDAP backend, the administrator will
+need to figure out precisely what is the best way to replicate (copy / distribute) the
+user and machine Accounts backend.
+</p><p>
+The use of a non-LDAP backend SAM database is particularly problematic because Domain member
+servers and workstations periodically change the machine trust account password. The new
+password is then stored only locally. This means that in the absence of a centrally stored
+accounts database (such as that provided with an LDAP based solution) if Samba-3 is running
+as a BDC, the PDC instance of the Domain member trust account password will not reach the
+PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs this results in
+overwriting of the SAM that contains the updated (changed) trust account password with resulting
+breakage of the domain trust.
+</p><p>
+Considering the number of comments and questions raised concerning how to configure a BDC
+lets consider each possible option and look at the pro's and con's for each theoretical solution:
+</p><div class="itemizedlist"><p class="title"><b>Backup Domain Backend Account Distribution Options</b></p><ul type="disc"><li><p>
+ Solution: Passwd Backend is LDAP based, BDCs use a slave LDAP server
+ </p><p>
+ Arguments For: This is a neat and manageable solution. The LDAP based SAM (ldapsam)
+ is constantly kept up to date.
+ </p><p>
+ Arguments Against: Complexity
+ </p></li><li><p>
+ Passdb Backend is tdbsam based, BDCs use cron based "net rcp vampire" to
+ suck down the Accounts database from the PDC
+ </p><p>
+ Arguments For: It would be a nice solution
+ </p><p>
+ Arguments Against: It does not work because Samba-3 does not support the required
+ protocols. This may become a later feature but is not available today.
+ </p></li><li><p>
+ Make use of rsync to replicate (pull down) copies of the essential account files
+ </p><p>
+ Arguments For: It is a simple solution, easy to set up as a scheduled job
+ </p><p>
+ Arguments Against: This will over-write the locally changed machine trust account
+ passwords. This is a broken and flawed solution. Do NOT do this.
+ </p></li><li><p>
+ Operate with an entirely local accounts database (not recommended)
+ </p><p>
+ Arguments For: Simple, easy to maintain
+ </p><p>
+ Arguments Against: All machine trust accounts and user accounts will be locally
+ maintained. Domain users will NOT be able to roam from office to office. This is
+ a broken and flawed solution. Do NOT do this.
+ </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2878811"></a>Essential Background Information</h2></div></div><div></div></div><p>
+A Domain Controller is a machine that is able to answer logon requests from network
+workstations. Microsoft LanManager and IBM LanServer were two early products that
+provided this capability. The technology has become known as the LanMan Netlogon service.
+</p><p>
+When MS Windows NT3.10 was first released it supported an new style of Domain Control
+and with it a new form of the network logon service that has extended functionality.
+This service became known as the NT NetLogon Service. The nature of this service has
+changed with the evolution of MS Windows NT and today provides a very complex array of
+services that are implemented over a complex spectrum of technologies.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2878839"></a>MS Windows NT4 Style Domain Control</h3></div></div><div></div></div><p>
+Whenever a user logs into a Windows NT4 / 200x / XP Profresional Workstation,
+the workstation connects to a Domain Controller (authentication server) to validate
+the username and password that the user entered are valid. If the information entered
+does not validate against the account information that has been stored in the Domain
+Control database (the SAM, or Security Accounts Manager database) then a set of error
+codes is returned to the workstation that has made the authentication request.
+</p><p>
+When the username / password pair has been validated, the Domain Controller
+(authentication server) will respond with full enumeration of the account information
+that has been stored regarding that user in the User and Machine Accounts database
+for that Domain. This information contains a complete network access profile for
+the user but excludes any information that is particular to the user's desktop profile,
+or for that matter it excludes all desktop profiles for groups that the user may
+belong to. It does include password time limits, password uniqueness controls,
+network access time limits, account validity information, machine names from which the
+user may access the network, and much more. All this information was stored in the SAM
+in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0).
+</p><p>
+The account information (user and machine) on Domain Controllers is stored in two files,
+one containing the Security information and the other the SAM. These are stored in files
+by the same name in the <tt class="filename">C:\WinNT\System32\config</tt> directory. These
+are the files that are involved in replication of the SAM database where Backup Domain
+Controllers are present on the network.
+</p><p>
+There are two situations in which it is desirable to install Backup Domain Controllers:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ On the local network that the Primary Domain Controller is on if there are many
+ workstations and/or where the PDC is generally very busy. In this case the BDCs
+ will pick up network logon requests and help to add robustness to network services.
+ </p></li><li><p>
+ At each remote site, to reduce wide area network traffic and to add stability to
+ remote network operations. The design of the network, the strategic placement of
+ Backup Domain Controllers, together with an implementation that localises as much
+ of network to client interchange as possible will help to minimise wide area network
+ bandwidth needs (and thus costs).
+ </p></li></ul></div><p>
+The PDC contains the master copy of the SAM. In the event that an administrator makes a
+change to the user account database while physically present on the local network that
+has the PDC, the change will likely be made directly to the PDC instance of the master
+copy of the SAM. In the event that this update may be performed in a branch office the
+change will likely be stored in a delta file on the local BDC. The BDC will then send
+a trigger to the PDC to commence the process of SAM synchronisation. The PDC will then
+request the delta from the BDC and apply it to the master SAM. THe PDC will then contact
+all the BDCs in the Domain and trigger them to obtain the update and then apply that to
+their own copy of the SAM.
+</p><p>
+Thus the BDC is said to hold a <span class="emphasis"><em>read-only</em></span> of the SAM from which
+it is able to process network logon requests and to authenticate users. The BDC can
+continue to provide this service, particularly while, for example, the wide area
+network link to the PDC is down. Thus a BDC plays a very important role in both
+maintenance of Domain security as well as in network integrity.
+</p><p>
+In the event that the PDC should need to be taken out of service, or if it dies, then
+one of the BDCs can be promoted to a PDC. If this happens while the original PDC is on
+line then it is automatically demoted to a BDC. This is an important aspect of Domain
+Controller management. The tool that is used to affect a promotion or a demotion is the
+Server Manager for Domains.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2876742"></a>Example PDC Configuration</h4></div></div><div></div></div><p>
+Since version 2.2 Samba officially supports domain logons for all current Windows Clients,
+including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some
+parameters in the <i class="parameter"><tt>[global]</tt></i>-section of the <tt class="filename">smb.conf</tt> have to be set:
+</p><pre class="programlisting">
+ workgroup = SAMBA
+ domain master = yes
+ domain logons = yes
+</pre><p>
+Several other things like a <i class="parameter"><tt>[homes]</tt></i> and a <i class="parameter"><tt>[netlogon]</tt></i> share also need to be set along with
+settings for the profile path, the users home drive, etc.. This will not be covered in this
+chapter, for more information please refer to the chapter on Domain Control.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876805"></a>Active Directory Domain Control</h3></div></div><div></div></div><p>
+As of the release of MS Windows 2000 and Active Directory, this information is now stored
+in a directory that can be replicated and for which partial or full administrative control
+can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory
+tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT
+act as a Backup Domain Contoller to an Active Directory Domain Controller.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876826"></a>What qualifies a Domain Controller on the network?</h3></div></div><div></div></div><p>
+Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS
+group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network.
+The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server.
+The name type <#1b> name is normally reserved for the Domain Master Browser, a role
+that has nothing to do with anything related to authentication, but the Microsoft Domain
+implementation requires the domain master browser to be on the same machine as the PDC.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876850"></a>How does a Workstation find its domain controller?</h3></div></div><div></div></div><p>
+An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a
+local user to be authenticated has to find the domain controller for SAMBA. It does this
+by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each
+of the machines it gets back from the queries is a domain controller and can answer logon
+requests. To not open security holes both the workstation and the selected domain controller
+authenticate each other. After that the workstation sends the user's credentials (name and
+password) to the local Domain Controller, for valdation.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2876875"></a>Backup Domain Controller Configuration</h2></div></div><div></div></div><p>
+Several things have to be done:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ The domain SID has to be the same on the PDC and the BDC. This used to
+ be stored in the file private/MACHINE.SID. This file is not created
+ anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is
+ stored in the file private/secrets.tdb. Simply copying the secrets.tdb
+ from the PDC to the BDC does not work, as the BDC would
+ generate a new SID for itself and override the domain SID with this
+ new BDC SID.</p><p>
+ To retrieve the domain SID from the PDC or an existing BDC and store it in the
+ secrets.tdb, execute 'net rpc getsid' on the BDC.
+ </p></li><li><p>
+ The Unix user database has to be synchronized from the PDC to the
+ BDC. This means that both the /etc/passwd and /etc/group have to be
+ replicated from the PDC to the BDC. This can be done manually
+ whenever changes are made, or the PDC is set up as a NIS master
+ server and the BDC as a NIS slave server. To set up the BDC as a
+ mere NIS client would not be enough, as the BDC would not be able to
+ access its user database in case of a PDC failure.
+ </p></li><li><p>
+ The Samba password database in the file private/smbpasswd has to be
+ replicated from the PDC to the BDC. This is a bit tricky, see the
+ next section.
+ </p></li><li><p>
+ Any netlogon share has to be replicated from the PDC to the
+ BDC. This can be done manually whenever login scripts are changed,
+ or it can be done automatically together with the smbpasswd
+ synchronization.
+ </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2876945"></a>Example Configuration</h3></div></div><div></div></div><p>
+Finally, the BDC has to be found by the workstations. This can be done by setting:
+</p><pre class="programlisting">
+ workgroup = SAMBA
+ domain master = no
+ domain logons = yes
+</pre><p>
+in the <i class="parameter"><tt>[global]</tt></i>-section of the <tt class="filename">smb.conf</tt> of the BDC. This makes the BDC
+only register the name SAMBA<#1c> with the WINS server. This is no
+problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to
+be registered by more than one machine. The parameter 'domain master =
+no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS
+name is reserved for the Primary Domain Controller.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2876995"></a>Common Errors</h2></div></div><div></div></div><p>
+As this is a rather new area for Samba there are not many examples that we may refer to. Keep
+watching for updates to this section.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2877009"></a>Machine Accounts keep expiring, what can I do?</h3></div></div><div></div></div><p>
+This problem will occur when occur when the passdb (SAM) files are copied from a central
+server but the local Backup Domain Controllers. Local machine trust account password updates
+are not copied back to the central server. The newer machine account password is then over
+written when the SAM is copied from the PDC. The result is that the Domain member machine
+on start up will find that it's passwords does not match the one now in the database and
+since the startup security check will now fail, this machine will not allow logon attempts
+to procede and the account expiry error will be reported.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2877034"></a>Can Samba be a Backup Domain Controller to an NT4 PDC?</h3></div></div><div></div></div><p>
+With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully
+implemented. The Samba Team is working on understanding and implementing the protocols,
+but this work has not been finished for version 2.2.
+</p><p>
+With version 3.0, the work on both the replication protocols and a suitable storage
+mechanism has progressed, and some form of NT4 BDC support is expected soon.
+</p><p>
+Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a
+BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to
+service logon requests whenever the PDC is down.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2877067"></a>How do I replicate the smbpasswd file?</h3></div></div><div></div></div><p>
+Replication of the smbpasswd file is sensitive. It has to be done whenever changes
+to the SAM are made. Every user's password change is done in the smbpasswd file and
+has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary.
+</p><p>
+As the smbpasswd file contains plain text password equivalents, it must not be
+sent unencrypted over the wire. The best way to set up smbpasswd replication from
+the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport.
+Ssh itself can be set up to accept *only* rsync transfer without requiring the user
+to type a password.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2877096"></a>Can I do this all with LDAP?</h3></div></div><div></div></div><p>
+The simple answer is YES. Samba's pdb_ldap code supports binding to a replica
+LDAP server, and will also follow referrals and rebind to the master if it ever
+needs to make a modification to the database. (Normally BDCs are read only, so
+this will not occur often).
+</p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="domain-member"></a>Chapter 7. Domain Membership</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jeremy</span> <span class="surname">Allison</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jra@samba.org">jra@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jerry@samba.org">jerry@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:tridge@samba.org">tridge@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2877621">Features and Benefits</a></dt><dt><a href="#id2877192">MS Windows Workstation/Server Machine Trust Accounts</a></dt><dd><dl><dt><a href="#id2877352">Manual Creation of Machine Trust Accounts</a></dt><dt><a href="#id2879134">Using NT4 Server Manager to Add Machine Accounts to the Domain</a></dt><dt><a href="#id2879331">"On-the-Fly" Creation of Machine Trust Accounts</a></dt><dt><a href="#id2879386">Making an MS Windows Workstation or Server a Domain Member</a></dt></dl></dd><dt><a href="#id2879531">Domain Member Server</a></dt><dd><dl><dt><a href="#id2879579">Joining an NT4 type Domain with Samba-3</a></dt><dt><a href="#id2882177">Why is this better than security = server?</a></dt></dl></dd><dt><a href="#ads-member">Samba ADS Domain Membership</a></dt><dd><dl><dt><a href="#id2882315">Setup your smb.conf</a></dt><dt><a href="#id2882398">Setup your /etc/krb5.conf</a></dt><dt><a href="#ads-create-machine-account">Create the computer account</a></dt><dt><a href="#ads-test-server">Test your server setup</a></dt><dt><a href="#ads-test-smbclient">Testing with smbclient</a></dt><dt><a href="#id2882740">Notes</a></dt></dl></dd><dt><a href="#id2882762">Common Errors</a></dt><dd><dl><dt><a href="#id2882784">Can Not Add Machine Back to Domain</a></dt><dt><a href="#id2882816">Adding Machine to Domain Fails</a></dt></dl></dd></dl></div><p>
+Domain Membership is a subject of vital concern, Samba must be able to
+participate as a member server in a Microsoft Domain security context, and
+Samba must be capable of providing Domain machine member trust accounts,
+otherwise it would not be capable of offering a viable option for many users.
+</p><p>
+This chapter covers background information pertaining to domain membership,
+Samba configuration for it, and MS Windows client procedures for joining a
+domain. Why is this necessary? Because both are areas in which there exists
+within the current MS Windows networking world and particularly in the
+Unix/Linux networking and administration world, a considerable level of
+mis-information, incorrect understanding, and a lack of knowledge. Hopefully
+this chapter will fill the voids.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2877621"></a>Features and Benefits</h2></div></div><div></div></div><p>
+MS Windows workstations and servers that want to participate in domain
+security need to
+be made Domain members. Participating in Domain security is often called
+<span class="emphasis"><em>Single Sign On</em></span> or <span class="acronym">SSO</span> for short. This
+chapter describes the process that must be followed to make a workstation
+(or another server - be it an <span class="application">MS Windows NT4 / 200x</span>
+server) or a Samba server a member of an MS Windows Domain security context.
+</p><p>
+Samba-3 can join an MS Windows NT4 style domain as a native member server, an
+MS Windows Active Directory Domain as a native member server, or a Samba Domain
+Control network.
+</p><p>
+Domain membership has many advantages:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ MS Windows workstation users get the benefit of SSO
+ </p></li><li><p>
+ Domain user access rights and file ownership / access controls can be set
+ from the single Domain SAM (Security Accounts Management) database
+ (works with Domain member servers as well as with MS Windows workstations
+ that are domain members)
+ </p></li><li><p>
+ Only <span class="application">MS Windows NT4 / 200x / XP Professional</span>
+ workstations that are Domain members
+ can use network logon facilities
+ </p></li><li><p>
+ Domain Member workstations can be better controlled through the use of
+ Policy files (<tt class="filename">NTConfig.POL</tt>) and Desktop Profiles.
+ </p></li><li><p>
+ Through the use of logon scripts users can be given transparent access to network
+ applications that run off application servers
+ </p></li><li><p>
+ Network administrators gain better application and user access management
+ abilities because there is no need to maintain user accounts on any network
+ client or server, other than the central Domain database
+ (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an
+ LDAP directory, or via an Active Directory infrastructure)
+ </p></li></ul></div></div><div xmlns:ns7="" class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2877192"></a>MS Windows Workstation/Server Machine Trust Accounts</h2></div></div><div></div></div><p>
+A machine trust account is an account that is used to authenticate a client
+machine
+(rather than a user) to the Domain Controller server. In Windows terminology,
+this is known as a "Computer Account."
+</p><p>
+The password of a machine trust account acts as the shared secret for
+secure communication with the Domain Controller. This is a security
+feature to prevent an unauthorized machine with the same NetBIOS name
+from joining the domain and gaining access to domain user/group
+accounts. Windows NT, 200x, XP Professional clients use machine trust
+accounts, but Windows 9x / Me / XP Home clients do not. Hence, a
+Windows 9x / Me / XP Home client is never a true member of a domain
+because it does not possess a machine trust account, and thus has no
+shared secret with the domain controller.
+</p><p>
+A Windows NT4 PDC stores each machine trust account in the Windows Registry.
+The introduction of MS Windows 2000 saw the introduction of Active Directory,
+the new repository for machine trust accounts.
+</p><ns7:p>
+A Samba PDC, however, stores each machine trust account in two parts,
+as follows:
+
+</ns7:p><div class="itemizedlist"><ul type="disc"><li><p>
+ A Domain Security Account (stored in the
+ <i class="parameter"><tt>passdb backend</tt></i> that has been configured in the
+ <tt class="filename">smb.conf</tt> file. The precise nature of the account information that is
+ stored depends on the type of backend database that has been chosen.
+ </p><p>
+ The older format of this data is the <tt class="filename">smbpasswd</tt> database
+ which contains the unix login ID, the Unix user identifier (UID), and the
+ LanMan and NT encrypted passwords. There is also some other information in
+ this file that we do not need to concern ourselves with here.
+ </p><p>
+ The two newer database types are called <span class="emphasis"><em>ldapsam</em></span>,
+ <span class="emphasis"><em>tdbsam</em></span>. Both store considerably more data than the
+ older <tt class="filename">smbpasswd</tt> file did. The extra information
+ enables new user account controls to be used.
+ </p></li><li><p>
+ A corresponding Unix account, typically stored in
+ <tt class="filename">/etc/passwd</tt>. Work is in progress to allow a
+ simplified mode of operation that does not require Unix user accounts, but
+ this may not be a feature of the early releases of Samba-3.
+ </p></li></ul></div><ns7:p>
+</ns7:p><p>
+There are three ways to create machine trust accounts:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Manual creation from the Unix/Linux command line. Here, both the Samba and
+ corresponding Unix account are created by hand.
+ </p></li><li><p>
+ Using the MS Windows NT4 Server Manager (either from an NT4 Domain member
+ server, or using the Nexus toolkit available from the Microsoft web site.
+ This tool can be run from any MS Windows machine so long as the user is
+ logged on as the administrator account.
+ </p></li><li><p>
+ "On-the-fly" creation. The Samba machine trust account is automatically
+ created by Samba at the time the client is joined to the domain.
+ (For security, this is the recommended method.) The corresponding Unix
+ account may be created automatically or manually.
+ </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2877352"></a>Manual Creation of Machine Trust Accounts</h3></div></div><div></div></div><p>
+The first step in manually creating a machine trust account is to manually
+create the corresponding Unix account in <tt class="filename">/etc/passwd</tt>.
+This can be done using <b class="command">vipw</b> or another 'add user' command
+that is normally used to create new Unix accounts. The following is an example for a Linux based Samba server:
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/sbin/useradd -g 100 -d /dev/null -c <i class="replaceable"><tt>"machine nickname"</tt></i> -s /bin/false <i class="replaceable"><tt>machine_name</tt></i>$ </tt></b>
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>passwd -l <i class="replaceable"><tt>machine_name</tt></i>$</tt></b>
+</p><p>
+On *BSD systems, this can be done using the <b class="command">chpass</b> utility:
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>chpass -a "<i class="replaceable"><tt>machine_name</tt></i>$:*:101:100::0:0:Workstation <i class="replaceable"><tt>machine_name</tt></i>:/dev/null:/sbin/nologin"</tt></b>
+</p><p>
+The <tt class="filename">/etc/passwd</tt> entry will list the machine name
+with a "$" appended, won't have a password, will have a null shell and no
+home directory. For example a machine named 'doppy' would have an
+<tt class="filename">/etc/passwd</tt> entry like this:
+</p><pre class="programlisting">
+doppy$:x:505:501:<i class="replaceable"><tt>machine_nickname</tt></i>:/dev/null:/bin/false
+</pre><p>
+Above, <i class="replaceable"><tt>machine_nickname</tt></i> can be any
+descriptive name for the client, i.e., BasementComputer.
+<i class="replaceable"><tt>machine_name</tt></i> absolutely must be the NetBIOS
+name of the client to be joined to the domain. The "$" must be
+appended to the NetBIOS name of the client or Samba will not recognize
+this as a machine trust account.
+</p><p>
+Now that the corresponding Unix account has been created, the next step is to create
+the Samba account for the client containing the well-known initial
+machine trust account password. This can be done using the <a href="smbpasswd.8.html" target="_top"><b class="command">smbpasswd(8)</b></a> command
+as shown here:
+</p><ns7:p>
+</ns7:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>smbpasswd -a -m <i class="replaceable"><tt>machine_name</tt></i></tt></b>
+</pre><ns7:p>>
+</ns7:p><p>
+where <i class="replaceable"><tt>machine_name</tt></i> is the machine's NetBIOS
+name. The RID of the new machine account is generated from the UID of
+the corresponding Unix account.
+</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Join the client to the domain immediately</h3><p>
+ Manually creating a machine trust account using this method is the
+ equivalent of creating a machine trust account on a Windows NT PDC using
+ the <span class="application">Server Manager</span>. From the time at which the
+ account is created to the time which the client joins the domain and
+ changes the password, your domain is vulnerable to an intruder joining
+ your domain using a machine with the same NetBIOS name. A PDC inherently
+ trusts members of the domain and will serve out a large degree of user
+ information to such clients. You have been warned!
+ </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2879134"></a>Using NT4 Server Manager to Add Machine Accounts to the Domain</h3></div></div><div></div></div><p>
+If the machine from which you are trying to manage the domain is an
+<span class="application">MS Windows NT4 workstation</span>
+then the tool of choice is the package called <b class="command">SRVTOOLS.EXE</b>.
+When executed in the target directory this will unpack
+<b class="command">SrvMge.exe</b> and <b class="command">UsrMgr.exe</b> (both are
+Domain Management tools for MS Windows NT4 workstation.
+</p><p>
+If your workstation is any other MS Windows product you should download the
+<b class="command">Nexus.exe</b> package from the Microsoft web site. When executed
+from the target directory this will unpack the same tools but for use on
+<span class="application">MS Windows 9x/Me/200x/XP</span>.
+</p><p>
+Launch the <b class="command">srvmgr.exe</b> (Server Manager for Domains) and follow these steps:
+</p><div class="procedure"><p class="title"><b>Procedure 7.1. Server Manager Account Machine Account Management</b></p><ol type="1"><li><p>
+ From the menu select <span class="guimenu">Computer</span>
+ </p></li><li><p>
+ Click on <span class="guimenuitem">Select Domain</span>
+ </p></li><li><p>
+ Click on the name of the domain you wish to administer in the
+ <span class="guilabel">Select Domain</span> panel and then click
+ <span class="guibutton">OK</span>.
+ </p></li><li><p>
+ Again from the menu select <span class="guimenu">Computer</span>
+ </p></li><li><p>
+ Select <span class="guimenuitem">Add to Domain</span>
+ </p></li><li><p>
+ In the dialog box, click on the radio button to
+ <span class="guilabel">Add NT Workstation of Server</span>, then
+ enter the machine name in the field provided, then click the
+ <span class="guibutton">Add</span> button.
+ </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2879331"></a>"On-the-Fly" Creation of Machine Trust Accounts</h3></div></div><div></div></div><p>
+The second (and recommended) way of creating machine trust accounts is
+simply to allow the Samba server to create them as needed when the client
+is joined to the domain.
+</p><p>Since each Samba machine trust account requires a corresponding Unix account, a method
+for automatically creating the Unix account is usually supplied; this requires configuration of the
+<a href="smb.conf.5.html#ADDMACHINESCRIPT" target="_top">add machine script</a> option in
+<tt class="filename">smb.conf</tt>. This method is not required, however; corresponding Unix
+accounts may also be created manually.
+</p><p>
+Below is an example for a RedHat Linux system.
+</p><pre class="programlisting">
+[global]
+ # <...remainder of parameters...>
+ add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2879386"></a>Making an MS Windows Workstation or Server a Domain Member</h3></div></div><div></div></div><p>
+The procedure for making an MS Windows workstation of server a member of the domain varies
+with the version of Windows:
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2879399"></a>Windows 200x XP Professional</h4></div></div><div></div></div><p>
+ When the user elects to make the client a domain member, Windows 200x prompts for
+ an account and password that has privileges to create machine accounts in the domain.
+ A Samba administrative account (i.e., a Samba account that has root privileges on the
+ Samba server) must be entered here; the operation will fail if an ordinary user
+ account is given.
+ </p><p>
+ Note: For security reasons the password for this administrative account should be set
+ to a password that is other than that used for the root user in the
+ <tt class="filename">/etc/passwd</tt>.
+ </p><p>
+ The name of the account that is used to create domain member machine accounts can be
+ anything the network administrator may choose. If it is other than <span class="emphasis"><em>root</em></span>
+ then this is easily mapped to root using the file pointed to be the <tt class="filename">smb.conf</tt> parameter
+ <i class="parameter"><tt>username map = /etc/samba/smbusers</tt></i>.
+ </p><p>
+ The session key of the Samba administrative account acts as an
+ encryption key for setting the password of the machine trust
+ account. The machine trust account will be created on-the-fly, or
+ updated if it already exists.
+ </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2879467"></a>Windows NT4</h4></div></div><div></div></div><p>
+ If the machine trust account was created manually, on the
+ Identification Changes menu enter the domain name, but do not
+ check the box <span class="guilabel">Create a Computer Account in the Domain</span>.
+ In this case, the existing machine trust account is used to join the machine
+ to the domain.
+ </p><p>
+ If the machine trust account is to be created
+ on-the-fly, on the Identification Changes menu enter the domain
+ name, and check the box <span class="guilabel">Create a Computer Account in the
+ Domain</span>. In this case, joining the domain proceeds as above
+ for Windows 2000 (i.e., you must supply a Samba administrative account when
+ prompted).
+ </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2879508"></a>Samba</h4></div></div><div></div></div><p>Joining a samba client to a domain is documented in
+ the <a href="#domain-member" title="Chapter 7. Domain Membership">Domain Member</a> chapter.
+ </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2879531"></a>Domain Member Server</h2></div></div><div></div></div><p>
+This mode of server operation involves the samba machine being made a member
+of a domain security context. This means by definition that all user
+authentication will be done from a centrally defined authentication regime.
+The authentication regime may come from an NT3/4 style (old domain technology)
+server, or it may be provided from an Active Directory server (ADS) running on
+MS Windows 2000 or later.
+</p><p>
+<span class="emphasis"><em>
+Of course it should be clear that the authentication back end itself could be
+from any distributed directory architecture server that is supported by Samba.
+This can be LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory
+Server, etc.
+</em></span>
+</p><p>
+Please refer to the <a href="#samba-pdc" title="Chapter 5. Domain Control">Domain Control chapter</a>
+for more information regarding how to create a domain
+machine account for a domain member server as well as for information
+regarding how to enable the samba domain member machine to join the domain and
+to be fully trusted by it.
+</p><div xmlns:ns8="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2879579"></a>Joining an NT4 type Domain with Samba-3</h3></div></div><div></div></div><ns8:p>
+ </ns8:p><div class="table"><a name="id2879589"></a><p class="title"><b>Table 7.1. Assumptions</b></p><table summary="Assumptions" border="1"><colgroup><col><col></colgroup><tbody><tr><td align="left">NetBIOS name:</td><td align="left">SERV1</td></tr><tr><td align="left">Win2K/NT domain name:</td><td align="left">DOM</td></tr><tr><td align="left">Domain's PDC NetBIOS name:</td><td align="left">DOMPDC</td></tr><tr><td align="left">Domain's BDC NetBIOS names:</td><td align="left">DOMBDC1 and DOMBDC2</td></tr></tbody></table></div><ns8:p>
+</ns8:p><p>
+First, you must edit your <tt class="filename">smb.conf</tt> file to tell Samba it should
+now use domain security.
+</p><p>
+Change (or add) your <a href="smb.conf.5.html#SECURITY" target="_top">
+<i class="parameter"><tt>security</tt></i></a> line in the [global] section
+of your <tt class="filename">smb.conf</tt> to read:
+</p><ns8:p>
+</ns8:p><pre class="programlisting">
+security = domain
+</pre><ns8:p>
+</ns8:p><p>
+Next change the <a href="smb.conf.5.html#WORKGROUP" target="_top"><i class="parameter"><tt>
+workgroup</tt></i></a> line in the <i class="parameter"><tt>[global]</tt></i>
+section to read:
+</p><ns8:p>
+</ns8:p><pre class="programlisting">
+workgroup = DOM
+</pre><ns8:p>
+</ns8:p><p>
+as this is the name of the domain we are joining.
+</p><p>
+You must also have the parameter <a href="smb.conf.5.html#ENCRYPTPASSWORDS" target="_top">
+<i class="parameter"><tt>encrypt passwords</tt></i></a> set to <tt class="constant">yes
+</tt> in order for your users to authenticate to the NT PDC.
+</p><p>
+Finally, add (or modify) a <a href="smb.conf.5.html#PASSWORDSERVER" target="_top">
+<i class="parameter"><tt>password server</tt></i></a> line in the [global]
+section to read:
+</p><ns8:p>
+</ns8:p><pre class="programlisting">
+password server = DOMPDC DOMBDC1 DOMBDC2
+</pre><ns8:p>
+</ns8:p><p>
+These are the primary and backup domain controllers Samba
+will attempt to contact in order to authenticate users. Samba will
+try to contact each of these servers in order, so you may want to
+rearrange this list in order to spread out the authentication load
+among domain controllers.
+</p><p>
+Alternatively, if you want smbd to automatically determine
+the list of Domain controllers to use for authentication, you may
+set this line to be:
+</p><ns8:p>
+</ns8:p><pre class="programlisting">
+password server = *
+</pre><ns8:p>
+</ns8:p><p>
+This method, allows Samba to use exactly the same mechanism that NT does. This
+method either broadcasts or uses a WINS database in order to
+find domain controllers to authenticate against.
+</p><p>
+In order to actually join the domain, you must run this command:
+</p><ns8:p>
+</ns8:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>net join -S DOMPDC -U<i class="replaceable"><tt>Administrator%password</tt></i></tt></b>
+</pre><ns8:p>
+</ns8:p><p>
+If the <tt class="option">-S DOMPDC</tt> argument is not given then
+the domain name will be obtained from <tt class="filename">smb.conf</tt>.
+</p><p>
+As we are joining the domain DOM and the PDC for that domain
+(the only machine that has write access to the domain SAM database)
+is DOMPDC. The <i class="replaceable"><tt>Administrator%password</tt></i> is
+the login name and password for an account which has the necessary
+privilege to add machines to the domain. If this is successful
+you will see the message:
+</p><p>
+<tt class="computeroutput">Joined domain DOM.</tt>
+or <tt class="computeroutput">Joined 'SERV1' to realm 'MYREALM'</tt>
+</p><p>
+in your terminal window. See the <a href="net.8.html" target="_top">
+net(8)</a> man page for more details.
+</p><p>
+This process joins the server to the domain without having to create the machine
+trust account on the PDC beforehand.
+</p><p>
+This command goes through the machine account password
+change protocol, then writes the new (random) machine account
+password for this Samba server into a file in the same directory
+in which an smbpasswd file would be stored - normally :
+</p><p>
+<tt class="filename">/usr/local/samba/private/secrets.tdb</tt>
+</p><p>
+This file is created and owned by root and is not
+readable by any other user. It is the key to the domain-level
+security for your system, and should be treated as carefully
+as a shadow password file.
+</p><p>
+Finally, restart your Samba daemons and get ready for
+clients to begin using domain security!
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2882177"></a>Why is this better than security = server?</h3></div></div><div></div></div><p>
+Currently, domain security in Samba doesn't free you from
+having to create local Unix users to represent the users attaching
+to your server. This means that if domain user <tt class="constant">DOM\fred
+</tt> attaches to your domain security Samba server, there needs
+to be a local Unix user fred to represent that user in the Unix
+filesystem. This is very similar to the older Samba security mode
+<a href="smb.conf.5.html#SECURITYEQUALSSERVER" target="_top">security = server</a>,
+where Samba would pass through the authentication request to a Windows
+NT server in the same way as a Windows 95 or Windows 98 server would.
+</p><p>
+Please refer to the <a href="winbind.html" target="_top">Winbind
+paper</a> for information on a system to automatically
+assign UNIX uids and gids to Windows NT Domain users and groups.
+</p><p>
+The advantage to domain-level security is that the
+authentication in domain-level security is passed down the authenticated
+RPC channel in exactly the same way that an NT server would do it. This
+means Samba servers now participate in domain trust relationships in
+exactly the same way NT servers do (i.e., you can add Samba servers into
+a resource domain and have the authentication passed on from a resource
+domain PDC to an account domain PDC).
+</p><p>
+In addition, with <i class="parameter"><tt>security = server</tt></i> every Samba
+daemon on a server has to keep a connection open to the
+authenticating server for as long as that daemon lasts. This can drain
+the connection resources on a Microsoft NT server and cause it to run
+out of available connections. With <i class="parameter"><tt>security = domain</tt></i>,
+however, the Samba daemons connect to the PDC/BDC only for as long
+as is necessary to authenticate the user, and then drop the connection,
+thus conserving PDC connection resources.
+</p><p>
+And finally, acting in the same manner as an NT server
+authenticating to a PDC means that as part of the authentication
+reply, the Samba server gets the user identification information such
+as the user SID, the list of NT groups the user belongs to, etc.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Much of the text of this document
+was first published in the Web magazine
+<a href="http://www.linuxworld.com" target="_top">LinuxWorld</a> as the article <a href="http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html" target="_top">Doing
+the NIS/NT Samba</a>.
+</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ads-member"></a>Samba ADS Domain Membership</h2></div></div><div></div></div><p>
+This is a rough guide to setting up Samba 3.0 with kerberos authentication against a
+Windows2000 KDC.
+</p><div xmlns:ns9="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2882315"></a>Setup your <tt class="filename">smb.conf</tt></h3></div></div><div></div></div><p>
+You must use at least the following 3 options in <tt class="filename">smb.conf</tt>:
+</p><pre class="programlisting">
+ realm = your.kerberos.REALM
+ security = ADS
+ encrypt passwords = yes
+</pre><ns9:p>
+In case samba can't figure out your ads server using your realm name, use the
+<i class="parameter"><tt>ads server</tt></i> option in <tt class="filename">smb.conf</tt>:
+</ns9:p><pre class="programlisting">
+ ads server = your.kerberos.server
+</pre><ns9:p>
+</ns9:p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+You do <span class="emphasis"><em>not</em></span> need a smbpasswd file, and older clients will be authenticated as
+if <i class="parameter"><tt>security = domain</tt></i>, although it won't do any harm and
+allows you to have local users not in the domain. It is expected that the above
+required options will change soon when active directory integration will get
+better.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2882398"></a>Setup your <tt class="filename">/etc/krb5.conf</tt></h3></div></div><div></div></div><p>
+The minimal configuration for <tt class="filename">krb5.conf</tt> is:
+</p><pre class="programlisting">
+ [realms]
+ YOUR.KERBEROS.REALM = {
+ kdc = your.kerberos.server
+ }
+</pre><p>
+Test your config by doing a <b class="userinput"><tt>kinit
+<i class="replaceable"><tt>USERNAME</tt></i>@<i class="replaceable"><tt>REALM</tt></i></tt></b> and
+making sure that your password is accepted by the Win2000 KDC.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The realm must be uppercase or you will get <span class="errorname">Cannot find KDC for
+requested realm while getting initial credentials</span> error
+</p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Time between the two servers must be synchronized. You will get a
+<span class="errorname">kinit(v5): Clock skew too great while getting initial credentials</span>
+if the time difference is more than five minutes.
+</p></div><p>
+You also must ensure that you can do a reverse DNS lookup on the IP
+address of your KDC. Also, the name that this reverse lookup maps to
+must either be the netbios name of the KDC (ie. the hostname with no
+domain attached) or it can alternatively be the netbios name
+followed by the realm.
+</p><p>
+The easiest way to ensure you get this right is to add a
+<tt class="filename">/etc/hosts</tt> entry mapping the IP address of your KDC to
+its netbios name. If you don't get this right then you will get a
+<span class="errorname">local error</span> when you try to join the realm.
+</p><p>
+If all you want is kerberos support in <span class="application">smbclient</span> then you can skip
+straight to <a href="#ads-test-smbclient" title="Testing with smbclient">Test with <span class="application">smbclient</span></a> now.
+<a href="#ads-create-machine-account" title="Create the computer account">Creating a computer account</a>
+and <a href="#ads-test-server" title="Test your server setup">testing your servers</a>
+is only needed if you want kerberos support for <span class="application">smbd</span> and <span class="application">winbindd</span>.
+</p></div><div xmlns:ns10="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ads-create-machine-account"></a>Create the computer account</h3></div></div><div></div></div><ns10:p>
+As a user that has write permission on the Samba private directory
+(usually root) run:
+</ns10:p><pre class="programlisting">
+ <b class="userinput"><tt>net join -U Administrator%password</tt></b>
+</pre><ns10:p>
+</ns10:p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2882589"></a>Possible errors</h4></div></div><div></div></div><ns10:p>
+</ns10:p><div class="variablelist"><dl><dt><span class="term"><span class="errorname">ADS support not compiled in</span></span></dt><dd><p>Samba must be reconfigured (remove config.cache) and recompiled
+ (make clean all install) after the kerberos libs and headers are installed.
+ </p></dd><dt><span class="term"><span class="errorname">net join prompts for user name</span></span></dt><dd><p>You need to login to the domain using <b class="userinput"><tt>kinit
+ <i class="replaceable"><tt>USERNAME</tt></i>@<i class="replaceable"><tt>REALM</tt></i></tt></b>.
+ <i class="replaceable"><tt>USERNAME</tt></i> must be a user who has rights to add a machine
+ to the domain. </p></dd></dl></div><ns10:p>
+</ns10:p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ads-test-server"></a>Test your server setup</h3></div></div><div></div></div><p>
+If the join was successful, you will see a new computer account with the
+NetBIOS name of your Samba server in Active Directory (in the "Computers"
+folder under Users and Computers.
+</p><p>
+On a Windows 2000 client try <b class="userinput"><tt>net use * \\server\share</tt></b>. You should
+be logged in with kerberos without needing to know a password. If
+this fails then run <b class="userinput"><tt>klist tickets</tt></b>. Did you get a ticket for the
+server? Does it have an encoding type of DES-CBC-MD5 ?
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ads-test-smbclient"></a>Testing with <span class="application">smbclient</span></h3></div></div><div></div></div><p>
+On your Samba server try to login to a Win2000 server or your Samba
+server using <span class="application">smbclient</span> and kerberos. Use <span class="application">smbclient</span> as usual, but
+specify the <i class="parameter"><tt>-k</tt></i> option to choose kerberos authentication.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2882740"></a>Notes</h3></div></div><div></div></div><p>
+You must change administrator password at least once after DC
+install, to create the right encoding types
+</p><p>
+W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in
+their defaults DNS setup. Maybe fixed in service packs?
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2882762"></a>Common Errors</h2></div></div><div></div></div><p>
+In the process of adding / deleting / re-adding domain member machine accounts there are
+many traps for the unwary player and there are many "little" things that can go wrong.
+It is particularly interesting how often subscribers on the samba mailing list have concluded
+after repeated failed attempts to add a machine account that it is necessary to "re-install"
+MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type
+of problem. The real solution is often very simple, and with understanding of how MS Windows
+networking functions. easily overcome.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2882784"></a>Can Not Add Machine Back to Domain</h3></div></div><div></div></div><p>
+<span class="emphasis"><em>Problem:</em></span> A Windows workstation was reinstalled. The original domain machine
+account was deleted and added immediately. The workstation will not join the domain if I use
+the same machine name. Attempts to add the machine fail with a message that the machine already
+exists on the network - I know it doen't. Why is this failing?
+</p><p>
+The original name is still in the NetBIOS name cache and must expire after machine account
+deletion BEFORE adding that same name as a domain member again. The best advice is to delete
+the old account and then to add the machine with a new name.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2882816"></a>Adding Machine to Domain Fails</h3></div></div><div></div></div><p>
+Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a
+message that, <span class="errorname">The machine could not be added at this time, there is a network problem.
+Please try again later.</span> Why?
+</p><p>
+You should check that there is an <i class="parameter"><tt>add machine script</tt></i> in your <tt class="filename">smb.conf</tt>
+file. If there is not, please add one that is appropriate for your OS platform. If a script
+has been defined you will need to debug it's operation. Increase the <i class="parameter"><tt>log level</tt></i>
+in the <tt class="filename">smb.conf</tt> file to level 10, then try to rejoin the domain. Check the logs to see which
+operation is failing.
+</p><p>
+Possible causes include:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ The script does not actually exist, or could not be located in the path specified.
+ </p><p>
+ <span class="emphasis"><em>Corrective Action:</em></span> Fix it. Make sure that when run manually
+ that the script will add both the Unix system account _and_ the Samba SAM account.
+ </p></li><li><p>
+ The machine could not be added to the Unix system accounts file <tt class="filename">/etc/passwd</tt>
+ </p><p>
+ <span class="emphasis"><em>Corrective Action:</em></span> Check that the machine name is a legal Unix
+ system account name. ie: If the Unix utility <b class="command">useradd</b> is called
+ then make sure that the machine name you are trying to add can be added using this
+ tool. <b class="command">Useradd</b> on some systems will not allow any upper case characters
+ nor will it allow spaces in the name.
+ </p></li></ul></div></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="StandAloneServer"></a>Chapter 8. Stand-Alone Servers</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2884259">Features and Benefits</a></dt><dt><a href="#id2884297">Background</a></dt><dt><a href="#id2884365">Example Configuration</a></dt><dd><dl><dt><a href="#id2882967">Reference Documentation Server</a></dt><dt><a href="#id2883015">Central Print Serving</a></dt></dl></dd><dt><a href="#id2883221">Common Errors</a></dt></dl></div><p>
+Stand-Alone servers are independant of Domain Controllers on the network.
+They are NOT domain members and function more like workgroup servers. In many
+cases a stand-alone server is configured with a minimum of security control
+with the intent that all data served will be readilly accessible to all users.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2884259"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Stand-Alone servers can be as secure or as insecure as needs dictate. They can
+have simple or complex configurations. Above all, despite the hoopla about
+Domain security they remain a very common installation.
+</p><p>
+If all that is needed is a server for read-only files, or for
+printers alone, it may not make sense to affect a complex installation.
+For example: A drafting office needs to store old drawings and reference
+standards. No-one can write files to the server as it is legislatively
+important that all documents remain unaltered. A share mode read-only stand-alone
+server is an ideal solution.
+</p><p>
+Another situation that warrants simplicity is an office that has many printers
+that are queued off a single central server. Everyone needs to be able to print
+to the printers, there is no need to affect any access controls and no files will
+be served from the print server. Again a share mode stand-alone server makes
+a great solution.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2884297"></a>Background</h2></div></div><div></div></div><p>
+The term <span class="emphasis"><em>stand-alone server</em></span> means that the server
+will provide local authentication and access control for all resources
+that are available from it. In general this means that there will be a
+local user database. In more technical terms, it means that resources
+on the machine will be made available in either SHARE mode or in
+USER mode.
+</p><p>
+No special action is needed other than to create user accounts. Stand-alone
+servers do NOT provide network logon services. This means that machines that
+use this server do NOT perform a domain log onto it. Whatever logon facility
+the workstations are subject to is independant of this machine. It is however
+necessary to accomodate any network user so that the logon name they use will
+be translated (mapped) locally on the stand-alone server to a locally known
+user name. There are several ways this cane be done.
+</p><p>
+Samba tends to blur the distinction a little in respect of what is
+a stand-alone server. This is because the authentication database may be
+local or on a remote server, even if from the samba protocol perspective
+the samba server is NOT a member of a domain security context.
+</p><p>
+Through the use of PAM (Pluggable Authentication Modules) and nsswitch
+(the name service switcher) the source of authentication may reside on
+another server. We would be inclined to call this the authentication server.
+This means that the samba server may use the local Unix/Linux system password database
+(<tt class="filename">/etc/passwd</tt> or <tt class="filename">/etc/shadow</tt>), may use a
+local smbpasswd file, or may use
+an LDAP back end, or even via PAM and Winbind another CIFS/SMB server
+for authentication.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2884365"></a>Example Configuration</h2></div></div><div></div></div><p>
+The following examples are designed to inspire simplicity. It is too easy to
+attempt a high level of creativity and to introduce too much complexity in
+server and network design.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2882967"></a>Reference Documentation Server</h3></div></div><div></div></div><p>
+Configuration of a read-only data server that EVERYONE can access is very simple.
+Here is the smb.conf file that will do this. Assume that all the reference documents
+are stored in the directory /export, that the documents are owned by a user other than
+nobody. No home directories are shared, that are no users in the <tt class="filename">/etc/passwd</tt>
+Unix system database. This is a very simple system to administer.
+</p><pre class="programlisting">
+ # Global parameters
+ [global]
+ workgroup = MYGROUP
+ netbios name = REFDOCS
+ security = SHARE
+ passdb backend = guest
+ wins server = 192.168.1.1
+
+ [data]
+ comment = Data
+ path = /export
+ guest only = Yes
+</pre><p>
+In the above example the machine name is set to REFDOCS, the workgroup is set to the name
+of the local workgroup so that the machine will appear in with systems users are familiar
+with. The only password backend required is the "guest" backend so as to allow default
+unprivilidged account names to be used. Given that there is a WINS server on this network
+we do use it.
+</p></div><div xmlns:ns13="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2883015"></a>Central Print Serving</h3></div></div><div></div></div><p>
+Configuration of a simple print server is very simple if you have all the right tools
+on your system.
+</p><div class="orderedlist"><p class="title"><b> Assumptions:</b></p><ol type="1"><li><p>
+ The print server must require no administration
+ </p></li><li><p>
+ The print spooling and processing system on our print server will be CUPS.
+ (Please refer to the chapter on printing for more information).
+ </p></li><li><p>
+ All printers will that the print server will service will be network
+ printers. They will be correctly configured, by the administrator,
+ in the CUPS environment.
+ </p></li><li><p>
+ All workstations will be installed using postscript drivers. The printer
+ of choice is the Apple Color LaserWriter.
+ </p></li></ol></div><p>
+In this example our print server will spool all incoming print jobs to
+<tt class="filename">/var/spool/samba</tt> until the job is ready to be submitted by
+samba to the CUPS print processor. Since all incoming connections will be as
+the anonymous (guest) user two things will be required:
+</p><div class="itemizedlist"><p class="title"><b>Enablement for Anonymous Printing</b></p><ul type="disc"><li xmlns:ns11=""><ns11:p>
+ The Unix/Linux system must have a <b class="command">guest</b> account.
+ The default for this is usually the account <b class="command">nobody</b>.
+ To find the correct name to use for your version of Samba do the
+ following:
+ </ns11:p><pre class="screen">
+<tt class="prompt">$ </tt><b class="userinput"><tt>testparm -s -v | grep "guest account"</tt></b>
+ </pre><ns11:p>
+ Then make sure that this account exists in your system password
+ database (<tt class="filename">/etc/passwd</tt>).
+ </ns11:p></li><li xmlns:ns12=""><ns12:p>
+ The directory into which Samba will spool the file must have write
+ access for the guest account. The following commands will ensure that
+ this directory is available for use:
+ </ns12:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>mkdir /var/spool/samba</tt></b>
+<tt class="prompt">root# </tt><b class="userinput"><tt>chown nobody.nobody /var/spool/samba</tt></b>
+<tt class="prompt">root# </tt><b class="userinput"><tt>chmod a+rwt /var/spool/samba</tt></b>
+ </pre><ns12:p>
+ </ns12:p></li></ul></div><ns13:p>
+</ns13:p><pre class="programlisting">
+ # Global parameters
+ [global]
+ workgroup = MYGROUP
+ netbios name = PTRSVR1
+ security = SHARE
+ passdb backend = guest
+ wins server = 192.168.1.1
+
+ [printers]
+ comment = All Printers
+ path = /var/spool/samba
+ printer admin = root
+ guest ok = Yes
+ printable = Yes
+ printing = cups
+ use client driver = Yes
+ browseable = No
+</pre><ns13:p>
+</ns13:p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2883221"></a>Common Errors</h2></div></div><div></div></div><p>
+The greatest mistake so often made is to make a network configuration too complex.
+It pays to use the simplest solution that will meet the needs of the moment.
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ClientConfig"></a>Chapter 9. MS Windows Network Configuration Guide</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2883589">Note</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2883589"></a>Note</h2></div></div><div></div></div><p>
+This chapter did not make it into this release.
+It is planned for the published release of this document.
+</p></div></div></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="optional"></a>Advanced Configuration</h1></div></div><div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id2883617"></a>Valuable Nuts and Bolts Information</h1></div></div><div></div></div><p>
+Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features.
+</p><div class="toc"><p><b>Table of Contents</b></p><dl><dt>10. <a href="#NetworkBrowsing">Samba / MS Windows Network Browsing Guide</a></dt><dd><dl><dt><a href="#id2883706">Features and Benefits</a></dt><dt><a href="#id2883784">What is Browsing?</a></dt><dt><a href="#id2883967">Discussion</a></dt><dd><dl><dt><a href="#id2883983">NetBIOS over TCP/IP</a></dt><dt><a href="#id2883290">TCP/IP - without NetBIOS</a></dt><dt><a href="#id2883418">DNS and Active Directory</a></dt></dl></dd><dt><a href="#id2883554">How Browsing Functions</a></dt><dd><dl><dt><a href="#id2884860">Setting up WORKGROUP Browsing</a></dt><dt><a href="#id2885066">Setting up DOMAIN Browsing</a></dt><dt><a href="#browse-force-master">Forcing samba to be the master</a></dt><dt><a href="#id2885332">Making samba the domain master</a></dt><dt><a href="#id2888727">Note about broadcast addresses</a></dt><dt><a href="#id2888744">Multiple interfaces</a></dt><dt><a href="#id2888773">Use of the Remote Announce parameter</a></dt><dt><a href="#id2888877">Use of the Remote Browse Sync parameter</a></dt></dl></dd><dt><a href="#id2888938">WINS - The Windows Internetworking Name Server</a></dt><dd><dl><dt><a href="#id2889089">Setting up a WINS server</a></dt><dt><a href="#id2889284">WINS Replication</a></dt><dt><a href="#id2889309">Static WINS Entries</a></dt></dl></dd><dt><a href="#id2889340">Helpful Hints</a></dt><dd><dl><dt><a href="#id2889353">Windows Networking Protocols</a></dt><dt><a href="#id2889420">Name Resolution Order</a></dt></dl></dd><dt><a href="#id2889541">Technical Overview of browsing</a></dt><dd><dl><dt><a href="#id2889588">Browsing support in samba</a></dt><dt><a href="#id2889695">Problem resolution</a></dt><dt><a href="#id2889774">Browsing across subnets</a></dt></dl></dd><dt><a href="#id2890391">Common Errors</a></dt><dd><dl><dt><a href="#id2890406">How can one flush the Samba NetBIOS name cache without restarting samba?</a></dt><dt><a href="#id2890435">My client reports "This server is not configured to list shared resources"</a></dt></dl></dd></dl></dd><dt>11. <a href="#passdb">Account Information Databases</a></dt><dd><dl><dt><a href="#id2890530">Features and Benefits</a></dt><dt><a href="#id2890854">Technical Information</a></dt><dd><dl><dt><a href="#id2890917">Important Notes About Security</a></dt><dt><a href="#id2891160">Mapping User Identifiers between MS Windows and Unix</a></dt></dl></dd><dt><a href="#id2891216">Account Management Tools</a></dt><dd><dl><dt><a href="#id2891247">The smbpasswd Command</a></dt><dt><a href="#id2891513">The pdbedit Command</a></dt></dl></dd><dt><a href="#id2891647">Password Backends</a></dt><dd><dl><dt><a href="#id2895859">Plain Text</a></dt><dt><a href="#id2895899">smbpasswd - Encrypted Password Database</a></dt><dt><a href="#id2896006">tdbsam</a></dt><dt><a href="#id2896034">ldapsam</a></dt><dt><a href="#id2897524">MySQL</a></dt><dt><a href="#XMLpassdb">XML</a></dt></dl></dd><dt><a href="#id2898328">Common Errors</a></dt><dd><dl><dt><a href="#id2898335">Users can not logon - Users not in Samba SAM</a></dt><dt><a href="#id2898350">Users are being added to the wrong backend database</a></dt><dt><a href="#id2898409">auth methods does not work</a></dt></dl></dd></dl></dd><dt>12. <a href="#groupmapping">Mapping MS Windows and Unix Groups</a></dt><dd><dl><dt><a href="#id2898582">Features and Benefits</a></dt><dt><a href="#id2898682">Discussion</a></dt><dd><dl><dt><a href="#id2898871">Example Configuration</a></dt></dl></dd><dt><a href="#id2898936">Configuration Scripts</a></dt><dd><dl><dt><a href="#id2898950">Sample smb.conf add group script</a></dt><dt><a href="#id2899017">Script to configure Group Mapping</a></dt></dl></dd><dt><a href="#id2899091">Common Errors</a></dt><dd><dl><dt><a href="#id2899107">Adding Groups Fails</a></dt><dt><a href="#id2899167">Adding MS Windows Groups to MS Windows Groups Fails</a></dt></dl></dd></dl></dd><dt>13. <a href="#AccessControls">File, Directory and Share Access Controls</a></dt><dd><dl><dt><a href="#id2902353">Features and Benefits</a></dt><dt><a href="#id2902478">File System Access Controls</a></dt><dd><dl><dt><a href="#id2902496">MS Windows NTFS Comparison with Unix File Systems</a></dt><dt><a href="#id2899413">Managing Directories</a></dt><dt><a href="#id2899508">File and Directory Access Control</a></dt></dl></dd><dt><a href="#id2899915">Share Definition Access Controls</a></dt><dd><dl><dt><a href="#id2899943">User and Group Based Controls</a></dt><dt><a href="#id2900215">File and Directory Permissions Based Controls</a></dt><dt><a href="#id2900461">Miscellaneous Controls</a></dt></dl></dd><dt><a href="#id2905044">Access Controls on Shares</a></dt><dd><dl><dt><a href="#id2905115">Share Permissions Management</a></dt></dl></dd><dt><a href="#id2905414">MS Windows Access Control Lists and Unix Interoperability</a></dt><dd><dl><dt><a href="#id2905422">Managing UNIX permissions Using NT Security Dialogs</a></dt><dt><a href="#id2905460">Viewing File Security on a Samba Share</a></dt><dt><a href="#id2905539">Viewing file ownership</a></dt><dt><a href="#id2905661">Viewing File or Directory Permissions</a></dt><dt><a href="#id2905889">Modifying file or directory permissions</a></dt><dt><a href="#id2906041">Interaction with the standard Samba create mask
+ parameters</a></dt><dt><a href="#id2906370">Interaction with the standard Samba file attribute
+ mapping</a></dt></dl></dd><dt><a href="#id2906446">Common Errors</a></dt><dd><dl><dt><a href="#id2906460">Users can not write to a public share</a></dt><dt><a href="#id2906838">I have set force user and samba still makes root the owner of all the files
+ I touch!</a></dt></dl></dd></dl></dd><dt>14. <a href="#locking">File and Record Locking</a></dt><dd><dl><dt><a href="#id2908960">Features and Benefits</a></dt><dt><a href="#id2909016">Discussion</a></dt><dd><dl><dt><a href="#id2906890">Opportunistic Locking Overview</a></dt></dl></dd><dt><a href="#id2907521">Samba Opportunistic Locking Control</a></dt><dd><dl><dt><a href="#id2907630">Example Configuration</a></dt></dl></dd><dt><a href="#id2907890">MS Windows Opportunistic Locking and Caching Controls</a></dt><dd><dl><dt><a href="#id2910326">Workstation Service Entries</a></dt><dt><a href="#id2910353">Server Service Entries</a></dt></dl></dd><dt><a href="#id2910432">Persistent Data Corruption</a></dt><dt><a href="#id2910463">Common Errors</a></dt><dd><dl><dt><a href="#id2910536">locking.tdb error messages</a></dt></dl></dd><dt><a href="#id2910566">Additional Reading</a></dt></dl></dd><dt>15. <a href="#securing-samba">Securing Samba</a></dt><dd><dl><dt><a href="#id2911991">Introduction</a></dt><dt><a href="#id2912024">Features and Benefits</a></dt><dt><a href="#id2910684">Technical Discussion of Protective Measures and Issues</a></dt><dd><dl><dt><a href="#id2910702">Using host based protection</a></dt><dt><a href="#id2910771">User based protection</a></dt><dt><a href="#id2910822">Using interface protection</a></dt><dt><a href="#id2910872">Using a firewall</a></dt><dt><a href="#id2910929">Using a IPC$ share deny</a></dt><dt><a href="#id2910994">NTLMv2 Security</a></dt></dl></dd><dt><a href="#id2911033">Upgrading Samba</a></dt><dt><a href="#id2911056">Common Errors</a></dt><dd><dl><dt><a href="#id2911075">Smbclient works on localhost, but the network is dead</a></dt><dt><a href="#id2911100">Why can users access home directories of other users?</a></dt></dl></dd></dl></dd><dt>16. <a href="#InterdomainTrusts">Interdomain Trust Relationships</a></dt><dd><dl><dt><a href="#id2911618">Features and Benefits</a></dt><dt><a href="#id2911646">Trust Relationship Background</a></dt><dt><a href="#id2911730">Native MS Windows NT4 Trusts Configuration</a></dt><dd><dl><dt><a href="#id2911742">NT4 as the Trusting Domain (ie. creating the trusted account)</a></dt><dt><a href="#id2913717">NT4 as the Trusted Domain (ie. creating trusted account's password)</a></dt></dl></dd><dt><a href="#id2913754">Configuring Samba NT-style Domain Trusts</a></dt><dd><dl><dt><a href="#id2913781">Samba-3 as the Trusting Domain</a></dt><dt><a href="#id2913908">Samba-3 as the Trusted Domain</a></dt></dl></dd><dt><a href="#id2911286">Common Errors</a></dt><dd><dl><dt><a href="#id2911301">Tell me about Trust Relationships using Samba</a></dt></dl></dd></dl></dd><dt>17. <a href="#msdfs">Hosting a Microsoft Distributed File System tree on Samba</a></dt><dd><dl><dt><a href="#id2911399">Features and Benefits</a></dt><dt><a href="#id2912809">Common Errors</a></dt></dl></dd><dt>18. <a href="#printing">Classical Printing Support</a></dt><dd><dl><dt><a href="#id2914332">Features and Benefits</a></dt><dt><a href="#id2914396">Technical Introduction</a></dt><dd><dl><dt><a href="#id2914432">What happens if you send a Job from a Client</a></dt><dt><a href="#id2914502">Printing Related Configuration Parameters</a></dt><dt><a href="#id2917610">Parameters Recommended for Use</a></dt><dt><a href="#id2912970">Parameters for Backwards Compatibility</a></dt><dt><a href="#id2913079">Parameters no longer in use</a></dt></dl></dd><dt><a href="#id2913172">A simple Configuration to Print with Samba-3</a></dt><dd><dl><dt><a href="#id2915178">Verification of "Settings in Use" with testparm</a></dt><dt><a href="#id2915261">A little Experiment to warn you</a></dt></dl></dd><dt><a href="#id2915568">Extended Sample Configuration to Print with Samba-3</a></dt><dt><a href="#id2915660">Detailed Explanation of the Example's Settings</a></dt><dd><dl><dt><a href="#id2915673">The [global] Section</a></dt><dt><a href="#id2925133">The [printers] Section</a></dt><dt><a href="#id2925462">Any [my_printer_name] Section</a></dt><dt><a href="#id2925683">Print Commands</a></dt><dt><a href="#id2925734">Default Print Commands for various Unix Print Subsystems</a></dt><dt><a href="#id2926260">Setting up your own Print Commands</a></dt></dl></dd><dt><a href="#id2926537">Innovations in Samba Printing since 2.2</a></dt><dd><dl><dt><a href="#id2926691">Client Drivers on Samba Server for Point'n'Print</a></dt><dt><a href="#id2926842">The [printer$] Section is removed from Samba-3</a></dt><dt><a href="#id2926955">Creating the [print$] Share</a></dt><dt><a href="#id2927026">Parameters in the [print$] Section</a></dt><dt><a href="#id2927247">Subdirectory Structure in [print$]</a></dt></dl></dd><dt><a href="#id2927408">Installing Drivers into [print$]</a></dt><dd><dl><dt><a href="#id2927502">Setting Drivers for existing Printers with a Client GUI</a></dt><dt><a href="#id2927686">Setting Drivers for existing Printers with
+rpcclient</a></dt></dl></dd><dt><a href="#id2929284">"The Proof of the Pudding lies in the Eating" (Client Driver Insta
+Procedure)</a></dt><dd><dl><dt><a href="#id2929305">The first Client Driver Installation</a></dt><dt><a href="#id2929502">IMPORTANT! Setting Device Modes on new Printers</a></dt><dt><a href="#id2929792">Further Client Driver Install Procedures</a></dt><dt><a href="#id2929887">Always make first Client Connection as root or "printer admin"</a></dt></dl></dd><dt><a href="#id2930029">Other Gotchas</a></dt><dd><dl><dt><a href="#id2930062">Setting Default Print Options for the Client Drivers</a></dt><dt><a href="#id2930496">Supporting large Numbers of Printers</a></dt><dt><a href="#id2930798">Adding new Printers with the Windows NT APW</a></dt><dt><a href="#id2931042">Weird Error Message Cannot connect under a
+different Name</a></dt><dt><a href="#id2931140">Be careful when assembling Driver Files</a></dt><dt><a href="#id2931411">Samba and Printer Ports</a></dt><dt><a href="#id2931481">Avoiding the most common Misconfigurations of the Client Driver</a></dt></dl></dd><dt><a href="#id2931504">The Imprints Toolset</a></dt><dd><dl><dt><a href="#id2931549">What is Imprints?</a></dt><dt><a href="#id2931590">Creating Printer Driver Packages</a></dt><dt><a href="#id2931609">The Imprints Server</a></dt><dt><a href="#id2931634">The Installation Client</a></dt></dl></dd><dt><a href="#id2931786">Add Network Printers at Logon without User Interaction</a></dt><dt><a href="#id2932115">The addprinter command</a></dt><dt><a href="#id2932160">Migration of "Classical" printing to Samba-3</a></dt><dt><a href="#id2932329">Publishing Printer Information in Active Directory or LDAP</a></dt><dt><a href="#id2932343">Common Errors and Problems</a></dt><dd><dl><dt><a href="#id2932356">I give my root password but I don't get access</a></dt><dt><a href="#id2932390">My printjobs get spooled into the spooling directory, but then get lost</a></dt></dl></dd></dl></dd><dt>19. <a href="#CUPS-printing">CUPS Printing Support in Samba 3.0</a></dt><dd><dl><dt><a href="#id2939414">Introduction</a></dt><dd><dl><dt><a href="#id2939421">Features and Benefits</a></dt><dt><a href="#id2939469">Overview</a></dt></dl></dd><dt><a href="#id2939521">Basic Configuration of CUPS support</a></dt><dd><dl><dt><a href="#id2939600">Linking of smbd with libcups.so</a></dt><dt><a href="#id2932509">Simple smb.conf Settings for CUPS</a></dt><dt><a href="#id2932572">More complex smb.conf Settings for
+CUPS</a></dt></dl></dd><dt><a href="#id2932671">Advanced Configuration</a></dt><dd><dl><dt><a href="#id2932692">Central spooling vs. "Peer-to-Peer" printing</a></dt><dt><a href="#id2932719">CUPS/Samba as a "spooling-only" Print Server; "raw" printing
+with Vendor Drivers on Windows Clients</a></dt><dt><a href="#id2932755">Driver Installation Methods on Windows Clients</a></dt><dt><a href="#id2932814">Explicitly enable "raw" printing for
+application/octet-stream!</a></dt><dt><a href="#id2932975">Three familiar Methods for driver upload plus a new one</a></dt></dl></dd><dt><a href="#id2933068">Using CUPS/Samba in an advanced Way -- intelligent printing
+with PostScript Driver Download</a></dt><dd><dl><dt><a href="#id2933143">GDI on Windows -- PostScript on Unix</a></dt><dt><a href="#id2933188">Windows Drivers, GDI and EMF</a></dt><dt><a href="#id2933286">Unix Printfile Conversion and GUI Basics</a></dt><dt><a href="#id2933358">PostScript and Ghostscript</a></dt><dt><a href="#id2933454">Ghostscript -- the Software RIP for non-PostScript Printers</a></dt><dt><a href="#id2933550">PostScript Printer Description (PPD) Specification</a></dt><dt><a href="#id2946373">CUPS can use all Windows-formatted Vendor PPDs</a></dt><dt><a href="#id2946462">CUPS also uses PPDs for non-PostScript Printers</a></dt></dl></dd><dt><a href="#id2946485">The CUPS Filtering Architecture</a></dt><dd><dl><dt><a href="#id2946623">MIME types and CUPS Filters</a></dt><dt><a href="#id2946811">MIME type Conversion Rules</a></dt><dt><a href="#id2946927">Filter Requirements</a></dt><dt><a href="#id2947096">Prefilters</a></dt><dt><a href="#id2947181">pstops</a></dt><dt><a href="#id2947284">pstoraster</a></dt><dt><a href="#id2947440">imagetops and imagetoraster</a></dt><dt><a href="#id2947495">rasterto [printerspecific]</a></dt><dt><a href="#id2947580">CUPS Backends</a></dt><dt><a href="#id2947894">cupsomatic/Foomatic -- how do they fit into the Picture?</a></dt><dt><a href="#id2947997">The Complete Picture</a></dt><dt><a href="#id2948012">mime.convs</a></dt><dt><a href="#id2948065">"Raw" printing</a></dt><dt><a href="#id2948120">"application/octet-stream" printing</a></dt><dt><a href="#id2948335">PostScript Printer Descriptions (PPDs) for non-PS Printers</a></dt><dt><a href="#id2948562">Difference between cupsomatic/foomatic-rip and
+native CUPS printing</a></dt><dt><a href="#id2948719">Examples for filtering Chains</a></dt><dt><a href="#id2948948">Sources of CUPS drivers / PPDs</a></dt><dt><a href="#id2949073">Printing with Interface Scripts</a></dt></dl></dd><dt><a href="#id2949135">Network printing (purely Windows)</a></dt><dd><dl><dt><a href="#id2949151">From Windows Clients to an NT Print Server</a></dt><dt><a href="#id2949190">Driver Execution on the Client</a></dt><dt><a href="#id2949249">Driver Execution on the Server</a></dt></dl></dd><dt><a href="#id2949312">Network Printing (Windows clients -- UNIX/Samba Print
+Servers)</a></dt><dd><dl><dt><a href="#id2949333">From Windows Clients to a CUPS/Samba Print Server</a></dt><dt><a href="#id2949493">Samba receiving Jobfiles and passing them to CUPS</a></dt></dl></dd><dt><a href="#id2949571">Network PostScript RIP: CUPS Filters on Server -- clients use
+PostScript Driver with CUPS-PPDs</a></dt><dd><dl><dt><a href="#id2949626">PPDs for non-PS Printers on UNIX</a></dt><dt><a href="#id2949667">PPDs for non-PS Printers on Windows</a></dt></dl></dd><dt><a href="#id2949732">Windows Terminal Servers (WTS) as CUPS Clients</a></dt><dd><dl><dt><a href="#id2949750">Printer Drivers running in "Kernel Mode" cause many
+Problems</a></dt><dt><a href="#id2949784">Workarounds impose Heavy Limitations</a></dt><dt><a href="#id2949805">CUPS: a "Magical Stone"?</a></dt><dt><a href="#id2949832">PostScript Drivers with no major problems -- even in Kernel
+Mode</a></dt></dl></dd><dt><a href="#id2949866"> Setting up CUPS for driver Download</a></dt><dd><dl><dt><a href="#id2949885">cupsaddsmb: the unknown Utility</a></dt><dt><a href="#id2949976">Prepare your smb.conf for
+cupsaddsmb</a></dt><dt><a href="#id2950023">CUPS Package of "PostScript Driver for WinNT/2k/XP"</a></dt><dt><a href="#id2950220">Recognize the different Driver Files</a></dt><dt><a href="#id2950278">Acquiring the Adobe Driver Files</a></dt><dt><a href="#id2950311">ESP Print Pro Package of "PostScript Driver for
+WinNT/2k/XP"</a></dt><dt><a href="#id2950361">Caveats to be considered</a></dt><dt><a href="#id2950582">What are the Benefits of using the "CUPS PostScript Driver for
+Windows NT/2k/XP" as compared to the Adobe Driver?</a></dt><dt><a href="#id2950763">Run "cupsaddsmb" (quiet Mode)</a></dt><dt><a href="#id2950864">Run "cupsaddsmb" with verbose Output</a></dt><dt><a href="#id2951007">Understanding cupsaddsmb</a></dt><dt><a href="#id2951101">How to recognize if cupsaddsm completed successfully</a></dt><dt><a href="#id2951188">cupsaddsmb with a Samba PDC</a></dt><dt><a href="#id2951223">cupsaddsmb Flowchart</a></dt><dt><a href="#id2951274">Installing the PostScript Driver on a Client</a></dt><dt><a href="#id2951389">Avoiding critical PostScript Driver Settings on the
+Client</a></dt></dl></dd><dt><a href="#id2951523">Installing PostScript Driver Files manually (using
+rpcclient)</a></dt><dd><dl><dt><a href="#id2951638">A Check of the rpcclient man Page</a></dt><dt><a href="#id2951750">Understanding the rpcclient man Page</a></dt><dt><a href="#id2951829">Producing an Example by querying a Windows Box</a></dt><dt><a href="#id2951919">What is required for adddriver and setdriver to succeed</a></dt><dt><a href="#id2952081">Manual Commandline Driver Installation in 15 little Steps</a></dt><dt><a href="#id2952701">Troubleshooting revisited</a></dt></dl></dd><dt><a href="#id2952803">The printing *.tdb Files</a></dt><dd><dl><dt><a href="#id2952906">Trivial DataBase Files</a></dt><dt><a href="#id2952976">Binary Format</a></dt><dt><a href="#id2953038">Losing *.tdb Files</a></dt><dt><a href="#id2953097">Using tdbbackup</a></dt></dl></dd><dt><a href="#id2953159">CUPS Print Drivers from Linuxprinting.org</a></dt><dd><dl><dt><a href="#id2953265">foomatic-rip and Foomatic explained</a></dt><dt><a href="#id2953893">foomatic-rip and Foomatic-PPD Download and Installation</a></dt></dl></dd><dt><a href="#id2954351">Page Accounting with CUPS</a></dt><dd><dl><dt><a href="#id2954382">Setting up Quotas</a></dt><dt><a href="#id2954413">Correct and incorrect Accounting</a></dt><dt><a href="#id2954454">Adobe and CUPS PostScript Drivers for Windows Clients</a></dt><dt><a href="#id2954526">The page_log File Syntax</a></dt><dt><a href="#id2954628">Possible Shortcomings</a></dt><dt><a href="#id2954699">Future Developments</a></dt><dt><a href="#id2954747">Other Accounting Tools</a></dt></dl></dd><dt><a href="#id2954762">Additional Material</a></dt><dt><a href="#id2954956">Auto-Deletion or Preservation of CUPS Spool Files</a></dt><dd><dl><dt><a href="#id2955001">CUPS Configuration Settings explained</a></dt><dt><a href="#id2955083">Pre-conditions</a></dt><dt><a href="#id2955144">Manual Configuration</a></dt></dl></dd><dt><a href="#id2955162">When not to use Samba to print to
+CUPS</a></dt><dt><a href="#id2955180">In Case of Trouble.....</a></dt><dd><dl><dt><a href="#id2955214">Where to find Documentation</a></dt><dt><a href="#id2955227">How to ask for Help</a></dt><dt><a href="#id2955240">Where to find Help</a></dt></dl></dd><dt><a href="#id2955254">Appendix</a></dt><dd><dl><dt><a href="#id2955261">Printing from CUPS to Windows attached
+Printers</a></dt><dt><a href="#id2955455">More CUPS filtering Chains</a></dt><dt><a href="#id2955709">Trouble Shooting Guidelines to fix typical Samba printing
+Problems</a></dt><dt><a href="#id2956815">An Overview of the CUPS Printing Processes</a></dt></dl></dd></dl></dd><dt>20. <a href="#VFS">Stackable VFS modules</a></dt><dd><dl><dt><a href="#id2958218">Features and Benefits</a></dt><dt><a href="#id2958235">Discussion</a></dt><dt><a href="#id2958286">Included modules</a></dt><dd><dl><dt><a href="#id2956883">audit</a></dt><dt><a href="#id2956922">extd_audit</a></dt><dt><a href="#id2957044">fake_perms</a></dt><dt><a href="#id2957063">recycle</a></dt><dt><a href="#id2957202">netatalk</a></dt></dl></dd><dt><a href="#id2957247">VFS modules available elsewhere</a></dt><dd><dl><dt><a href="#id2957269">DatabaseFS</a></dt><dt><a href="#id2957323">vscan</a></dt></dl></dd><dt><a href="#id2957352">Common Errors</a></dt></dl></dd><dt>21. <a href="#winbind">Integrated Logon Support using Winbind</a></dt><dd><dl><dt><a href="#id2957847">Features and Benefits</a></dt><dt><a href="#id2957875">Introduction</a></dt><dt><a href="#id2959857">What Winbind Provides</a></dt><dd><dl><dt><a href="#id2959916">Target Uses</a></dt></dl></dd><dt><a href="#id2959947">How Winbind Works</a></dt><dd><dl><dt><a href="#id2959975">Microsoft Remote Procedure Calls</a></dt><dt><a href="#id2960008">Microsoft Active Directory Services</a></dt><dt><a href="#id2960031">Name Service Switch</a></dt><dt><a href="#id2957393">Pluggable Authentication Modules</a></dt><dt><a href="#id2957465">User and Group ID Allocation</a></dt><dt><a href="#id2957499">Result Caching</a></dt></dl></dd><dt><a href="#id2957528">Installation and Configuration</a></dt><dd><dl><dt><a href="#id2957555">Introduction</a></dt><dt><a href="#id2957630">Requirements</a></dt><dt><a href="#id2958907">Testing Things Out</a></dt></dl></dd><dt><a href="#id2963255">Conclusion</a></dt><dt><a href="#id2963274">Common Errors</a></dt></dl></dd><dt>22. <a href="#AdvancedNetworkManagement">Advanced Network Manangement</a></dt><dd><dl><dt><a href="#id2964647">Features and Benefits</a></dt><dt><a href="#id2964678">Remote Server Administration</a></dt><dt><a href="#id2963360">Remote Desktop Management</a></dt><dd><dl><dt><a href="#id2963377">Remote Management from NoMachines.Com</a></dt></dl></dd><dt><a href="#id2963579">Network Logon Script Magic</a></dt><dd><dl><dt><a href="#id2963774">Adding printers without user intervention</a></dt></dl></dd><dt><a href="#id2963806">Common Errors</a></dt></dl></dd><dt>23. <a href="#PolicyMgmt">System and Account Policies</a></dt><dd><dl><dt><a href="#id2964204">Features and Benefits</a></dt><dt><a href="#id2964256">Creating and Managing System Policies</a></dt><dd><dl><dt><a href="#id2964367">Windows 9x/Me Policies</a></dt><dt><a href="#id2963915">Windows NT4 Style Policy Files</a></dt><dt><a href="#id2964048">MS Windows 200x / XP Professional Policies</a></dt></dl></dd><dt><a href="#id2965490">Managing Account/User Policies</a></dt><dd><dl><dt><a href="#id2965591">Samba Editreg Toolset</a></dt><dt><a href="#id2965611">Windows NT4/200x</a></dt><dt><a href="#id2965631">Samba PDC</a></dt></dl></dd><dt><a href="#id2965676">System Startup and Logon Processing Overview</a></dt><dt><a href="#id2965823">Common Errors</a></dt><dd><dl><dt><a href="#id2965837">Policy Does Not Work</a></dt></dl></dd></dl></dd><dt>24. <a href="#ProfileMgmt">Desktop Profile Management</a></dt><dd><dl><dt><a href="#id2965940">Features and Benefits</a></dt><dt><a href="#id2965973">Roaming Profiles</a></dt><dd><dl><dt><a href="#id2966014">Samba Configuration for Profile Handling</a></dt><dt><a href="#id2971377">Windows Client Profile Configuration Information</a></dt><dt><a href="#id2972314">Sharing Profiles between W9x/Me and NT4/200x/XP workstations</a></dt><dt><a href="#id2972378">Profile Migration from Windows NT4/200x Server to Samba</a></dt></dl></dd><dt><a href="#id2972638">Mandatory profiles</a></dt><dt><a href="#id2972696">Creating/Managing Group Profiles</a></dt><dt><a href="#id2972742">Default Profile for Windows Users</a></dt><dd><dl><dt><a href="#id2972762">MS Windows 9x/Me</a></dt><dt><a href="#id2972910">MS Windows NT4 Workstation</a></dt><dt><a href="#id2973464">MS Windows 200x/XP</a></dt></dl></dd><dt><a href="#id2973968">Common Errors</a></dt><dd><dl><dt><a href="#id2973980">How does one set up roaming profiles for just one (or a few) user/s or group/s?</a></dt><dt><a href="#id2974043">Can NOT use Roaming Profiles</a></dt><dt><a href="#id2974262">Changing the default profile</a></dt></dl></dd></dl></dd><dt>25. <a href="#pam">PAM based Distributed Authentication</a></dt><dd><dl><dt><a href="#id2975719">Features and Benefits</a></dt><dt><a href="#id2974574">Technical Discussion</a></dt><dd><dl><dt><a href="#id2974590">PAM Configuration Syntax</a></dt><dt><a href="#id2975256">Example System Configurations</a></dt><dt><a href="#id2977688">smb.conf PAM Configuration</a></dt><dt><a href="#id2977745">Remote CIFS Authentication using winbindd.so</a></dt><dt><a href="#id2977829">Password Synchronization using pam_smbpass.so</a></dt></dl></dd><dt><a href="#id2978196">Common Errors</a></dt><dd><dl><dt><a href="#id2978209">pam_winbind problem</a></dt></dl></dd></dl></dd><dt>26. <a href="#integrate-ms-networks">Integrating MS Windows networks with Samba</a></dt><dd><dl><dt><a href="#id2979952">Features and Benefits</a></dt><dt><a href="#id2979977">Background Information</a></dt><dt><a href="#id2980022">Name Resolution in a pure Unix/Linux world</a></dt><dd><dl><dt><a href="#id2980073">/etc/hosts</a></dt><dt><a href="#id2980198">/etc/resolv.conf</a></dt><dt><a href="#id2978348">/etc/host.conf</a></dt><dt><a href="#id2978390">/etc/nsswitch.conf</a></dt></dl></dd><dt><a href="#id2978479">Name resolution as used within MS Windows networking</a></dt><dd><dl><dt><a href="#id2978604">The NetBIOS Name Cache</a></dt><dt><a href="#id2978648">The LMHOSTS file</a></dt><dt><a href="#id2978762">HOSTS file</a></dt><dt><a href="#id2978795">DNS Lookup</a></dt><dt><a href="#id2978820">WINS Lookup</a></dt></dl></dd><dt><a href="#id2978890">Common Errors</a></dt><dd><dl><dt><a href="#id2978906">My Boomerang Won't Come Back</a></dt><dt><a href="#id2978938">Very Slow Network Connections</a></dt><dt><a href="#id2978989">Samba server name change problem</a></dt></dl></dd></dl></dd><dt>27. <a href="#unicode">Unicode/Charsets</a></dt><dd><dl><dt><a href="#id2979144">Features and Benefits</a></dt><dt><a href="#id2979186">What are charsets and unicode?</a></dt><dt><a href="#id2979255">Samba and charsets</a></dt><dt><a href="#id2979355">Conversion from old names</a></dt><dt><a href="#id2979401">Japanese charsets</a></dt></dl></dd><dt>28. <a href="#Backup">Samba Backup Techniques</a></dt><dd><dl><dt><a href="#id2981995">Note</a></dt><dt><a href="#id2982016">Features and Benefits</a></dt></dl></dd><dt>29. <a href="#SambaHA">High Availability Options</a></dt><dd><dl><dt><a href="#id2981826">Note</a></dt></dl></dd></dl></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NetworkBrowsing"></a>Chapter 10. Samba / MS Windows Network Browsing Guide</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">July 5, 1998</p></div><div><p class="pubdate">Updated: April 21, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2883706">Features and Benefits</a></dt><dt><a href="#id2883784">What is Browsing?</a></dt><dt><a href="#id2883967">Discussion</a></dt><dd><dl><dt><a href="#id2883983">NetBIOS over TCP/IP</a></dt><dt><a href="#id2883290">TCP/IP - without NetBIOS</a></dt><dt><a href="#id2883418">DNS and Active Directory</a></dt></dl></dd><dt><a href="#id2883554">How Browsing Functions</a></dt><dd><dl><dt><a href="#id2884860">Setting up WORKGROUP Browsing</a></dt><dt><a href="#id2885066">Setting up DOMAIN Browsing</a></dt><dt><a href="#browse-force-master">Forcing samba to be the master</a></dt><dt><a href="#id2885332">Making samba the domain master</a></dt><dt><a href="#id2888727">Note about broadcast addresses</a></dt><dt><a href="#id2888744">Multiple interfaces</a></dt><dt><a href="#id2888773">Use of the Remote Announce parameter</a></dt><dt><a href="#id2888877">Use of the Remote Browse Sync parameter</a></dt></dl></dd><dt><a href="#id2888938">WINS - The Windows Internetworking Name Server</a></dt><dd><dl><dt><a href="#id2889089">Setting up a WINS server</a></dt><dt><a href="#id2889284">WINS Replication</a></dt><dt><a href="#id2889309">Static WINS Entries</a></dt></dl></dd><dt><a href="#id2889340">Helpful Hints</a></dt><dd><dl><dt><a href="#id2889353">Windows Networking Protocols</a></dt><dt><a href="#id2889420">Name Resolution Order</a></dt></dl></dd><dt><a href="#id2889541">Technical Overview of browsing</a></dt><dd><dl><dt><a href="#id2889588">Browsing support in samba</a></dt><dt><a href="#id2889695">Problem resolution</a></dt><dt><a href="#id2889774">Browsing across subnets</a></dt></dl></dd><dt><a href="#id2890391">Common Errors</a></dt><dd><dl><dt><a href="#id2890406">How can one flush the Samba NetBIOS name cache without restarting samba?</a></dt><dt><a href="#id2890435">My client reports "This server is not configured to list shared resources"</a></dt></dl></dd></dl></div><p>
+This document contains detailed information as well as a fast track guide to
+implementing browsing across subnets and / or across workgroups (or domains).
+WINS is the best tool for resolution of NetBIOS names to IP addesses. WINS is
+NOT involved in browse list handling except by way of name to address resolution.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+MS Windows 2000 and later can be configured to operate with NO NetBIOS
+over TCP/IP. Samba-3 and later also supports this mode of operation.
+When the use of NetBIOS over TCP/IP has been disabled then the primary
+means for resolution of MS Windows machine names is via DNS and Active Directory.
+The following information assumes that your site is running NetBIOS over TCP/IP.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2883706"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Someone once referred to the past in terms of: <span class="emphasis"><em>They were the worst of times,
+they were the best of times. The more we look back, them more we long for what was and
+hope it never returns!</em></span>.
+</p><p>
+For many MS Windows network administrators that statement sums up their feelings about
+NetBIOS networking precisely. For those who mastered NetBIOS networking it's fickle
+nature was just par for the course. For those who never quite managed to tame it's
+lusty features NetBIOS is like Paterson's Curse.
+</p><p>
+For those not familiar with botanical problems in Australia: Paterson's curse,
+Echium plantagineum, was introduced to Australia from Europe during the mid-nineteenth
+century. Since then it has spread rapidly. The high seed production, with densities of
+thousands of seeds per square metre, a seed longevity of more than seven years, and an
+ability to germinate at any time of year, given the right conditions, are some of the
+features which make it such a persistent weed.
+</p><p>
+In this chapter we explore vital aspects of SMB (Server Message Block) networking with
+a particular focus on SMB as implmented through running NetBIOS (Network Basic
+Input / Output System) over TCP/IP. Since Samba does NOT implement SMB or NetBIOS over
+any other protocols we need to know how to configure our network environment and simply
+remember to use nothing but TCP/IP on all our MS Windows network clients.
+</p><p>
+Samba provides the ability to implement a WINS (Windows Internetworking Name Server)
+and implements extensions to Microsoft's implementation of WINS. These extensions
+help Samba to affect stable WINS operations beyond the normal scope of MS WINS.
+</p><p>
+Please note that WINS is exclusively a service that applies only to those systems
+that run NetBIOS over TCP/IP. MS Windows 200x / XP have the capacity to turn off
+support for NetBIOS, in which case WINS is of no relevance. Samba-3 supports this also.
+</p><p>
+For those networks on which NetBIOS has been disabled (ie: WINS is NOT required)
+the use of DNS is necessary for host name resolution.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2883784"></a>What is Browsing?</h2></div></div><div></div></div><p>
+To most people browsing means that they can see the MS Windows and Samba servers
+in the Network Neighborhood, and when the computer icon for a particular server is
+clicked, it opens up and shows the shares and printers available on the target server.
+</p><p>
+What seems so simple is in fact a very complex interaction of different technologies.
+The technologies (or methods) employed in making all of this work includes:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>MS Windows machines register their presence to the network</td></tr><tr><td>Machines announce themselves to other machines on the network</td></tr><tr><td>One or more machine on the network collates the local announcements</td></tr><tr><td>The client machine finds the machine that has the collated list of machines</td></tr><tr><td>The client machine is able to resolve the machine names to IP addresses</td></tr><tr><td>The client machine is able to connect to a target machine</td></tr></table><p>
+The samba application that controls/manages browse list management and name resolution is
+called <tt class="filename">nmbd</tt>. The configuration parameters involved in nmbd's operation are:
+</p><pre class="programlisting">
+
+ Browsing options:
+ -----------------
+ * os level
+ lm announce
+ lm interval
+ * preferred master
+ * local master
+ * domain master
+ browse list
+ enhanced browsing
+
+ Name Resolution Method:
+ -----------------------
+ * name resolve order
+
+ WINS options:
+ -------------
+ dns proxy
+ wins proxy
+ * wins server
+ * wins support
+ wins hook
+</pre><p>
+For Samba the WINS Server and WINS Support are mutually exclusive options. Those marked with
+an '*' are the only options that commonly MAY need to be modified. Even if not one of these
+parameters is set nmbd will still do it's job.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2883967"></a>Discussion</h2></div></div><div></div></div><p>
+Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging.
+SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports
+NetBIOS over TCP/IP for backwards compatibility. Microsoft are intent on phasing out NetBIOS
+support.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2883983"></a>NetBIOS over TCP/IP</h3></div></div><div></div></div><p>
+Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP.
+MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to
+affect browse list management. When running NetBIOS over TCP/IP this uses UDP based messaging.
+UDP messages can be broadcast or unicast.
+</p><p>
+Normally, only unicast UDP messaging can be forwarded by routers. The
+<b class="command">remote announce</b> parameter to smb.conf helps to project browse announcements
+to remote network segments via unicast UDP. Similarly, the
+<b class="command">remote browse sync</b> parameter of <tt class="filename">smb.conf</tt>
+implements browse list collation using unicast UDP.
+</p><p>
+Secondly, in those networks where Samba is the only SMB server technology
+wherever possible <tt class="filename">nmbd</tt> should be configured on one (1) machine as the WINS
+server. This makes it easy to manage the browsing environment. If each network
+segment is configured with it's own Samba WINS server, then the only way to
+get cross segment browsing to work is by using the
+<b class="command">remote announce</b> and the <b class="command">remote browse sync</b>
+parameters to your <tt class="filename">smb.conf</tt> file.
+</p><p>
+If only one WINS server is used for an entire multi-segment network then
+the use of the <b class="command">remote announce</b> and the
+<b class="command">remote browse sync</b> parameters should NOT be necessary.
+</p><p>
+As of Samba 3 WINS replication is being worked on. The bulk of the code has
+been committed, but it still needs maturation. This is NOT a supported feature
+of the Samba-3.0.0 release. Hopefully, this will become a supported feature
+of one of the samba-3 release series.
+</p><p>
+Right now samba WINS does not support MS-WINS replication. This means that
+when setting up Samba as a WINS server there must only be one <tt class="filename">nmbd</tt>
+configured as a WINS server on the network. Some sites have used multiple Samba WINS
+servers for redundancy (one server per subnet) and then used
+<b class="command">remote browse sync</b> and <b class="command">remote announce</b>
+to affect browse list collation across all segments. Note that this means clients
+will only resolve local names, and must be configured to use DNS to resolve names
+on other subnets in order to resolve the IP addresses of the servers they can see
+on other subnets. This setup is not recommended, but is mentioned as a practical
+consideration (ie: an 'if all else fails' scenario).
+</p><p>
+Lastly, take note that browse lists are a collection of unreliable broadcast
+messages that are repeated at intervals of not more than 15 minutes. This means
+that it will take time to establish a browse list and it can take up to 45
+minutes to stabilise, particularly across network segments.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2883290"></a>TCP/IP - without NetBIOS</h3></div></div><div></div></div><p>
+All TCP/IP using systems use various forms of host name resolution. The primary
+methods for TCP/IP hostname resolutions involves either a static file (<tt class="filename">/etc/hosts
+</tt>) or DNS (the Domain Name System). DNS is the technology that makes
+the Internet usable. DNS based host name resolution is supported by nearly all TCP/IP
+enabled systems. Only a few embedded TCP/IP systems do not support DNS.
+</p><p>
+When an MS Windows 200x / XP system attempts to resolve a host name to an IP address
+it follows a defined path:
+</p><div class="orderedlist"><ol type="1"><li><p>
+ Checks the <tt class="filename">hosts</tt> file. It is located in
+ <tt class="filename">C:\WinNT\System32\Drivers\etc</tt>.
+ </p></li><li><p>
+ Does a DNS lookup
+ </p></li><li><p>
+ Checks the NetBIOS name cache
+ </p></li><li><p>
+ Queries the WINS server
+ </p></li><li><p>
+ Does a broadcast name lookup over UDP
+ </p></li><li><p>
+ Looks up entries in LMHOSTS. It is located in
+ <tt class="filename">C:\WinNT\System32\Drivers\etc</tt>.
+ </p></li></ol></div><p>
+Windows 200x / XP can register it's host name with a Dynamic DNS server. You can
+force register with a Dynamic DNS server in Windows 200x / XP using:
+<b class="command">ipconfig /registerdns</b>
+</p><p>
+With Active Directory (ADS), a correctly functioning DNS server is absolutely
+essential. In the absence of a working DNS server that has been correctly configured
+MS Windows clients and servers will be totally unable to locate each other,
+consequently network services will be severely impaired.
+</p><p>
+The use of Dynamic DNS is highly recommended with Active Directory, in which case
+the use of BIND9 is preferred for it's ability to adequately support the SRV (service)
+records that are needed for Active Directory.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2883418"></a>DNS and Active Directory</h3></div></div><div></div></div><p>
+Occasionally we hear from Unix network administrators who want to use a Unix based Dynamic
+DNS server in place of the Microsoft DNS server. While this might be desirable to some, the
+MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible
+to use BIND version 8 or 9, but it will almost certainly be necessary to create service records
+so that MS Active Directory clients can resolve host names to locate essential network services.
+The following are some of the default service records that Active Directory requires:
+</p><div class="itemizedlist"><ul type="disc"><li><p>_ldap._tcp.pdc.ms-dcs.<span class="emphasis"><em>Domain</em></span></p><p>
+ This provides the address of the Windows NT PDC for the Domain.
+ </p></li><li><p>_ldap._tcp.pdc.ms-dcs.<span class="emphasis"><em>DomainTree</em></span></p><p>
+ Resolves the addresses of Global Catalog servers in the domain.
+ </p></li><li><p>_ldap._tcp.<span class="emphasis"><em>site</em></span>.sites.writable.ms-dcs.<span class="emphasis"><em>Domain</em></span></p><p>
+ Provides list of domain controllers based on sites.
+ </p></li><li><p>_ldap._tcp.writable.ms-dcs.<span class="emphasis"><em>Domain</em></span></p><p>
+ Enumerates list of domain controllers that have the writable
+ copies of the Active Directory data store.
+ </p></li><li><p>_ldap._tcp.<span class="emphasis"><em>GUID</em></span>.domains.ms-dcs.<span class="emphasis"><em>DomainTree</em></span></p><p>
+ Entry used by MS Windows clients to locate machines using the
+ Global Unique Identifier.
+ </p></li><li><p>_ldap._tcp.<span class="emphasis"><em>Site</em></span>.gc.ms-dcs.<span class="emphasis"><em>DomainTree</em></span></p><p>
+ Used by MS Windows clients to locate site configuration dependant
+ Global Catalog server.
+ </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2883554"></a>How Browsing Functions</h2></div></div><div></div></div><p>
+MS Windows machines register their NetBIOS names
+(ie: the machine name for each service type in operation) on start
+up. The exact method by which this name registration
+takes place is determined by whether or not the MS Windows client/server
+has been given a WINS server address, whether or not LMHOSTS lookup
+is enabled, or if DNS for NetBIOS name resolution is enabled, etc.
+</p><p>
+In the case where there is no WINS server all name registrations as
+well as name lookups are done by UDP broadcast. This isolates name
+resolution to the local subnet, unless LMHOSTS is used to list all
+names and IP addresses. In such situations Samba provides a means by
+which the samba server name may be forcibly injected into the browse
+list of a remote MS Windows network (using the
+<b class="command">remote announce</b> parameter).
+</p><p>
+Where a WINS server is used, the MS Windows client will use UDP
+unicast to register with the WINS server. Such packets can be routed
+and thus WINS allows name resolution to function across routed networks.
+</p><p>
+During the startup process an election will take place to create a
+local master browser if one does not already exist. On each NetBIOS network
+one machine will be elected to function as the domain master browser. This
+domain browsing has nothing to do with MS security domain control.
+Instead, the domain master browser serves the role of contacting each local
+master browser (found by asking WINS or from LMHOSTS) and exchanging browse
+list contents. This way every master browser will eventually obtain a complete
+list of all machines that are on the network. Every 11-15 minutes an election
+is held to determine which machine will be the master browser. By the nature of
+the election criteria used, the machine with the highest uptime, or the
+most senior protocol version, or other criteria, will win the election
+as domain master browser.
+</p><p>
+Clients wishing to browse the network make use of this list, but also depend
+on the availability of correct name resolution to the respective IP
+address/addresses.
+</p><p>
+Any configuration that breaks name resolution and/or browsing intrinsics
+will annoy users because they will have to put up with protracted
+inability to use the network services.
+</p><p>
+Samba supports a feature that allows forced synchonisation
+of browse lists across routed networks using the <b class="command">remote
+browse sync</b> parameter in the <tt class="filename">smb.conf</tt> file.
+This causes Samba to contact the local master browser on a remote network and
+to request browse list synchronisation. This effectively bridges
+two networks that are separated by routers. The two remote
+networks may use either broadcast based name resolution or WINS
+based name resolution, but it should be noted that the <b class="command">remote
+browse sync</b> parameter provides browse list synchronisation - and
+that is distinct from name to address resolution, in other
+words, for cross subnet browsing to function correctly it is
+essential that a name to address resolution mechanism be provided.
+This mechanism could be via DNS, <tt class="filename">/etc/hosts</tt>,
+and so on.
+</p><div xmlns:ns14="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2884860"></a>Setting up WORKGROUP Browsing</h3></div></div><div></div></div><p>
+To set up cross subnet browsing on a network containing machines
+in up to be in a WORKGROUP, not an NT Domain you need to set up one
+Samba server to be the Domain Master Browser (note that this is *NOT*
+the same as a Primary Domain Controller, although in an NT Domain the
+same machine plays both roles). The role of a Domain master browser is
+to collate the browse lists from local master browsers on all the
+subnets that have a machine participating in the workgroup. Without
+one machine configured as a domain master browser each subnet would
+be an isolated workgroup, unable to see any machines on any other
+subnet. It is the presense of a domain master browser that makes
+cross subnet browsing possible for a workgroup.
+</p><p>
+In an WORKGROUP environment the domain master browser must be a
+Samba server, and there must only be one domain master browser per
+workgroup name. To set up a Samba server as a domain master browser,
+set the following option in the <i class="parameter"><tt>[global]</tt></i> section
+of the <tt class="filename">smb.conf</tt> file :
+</p><ns14:p>
+</ns14:p><pre class="programlisting">
+ domain master = yes
+</pre><ns14:p>
+</ns14:p><p>
+The domain master browser should also preferrably be the local master
+browser for its own subnet. In order to achieve this set the following
+options in the <i class="parameter"><tt>[global]</tt></i> section of the <tt class="filename">smb.conf</tt> file :
+</p><ns14:p>
+</ns14:p><pre class="programlisting">
+ domain master = yes
+ local master = yes
+ preferred master = yes
+ os level = 65
+</pre><ns14:p>
+</ns14:p><p>
+The domain master browser may be the same machine as the WINS
+server, if you require.
+</p><p>
+Next, you should ensure that each of the subnets contains a
+machine that can act as a local master browser for the
+workgroup. Any MS Windows NT/2K/XP/2003 machine should be
+able to do this, as will Windows 9x machines (although these
+tend to get rebooted more often, so it's not such a good idea
+to use these). To make a Samba server a local master browser
+set the following options in the <i class="parameter"><tt>[global]</tt></i> section of the
+<tt class="filename">smb.conf</tt> file :
+</p><ns14:p>
+</ns14:p><pre class="programlisting">
+ domain master = no
+ local master = yes
+ preferred master = yes
+ os level = 65
+</pre><ns14:p>
+</ns14:p><p>
+Do not do this for more than one Samba server on each subnet,
+or they will war with each other over which is to be the local
+master browser.
+</p><p>
+The <i class="parameter"><tt>local master</tt></i> parameter allows Samba to act as a
+local master browser. The <i class="parameter"><tt>preferred master</tt></i> causes nmbd
+to force a browser election on startup and the <i class="parameter"><tt>os level</tt></i>
+parameter sets Samba high enough so that it should win any browser elections.
+</p><p>
+If you have an NT machine on the subnet that you wish to
+be the local master browser then you can disable Samba from
+becoming a local master browser by setting the following
+options in the <i class="parameter"><tt>[global]</tt></i> section of the
+<tt class="filename">smb.conf</tt> file :
+</p><ns14:p>
+</ns14:p><pre class="programlisting">
+ domain master = no
+ local master = no
+ preferred master = no
+ os level = 0
+</pre><ns14:p>
+</ns14:p></div><div xmlns:ns15="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2885066"></a>Setting up DOMAIN Browsing</h3></div></div><div></div></div><p>
+If you are adding Samba servers to a Windows NT Domain then
+you must not set up a Samba server as a domain master browser.
+By default, a Windows NT Primary Domain Controller for a Domain
+name is also the Domain master browser for that name, and many
+things will break if a Samba server registers the Domain master
+browser NetBIOS name (<i class="replaceable"><tt>DOMAIN</tt></i><1B>)
+with WINS instead of the PDC.
+</p><p>
+For subnets other than the one containing the Windows NT PDC
+you may set up Samba servers as local master browsers as
+described. To make a Samba server a local master browser set
+the following options in the <b class="command">[global]</b> section
+of the <tt class="filename">smb.conf</tt> file :
+</p><ns15:p>
+</ns15:p><pre class="programlisting">
+ domain master = no
+ local master = yes
+ preferred master = yes
+ os level = 65
+</pre><ns15:p>
+</ns15:p><p>
+If you wish to have a Samba server fight the election with machines
+on the same subnet you may set the <i class="parameter"><tt>os level</tt></i> parameter
+to lower levels. By doing this you can tune the order of machines that
+will become local master browsers if they are running. For
+more details on this see the section <a href="#browse-force-master" title="Forcing samba to be the master">
+Forcing samba to be the master browser</a>
+below.
+</p><p>
+If you have Windows NT machines that are members of the domain
+on all subnets, and you are sure they will always be running then
+you can disable Samba from taking part in browser elections and
+ever becoming a local master browser by setting following options
+in the <i class="parameter"><tt>[global]</tt></i> section of the <tt class="filename">smb.conf</tt>
+file :
+</p><ns15:p>
+</ns15:p><pre class="programlisting">
+ domain master = no
+ local master = no
+ preferred master = no
+ os level = 0
+</pre><ns15:p>
+</ns15:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="browse-force-master"></a>Forcing samba to be the master</h3></div></div><div></div></div><p>
+Who becomes the <i class="parameter"><tt>master browser</tt></i> is determined by an election
+process using broadcasts. Each election packet contains a number of parameters
+which determine what precedence (bias) a host should have in the
+election. By default Samba uses a very low precedence and thus loses
+elections to just about anyone else.
+</p><p>
+If you want Samba to win elections then just set the <i class="parameter"><tt>os level</tt></i> global
+option in <tt class="filename">smb.conf</tt> to a higher number. It defaults to 0. Using 34
+would make it win all elections over every other system (except other
+samba systems!)
+</p><p>
+A <i class="parameter"><tt>os level</tt></i> of 2 would make it beat WfWg and Win95, but not MS Windows
+NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.
+</p><p>The maximum os level is 255</p><p>
+If you want samba to force an election on startup, then set the
+<i class="parameter"><tt>preferred master</tt></i> global option in <tt class="filename">smb.conf</tt> to <tt class="constant">yes</tt>. Samba will
+then have a slight advantage over other potential master browsers
+that are not preferred master browsers. Use this parameter with
+care, as if you have two hosts (whether they are windows 95 or NT or
+samba) on the same local subnet both set with <i class="parameter"><tt>preferred master</tt></i> to
+<tt class="constant">yes</tt>, then periodically and continually they will force an election
+in order to become the local master browser.
+</p><p>
+ If you want samba to be a <i class="parameter"><tt>domain master browser</tt></i>, then it is
+recommended that you also set <i class="parameter"><tt>preferred master</tt></i> to <tt class="constant">yes</tt>, because
+samba will not become a domain master browser for the whole of your
+LAN or WAN if it is not also a local master browser on its own
+broadcast isolated subnet.
+</p><p>
+It is possible to configure two samba servers to attempt to become
+the domain master browser for a domain. The first server that comes
+up will be the domain master browser. All other samba servers will
+attempt to become the domain master browser every 5 minutes. They
+will find that another samba server is already the domain master
+browser and will fail. This provides automatic redundancy, should
+the current domain master browser fail.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2885332"></a>Making samba the domain master</h3></div></div><div></div></div><p>
+The domain master is responsible for collating the browse lists of
+multiple subnets so that browsing can occur between subnets. You can
+make samba act as the domain master by setting <i class="parameter"><tt>domain master = yes</tt></i>
+in <tt class="filename">smb.conf</tt>. By default it will not be a domain master.
+</p><p>
+Note that you should <span class="emphasis"><em>not</em></span> set Samba to be the domain master for a
+workgroup that has the same name as an NT Domain.
+</p><p>
+When samba is the domain master and the master browser it will listen
+for master announcements (made roughly every twelve minutes) from local
+master browsers on other subnets and then contact them to synchronise
+browse lists.
+</p><p>
+If you want samba to be the domain master then I suggest you also set
+the <i class="parameter"><tt>os level</tt></i> high enough to make sure it wins elections, and set
+<i class="parameter"><tt>preferred master</tt></i> to <tt class="constant">yes</tt>, to get samba to force an election on
+startup.
+</p><p>
+Note that all your servers (including samba) and clients should be
+using a WINS server to resolve NetBIOS names. If your clients are only
+using broadcasting to resolve NetBIOS names, then two things will occur:
+</p><div class="orderedlist"><ol type="1"><li><p>
+ your local master browsers will be unable to find a domain master
+ browser, as it will only be looking on the local subnet.
+ </p></li><li><p>
+ if a client happens to get hold of a domain-wide browse list, and
+ a user attempts to access a host in that list, it will be unable to
+ resolve the NetBIOS name of that host.
+ </p></li></ol></div><p>
+If, however, both samba and your clients are using a WINS server, then:
+</p><div class="orderedlist"><ol type="1"><li><p>
+ your local master browsers will contact the WINS server and, as long as
+ samba has registered that it is a domain master browser with the WINS
+ server, your local master browser will receive samba's ip address
+ as its domain master browser.
+ </p></li><li><p>
+ when a client receives a domain-wide browse list, and a user attempts
+ to access a host in that list, it will contact the WINS server to
+ resolve the NetBIOS name of that host. as long as that host has
+ registered its NetBIOS name with the same WINS server, the user will
+ be able to see that host.
+ </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2888727"></a>Note about broadcast addresses</h3></div></div><div></div></div><p>
+If your network uses a "0" based broadcast address (for example if it
+ends in a 0) then you will strike problems. Windows for Workgroups
+does not seem to support a 0's broadcast and you will probably find
+that browsing and name lookups won't work.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2888744"></a>Multiple interfaces</h3></div></div><div></div></div><p>
+Samba now supports machines with multiple network interfaces. If you
+have multiple interfaces then you will need to use the <b class="command">interfaces</b>
+option in <tt class="filename">smb.conf</tt> to configure them.
+</p></div><div xmlns:ns16="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2888773"></a>Use of the Remote Announce parameter</h3></div></div><div></div></div><ns16:p>
+The <i class="parameter"><tt>remote announce</tt></i> parameter of
+<tt class="filename">smb.conf</tt> can be used to forcibly ensure
+that all the NetBIOS names on a network get announced to a remote network.
+The syntax of the <i class="parameter"><tt>remote announce</tt></i> parameter is:
+</ns16:p><pre class="programlisting">
+ remote announce = a.b.c.d [e.f.g.h] ...
+</pre><ns16:p>
+_or_
+</ns16:p><pre class="programlisting">
+ remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...
+</pre><ns16:p>
+
+where:
+</ns16:p><div class="variablelist"><dl><dt><span class="term"><i class="replaceable"><tt>a.b.c.d</tt></i> and
+<i class="replaceable"><tt>e.f.g.h</tt></i></span></dt><dd><p>is either the LMB (Local Master Browser) IP address
+or the broadcst address of the remote network.
+ie: the LMB is at 192.168.1.10, or the address
+could be given as 192.168.1.255 where the netmask
+is assumed to be 24 bits (255.255.255.0).
+When the remote announcement is made to the broadcast
+address of the remote network every host will receive
+our announcements. This is noisy and therefore
+undesirable but may be necessary if we do NOT know
+the IP address of the remote LMB.</p></dd><dt><span class="term"><i class="replaceable"><tt>WORKGROUP</tt></i></span></dt><dd><p>is optional and can be either our own workgroup
+or that of the remote network. If you use the
+workgroup name of the remote network then our
+NetBIOS machine names will end up looking like
+they belong to that workgroup, this may cause
+name resolution problems and should be avoided.
+</p></dd></dl></div><ns16:p>
+</ns16:p></div><div xmlns:ns17="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2888877"></a>Use of the Remote Browse Sync parameter</h3></div></div><div></div></div><p>
+The <i class="parameter"><tt>remote browse sync</tt></i> parameter of
+<tt class="filename">smb.conf</tt> is used to announce to
+another LMB that it must synchronise it's NetBIOS name list with our
+Samba LMB. It works ONLY if the Samba server that has this option is
+simultaneously the LMB on it's network segment.
+</p><ns17:p>
+The syntax of the <i class="parameter"><tt>remote browse sync</tt></i> parameter is:
+
+</ns17:p><pre class="programlisting">
+remote browse sync = <i class="replaceable"><tt>a.b.c.d</tt></i>
+</pre><ns17:p>
+
+where <i class="replaceable"><tt>a.b.c.d</tt></i> is either the IP address of the
+remote LMB or else is the network broadcast address of the remote segment.
+</ns17:p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2888938"></a>WINS - The Windows Internetworking Name Server</h2></div></div><div></div></div><p>
+Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly
+recommended. Every NetBIOS machine registers its name together with a
+name_type value for each of of several types of service it has available.
+eg: It registers its name directly as a unique (the type 0x03) name.
+It also registers its name if it is running the lanmanager compatible
+server service (used to make shares and printers available to other users)
+by registering the server (the type 0x20) name.
+</p><p>
+All NetBIOS names are up to 15 characters in length. The name_type variable
+is added to the end of the name - thus creating a 16 character name. Any
+name that is shorter than 15 characters is padded with spaces to the 15th
+character. ie: All NetBIOS names are 16 characters long (including the
+name_type information).
+</p><p>
+WINS can store these 16 character names as they get registered. A client
+that wants to log onto the network can ask the WINS server for a list
+of all names that have registered the NetLogon service name_type. This saves
+broadcast traffic and greatly expedites logon processing. Since broadcast
+name resolution can not be used across network segments this type of
+information can only be provided via WINS _or_ via statically configured
+<tt class="filename">lmhosts</tt> files that must reside on all clients in the
+absence of WINS.
+</p><p>
+WINS also serves the purpose of forcing browse list synchronisation by all
+LMB's. LMB's must synchronise their browse list with the DMB (domain master
+browser) and WINS helps the LMB to identify it's DMB. By definition this
+will work only within a single workgroup. Note that the domain master browser
+has NOTHING to do with what is referred to as an MS Windows NT Domain. The
+later is a reference to a security environment while the DMB refers to the
+master controller for browse list information only.
+</p><p>
+Use of WINS will work correctly only if EVERY client TCP/IP protocol stack
+has been configured to use the WINS server/s. Any client that has not been
+configured to use the WINS server will continue to use only broadcast based
+name registration so that WINS may NEVER get to know about it. In any case,
+machines that have not registered with a WINS server will fail name to address
+lookup attempts by other clients and will therefore cause workstation access
+errors.
+</p><p>
+To configure Samba as a WINS server just add
+<i class="parameter"><tt>wins support = yes</tt></i> to the <tt class="filename">smb.conf</tt>
+file [globals] section.
+</p><p>
+To configure Samba to register with a WINS server just add
+<i class="parameter"><tt>wins server = a.b.c.d</tt></i> to your <tt class="filename">smb.conf</tt> file <i class="parameter"><tt>[globals]</tt></i> section.
+</p><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Important</h3><p>
+Never use both <i class="parameter"><tt>wins support = yes</tt></i> together
+with <i class="parameter"><tt>wins server = a.b.c.d</tt></i>
+particularly not using it's own IP address.
+Specifying both will cause <span class="application">nmbd</span> to refuse to start!
+</p></div><div xmlns:ns18="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2889089"></a>Setting up a WINS server</h3></div></div><div></div></div><p>
+Either a Samba machine or a Windows NT Server machine may be set up
+as a WINS server. To set a Samba machine to be a WINS server you must
+add the following option to the <tt class="filename">smb.conf</tt> file on the selected machine :
+in the <i class="parameter"><tt>[globals]</tt></i> section add the line
+</p><ns18:p>
+</ns18:p><pre class="programlisting">
+ wins support = yes
+</pre><ns18:p>
+</ns18:p><p>
+Versions of Samba prior to 1.9.17 had this parameter default to
+yes. If you have any older versions of Samba on your network it is
+strongly suggested you upgrade to a recent version, or at the very
+least set the parameter to 'no' on all these machines.
+</p><p>
+Machines with <i class="parameter"><tt>wins support = yes</tt></i> will keep a list of
+all NetBIOS names registered with them, acting as a DNS for NetBIOS names.
+</p><p>
+You should set up only ONE wins server. Do NOT set the
+<i class="parameter"><tt>wins support = yes</tt></i> option on more than one Samba
+server.
+</p><p>
+To set up a Windows NT Server as a WINS server you need to set up
+the WINS service - see your NT documentation for details. Note that
+Windows NT WINS Servers can replicate to each other, allowing more
+than one to be set up in a complex subnet environment. As Microsoft
+refuse to document these replication protocols Samba cannot currently
+participate in these replications. It is possible in the future that
+a Samba->Samba WINS replication protocol may be defined, in which
+case more than one Samba machine could be set up as a WINS server
+but currently only one Samba server should have the
+<i class="parameter"><tt>wins support = yes</tt></i> parameter set.
+</p><p>
+After the WINS server has been configured you must ensure that all
+machines participating on the network are configured with the address
+of this WINS server. If your WINS server is a Samba machine, fill in
+the Samba machine IP address in the <span class="guilabel">Primary WINS Server</span> field of
+the <span class="guilabel">Control Panel->Network->Protocols->TCP->WINS Server</span> dialogs
+in Windows 95 or Windows NT. To tell a Samba server the IP address
+of the WINS server add the following line to the <i class="parameter"><tt>[global]</tt></i> section of
+all <tt class="filename">smb.conf</tt> files :
+</p><ns18:p>
+</ns18:p><pre class="programlisting">
+ wins server = <name or IP address>
+</pre><ns18:p>
+</ns18:p><p>
+where <name or IP address> is either the DNS name of the WINS server
+machine or its IP address.
+</p><p>
+Note that this line MUST NOT BE SET in the <tt class="filename">smb.conf</tt> file of the Samba
+server acting as the WINS server itself. If you set both the
+<i class="parameter"><tt>wins support = yes</tt></i> option and the
+<i class="parameter"><tt>wins server = <name></tt></i> option then
+nmbd will fail to start.
+</p><p>
+There are two possible scenarios for setting up cross subnet browsing.
+The first details setting up cross subnet browsing on a network containing
+Windows 95, Samba and Windows NT machines that are not configured as
+part of a Windows NT Domain. The second details setting up cross subnet
+browsing on networks that contain NT Domains.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2889284"></a>WINS Replication</h3></div></div><div></div></div><p>
+Samba-3 permits WINS replication through the use of the <tt class="filename">wrepld</tt> utility.
+This tool is not currently capable of being used as it is still in active development.
+As soon as this tool becomes moderately functional we will prepare man pages and enhance this
+section of the documentation to provide usage and technical details.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2889309"></a>Static WINS Entries</h3></div></div><div></div></div><p>
+New to Samba-3 is a tool called <b class="command">winsedit</b> that may be used to add
+static WINS entries to the WINS database. This tool can be used also to modify entries
+existing in the WINS database.
+</p><p>
+The development of the winsedit tool was made necessary due to the migration
+of the older style wins.dat file into a new tdb binary backend data store.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2889340"></a>Helpful Hints</h2></div></div><div></div></div><p>
+The following hints should be carefully considered as they are stumbling points
+for many new network administrators.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2889353"></a>Windows Networking Protocols</h3></div></div><div></div></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+Do NOT use more than one (1) protocol on MS Windows machines
+</p></div><p>
+A very common cause of browsing problems results from installing more than
+one protocol on an MS Windows machine.
+</p><p>
+Every NetBIOS machine takes part in a process of electing the LMB (and DMB)
+every 15 minutes. A set of election criteria is used to determine the order
+of precidence for winning this election process. A machine running Samba or
+Windows NT will be biased so that the most suitable machine will predictably
+win and thus retain it's role.
+</p><p>
+The election process is "fought out" so to speak over every NetBIOS network
+interface. In the case of a Windows 9x machine that has both TCP/IP and IPX
+installed and has NetBIOS enabled over both protocols the election will be
+decided over both protocols. As often happens, if the Windows 9x machine is
+the only one with both protocols then the LMB may be won on the NetBIOS
+interface over the IPX protocol. Samba will then lose the LMB role as Windows
+9x will insist it knows who the LMB is. Samba will then cease to function
+as an LMB and thus browse list operation on all TCP/IP only machines will
+fail.
+</p><p><span class="emphasis"><em>
+Windows 95, 98, 98se, Me are referred to generically as Windows 9x.
+The Windows NT4, 2000, XP and 2003 use common protocols. These are roughly
+referred to as the WinNT family, but it should be recognised that 2000 and
+XP/2003 introduce new protocol extensions that cause them to behave
+differently from MS Windows NT4. Generally, where a server does NOT support
+the newer or extended protocol, these will fall back to the NT4 protocols.
+</em></span></p><p>
+The safest rule of all to follow it this - USE ONLY ONE PROTOCOL!
+</p></div><div xmlns:ns19="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2889420"></a>Name Resolution Order</h3></div></div><div></div></div><p>
+Resolution of NetBIOS names to IP addresses can take place using a number
+of methods. The only ones that can provide NetBIOS name_type information
+are:</p><table class="simplelist" border="0" summary="Simple list"><tr><td>WINS: the best tool!</td></tr><tr><td>LMHOSTS: is static and hard to maintain.</td></tr><tr><td>Broadcast: uses UDP and can not resolve names across remote segments.</td></tr></table><p>
+Alternative means of name resolution includes:</p><table class="simplelist" border="0" summary="Simple list"><tr><td><tt class="filename">/etc/hosts</tt>: is static, hard to maintain, and lacks name_type info</td></tr><tr><td>DNS: is a good choice but lacks essential name_type info.</td></tr></table><ns19:p>
+Many sites want to restrict DNS lookups and want to avoid broadcast name
+resolution traffic. The "name resolve order" parameter is of great help here.
+The syntax of the "name resolve order" parameter is:
+</ns19:p><pre class="programlisting">
+name resolve order = wins lmhosts bcast host
+</pre><ns19:p>
+_or_
+</ns19:p><pre class="programlisting">
+name resolve order = wins lmhosts (eliminates bcast and host)
+</pre><ns19:p>
+The default is:
+</ns19:p><pre class="programlisting">
+name resolve order = host lmhost wins bcast
+</pre><ns19:p>
+where "host" refers the the native methods used by the Unix system
+to implement the gethostbyname() function call. This is normally
+controlled by <tt class="filename">/etc/host.conf</tt>, <tt class="filename">/etc/nsswitch.conf</tt> and <tt class="filename">/etc/resolv.conf</tt>.
+</ns19:p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2889541"></a>Technical Overview of browsing</h2></div></div><div></div></div><p>
+SMB networking provides a mechanism by which clients can access a list
+of machines in a network, a so-called <i class="parameter"><tt>browse list</tt></i>. This list
+contains machines that are ready to offer file and/or print services
+to other machines within the network. Thus it does not include
+machines which aren't currently able to do server tasks. The browse
+list is heavily used by all SMB clients. Configuration of SMB
+browsing has been problematic for some Samba users, hence this
+document.
+</p><p>
+MS Windows 2000 and later, as with Samba 3 and later, can be
+configured to not use NetBIOS over TCP/IP. When configured this way
+it is imperative that name resolution (using DNS/LDAP/ADS) be correctly
+configured and operative. Browsing will NOT work if name resolution
+from SMB machine names to IP addresses does not function correctly.
+</p><p>
+Where NetBIOS over TCP/IP is enabled use of a WINS server is highly
+recommended to aid the resolution of NetBIOS (SMB) names to IP addresses.
+WINS allows remote segment clients to obtain NetBIOS name_type information
+that can NOT be provided by any other means of name resolution.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2889588"></a>Browsing support in samba</h3></div></div><div></div></div><p>
+Samba facilitates browsing. The browsing is supported by <span class="application">nmbd</span>
+and is also controlled by options in the <tt class="filename">smb.conf</tt> file.
+Samba can act as a local browse master for a workgroup and the ability
+to support domain logons and scripts is now available.
+</p><p>
+Samba can also act as a domain master browser for a workgroup. This
+means that it will collate lists from local browse masters into a
+wide area network server list. In order for browse clients to
+resolve the names they may find in this list, it is recommended that
+both samba and your clients use a WINS server.
+</p><p>
+Note that you should NOT set Samba to be the domain master for a
+workgroup that has the same name as an NT Domain: on each wide area
+network, you must only ever have one domain master browser per workgroup,
+regardless of whether it is NT, Samba or any other type of domain master
+that is providing this service.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Nmbd can be configured as a WINS server, but it is not
+necessary to specifically use samba as your WINS server. MS Windows
+NT4, Server or Advanced Server 2000 or 2003 can be configured as
+your WINS server. In a mixed NT/2000/2003 server and samba environment on
+a Wide Area Network, it is recommended that you use the Microsoft
+WINS server capabilities. In a samba-only environment, it is
+recommended that you use one and only one Samba server as your WINS server.
+</p></div><p>
+To get browsing to work you need to run nmbd as usual, but will need
+to use the <i class="parameter"><tt>workgroup</tt></i> option in <tt class="filename">smb.conf</tt>
+to control what workgroup Samba becomes a part of.
+</p><p>
+Samba also has a useful option for a Samba server to offer itself for
+browsing on another subnet. It is recommended that this option is only
+used for 'unusual' purposes: announcements over the internet, for
+example. See <i class="parameter"><tt>remote announce</tt></i> in the
+<tt class="filename">smb.conf</tt> man page.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2889695"></a>Problem resolution</h3></div></div><div></div></div><p>
+If something doesn't work then hopefully the log.nmb file will help
+you track down the problem. Try a debug level of 2 or 3 for finding
+problems. Also note that the current browse list usually gets stored
+in text form in a file called <tt class="filename">browse.dat</tt>.
+</p><p>
+Note that if it doesn't work for you, then you should still be able to
+type the server name as <tt class="filename">\\SERVER</tt> in filemanager then
+hit enter and filemanager should display the list of available shares.
+</p><p>
+Some people find browsing fails because they don't have the global
+<i class="parameter"><tt>guest account</tt></i> set to a valid account. Remember that the
+IPC$ connection that lists the shares is done as guest, and thus you must
+have a valid guest account.
+</p><p><span class="emphasis"><em>
+MS Windows 2000 and upwards (as with Samba) can be configured to disallow
+anonymous (ie: Guest account) access to the IPC$ share. In that case, the
+MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the
+name of the currently logged in user to query the IPC$ share. MS Windows
+9X clients are not able to do this and thus will NOT be able to browse
+server resources.
+</em></span></p><p>
+The other big problem people have is that their broadcast address,
+netmask or IP address is wrong (specified with the "interfaces" option
+in <tt class="filename">smb.conf</tt>)
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2889774"></a>Browsing across subnets</h3></div></div><div></div></div><p>
+Since the release of Samba 1.9.17(alpha1) Samba has been
+updated to enable it to support the replication of browse lists
+across subnet boundaries. New code and options have been added to
+achieve this. This section describes how to set this feature up
+in different settings.
+</p><p>
+To see browse lists that span TCP/IP subnets (ie. networks separated
+by routers that don't pass broadcast traffic) you must set up at least
+one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing
+NetBIOS name to IP address translation to be done by doing a direct
+query of the WINS server. This is done via a directed UDP packet on
+port 137 to the WINS server machine. The reason for a WINS server is
+that by default, all NetBIOS name to IP address translation is done
+by broadcasts from the querying machine. This means that machines
+on one subnet will not be able to resolve the names of machines on
+another subnet without using a WINS server.
+</p><p>
+Remember, for browsing across subnets to work correctly, all machines,
+be they Windows 95, Windows NT, or Samba servers must have the IP address
+of a WINS server given to them by a DHCP server, or by manual configuration
+(for Win95 and WinNT, this is in the TCP/IP Properties, under Network
+settings) for Samba this is in the <tt class="filename">smb.conf</tt> file.
+</p><div xmlns:ns20="" class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2889825"></a>How does cross subnet browsing work ?</h4></div></div><div></div></div><p>
+Cross subnet browsing is a complicated dance, containing multiple
+moving parts. It has taken Microsoft several years to get the code
+that achieves this correct, and Samba lags behind in some areas.
+Samba is capable of cross subnet browsing when configured correctly.
+</p><p>
+Consider a network set up as follows :
+</p><ns20:p>
+
+</ns20:p><pre class="programlisting">
+ (DMB)
+ N1_A N1_B N1_C N1_D N1_E
+ | | | | |
+ -------------------------------------------------------
+ | subnet 1 |
+ +---+ +---+
+ |R1 | Router 1 Router 2 |R2 |
+ +---+ +---+
+ | |
+ | subnet 2 subnet 3 |
+ -------------------------- ------------------------------------
+ | | | | | | | |
+ N2_A N2_B N2_C N2_D N3_A N3_B N3_C N3_D
+ (WINS)
+</pre><ns20:p>
+</ns20:p><p>
+Consisting of 3 subnets (1, 2, 3) connected by two routers
+(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines
+on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume
+for the moment that all these machines are configured to be in the
+same workgroup (for simplicity's sake). Machine N1_C on subnet 1
+is configured as Domain Master Browser (ie. it will collate the
+browse lists for the workgroup). Machine N2_D is configured as
+WINS server and all the other machines are configured to register
+their NetBIOS names with it.
+</p><p>
+As all these machines are booted up, elections for master browsers
+will take place on each of the three subnets. Assume that machine
+N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on
+subnet 3 - these machines are known as local master browsers for
+their particular subnet. N1_C has an advantage in winning as the
+local master browser on subnet 1 as it is set up as Domain Master
+Browser.
+</p><p>
+On each of the three networks, machines that are configured to
+offer sharing services will broadcast that they are offering
+these services. The local master browser on each subnet will
+receive these broadcasts and keep a record of the fact that
+the machine is offering a service. This list of records is
+the basis of the browse list. For this case, assume that
+all the machines are configured to offer services so all machines
+will be on the browse list.
+</p><p>
+For each network, the local master browser on that network is
+considered 'authoritative' for all the names it receives via
+local broadcast. This is because a machine seen by the local
+master browser via a local broadcast must be on the same
+network as the local master browser and thus is a 'trusted'
+and 'verifiable' resource. Machines on other networks that
+the local master browsers learn about when collating their
+browse lists have not been directly seen - these records are
+called 'non-authoritative'.
+</p><p>
+At this point the browse lists look as follows (these are
+the machines you would see in your network neighborhood if
+you looked in it on a particular network right now).
+</p><ns20:p>
+</ns20:p><div class="table"><a name="id2889940"></a><p class="title"><b>Table 10.1. Browse subnet example 1</b></p><table summary="Browse subnet example 1" border="1"><colgroup><col><col><col></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="left">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="left">N1_A, N1_B, N1_C, N1_D, N1_E</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="left">N2_A, N2_B, N2_C, N2_D</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="left">N3_A, N3_B, N3_C, N3_D</td></tr></tbody></table></div><ns20:p>
+</ns20:p><p>
+Note that at this point all the subnets are separate, no
+machine is seen across any of the subnets.
+</p><p>
+Now examine subnet 2. As soon as N2_B has become the local
+master browser it looks for a Domain master browser to synchronize
+its browse list with. It does this by querying the WINS server
+(N2_D) for the IP address associated with the NetBIOS name
+WORKGROUP<1B>. This name was registered by the Domain master
+browser (N1_C) with the WINS server as soon as it was booted.
+</p><p>
+Once N2_B knows the address of the Domain master browser it
+tells it that is the local master browser for subnet 2 by
+sending a MasterAnnouncement packet as a UDP port 138 packet.
+It then synchronizes with it by doing a NetServerEnum2 call. This
+tells the Domain Master Browser to send it all the server
+names it knows about. Once the domain master browser receives
+the MasterAnnouncement packet it schedules a synchronization
+request to the sender of that packet. After both synchronizations
+are done the browse lists look like :
+</p><ns20:p>
+</ns20:p><div class="table"><a name="id2890050"></a><p class="title"><b>Table 10.2. Browse subnet example 2</b></p><table summary="Browse subnet example 2" border="1"><colgroup><col><col><col></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="left">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="left">N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*)</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="left">N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="left">N3_A, N3_B, N3_C, N3_D</td></tr></tbody></table></div><ns20:p>
+
+Servers with a (*) after them are non-authoritative names.
+</ns20:p><p>
+At this point users looking in their network neighborhood on
+subnets 1 or 2 will see all the servers on both, users on
+subnet 3 will still only see the servers on their own subnet.
+</p><p>
+The same sequence of events that occured for N2_B now occurs
+for the local master browser on subnet 3 (N3_D). When it
+synchronizes browse lists with the domain master browser (N1_A)
+it gets both the server entries on subnet 1, and those on
+subnet 2. After N3_D has synchronized with N1_C and vica-versa
+the browse lists look like.
+</p><ns20:p>
+</ns20:p><div class="table"><a name="id2890149"></a><p class="title"><b>Table 10.3. Browse subnet example 3</b></p><table summary="Browse subnet example 3" border="1"><colgroup><col><col><col></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="left">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="left">N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="left">N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="left">N3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)</td></tr></tbody></table></div><ns20:p>
+
+Servers with a (*) after them are non-authoritative names.
+</ns20:p><p>
+At this point users looking in their network neighborhood on
+subnets 1 or 3 will see all the servers on all sunbets, users on
+subnet 2 will still only see the servers on subnets 1 and 2, but not 3.
+</p><p>
+Finally, the local master browser for subnet 2 (N2_B) will sync again
+with the domain master browser (N1_C) and will recieve the missing
+server entries. Finally - and as a steady state (if no machines
+are removed or shut off) the browse lists will look like :
+</p><ns20:p>
+</ns20:p><div class="table"><a name="id2890249"></a><p class="title"><b>Table 10.4. Browse subnet example 4</b></p><table summary="Browse subnet example 4" border="1"><colgroup><col><col><col></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="left">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="left">N1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="left">N2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="left">N3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)</td></tr></tbody></table></div><ns20:p>
+
+Servers with a (*) after them are non-authoritative names.
+</ns20:p><p>
+Synchronizations between the domain master browser and local
+master browsers will continue to occur, but this should be a
+steady state situation.
+</p><p>
+If either router R1 or R2 fails the following will occur:
+</p><div class="orderedlist"><ol type="1"><li><p>
+ Names of computers on each side of the inaccessible network fragments
+ will be maintained for as long as 36 minutes, in the network neighbourhood
+ lists.
+ </p></li><li><p>
+ Attempts to connect to these inaccessible computers will fail, but the
+ names will not be removed from the network neighbourhood lists.
+ </p></li><li><p>
+ If one of the fragments is cut off from the WINS server, it will only
+ be able to access servers on its local subnet, by using subnet-isolated
+ broadcast NetBIOS name resolution. The effects are similar to that of
+ losing access to a DNS server.
+ </p></li></ol></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2890391"></a>Common Errors</h2></div></div><div></div></div><p>
+Many questions are sked on the mailing lists regarding browsing. The majority of browsing
+problems originate out of incorrect configuration of NetBIOS name resolution. Some are of
+particular note.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2890406"></a>How can one flush the Samba NetBIOS name cache without restarting samba?</h3></div></div><div></div></div><p>
+Samba's nmbd process controls all browse list handling. Under normal circumstances it is
+safe to restart nmbd. This will effectively flush the samba NetBIOS name cache and cause it
+to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear
+in the browse list. When nmbd is taken out of service another machine on the network will
+become the browse master. This new list may still have the rogue entry in it. If you really
+want to clear a rogue machine from the list then every machine on the network will need to be
+shut down and restarted at after all machines are down. Failing a complete restart, the only
+other thing you can do is wait until the entry times out and is then flushed from the list.
+This may take a long time on some networks (months).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2890435"></a>My client reports "This server is not configured to list shared resources"</h3></div></div><div></div></div><p>
+Your guest account is probably invalid for some reason. Samba uses the
+guest account for browsing in smbd. Check that your guest account is
+valid.
+</p><p>See also <i class="parameter"><tt>guest account</tt></i> in the <tt class="filename">smb.conf</tt> man page.</p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="passdb"></a>Chapter 11. Account Information Databases</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jerry@samba.org">jerry@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jeremy</span> <span class="surname">Allison</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jra@samba.org">jra@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Olivier (lem)</span> <span class="surname">Lemaire</span></h3><div class="affiliation"><span class="orgname">IDEALX<br></span><div class="address"><p><tt class="email"><<a href="mailto:olem@IDEALX.org">olem@IDEALX.org</a>></tt></p></div></div></div></div><div><p class="pubdate">May 24, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2890530">Features and Benefits</a></dt><dt><a href="#id2890854">Technical Information</a></dt><dd><dl><dt><a href="#id2890917">Important Notes About Security</a></dt><dt><a href="#id2891160">Mapping User Identifiers between MS Windows and Unix</a></dt></dl></dd><dt><a href="#id2891216">Account Management Tools</a></dt><dd><dl><dt><a href="#id2891247">The smbpasswd Command</a></dt><dt><a href="#id2891513">The pdbedit Command</a></dt></dl></dd><dt><a href="#id2891647">Password Backends</a></dt><dd><dl><dt><a href="#id2895859">Plain Text</a></dt><dt><a href="#id2895899">smbpasswd - Encrypted Password Database</a></dt><dt><a href="#id2896006">tdbsam</a></dt><dt><a href="#id2896034">ldapsam</a></dt><dt><a href="#id2897524">MySQL</a></dt><dt><a href="#XMLpassdb">XML</a></dt></dl></dd><dt><a href="#id2898328">Common Errors</a></dt><dd><dl><dt><a href="#id2898335">Users can not logon - Users not in Samba SAM</a></dt><dt><a href="#id2898350">Users are being added to the wrong backend database</a></dt><dt><a href="#id2898409">auth methods does not work</a></dt></dl></dd></dl></div><p>
+Samba-3 implements a new capability to work concurrently with mulitple account backends.
+The possible new combinations of password backends allows Samba-3 a degree of flexibility
+and scalability that previously could be achieved only with MS Windows Active Directory.
+This chapter describes the new functionality and how to get the most out of it.
+</p><p>
+In the course of development of Samba-3 a number of requests were received to provide the
+ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide
+matching Unix/Linux accounts. We called this the <span class="emphasis"><em>Non Unix Accounts (NUA)</em></span>
+capability. The intent was that an administrator could decide to use the <span class="emphasis"><em>tdbsam</em></span>
+backend and by simply specifying <span class="emphasis"><em>"passdb backend = tdbsam_nua, guest"</em></span>
+this would allow Samba-3 to implement a solution that did not use Unix accounts per se. Late
+in the development cycle the team doing this work hit upon some obstacles that prevents this
+solution from being used. Given the delays with Samba-3 release a decision was made to NOT
+deliver this functionality until a better method of recognising NT Group SIDs from NT User
+SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Samba-3.0.0 does NOT support Non-Unix Account (NUA) operation.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2890530"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality
+as follows:
+</p><div class="variablelist"><p class="title"><b>Backwards Compatibility Backends</b></p><dl><dt><span class="term">Plain Text:</span></dt><dd><p>
+ This option uses nothing but the Unix/Linux <tt class="filename">/etc/passwd</tt>
+ style back end. On systems that have PAM (Pluggable Authentication Modules)
+ support all PAM modules are supported. The behaviour is just as it was with
+ Samba-2.2.x, and the protocol limitations imposed by MS Windows clients
+ apply likewise.
+ </p></dd><dt><span class="term">smbpasswd:</span></dt><dd><p>
+ This option allows continues use of the <tt class="filename">smbpasswd</tt>
+ file that maintains a plain ASCII (text) layout that includes the MS Windows
+ LanMan and NT encrypted passwords as well as a field that stores some
+ account information. This form of password backend does NOT store any of
+ the MS Windows NT/200x SAM (Security Account Manager) information needed to
+ provide the extended controls that are needed for more comprehensive
+ interoperation with MS Windows NT4 / 200x servers.
+ </p><p>
+ This backend should be used only for backwards compatibility with older
+ versions of Samba. It may be deprecated in future releases.
+ </p></dd><dt><span class="term">ldapsam_compat (Samba-2.2 LDAP Compatibilty):</span></dt><dd><p>
+ There is a password backend option that allows continued operation with
+ a existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension.
+ This option is provided primarily as a migration tool, although there is
+ no reason to force migration at this time. Note that this tool will eventually
+ be deprecated.
+ </p></dd></dl></div><p>
+Samba-3 introduces the following new password backend capabilities:
+</p><div class="variablelist"><p class="title"><b>New Backends</b></p><dl><dt><span class="term">guest:</span></dt><dd><p>
+ This is <span class="emphasis"><em>always</em></span> required as the last backend specified.
+ It provides the ability to handle guest account requirements for access to
+ resources like <i class="parameter"><tt>IPC$</tt></i> which is used for browsing.
+ </p></dd><dt><span class="term">tdbsam:</span></dt><dd><p>
+ This backend provides a rich database backend for local servers. This
+ backend is NOT suitable for multiple domain controller (ie: PDC + one
+ or more BDC) installations.
+ </p><p>
+ The <span class="emphasis"><em>tdbsam</em></span> password backend stores the old <span class="emphasis"><em>
+ smbpasswd</em></span> information PLUS the extended MS Windows NT / 200x
+ SAM information into a binary format TDB (trivial database) file.
+ The inclusion of the extended information makes it possible for Samba-3
+ to implement the same account and system access controls that are possible
+ with MS Windows NT4 and MS Windows 200x based systems.
+ </p><p>
+ The inclusion of the <span class="emphasis"><em>tdbsam</em></span> capability is a direct
+ response to user requests to allow simple site operation without the overhead
+ of the complexities of running OpenLDAP. It is recommended to use this only
+ for sites that have fewer than 250 users. For larger sites or implementations
+ the use of OpenLDAP or of Active Directory integration is strongly recommended.
+ </p></dd><dt><span class="term">ldapsam:</span></dt><dd><p>
+ This provides a rich directory backend for distributed account installation
+ </p><p>
+ Samba-3 has a new and extended LDAP implementation that requires configuration
+ of OpenLDAP with a new format samba schema. The new format schema file is
+ included in the <tt class="filename">~samba/examples/LDAP</tt> directory.
+ </p><p>
+ The new LDAP implementation significantly expands the control abilities that
+ were possible with prior versions of Samba. It is now possible to specify
+ "per user" profile settings, home directories, account access controls, and
+ much more. Corporate sites will see that the Samba-Team has listened to their
+ requests both for capability and to allow greater scalability.
+ </p></dd><dt><span class="term">mysqlsam (MySQL based backend):</span></dt><dd><p>
+ It is expected that the MySQL based SAM will be very popular in some corners.
+ This database backend will be on considerable interest to sites that want to
+ leverage existing MySQL technology.
+ </p></dd><dt><span class="term">xmlsam (XML based datafile):</span></dt><dd><p>
+ Allows the account and password data to be stored in an XML format
+ data file. This backend can not be used for normal operation, it can only
+ be used in conjunction with <b class="command">pdbedit</b>'s pdb2pdb
+ functionality. The DTD that is used might be subject to changes in the future.
+ </p><p>
+ The xmlsam option can be useful for account migration between database
+ backends or backups. Use of this tool will allow the data to be edited before migration
+ into another backend format.
+ </p></dd><dt><span class="term">nisplussam:</span></dt><dd><p>
+ The NIS+ based passdb backend. Takes name NIS domain as an
+ optional argument. Only works with Sun NIS+ servers.
+ </p></dd></dl></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2890854"></a>Technical Information</h2></div></div><div></div></div><p>
+ Old windows clients send plain text passwords over the wire. Samba can check these
+ passwords by crypting them and comparing them to the hash stored in the unix user database.
+ </p><p>
+ Newer windows clients send encrypted passwords (so-called Lanman and NT hashes) over
+ the wire, instead of plain text passwords. The newest clients will send only encrypted
+ passwords and refuse to send plain text passwords, unless their registry is tweaked.
+ </p><p>
+ These passwords can't be converted to unix style encrypted passwords. Because of that
+ you can't use the standard unix user database, and you have to store the Lanman and NT
+ hashes somewhere else.
+ </p><p>
+ In addition to differently encrypted passwords, windows also stores certain data for each
+ user that is not stored in a unix user database. e.g: workstations the user may logon from,
+ the location where the users' profile is stored, and so on. Samba retrieves and stores this
+ information using a <i class="parameter"><tt>passdb backend</tt></i>. Commonly available backends are LDAP, plain text
+ file, MySQL and nisplus. For more information, see the man page for <tt class="filename">smb.conf</tt> regarding the
+ <i class="parameter"><tt>passdb backend</tt></i> parameter.
+ </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2890917"></a>Important Notes About Security</h3></div></div><div></div></div><p>
+ The unix and SMB password encryption techniques seem similar on the surface. This
+ similarity is, however, only skin deep. The unix scheme typically sends clear text
+ passwords over the network when logging in. This is bad. The SMB encryption scheme
+ never sends the cleartext password over the network but it does store the 16 byte
+ hashed values on disk. This is also bad. Why? Because the 16 byte hashed values
+ are a "password equivalent". You cannot derive the user's password from them, but
+ they could potentially be used in a modified client to gain access to a server.
+ This would require considerable technical knowledge on behalf of the attacker but
+ is perfectly possible. You should thus treat the data stored in whatever passdb
+ backend you use (smbpasswd file, ldap, mysql) as though it contained the cleartext
+ passwords of all your users. Its contents must be kept secret, and the file should
+ be protected accordingly.
+ </p><p>
+ Ideally we would like a password scheme that involves neither plain text passwords
+ on the net nor on disk. Unfortunately this is not available as Samba is stuck with
+ having to be compatible with other SMB systems (WinNT, WfWg, Win95 etc).
+ </p><p>
+ Windows NT 4.0 Service pack 3 changed the default setting so that plaintext passwords
+ are disabled from being sent over the wire. This mandates either the use of encrypted
+ password support or edit the Windows NT registry to re-enable plaintext passwords.
+ </p><p>
+ The following versions of MS Windows do not support full domain security protocols,
+ although they may log onto a domain environment:
+ </p><table class="simplelist" border="0" summary="Simple list"><tr><td>MS DOS Network client 3.0 with the basic network redirector installed</td></tr><tr><td>Windows 95 with the network redirector update installed</td></tr><tr><td>Windows 98 [se]</td></tr><tr><td>Windows Me</td></tr></table><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+ MS Windows XP Home does not have facilities to become a domain member and it can
+ not participate in domain logons.
+ </p></div><p>
+ The following versions of MS Windows fully support domain security protocols.
+ </p><table class="simplelist" border="0" summary="Simple list"><tr><td>Windows NT 3.5x</td></tr><tr><td>Windows NT 4.0</td></tr><tr><td>Windows 2000 Professional</td></tr><tr><td>Windows 200x Server/Advanced Server</td></tr><tr><td>Windows XP Professional</td></tr></table><p>
+ All current release of Microsoft SMB/CIFS clients support authentication via the
+ SMB Challenge/Response mechanism described here. Enabling clear text authentication
+ does not disable the ability of the client to participate in encrypted authentication.
+ Instead, it allows the client to negotiate either plain text _or_ encrypted password
+ handling.
+ </p><p>
+ MS Windows clients will cache the encrypted password alone. Where plain text passwords
+ are re-enabled, through the appropriate registry change, the plain text password is NEVER
+ cached. This means that in the event that a network connections should become disconnected
+ (broken) only the cached (encrypted) password will be sent to the resource server to
+ affect a auto-reconnect. If the resource server does not support encrypted passwords the
+ auto-reconnect will fail. <span class="emphasis"><em>USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED.</em></span>
+ </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2891070"></a>Advantages of Encrypted Passwords</h4></div></div><div></div></div><div class="itemizedlist"><ul type="disc"><li><p>Plain text passwords are not passed across
+ the network. Someone using a network sniffer cannot just
+ record passwords going to the SMB server.</p></li><li><p>Plain text passwords are not stored anywhere in
+ memory or on disk.</p></li><li><p>WinNT doesn't like talking to a server
+ that does not support encrypted passwords. It will refuse
+ to browse the server if the server is also in user level
+ security mode. It will insist on prompting the user for the
+ password on each connection, which is very annoying. The
+ only things you can do to stop this is to use SMB encryption.
+ </p></li><li><p>Encrypted password support allows automatic share
+ (resource) reconnects.</p></li><li><p>Encrypted passwords are essential for PDC/BDC
+ operation.</p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2891124"></a>Advantages of non-encrypted passwords</h4></div></div><div></div></div><div class="itemizedlist"><ul type="disc"><li><p>Plain text passwords are not kept
+ on disk, and are NOT cached in memory. </p></li><li><p>Uses same password file as other unix
+ services such as login and ftp</p></li><li><p>Use of other services (such as telnet and ftp) which
+ send plain text passwords over the net, so sending them for SMB
+ isn't such a big deal.</p></li></ul></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2891160"></a>Mapping User Identifiers between MS Windows and Unix</h3></div></div><div></div></div><p>
+ Every operation in Unix/Linux requires a user identifier (UID), just as in
+ MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides
+ two means for mapping an MS Windows user to a Unix/Linux UID.
+ </p><p>
+ Firstly, all Samba SAM (Security Account Management database) accounts require
+ a Unix/Linux UID that the account will map to. As users are added to the account
+ information database samba-3 will call the <i class="parameter"><tt>add user script</tt></i>
+ interface to add the account to the Samba host OS. In essence all accounts in
+ the local SAM require a local user account.
+ </p><p>
+ The second way to affect Windows SID to Unix UID mapping is via the
+ <span class="emphasis"><em>idmap uid, idmap gid</em></span> parameters in <tt class="filename">smb.conf</tt>.
+ Please refer to the man page for information about these parameters.
+ These parameters are essential when mapping users from a remote SAM server.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2891216"></a>Account Management Tools</h2></div></div><div></div></div><p>
+Samba-3 provides two (2) tools for management of User and machine accounts. These tools are
+called <tt class="filename">smbpasswd</tt> and <b class="command">pdbedit</b>. A third tool is under
+development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK
+GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will
+be announced in time for samba-3.0.1 release timing.
+</p><div xmlns:ns21="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2891247"></a>The <span class="emphasis"><em>smbpasswd</em></span> Command</h3></div></div><div></div></div><p>
+ The smbpasswd utility is a utility similar to the <b class="command">passwd</b>
+ or <b class="command">yppasswd</b> programs. It maintains the two 32 byte password
+ fields in the passdb backend.
+ </p><p>
+ <b class="command">smbpasswd</b> works in a client-server mode where it contacts the
+ local smbd to change the user's password on its behalf.This has enormous benefits
+ as follows:
+ </p><p>
+ <b class="command">smbpasswd</b> has the capability to change passwords on Windows NT
+ servers (this only works when the request is sent to the NT Primary Domain Controller
+ if changing an NT Domain user's password).
+ </p><p>
+ <b class="command">smbpasswd</b> can be used to:
+ </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="emphasis"><em>add</em></span> user or machine accounts</td></tr><tr><td><span class="emphasis"><em>delete</em></span> user or machine accounts</td></tr><tr><td><span class="emphasis"><em>enable</em></span> user or machine accounts</td></tr><tr><td><span class="emphasis"><em>disable</em></span> user or machine accounts</td></tr><tr><td><span class="emphasis"><em>set to NULL</em></span> user passwords</td></tr><tr><td><span class="emphasis"><em>manage interdomain trust accounts</em></span></td></tr></table><p>
+ To run smbpasswd as a normal user just type:
+ </p><ns21:p>
+ </ns21:p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>smbpasswd</tt></b>
+ <tt class="prompt">Old SMB password: </tt><b class="userinput"><tt><i class="replaceable"><tt>secret</tt></i></tt></b>
+ </pre><ns21:p>
+ For <i class="replaceable"><tt>secret</tt></i> type old value here - or hit return if
+ there was no old password
+ </ns21:p><pre class="screen">
+ <tt class="prompt">New SMB Password: </tt><b class="userinput"><tt><i class="replaceable"><tt>new secret</tt></i></tt></b>
+ <tt class="prompt">Repeat New SMB Password: </tt><b class="userinput"><tt><i class="replaceable"><tt>new secret</tt></i></tt></b>
+ </pre><ns21:p>
+ </ns21:p><p>
+ If the old value does not match the current value stored for that user, or the two
+ new values do not match each other, then the password will not be changed.
+ </p><p>
+ When invoked by an ordinary user it will only allow change of their own
+ SMB password.
+ </p><p>
+ When run by root smbpasswd may take an optional argument, specifying
+ the user name whose SMB password you wish to change. When run as root, smbpasswd
+ does not prompt for or check the old password value, thus allowing root to set passwords
+ for users who have forgotten their passwords.
+ </p><p>
+ <b class="command">smbpasswd</b> is designed to work in the way familiar to UNIX
+ users who use the <b class="command">passwd</b> or <b class="command">yppasswd</b> commands.
+ While designed for administrative use, this tool provides essential user level
+ password change capabilities.
+ </p><p>
+ For more details on using <b class="command">smbpasswd</b> refer to the man page (the
+ definitive reference).
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2891513"></a>The <span class="emphasis"><em>pdbedit</em></span> Command</h3></div></div><div></div></div><p>
+ <b class="command">pdbedit</b> is a tool that can be used only by root. It is used to
+ manage the passdb backend. <b class="command">pdbedit</b> can be used to:
+ </p><table class="simplelist" border="0" summary="Simple list"><tr><td>add, remove or modify user accounts</td></tr><tr><td>listing user accounts</td></tr><tr><td>migrate user accounts</td></tr></table><p>
+ The <b class="command">pdbedit</b> tool is the only one that can manage the account
+ security and policy settings. It is capable of all operations that smbpasswd can
+ do as well as a super set of them.
+ </p><p>
+ One particularly important purpose of the <b class="command">pdbedit</b> is to allow
+ the migration of account information from one passdb backend to another. See the
+ <a href="#XMLpassdb" title="XML">XML</a> password backend section of this chapter.
+ </p><p>
+ The following is an example of the user account information that is stored in
+ a tdbsam password backend. This listing was produced by running:
+ </p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>pdbedit -Lv met</tt></b>
+ Unix username: met
+ NT username:
+ Account Flags: [UX ]
+ User SID: S-1-5-21-1449123459-1407424037-3116680435-2004
+ Primary Group SID: S-1-5-21-1449123459-1407424037-3116680435-1201
+ Full Name: Melissa E Terpstra
+ Home Directory: \\frodo\met\Win9Profile
+ HomeDir Drive: H:
+ Logon Script: scripts\logon.bat
+ Profile Path: \\frodo\Profiles\met
+ Domain: MIDEARTH
+ Account desc:
+ Workstations: melbelle
+ Munged dial:
+ Logon time: 0
+ Logoff time: Mon, 18 Jan 2038 20:14:07 GMT
+ Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT
+ Password last set: Sat, 14 Dec 2002 14:37:03 GMT
+ Password can change: Sat, 14 Dec 2002 14:37:03 GMT
+ Password must change: Mon, 18 Jan 2038 20:14:07 GMT
+ </pre></div></div><div xmlns:ns22="" class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2891647"></a>Password Backends</h2></div></div><div></div></div><p>
+Samba-3 offers the greatest flexibility in backend account database design of any SMB/CIFS server
+technology available today. The flexibility is immediately obvious as one begins to explore this
+capability.
+</p><p>
+It is possible to specify not only multiple different password backends, but even multiple
+backends of the same type. For example, to use two different tdbsam databases:
+</p><ns22:p>
+</ns22:p><pre class="programlisting">
+[globals]
+ passdb backend = tdbsam:/etc/samba/passdb.tdb, \
+ tdbsam:/etc/samba/old-passdb.tdb, guest
+</pre><ns22:p>
+</ns22:p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2895859"></a>Plain Text</h3></div></div><div></div></div><p>
+ Older versions of samba retrieved user information from the unix user database
+ and eventually some other fields from the file <tt class="filename">/etc/samba/smbpasswd</tt>
+ or <tt class="filename">/etc/smbpasswd</tt>. When password encryption is disabled, no
+ SMB specific data is stored at all. Instead all operations are conduected via the way
+ that the samba host OS will access it's <tt class="filename">/etc/passwd</tt> database.
+ eg: On Linux systems that is done via PAM.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2895899"></a>smbpasswd - Encrypted Password Database</h3></div></div><div></div></div><p>
+ Traditionally, when configuring <a href="smb.conf.5.html#ENCRYPTPASSWORDS" target="_top">"encrypt
+ passwords = yes"</a> in Samba's <tt class="filename">smb.conf</tt> file, user account
+ information such as username, LM/NT password hashes, password change times, and account
+ flags have been stored in the <tt class="filename">smbpasswd(5)</tt> file. There are several
+ disadvantages to this approach for sites with very large numbers of users (counted
+ in the thousands).
+ </p><div class="itemizedlist"><ul type="disc"><li><p>
+ The first is that all lookups must be performed sequentially. Given that
+ there are approximately two lookups per domain logon (one for a normal
+ session connection such as when mapping a network drive or printer), this
+ is a performance bottleneck for large sites. What is needed is an indexed approach
+ such as is used in databases.
+ </p></li><li><p>
+ The second problem is that administrators who desire to replicate a smbpasswd file
+ to more than one Samba server were left to use external tools such as
+ <b class="command">rsync(1)</b> and <b class="command">ssh(1)</b> and wrote custom,
+ in-house scripts.
+ </p></li><li><p>
+ And finally, the amount of information which is stored in an smbpasswd entry leaves
+ no room for additional attributes such as a home directory, password expiration time,
+ or even a Relative Identifier (RID).
+ </p></li></ul></div><p>
+ As a result of these deficiencies, a more robust means of storing user attributes
+ used by smbd was developed. The API which defines access to user accounts
+ is commonly referred to as the samdb interface (previously this was called the passdb
+ API, and is still so named in the Samba CVS trees).
+ </p><p>
+ Samba-3 provides an enhanced set of passdb backends that overcome the deficiencies
+ of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam.
+ Of these ldapsam will be of most interest to large corporate or enterprise sites.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896006"></a>tdbsam</h3></div></div><div></div></div><p>Samba can store user and machine account data in a "TDB" (Trivial Database).
+ Using this backend doesn't require any additional configuration. This backend is
+ recommended for new installations that do not require LDAP.
+ </p><p>
+ As a general guide the Samba-Team do NOT recommend using the tdbsam backend for sites
+ that have 250 or more users. Additionally, tdbsam is not capable of scaling for use
+ in sites that require PDB/BDC implmentations that requires replication of the account
+ database. Clearly, for reason of scalability the use of ldapsam should be encouraged.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2896034"></a>ldapsam</h3></div></div><div></div></div><p>
+ There are a few points to stress that the ldapsam does not provide. The LDAP
+ support referred to in the this documentation does not include:
+ </p><div class="itemizedlist"><ul type="disc"><li><p>A means of retrieving user account information from
+ an Windows 200x Active Directory server.</p></li><li><p>A means of replacing /etc/passwd.</p></li></ul></div><p>
+ The second item can be accomplished by using LDAP NSS and PAM modules. LGPL
+ versions of these libraries can be obtained from PADL Software
+ (<a href="http://www.padl.com/" target="_top">http://www.padl.com/</a>). More
+ information about the configuration of these packages may be found at "LDAP,
+ System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS".
+ Refer to <a href="http://safari.oreilly.com/?XmlId=1-56592-491-6" target="_top">
+ http://safari.oreilly.com/?XmlId=1-56592-491-6</a> for those who might wish to know
+ more about configuration and administration of an OpenLDAP server.
+ </p><p>
+ This document describes how to use an LDAP directory for storing Samba user
+ account information traditionally stored in the smbpasswd(5) file. It is
+ assumed that the reader already has a basic understanding of LDAP concepts
+ and has a working directory server already installed. For more information
+ on LDAP architectures and Directories, please refer to the following sites.
+ </p><div class="itemizedlist"><ul type="disc"><li><p>OpenLDAP - <a href="http://www.openldap.org/" target="_top">http://www.openldap.org/</a></p></li><li><p>iPlanet Directory Server -
+ <a href="http://iplanet.netscape.com/directory" target="_top">http://iplanet.netscape.com/directory</a></p></li></ul></div><p>
+ Two additional Samba resources which may prove to be helpful are
+ </p><div class="itemizedlist"><ul type="disc"><li><p>The <a href="http://www.unav.es/cti/ldap-smb/ldap-smb-3-howto.html" target="_top">Samba-PDC-LDAP-HOWTO</a>
+ maintained by Ignacio Coupeau.</p></li><li><p>The NT migration scripts from <a href="http://samba.idealx.org/" target="_top">IDEALX</a> that are
+ geared to manage users and group in such a Samba-LDAP Domain Controller configuration.
+ </p></li></ul></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2896172"></a>Supported LDAP Servers</h4></div></div><div></div></div><p>
+ The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and
+ client libraries. The same code should work with Netscape's Directory Server and client SDK.
+ However, there are bound to be compile errors and bugs. These should not be hard to fix.
+ Please submit fixes via <a href="#bugreport" title="Chapter 35. Reporting Bugs">Bug reporting facility</a>.
+ </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2896197"></a>Schema and Relationship to the RFC 2307 posixAccount</h4></div></div><div></div></div><p>
+ Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in
+ <tt class="filename">examples/LDAP/samba.schema</tt>. The sambaAccount objectclass is given here:
+ </p><ns22:p>
+</ns22:p><pre class="programlisting">
+objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY
+ DESC 'Samba Auxilary Account'
+ MUST ( uid $ rid )
+ MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
+ logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
+ displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
+ description $ userWorkstations $ primaryGroupID $ domain ))
+</pre><ns22:p>
+</ns22:p><p>
+ The <tt class="filename">samba.schema</tt> file has been formatted for OpenLDAP 2.0/2.1.
+ The OID's are owned by the Samba Team and as such is legal to be openly published.
+ If you translate the schema to be used with Netscape DS, please
+ submit the modified schema file as a patch to
+ <a href="mailto:jerry@samba.org" target="_top">jerry@samba.org</a>.
+ </p><p>
+ Just as the smbpasswd file is meant to store information which supplements a
+ user's <tt class="filename">/etc/passwd</tt> entry, so is the sambaAccount object
+ meant to supplement the UNIX user account information. A sambaAccount is a
+ <tt class="constant">STRUCTURAL</tt> objectclass so it can be stored individually
+ in the directory. However, there are several fields (e.g. uid) which overlap
+ with the posixAccount objectclass outlined in RFC2307. This is by design.
+ </p><p>
+ In order to store all user account information (UNIX and Samba) in the directory,
+ it is necessary to use the sambaAccount and posixAccount objectclasses in
+ combination. However, smbd will still obtain the user's UNIX account
+ information via the standard C library calls (e.g. getpwnam(), et. al.).
+ This means that the Samba server must also have the LDAP NSS library installed
+ and functioning correctly. This division of information makes it possible to
+ store all Samba account information in LDAP, but still maintain UNIX account
+ information in NIS while the network is transitioning to a full LDAP infrastructure.
+ </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2896306"></a>OpenLDAP configuration</h4></div></div><div></div></div><p>
+ To include support for the sambaAccount object in an OpenLDAP directory
+ server, first copy the samba.schema file to slapd's configuration directory.
+ The samba.schema file can be found in the directory <tt class="filename">examples/LDAP</tt>
+ in the samba source distribution.
+ </p><ns22:p>
+</ns22:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>cp samba.schema /etc/openldap/schema/</tt></b>
+</pre><ns22:p>
+</ns22:p><p>
+ Next, include the <tt class="filename">samba.schema</tt> file in <tt class="filename">slapd.conf</tt>.
+ The sambaAccount object contains two attributes which depend upon other schema
+ files. The 'uid' attribute is defined in <tt class="filename">cosine.schema</tt> and
+ the 'displayName' attribute is defined in the <tt class="filename">inetorgperson.schema</tt>
+ file. Both of these must be included before the <tt class="filename">samba.schema</tt> file.
+ </p><ns22:p>
+</ns22:p><pre class="programlisting">
+## /etc/openldap/slapd.conf
+
+## schema files (core.schema is required by default)
+include /etc/openldap/schema/core.schema
+
+## needed for sambaAccount
+include /etc/openldap/schema/cosine.schema
+include /etc/openldap/schema/inetorgperson.schema
+include /etc/openldap/schema/samba.schema
+include /etc/openldap/schema/nis.schema
+....
+</pre><ns22:p>
+</ns22:p><p>
+ It is recommended that you maintain some indices on some of the most usefull attributes,
+ like in the following example, to speed up searches made on sambaAccount objectclasses
+ (and possibly posixAccount and posixGroup as well).
+ </p><ns22:p>
+</ns22:p><pre class="screen">
+# Indices to maintain
+## required by OpenLDAP
+index objectclass eq
+
+index cn pres,sub,eq
+index sn pres,sub,eq
+## required to support pdb_getsampwnam
+index uid pres,sub,eq
+## required to support pdb_getsambapwrid()
+index displayName pres,sub,eq
+
+## uncomment these if you are storing posixAccount and
+## posixGroup entries in the directory as well
+##index uidNumber eq
+##index gidNumber eq
+##index memberUid eq
+
+index sambaSID eq
+index sambaPrimaryGroupSID eq
+index sambaDomainName eq
+index default sub
+</pre><ns22:p>
+</ns22:p><p>
+ Create the new index by executing:
+ </p><ns22:p>
+</ns22:p><pre class="screen">
+./sbin/slapindex -f slapd.conf
+</pre><ns22:p>
+</ns22:p><p>
+ Remember to restart slapd after making these changes:
+ </p><ns22:p>
+</ns22:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>/etc/init.d/slapd restart</tt></b>
+</pre><ns22:p>
+</ns22:p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2896493"></a>Initialise the LDAP database</h4></div></div><div></div></div><p>
+ Before you can add accounts to the LDAP database you must create the account containers
+ that they will be stored in. The following LDIF file should be modified to match your
+ needs (ie: Your DNS entries, etc.).
+ </p><ns22:p>
+</ns22:p><pre class="screen">
+# Organization for Samba Base
+dn: dc=plainjoe,dc=org
+objectclass: dcObject
+objectclass: organization
+dc: plainjoe
+o: Terpstra Org Network
+description: The Samba-3 Network LDAP Example
+
+# Organizational Role for Directory Management
+dn: cn=Manager,dc=plainjoe,dc=org
+objectclass: organizationalRole
+cn: Manager
+description: Directory Manager
+
+# Setting up container for users
+dn: ou=People,dc=plainjoe,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: People
+
+# Setting up admin handle for People OU
+dn: cn=admin,ou=People,dc=plainjoe,dc=org
+cn: admin
+objectclass: top
+objectclass: organizationalRole
+objectclass: simpleSecurityObject
+userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz
+</pre><ns22:p>
+</ns22:p><p>
+ The userPassword shown above should be generated using <b class="command">slappasswd</b>.
+ </p><p>
+ The following command will then load the contents of the LDIF file into the LDAP
+ database.
+ </p><ns22:p>
+</ns22:p><pre class="screen">
+<tt class="prompt">$ </tt><b class="userinput"><tt>slapadd -v -l initldap.dif</tt></b>
+</pre><ns22:p>
+</ns22:p><p>
+ Do not forget to secure your LDAP server with an adequate access control list,
+ as well as an admin password.
+ </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><ns22:p>
+ Before Samba can access the LDAP server you need to stoe the LDAP admin password
+ into the Samba-3 <tt class="filename">secrets.tdb</tt> database by:
+ </ns22:p><pre class="screen">
+<tt class="prompt">root# </tt> <b class="userinput"><tt>smbpasswd -w <i class="replaceable"><tt>secret</tt></i></tt></b>
+ </pre><ns22:p>
+ </ns22:p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2896622"></a>Configuring Samba</h4></div></div><div></div></div><p>
+ The following parameters are available in smb.conf only if your
+ version of samba was built with LDAP support. Samba automatically builds with LDAP support if the
+ LDAP libraries are found.
+ </p><div class="itemizedlist"><ul type="disc"><li><p><a href="smb.conf.5.html#PASSDBBACKEND" target="_top">passdb backend = ldapsam:url</a></p></li><li><p><a href="smb.conf.5.html#LDAPSSL" target="_top">ldap ssl</a></p></li><li><p><a href="smb.conf.5.html#LDAPADMINDN" target="_top">ldap admin dn</a></p></li><li><p><a href="smb.conf.5.html#LDAPSUFFIX" target="_top">ldap suffix</a></p></li><li><p><a href="smb.conf.5.html#LDAPFILTER" target="_top">ldap filter</a></p></li><li><p><a href="smb.conf.5.html#LDAPMACHINSUFFIX" target="_top">ldap machine suffix</a></p></li><li><p><a href="smb.conf.5.html#LDAPUSERSUFFIX" target="_top">ldap user suffix</a></p></li><li><p><a href="smb.conf.5.html#LDAPDELETEDN" target="_top">ldap delete dn</a></p></li><li><p><a href="smb.conf.5.html#LDAPPASSWDSYNC" target="_top">ldap passwd sync</a></p></li><li><p><a href="smb.conf.5.html#LDAPTRUSTIDS" target="_top">ldap trust ids</a></p></li></ul></div><p>
+ These are described in the <tt class="filename">smb.conf</tt> man
+ page and so will not be repeated here. However, a sample smb.conf file for
+ use with an LDAP directory could appear as
+ </p><ns22:p>
+</ns22:p><pre class="programlisting">
+## /usr/local/samba/lib/smb.conf
+[global]
+ security = user
+ encrypt passwords = yes
+
+ netbios name = TASHTEGO
+ workgroup = NARNIA
+
+ # ldap related parameters
+
+ # define the DN to use when binding to the directory servers
+ # The password for this DN is not stored in smb.conf. Rather it
+ # must be set by using 'smbpasswd -w <i class="replaceable"><tt>secretpw</tt></i>' to store the
+ # passphrase in the secrets.tdb file. If the "ldap admin dn" values
+ # change, this password will need to be reset.
+ ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
+
+ # Define the SSL option when connecting to the directory
+ # ('off', 'start tls', or 'on' (default))
+ ldap ssl = start tls
+
+ # syntax: passdb backend = ldapsam:ldap://server-name[:port]
+ passdb backend = ldapsam:ldap://funball.samba.org, guest
+
+ # smbpasswd -x delete the entire dn-entry
+ ldap delete dn = no
+
+ # the machine and user suffix added to the base suffix
+ # wrote WITHOUT quotes. NULL siffixes by default
+ ldap user suffix = ou=People
+ ldap machine suffix = ou=Systems
+
+ # Trust unix account information in LDAP
+ # (see the smb.conf manpage for details)
+ ldap trust ids = Yes
+
+ # specify the base DN to use when searching the directory
+ ldap suffix = "ou=people,dc=samba,dc=org"
+
+ # generally the default ldap search filter is ok
+ # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))"
+</pre><ns22:p>
+</ns22:p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2896800"></a>Accounts and Groups management</h4></div></div><div></div></div><p>
+ As users accounts are managed thru the sambaAccount objectclass, you should
+ modify your existing administration tools to deal with sambaAccount attributes.
+ </p><p>
+ Machines accounts are managed with the sambaAccount objectclass, just
+ like users accounts. However, it's up to you to store thoses accounts
+ in a different tree of your LDAP namespace: you should use
+ "ou=Groups,dc=plainjoe,dc=org" to store groups and
+ "ou=People,dc=plainjoe,dc=org" to store users. Just configure your
+ NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration
+ file).
+ </p><p>
+ In Samba release 3.0, the group management system is based on posix
+ groups. This means that Samba makes usage of the posixGroup objectclass.
+ For now, there is no NT-like group system management (global and local
+ groups).
+ </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2896837"></a>Security and sambaAccount</h4></div></div><div></div></div><p>
+ There are two important points to remember when discussing the security
+ of sambaAccount entries in the directory.
+ </p><div class="itemizedlist"><ul type="disc"><li><p><span class="emphasis"><em>Never</em></span> retrieve the lmPassword or
+ ntPassword attribute values over an unencrypted LDAP session.</p></li><li><p><span class="emphasis"><em>Never</em></span> allow non-admin users to
+ view the lmPassword or ntPassword attribute values.</p></li></ul></div><p>
+ These password hashes are clear text equivalents and can be used to impersonate
+ the user without deriving the original clear text strings. For more information
+ on the details of LM/NT password hashes, refer to the
+ <a href="#passdb" title="Chapter 11. Account Information Databases">Account Information Database</a> section of this chapter.
+ </p><p>
+ To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults
+ to require an encrypted session (<i class="parameter"><tt>ldap ssl = on</tt></i>) using
+ the default port of <tt class="constant">636</tt>
+ when contacting the directory server. When using an OpenLDAP server, it
+ is possible to use the use the StartTLS LDAP extended operation in the place of
+ LDAPS. In either case, you are strongly discouraged to disable this security
+ (<i class="parameter"><tt>ldap ssl = off</tt></i>).
+ </p><p>
+ Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS
+ extended operation. However, the OpenLDAP library still provides support for
+ the older method of securing communication between clients and servers.
+ </p><p>
+ The second security precaution is to prevent non-administrative users from
+ harvesting password hashes from the directory. This can be done using the
+ following ACL in <tt class="filename">slapd.conf</tt>:
+ </p><ns22:p>
+</ns22:p><pre class="programlisting">
+## allow the "ldap admin dn" access, but deny everyone else
+access to attrs=lmPassword,ntPassword
+ by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write
+ by * none
+</pre><ns22:p>
+</ns22:p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2896958"></a>LDAP special attributes for sambaAccounts</h4></div></div><div></div></div><p>
+ The sambaAccount objectclass is composed of the following attributes:
+ </p><ns22:p>
+ </ns22:p><div class="table"><a name="id2896974"></a><p class="title"><b>Table 11.1. Attributes in the sambaAccount objectclass (LDAP)</b></p><table summary="Attributes in the sambaAccount objectclass (LDAP)" border="1"><colgroup><col><col></colgroup><tbody><tr><td align="left"><tt class="constant">lmPassword</tt></td><td align="left">the LANMAN password 16-byte hash stored as a character
+ representation of a hexidecimal string.</td></tr><tr><td align="left"><tt class="constant">ntPassword</tt></td><td align="left">the NT password hash 16-byte stored as a character
+ representation of a hexidecimal string.</td></tr><tr><td align="left"><tt class="constant">pwdLastSet</tt></td><td align="left">The integer time in seconds since 1970 when the
+ <tt class="constant">lmPassword</tt> and <tt class="constant">ntPassword</tt> attributes were last set.
+ </td></tr><tr><td align="left"><tt class="constant">acctFlags</tt></td><td align="left">string of 11 characters surrounded by square brackets []
+ representing account flags such as U (user), W(workstation), X(no password expiration),
+ I(Domain trust account), H(Home dir required), S(Server trust account),
+ and D(disabled).</td></tr><tr><td align="left"><tt class="constant">logonTime</tt></td><td align="left">Integer value currently unused</td></tr><tr><td align="left"><tt class="constant">logoffTime</tt></td><td align="left">Integer value currently unused</td></tr><tr><td align="left"><tt class="constant">kickoffTime</tt></td><td align="left">Integer value currently unused</td></tr><tr><td align="left"><tt class="constant">pwdCanChange</tt></td><td align="left">Integer value currently unused</td></tr><tr><td align="left"><tt class="constant">pwdMustChange</tt></td><td align="left">Integer value currently unused</td></tr><tr><td align="left"><tt class="constant">homeDrive</tt></td><td align="left">specifies the drive letter to which to map the
+ UNC path specified by homeDirectory. The drive letter must be specified in the form "X:"
+ where X is the letter of the drive to map. Refer to the "logon drive" parameter in the
+ smb.conf(5) man page for more information.</td></tr><tr><td align="left"><tt class="constant">scriptPath</tt></td><td align="left">The scriptPath property specifies the path of
+ the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path
+ is relative to the netlogon share. Refer to the "logon script" parameter in the
+ smb.conf(5) man page for more information.</td></tr><tr><td align="left"><tt class="constant">profilePath</tt></td><td align="left">specifies a path to the user's profile.
+ This value can be a null string, a local absolute path, or a UNC path. Refer to the
+ "logon path" parameter in the smb.conf(5) man page for more information.</td></tr><tr><td align="left"><tt class="constant">smbHome</tt></td><td align="left">The homeDirectory property specifies the path of
+ the home directory for the user. The string can be null. If homeDrive is set and specifies
+ a drive letter, homeDirectory should be a UNC path. The path must be a network
+ UNC path of the form <tt class="filename">\\server\share\directory</tt>. This value can be a null string.
+ Refer to the <b class="command">logon home</b> parameter in the <tt class="filename">smb.conf</tt> man page for more information.
+ </td></tr><tr><td align="left"><tt class="constant">userWorkstation</tt></td><td align="left">character string value currently unused.
+ </td></tr><tr><td align="left"><tt class="constant">rid</tt></td><td align="left">the integer representation of the user's relative identifier
+ (RID).</td></tr><tr><td align="left"><tt class="constant">primaryGroupID</tt></td><td align="left">the relative identifier (RID) of the primary group
+ of the user.</td></tr><tr><td align="left"><tt class="constant">domain</tt></td><td align="left">domain the user is part of.</td></tr></tbody></table></div><ns22:p>
+ </ns22:p><p>
+ The majority of these parameters are only used when Samba is acting as a PDC of
+ a domain (refer to the <a href="#samba-pdc" title="Chapter 5. Domain Control">Samba as a primary domain controller</a> chapter for details on
+ how to configure Samba as a Primary Domain Controller). The following four attributes
+ are only stored with the sambaAccount entry if the values are non-default values:
+ </p><table class="simplelist" border="0" summary="Simple list"><tr><td>smbHome</td></tr><tr><td>scriptPath</td></tr><tr><td>logonPath</td></tr><tr><td>homeDrive</td></tr></table><p>
+ These attributes are only stored with the sambaAccount entry if
+ the values are non-default values. For example, assume TASHTEGO has now been
+ configured as a PDC and that <i class="parameter"><tt>logon home = \\%L\%u</tt></i> was defined in
+ its <tt class="filename">smb.conf</tt> file. When a user named "becky" logons to the domain,
+ the <i class="parameter"><tt>logon home</tt></i> string is expanded to \\TASHTEGO\becky.
+ If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org",
+ this value is used. However, if this attribute does not exist, then the value
+ of the <i class="parameter"><tt>logon home</tt></i> parameter is used in its place. Samba
+ will only write the attribute value to the directory entry if the value is
+ something other than the default (e.g. <tt class="filename">\\MOBY\becky</tt>).
+ </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2897322"></a>Example LDIF Entries for a sambaAccount</h4></div></div><div></div></div><p>
+ The following is a working LDIF with the inclusion of the posixAccount objectclass:
+ </p><ns22:p>
+ </ns22:p><pre class="programlisting">
+ dn: uid=guest2, ou=people,dc=plainjoe,dc=org
+ ntPassword: 878D8014606CDA29677A44EFA1353FC7
+ pwdMustChange: 2147483647
+ primaryGroupID: 1201
+ lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+ pwdLastSet: 1010179124
+ logonTime: 0
+ objectClass: sambaAccount
+ uid: guest2
+ kickoffTime: 2147483647
+ acctFlags: [UX ]
+ logoffTime: 2147483647
+ rid: 19006
+ pwdCanChange: 0
+ </pre><ns22:p>
+ </ns22:p><p>
+ The following is an LDIF entry for using both the sambaAccount and
+ posixAccount objectclasses:
+ </p><ns22:p>
+ </ns22:p><pre class="programlisting">
+ dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
+ logonTime: 0
+ displayName: Gerald Carter
+ lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+ primaryGroupID: 1201
+ objectClass: posixAccount
+ objectClass: sambaAccount
+ acctFlags: [UX ]
+ userPassword: {crypt}BpM2ej8Rkzogo
+ uid: gcarter
+ uidNumber: 9000
+ cn: Gerald Carter
+ loginShell: /bin/bash
+ logoffTime: 2147483647
+ gidNumber: 100
+ kickoffTime: 2147483647
+ pwdLastSet: 1010179230
+ rid: 19000
+ homeDirectory: /home/tashtego/gcarter
+ pwdCanChange: 0
+ pwdMustChange: 2147483647
+ ntPassword: 878D8014606CDA29677A44EFA1353FC7
+</pre><ns22:p>
+ </ns22:p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2897383"></a>Password synchronisation</h4></div></div><div></div></div><p>
+ Since version 3.0 samba can update the non-samba (LDAP) password stored with an account. When
+ using pam_ldap, this allows changing both unix and windows passwords at once.
+ </p><p>The <i class="parameter"><tt>ldap passwd sync</tt></i> options can have the following values:</p><div class="variablelist"><dl><dt><span class="term">yes</span></dt><dd><p>When the user changes his password, update
+ <tt class="constant">ntPassword</tt>, <tt class="constant">lmPassword</tt>
+ and the <tt class="constant">password</tt> fields.</p></dd><dt><span class="term">no</span></dt><dd><p>Only update <tt class="constant">ntPassword</tt> and <tt class="constant">lmPassword</tt>.</p></dd><dt><span class="term">only</span></dt><dd><p>Only update the LDAP password and let the LDAP server worry
+ about the other fields. This option is only available when
+ the LDAP library supports LDAP_EXOP_X_MODIFY_PASSWD. </p></dd></dl></div><p>More information can be found in the <a href="smb.conf.5.html#LDAPPASSWDSYNC" target="_top">smb.conf</a> manpage.
+ </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2897495"></a>ldap trust ids</h4></div></div><div></div></div><p>
+ LDAP Performance can be improved by using the <b class="command">ldap trust ids</b> parameter.
+ See the <a href="smb.conf.5.html#LDAPTRUSTIDS" target="_top">smb.conf</a> manpage for details.
+ </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2897524"></a>MySQL</h3></div></div><div></div></div><p>
+ Every so often someone will come along with a great new idea. Storing of user accounts in an
+ SQL backend is one of them. Those who want to do this are in the best position to know what the
+ specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt
+ to document every nitty little detail why certain things of marginal utility to the bulk of
+ Samba users might make sense to the rest. In any case, the following instructions should help
+ the determined SQL user to implement a working system.
+ </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2897546"></a>Creating the database</h4></div></div><div></div></div><ns22:p>
+ You either can set up your own table and specify the field names to pdb_mysql (see below
+ for the column names) or use the default table. The file <tt class="filename">examples/pdb/mysql/mysql.dump</tt>
+ contains the correct queries to create the required tables. Use the command :
+
+ </ns22:p><pre class="screen"><tt class="prompt">$ </tt><b class="userinput"><tt>mysql -u<i class="replaceable"><tt>username</tt></i> -h<i class="replaceable"><tt>hostname</tt></i> -p<i class="replaceable"><tt>password</tt></i> <i class="replaceable"><tt>databasename</tt></i> > <tt class="filename">/path/to/samba/examples/pdb/mysql/mysql.dump</tt></tt></b></pre><ns22:p>
+ </ns22:p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2897609"></a>Configuring</h4></div></div><div></div></div><p>This plugin lacks some good documentation, but here is some short info:</p><ns22:p>Add a the following to the <i class="parameter"><tt>passdb backend</tt></i> variable in your <tt class="filename">smb.conf</tt>:
+ </ns22:p><pre class="programlisting">
+ passdb backend = [other-plugins] mysql:identifier [other-plugins]
+ </pre><ns22:p>
+ </ns22:p><p>The identifier can be any string you like, as long as it doesn't collide with
+ the identifiers of other plugins or other instances of pdb_mysql. If you
+ specify multiple pdb_mysql.so entries in <i class="parameter"><tt>passdb backend</tt></i>, you also need to
+ use different identifiers!
+ </p><p>
+ Additional options can be given thru the <tt class="filename">smb.conf</tt> file in the <i class="parameter"><tt>[global]</tt></i> section.
+ </p><ns22:p>
+ </ns22:p><div class="table"><a name="id2897685"></a><p class="title"><b>Table 11.2. Basic smb.conf options for MySQL passdb backend</b></p><table summary="Basic smb.conf options for MySQL passdb backend" border="1"><colgroup><col><col></colgroup><thead><tr><th align="left">Field</th><th align="left">Contents</th></tr></thead><tbody><tr><td align="left">identifier:mysql host</td><td align="left">host name, defaults to 'localhost'</td></tr><tr><td align="left">identifier:mysql password</td><td align="left"> </td></tr><tr><td align="left">identifier:mysql user</td><td align="left">defaults to 'samba'</td></tr><tr><td align="left">identifier:mysql database</td><td align="left">defaults to 'samba'</td></tr><tr><td align="left">identifier:mysql port</td><td align="left">defaults to 3306</td></tr><tr><td align="left">identifier:table</td><td align="left">Name of the table containing users</td></tr></tbody></table></div><ns22:p>
+ </ns22:p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+ Since the password for the mysql user is stored in the
+ <tt class="filename">smb.conf</tt> file, you should make the the <tt class="filename">smb.conf</tt> file
+ readable only to the user that runs samba. This is considered a security
+ bug and will be fixed soon.
+ </p></div><p>Names of the columns in this table(I've added column types those columns should have first):</p><ns22:p>
+ </ns22:p><div class="table"><a name="id2897810"></a><p class="title"><b>Table 11.3. MySQL field names for MySQL passdb backend</b></p><table summary="MySQL field names for MySQL passdb backend" border="1"><colgroup><col><col><col></colgroup><thead><tr><th align="left">Field</th><th align="left">Type</th><th align="left">Contents</th></tr></thead><tbody><tr><td align="left">identifier:logon time column</td><td align="left">int(9)</td><td align="left"> </td></tr><tr><td align="left">identifier:logoff time column</td><td align="left">int(9)</td><td align="left"> </td></tr><tr><td align="left">identifier:kickoff time column</td><td align="left">int(9)</td><td align="left"> </td></tr><tr><td align="left">identifier:pass last set time column</td><td align="left">int(9)</td><td align="left"> </td></tr><tr><td align="left">identifier:pass can change time column</td><td align="left">int(9)</td><td align="left"> </td></tr><tr><td align="left">identifier:pass must change time column</td><td align="left">int(9)</td><td align="left"> </td></tr><tr><td align="left">identifier:username column</td><td align="left">varchar(255)</td><td align="left">unix username</td></tr><tr><td align="left">identifier:domain column</td><td align="left">varchar(255)</td><td align="left">NT domain user is part of</td></tr><tr><td align="left">identifier:nt username column</td><td align="left">varchar(255)</td><td align="left">NT username</td></tr><tr><td align="left">identifier:fullname column</td><td align="left">varchar(255)</td><td align="left">Full name of user</td></tr><tr><td align="left">identifier:home dir column</td><td align="left">varchar(255)</td><td align="left">Unix homedir path</td></tr><tr><td align="left">identifier:dir drive column</td><td align="left">varchar(2)</td><td align="left">Directory drive path (eg: 'H:')</td></tr><tr><td align="left">identifier:logon script column</td><td align="left">varchar(255)</td><td align="left">Batch file to run on client side when logging on</td></tr><tr><td align="left">identifier:profile path column</td><td align="left">varchar(255)</td><td align="left">Path of profile</td></tr><tr><td align="left">identifier:acct desc column</td><td align="left">varchar(255)</td><td align="left">Some ASCII NT user data</td></tr><tr><td align="left">identifier:workstations column</td><td align="left">varchar(255)</td><td align="left">Workstations user can logon to (or NULL for all)</td></tr><tr><td align="left">identifier:unknown string column</td><td align="left">varchar(255)</td><td align="left">unknown string</td></tr><tr><td align="left">identifier:munged dial column</td><td align="left">varchar(255)</td><td align="left">?</td></tr><tr><td align="left">identifier:user sid column</td><td align="left">varchar(255)</td><td align="left">NT user SID</td></tr><tr><td align="left">identifier:group sid column</td><td align="left">varchar(255)</td><td align="left">NT group ID</td></tr><tr><td align="left">identifier:lanman pass column</td><td align="left">varchar(255)</td><td align="left">encrypted lanman password</td></tr><tr><td align="left">identifier:nt pass column</td><td align="left">varchar(255)</td><td align="left">encrypted nt passwd</td></tr><tr><td align="left">identifier:plain pass column</td><td align="left">varchar(255)</td><td align="left">plaintext password</td></tr><tr><td align="left">identifier:acct control column</td><td align="left">int(9)</td><td align="left">nt user data</td></tr><tr><td align="left">identifier:unknown 3 column</td><td align="left">int(9)</td><td align="left">unknown</td></tr><tr><td align="left">identifier:logon divs column</td><td align="left">int(9)</td><td align="left">?</td></tr><tr><td align="left">identifier:hours len column</td><td align="left">int(9)</td><td align="left">?</td></tr><tr><td align="left">identifier:unknown 5 column</td><td align="left">int(9)</td><td align="left">unknown</td></tr><tr><td align="left">identifier:unknown 6 column</td><td align="left">int(9)</td><td align="left">unknown</td></tr></tbody></table></div><ns22:p>
+ </ns22:p><p>
+ Eventually, you can put a colon (:) after the name of each column, which
+ should specify the column to update when updating the table. You can also
+ specify nothing behind the colon - then the data from the field will not be
+ updated.
+ </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2898192"></a>Using plaintext passwords or encrypted password</h4></div></div><div></div></div><p>
+ I strongly discourage the use of plaintext passwords, however, you can use them:
+ </p><p>
+ If you would like to use plaintext passwords, set
+ 'identifier:lanman pass column' and 'identifier:nt pass column' to
+ 'NULL' (without the quotes) and 'identifier:plain pass column' to the
+ name of the column containing the plaintext passwords.
+ </p><p>
+ If you use encrypted passwords, set the 'identifier:plain pass
+ column' to 'NULL' (without the quotes). This is the default.
+ </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2898222"></a>Getting non-column data from the table</h4></div></div><div></div></div><p>
+ It is possible to have not all data in the database and making some 'constant'.
+ </p><p>
+ For example, you can set 'identifier:fullname column' to :
+ <b class="command">CONCAT(First_name,' ',Sur_name)</b>
+ </p><p>
+ Or, set 'identifier:workstations column' to :
+ <b class="command">NULL</b></p><p>See the MySQL documentation for more language constructs.</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="XMLpassdb"></a>XML</h3></div></div><div></div></div><p>This module requires libxml2 to be installed.</p><p>The usage of pdb_xml is pretty straightforward. To export data, use:
+ </p><p>
+ <tt class="prompt">$ </tt><b class="userinput"><tt>pdbedit -e xml:filename</tt></b>
+ </p><p>
+ (where filename is the name of the file to put the data in)
+ </p><p>
+ To import data, use:
+ <tt class="prompt">$ </tt><b class="userinput"><tt>pdbedit -i xml:filename</tt></b>
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2898328"></a>Common Errors</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2898335"></a>Users can not logon - Users not in Samba SAM</h3></div></div><div></div></div><p>
+ People forget to put their users in their backend and then complain samba won't authorize them.
+ </p></div><div xmlns:ns23="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2898350"></a>Users are being added to the wrong backend database</h3></div></div><div></div></div><p>
+ A few complaints have been recieved from users that just moved to samba-3. The following
+ <tt class="filename">smb.conf</tt> file entries were causing problems, new accounts were being added to the old
+ smbpasswd file, not to the tdbsam passdb.tdb file:
+ </p><ns23:p>
+ </ns23:p><pre class="programlisting">
+ [globals]
+ ...
+ passdb backend = smbpasswd, tdbsam, guest
+ ...
+ </pre><ns23:p>
+ </ns23:p><p>
+ Samba will add new accounts to the first entry in the <span class="emphasis"><em>passdb backend</em></span>
+ parameter entry. If you want to update to the tdbsam, then change the entry to:
+ </p><ns23:p>
+ </ns23:p><pre class="programlisting">
+ [globals]
+ ...
+ passdb backend = tdbsam, smbpasswd, guest
+ ...
+ </pre><ns23:p>
+ </ns23:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2898409"></a>auth methods does not work</h3></div></div><div></div></div><p>
+ If you explicitly set an 'auth methods' parameter, guest must be specified as the first
+ entry on the line. Eg: <i class="parameter"><tt>auth methods = guest sam</tt></i>.
+ </p><p>
+ This is the exact opposite of the requirement for the <i class="parameter"><tt>passdb backed</tt></i>
+ option, where it must be the <span class="emphasis"><em>LAST</em></span> parameter on the line.
+ </p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="groupmapping"></a>Chapter 12. Mapping MS Windows and Unix Groups</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jean François</span> <span class="surname">Micouleau</span></h3></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jerry@samba.org">jerry@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2898582">Features and Benefits</a></dt><dt><a href="#id2898682">Discussion</a></dt><dd><dl><dt><a href="#id2898871">Example Configuration</a></dt></dl></dd><dt><a href="#id2898936">Configuration Scripts</a></dt><dd><dl><dt><a href="#id2898950">Sample smb.conf add group script</a></dt><dt><a href="#id2899017">Script to configure Group Mapping</a></dt></dl></dd><dt><a href="#id2899091">Common Errors</a></dt><dd><dl><dt><a href="#id2899107">Adding Groups Fails</a></dt><dt><a href="#id2899167">Adding MS Windows Groups to MS Windows Groups Fails</a></dt></dl></dd></dl></div><p>
+ Starting with Samba-3, new group mapping functionality is available to create associations
+ between Windows group SIDs and UNIX groups. The <i class="parameter"><tt>groupmap</tt></i> subcommand
+ included with the <span class="application">net</span> tool can be used to manage these associations.
+ </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+ The first immediate reason to use the group mapping on a Samba PDC, is that
+ the <i class="parameter"><tt>domain admin group</tt></i> has been removed and should no longer
+ be specified in <tt class="filename">smb.conf</tt>. This parameter was used to give the listed users membership
+ in the <tt class="constant">Domain Admins</tt> Windows group which gave local admin rights on their workstations
+ (in default configurations).
+ </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2898582"></a>Features and Benefits</h2></div></div><div></div></div><p>
+ Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to
+ arbitrarily associate them with Unix/Linux group accounts.
+ </p><p>
+ Group accounts can be managed using the MS Windows NT4 or MS Windows 200x MMC tools
+ so long as appropriate interface scripts have been provided to <tt class="filename">smb.conf</tt>
+ </p><p>
+ Administrators should be aware that where <tt class="filename">smb.conf</tt> group interface scripts make
+ direct calls to the Unix/Linux system tools (eg: the shadow utilities, <b class="command">groupadd</b>,
+ <b class="command">groupdel</b>, <b class="command">groupmod</b>) then the resulting Unix/Linux group names will be subject
+ to any limits imposed by these tools. If the tool does NOT allow upper case characters
+ or space characters, then the creation of an MS Windows NT4 / 200x style group of
+ <i class="parameter"><tt>Engineering Managers</tt></i> will attempt to create an identically named
+ Unix/Linux group, an attempt that will of course fail!
+ </p><p>
+ There are several possible work-arounds for the operating system tools limitation. One
+ method is to use a script that generates a name for the Unix/Linux system group that
+ fits the operating system limits, and that then just passes the Unix/Linux group id (GID)
+ back to the calling samba interface. This will provide a dynamic work-around solution.
+ </p><p>
+ Another work-around is to manually create a Unix/Linux group, then manually create the
+ MS Windows NT4 / 200x group on the Samba server and then use the <b class="command">net groupmap</b>
+ tool to connect the two to each other.
+ </p></div><div xmlns:ns26="" class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2898682"></a>Discussion</h2></div></div><div></div></div><p>
+ When installing <span class="application">MS Windows NT4 / 200x</span> on a computer, the installation
+ program creates default users and groups. Notably the <tt class="constant">Administrators</tt> group,
+ and gives to that group privileges necessary privilidges to perform essential system tasks.
+ eg: Ability to change the date and time or to kill any process (or close too) running on the
+ local machine.
+ </p><p>
+ The 'Administrator' user is a member of the 'Administrators' group, and thus inherits
+ 'Administrators' group privileges. If a 'joe' user is created to be a member of the
+ 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'.
+ </p><p>
+ When an MS Windows NT4 / W200x is made a domain member, the "Domain Adminis" group of the
+ PDC is added to the local 'Administrators' group of the workstation. Every member of the
+ 'Domain Administrators' group inherits the rights of the local 'Administrators' group when
+ logging on the workstation.
+ </p><p>
+ The following steps describe how to make samba PDC users members of the 'Domain Admins' group?
+ </p><div class="orderedlist"><ol type="1"><li><p>
+ create a unix group (usually in <tt class="filename">/etc/group</tt>), let's call it domadm
+ </p></li><li xmlns:ns24=""><p>add to this group the users that must be Administrators. For example
+ if you want joe,john and mary, your entry in <tt class="filename">/etc/group</tt> will
+ look like:
+ </p><pre class="programlisting">
+ domadm:x:502:joe,john,mary
+ </pre><ns24:p>
+ </ns24:p></li><li xmlns:ns25=""><p>
+ Map this domadm group to the "Domain Admins" group by running the command:
+ </p><ns25:p>
+ </ns25:p><pre class="screen">
+ <tt class="prompt">root# </tt><b class="userinput"><tt>net groupmap add ntgroup="Domain Admins" unixgroup=domadm</tt></b>
+ </pre><ns25:p>
+ </ns25:p><p>
+ The quotes around "Domain Admins" are necessary due to the space in the group name.
+ Also make sure to leave no whitespace surrounding the equal character (=).
+ </p></li></ol></div><p>
+ Now joe, john and mary are domain administrators!
+ </p><p>
+ It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as
+ making any UNIX group a Windows domain group. For example, if you wanted to include a
+ UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine,
+ you would flag that group as a domain group by running the following on the Samba PDC:
+ </p><ns26:p>
+ </ns26:p><pre class="screen">
+ <tt class="prompt">root# </tt><b class="userinput"><tt>net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct</tt></b>
+ </pre><ns26:p>
+ </ns26:p><p>
+ Be aware that the RID parmeter is a unsigned 32 bit integer that should
+ normally start at 1000. However, this rid must not overlap with any RID assigned
+ to a user. Verifying this is done differently depending on on the passdb backend
+ you are using. Future versions of the tools may perform the verification automatically,
+ but for now the burden is on you.
+ </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2898871"></a>Example Configuration</h3></div></div><div></div></div><p>
+ You can list the various groups in the mapping database by executing
+ <b class="command">net groupmap list</b>. Here is an example:
+ </p><ns26:p>
+ </ns26:p><pre class="screen">
+ <tt class="prompt">root# </tt> <b class="userinput"><tt>net groupmap list</tt></b>
+ System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
+ Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
+ Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
+ Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
+ </pre><ns26:p>
+ </ns26:p><p>
+ For complete details on <b class="command">net groupmap</b>, refer to the net(8) man page.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2898936"></a>Configuration Scripts</h2></div></div><div></div></div><p>
+ Everyone needs tools. Some of us like to create our own, others prefer to use canned tools
+ (ie: prepared by someone else for general use).
+ </p><div xmlns:ns27="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2898950"></a>Sample <tt class="filename">smb.conf</tt> add group script</h3></div></div><div></div></div><p>
+ A script to great complying group names for use by the samba group interfaces:
+ </p><ns27:p>
+</ns27:p><div class="example"><a name="id2898973"></a><p class="title"><b>Example 12.1. smbgrpadd.sh</b></p><pre class="programlisting">
+
+#!/bin/bash
+
+# Add the group using normal system groupadd tool.
+groupadd smbtmpgrp00
+
+thegid=`cat /etc/group | grep smbtmpgrp00 | cut -d ":" -f3`
+
+# Now change the name to what we want for the MS Windows networking end
+cat /etc/group | sed s/smbtmpgrp00/$1/g > /etc/group
+
+# Now return the GID as would normally happen.
+echo $thegid
+exit 0
+</pre></div><ns27:p>
+</ns27:p><ns27:p>
+ The <tt class="filename">smb.conf</tt> entry for the above script would look like:
+ </ns27:p><pre class="programlisting">
+ add group script = /path_to_tool/smbgrpadd.sh %g
+ </pre><ns27:p>
+ </ns27:p></div><div xmlns:ns28="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2899017"></a>Script to configure Group Mapping</h3></div></div><div></div></div><p>
+ In our example we have created a Unix/Linux group called <i class="parameter"><tt>ntadmin</tt></i>.
+ Our script will create the additional groups <i class="parameter"><tt>Engineers, Marketoids, Gnomes</tt></i>:
+ </p><ns28:p>
+</ns28:p><pre class="programlisting">
+#!/bin/bash
+
+net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin
+net groupmap modify ntgroup="Domain Users" unixgroup=users
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
+net groupmap modify ntgroup="Administrators" unixgroup=root
+net groupmap modify ntgroup="Users" unixgroup=users
+net groupmap modify ntgroup="Guests" unixgroup=nobody
+net groupmap modify ntgroup="System Operators" unixgroup=sys
+net groupmap modify ntgroup="Account Operators" unixgroup=root
+net groupmap modify ntgroup="Backup Operators" unixgroup=bin
+net groupmap modify ntgroup="Print Operators" unixgroup=lp
+net groupmap modify ntgroup="Replicators" unixgroup=daemon
+net groupmap modify ntgroup="Power Users" unixgroup=sys
+
+#groupadd Engineers
+#groupadd Marketoids
+#groupadd Gnomes
+
+#net groupmap add ntgroup="Engineers" unixgroup=Engineers type=d
+#net groupmap add ntgroup="Marketoids" unixgroup=Marketoids type=d
+#net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d
+</pre><ns28:p>
+</ns28:p><p>
+ Of course it is expected that the admininstrator will modify this to suit local needs.
+ For information regarding the use of the <b class="command">net groupmap</b> tool please
+ refer to the man page.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2899091"></a>Common Errors</h2></div></div><div></div></div><p>
+At this time there are many little surprises for the unwary administrator. In a real sense
+it is imperative that every step of automated control scripts must be carefully tested
+manually before putting them into active service.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2899107"></a>Adding Groups Fails</h3></div></div><div></div></div><p>
+ This is a common problem when the <b class="command">groupadd</b> is called directly
+ by the samba interface script for the <i class="parameter"><tt>add group script</tt></i> in
+ the <tt class="filename">smb.conf</tt> file.
+ </p><p>
+ The most common cause of failure is an attempt to add an MS Windows group acocunt
+ that has either an upper case character and/or a space character in it.
+ </p><p>
+ There are three possible work-arounds. Firstly, use only group names that comply
+ with the limitations of the Unix/Linux <b class="command">groupadd</b> system tool.
+ The second involves use of the script mentioned earlier in this chapter, and the
+ third option is to manually create a Unix/Linux group account that can substitute
+ for the MS Windows group name, then use the procedure listed above to map that group
+ to the MS Windows group.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2899167"></a>Adding MS Windows Groups to MS Windows Groups Fails</h3></div></div><div></div></div><p>
+ Samba-3 does NOT support nested groups from the MS Windows control environment.
+ </p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="AccessControls"></a>Chapter 13. File, Directory and Share Access Controls</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jeremy</span> <span class="surname">Allison</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jra@samba.org">jra@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">May 10, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2902353">Features and Benefits</a></dt><dt><a href="#id2902478">File System Access Controls</a></dt><dd><dl><dt><a href="#id2902496">MS Windows NTFS Comparison with Unix File Systems</a></dt><dt><a href="#id2899413">Managing Directories</a></dt><dt><a href="#id2899508">File and Directory Access Control</a></dt></dl></dd><dt><a href="#id2899915">Share Definition Access Controls</a></dt><dd><dl><dt><a href="#id2899943">User and Group Based Controls</a></dt><dt><a href="#id2900215">File and Directory Permissions Based Controls</a></dt><dt><a href="#id2900461">Miscellaneous Controls</a></dt></dl></dd><dt><a href="#id2905044">Access Controls on Shares</a></dt><dd><dl><dt><a href="#id2905115">Share Permissions Management</a></dt></dl></dd><dt><a href="#id2905414">MS Windows Access Control Lists and Unix Interoperability</a></dt><dd><dl><dt><a href="#id2905422">Managing UNIX permissions Using NT Security Dialogs</a></dt><dt><a href="#id2905460">Viewing File Security on a Samba Share</a></dt><dt><a href="#id2905539">Viewing file ownership</a></dt><dt><a href="#id2905661">Viewing File or Directory Permissions</a></dt><dt><a href="#id2905889">Modifying file or directory permissions</a></dt><dt><a href="#id2906041">Interaction with the standard Samba create mask
+ parameters</a></dt><dt><a href="#id2906370">Interaction with the standard Samba file attribute
+ mapping</a></dt></dl></dd><dt><a href="#id2906446">Common Errors</a></dt><dd><dl><dt><a href="#id2906460">Users can not write to a public share</a></dt><dt><a href="#id2906838">I have set force user and samba still makes root the owner of all the files
+ I touch!</a></dt></dl></dd></dl></div><p>
+Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of
+resources shared via Samba do not behave in the manner they might expect. MS Windows network
+adminstrators are often confused regarding network access controls and what is the best way to
+provide users with the type of access they need while protecting resources from the consequences
+of untoward access capabilities.
+</p><p>
+Unix administrators frequently are not familiar with the MS Windows environment and in particular
+have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file
+and directory access permissions.
+</p><p>
+The problem lies in the differences in how file and directory permissions and controls work
+between the two environments. This difference is one that Samba can not completely hide, even
+though it does try to make the chasm transparent.
+</p><p>
+POSIX Access Control List technology has been available (along with Extended Attributes)
+for Unix for many years, yet there is little evidence today of any significant use. This
+explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows
+administrators are astounded at this given that ACLs were a foundational capability of the now
+decade old MS Windows NT operating system.
+</p><p>
+The purpose of this chapter is to present each of the points of control that are possible with
+Samba-3 in the hope that this will help the network administrator to find the optimum method
+for delivering the best environment for MS Windows desktop users.
+</p><p>
+This is an opportune point to mention that it should be borne in mind that Samba was created to
+provide a means of interoperability and interchange of data between two operating environments
+that are quite different. It was never the intent to make Unix/Linux like MS Windows NT. Instead
+the purpose was an is to provide a sufficient level of exchange of data between the two environments.
+What is available today extends well beyond early plans and expections, yet the gap continues to
+shrink.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2902353"></a>Features and Benefits</h2></div></div><div></div></div><p>
+ Samba offers a lot of flexibility in file system access management. These are the key access control
+ facilities present in Samba today:
+ </p><div class="itemizedlist"><p class="title"><b>Samba Access Control Facilities</b></p><ul type="disc"><li><p>
+ <span class="emphasis"><em>Unix File and Directory Permissions</em></span>
+ </p><p>
+ Samba honours and implements Unix file system access controls. Users
+ who access a Samba server will do so as a particular MS Windows user.
+ This information is passed to the Samba server as part of the logon or
+ connection setup process. Samba uses this user identity to validate
+ whether or not the user should be given access to file system resources
+ (files and directories). This chapter provides an overview for those
+ to whom the Unix permissions and controls are a little strange or unknown.
+ </p></li><li><p>
+ <span class="emphasis"><em>Samba Share Definitions</em></span>
+ </p><p>
+ In configuring share settings and controls in the <tt class="filename">smb.conf</tt> file
+ the network administrator can exercise over-rides to native file
+ system permissions and behaviours. This can be handy and convenient
+ to affect behaviour that is more like what MS Windows NT users expect
+ but it is seldom the <span class="emphasis"><em>best</em></span> way to achieve this.
+ The basic options and techniques are described herein.
+ </p></li><li><p>
+ <span class="emphasis"><em>Samba Share ACLs</em></span>
+ </p><p>
+ Just like it is possible in MS Windows NT to set ACLs on shares
+ themselves, so it is possible to do this in Samba.
+ Very few people make use of this facility, yet it remains on of the
+ easiest ways to affect access controls (restrictions) and can often
+ do so with minimum invasiveness compared with other methods.
+ </p></li><li><p>
+ <span class="emphasis"><em>MS Windows ACLs through Unix POSIX ACLs</em></span>
+ </p><p>
+ The use of POSIX ACLs on Unix/Linux is possible ONLY if the underlying
+ operating system supports them. If not, then this option will not be
+ available to you. Current Unix technology platforms have native support
+ for POSIX ACLs. There are patches for the Linux kernel that provide
+ this also. Sadly, few Linux paltforms ship today with native ACLs and
+ Extended Attributes enabled. This chapter has pertinent information
+ for users of platforms that support them.
+ </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2902478"></a>File System Access Controls</h2></div></div><div></div></div><p>
+Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP
+implement a totally divergent file system technology from what is provided in the Unix operating system
+environment. Firstly we should consider what the most significant differences are, then we shall look
+at how Samba helps to bridge the differences.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2902496"></a>MS Windows NTFS Comparison with Unix File Systems</h3></div></div><div></div></div><p>
+ Samba operates on top of the Unix file system. This means it is subject to Unix file system conventions
+ and permissions. It also means that if the MS Windows networking environment requires file system
+ behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating
+ that in a transparent and consistent manner.
+ </p><p>
+ It is good news that Samba does this to a very large extent and on top of that provides a high degree
+ of optional configuration to over-ride the default behaviour. We will look at some of these over-rides,
+ but for the greater part we will stay withing the bounds of default behaviour. Those wishing to explore
+ to depths of control ability should review the <tt class="filename">smb.conf</tt> man page.
+ </p><div class="variablelist"><p class="title"><b>File System Feature Comparison</b></p><dl><dt><span class="term">Name Space</span></dt><dd><p>
+ MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, Unix file names
+ may be 1023 characters long. In MS Windows file extensions indicate particular file types,
+ in Unix this is not so rigorously observed as all names are considered arbitrary.
+ </p><p>
+ What MS Windows calls a Folder, Unix calls a directory,
+ </p></dd><dt><span class="term">Case Sensitivity</span></dt><dd><p>
+ MS Windows file names are generally Upper Case if made up of 8.3 (ie: 8 character file name
+ and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case
+ Insensitive.
+ </p><p>
+ Unix file and directory names are Case Sensitive and Case Preserving. Samba implements the
+ MS Windows file name behaviour, but it does so as a user application. The Unix file system
+ provides no mechanism to perform case insensitive file name lookups. MS Windows does this
+ by default. This means that Samba has to carry the processing overhead to provide features
+ that are NOT native to the Unix operating system environment.
+ </p><p>
+ Consider the following, all are unique Unix names but one single MS Windows file name:
+ <tt class="computeroutput">
+ MYFILE.TXT
+ MyFile.txt
+ myfile.txt
+ </tt>
+ So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in Unix
+ they can. So what should Samba do if all three are present? Answer, the one that is lexically
+ first will be accessible to MS Windows users, the others are invisible and unaccessible - any
+ other solution would be suicidal.
+ </p></dd><dt><span class="term">Directory Separators</span></dt><dd><p>
+ MS Windows and DOS uses the back-slash '\' as a directory delimiter, Unix uses the forward-slash '/'
+ as it's directory delimiter. This is transparently handled by Samba.
+ </p></dd><dt><span class="term">Drive Identification</span></dt><dd><p>
+ MS Windows products support a notion of drive letters, like <b class="command">C:</b> to represent
+ disk partitions. Unix has NO concept if separate identifiers for file partitions since each
+ such file system is <tt class="filename">mounted</tt> to become part of the over-all directory tree.
+ The Unix directory tree begins at '/', just like the root of a DOS drive is specified like
+ <b class="command">C:\</b>.
+ </p></dd><dt><span class="term">File Naming Conventions</span></dt><dd><p>
+ MS Windows generally never experiences file names that begin with a '.', while in Unix these
+ are commonly found in a user's home directory. Files that begin with a '.' are typically
+ either start up files for various Unix applications, or they may be files that contain
+ start-up configuration data.
+ </p></dd><dt><span class="term">Links and Short-Cuts</span></dt><dd><p>
+ MS Windows make use of "links and Short-Cuts" that are actually special types of files that will
+ redirect an attempt to execute the file to the real location of the file. Unix knows of file and directory
+ links, but they are entirely different from what MS Windows users are used to.
+ </p><p>
+ Symbolic links are files in Unix that contain the actual location of the data (file OR directory). An
+ operation (like read or write) will operate directly on the file referenced. Symbolic links are also
+ referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows
+ one physical file to be known simulataneously by more than one file name.
+ </p></dd></dl></div><p>
+ There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort
+ in the process of becoming familiar with Unix/Linux. These are best left for a text that is dedicated to the
+ purpose of Unix/Linux training/education.
+ </p></div><div xmlns:ns29="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2899413"></a>Managing Directories</h3></div></div><div></div></div><ns29:p>
+ There are three basic operations for managing directories, <b class="command">create, delete, rename</b>.
+ </ns29:p><div class="table"><a name="id2899431"></a><p class="title"><b>Table 13.1. Managing directories with unix and windows</b></p><table summary="Managing directories with unix and windows" border="1"><colgroup><col><col><col></colgroup><thead><tr><th align="center">Action</th><th align="center">MS Windows Command</th><th align="center">Unix Command</th></tr></thead><tbody><tr><td align="center">create</td><td align="center">md folder</td><td align="center">mkdir folder</td></tr><tr><td align="center">delete</td><td align="center">rd folder</td><td align="center">rmdir folder</td></tr><tr><td align="center">rename</td><td align="center">rename oldname newname</td><td align="center">mv oldname newname</td></tr></tbody></table></div><ns29:p>
+ </ns29:p></div><div xmlns:ns30="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2899508"></a>File and Directory Access Control</h3></div></div><div></div></div><p>
+ The network administrator is strongly advised to read foundational training manuals and reference materials
+ regarding file and directory permissions maintenance. Much can be achieved with the basic Unix permissions
+ without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended
+ Attributes (EAs).
+ </p><ns30:p>
+ Unix/Linux file and directory access permissions invloves setting three (3) primary sets of data and one (1) control set.
+ A Unix file listing looks as follows:-
+
+ </ns30:p><pre class="screen">
+ <tt class="prompt">jht@frodo:~/stuff> </tt><b class="userinput"><tt>ls -la</tt></b>
+ total 632
+ drwxr-xr-x 13 jht users 816 2003-05-12 22:56 .
+ drwxr-xr-x 37 jht users 3800 2003-05-12 22:29 ..
+ d--------- 2 jht users 48 2003-05-12 22:29 muchado00
+ d--x--x--x 2 jht users 48 2003-05-12 22:29 muchado01
+ dr-xr-xr-x 2 jht users 48 2003-05-12 22:29 muchado02
+ drwxrwxrwx 2 jht users 48 2003-05-12 22:29 muchado03
+ drw-rw-rw- 2 jht users 48 2003-05-12 22:29 muchado04
+ d-w--w--w- 2 jht users 48 2003-05-12 22:29 muchado05
+ dr--r--r-- 2 jht users 48 2003-05-12 22:29 muchado06
+ drwxrwxrwt 2 jht users 48 2003-05-12 22:29 muchado07
+ drwsrwsrwx 2 jht users 48 2003-05-12 22:29 muchado08
+ ---------- 1 jht users 1242 2003-05-12 22:31 mydata00.lst
+ ---x--x--x 1 jht users 1674 2003-05-12 22:33 mydata01.lst
+ --w--w--w- 1 jht users 7754 2003-05-12 22:33 mydata02.lst
+ --wx-wx-wx 1 jht users 260179 2003-05-12 22:33 mydata03.lst
+ -r--r--r-- 1 jht users 21017 2003-05-12 22:32 mydata04.lst
+ -r-xr-xr-x 1 jht users 206339 2003-05-12 22:32 mydata05.lst
+ -rw-rw-rw- 1 jht users 41105 2003-05-12 22:32 mydata06.lst
+ -rwxrwxrwx 1 jht users 19312 2003-05-12 22:32 mydata07.lst
+ <tt class="prompt">jht@frodo:~/stuff></tt>
+ </pre><ns30:p>
+ </ns30:p><p>
+ The columns above represent (from left to right): permissions, no blocks used, owner, group, size (bytes), access date, access time, file name.
+ </p><ns30:p>
+ The permissions field is made up of:
+
+ </ns30:p><pre class="programlisting">
+ <i><span class="comment"> JRV: Put this into a diagram of some sort</span></i>
+ [ type ] [ users ] [ group ] [ others ] [File, Directory Permissions]
+ [ d | l ] [ r w x ] [ r w x ] [ r w x ]
+ | | | | | | | | | | |
+ | | | | | | | | | | |-----> Can Execute, List files
+ | | | | | | | | | |-------> Can Write, Create files
+ | | | | | | | | |---------> Can Read, Read files
+ | | | | | | | |---------------> Can Execute, List files
+ | | | | | | |-----------------> Can Write, Create files
+ | | | | | |-------------------> Can Read, Read files
+ | | | | |-------------------------> Can Execute, List files
+ | | | |---------------------------> Can Write, Create files
+ | | |-----------------------------> Can Read, Read files
+ | |-----------------------------------> Is a symbolic Link
+ |---------------------------------------> Is a directory
+ </pre><ns30:p>
+ </ns30:p><ns30:p>
+ Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character.
+
+ </ns30:p><div class="example"><a name="id2899836"></a><p class="title"><b>Example 13.1. Example File</b></p><pre class="programlisting">
+ -rwxr-x--- Means: The owner (user) can read, write, execute
+ the group can read and execute
+ everyone else can NOT do anything with it
+ </pre></div><ns30:p>
+
+ </ns30:p><p>
+ Additional posibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket.
+ </p><p>
+ The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x),r
+ execute only if the file is a directory or already has execute permission for some user (X), set user or group ID on execution (s),
+ sticky (t).
+ </p><p>
+ When the sticky bit is set on a directory, files in that directory may be unlinked (deleted) or renamed only by root or their owner.
+ Without the sticky bit, anyone able to write to the directory can delete or rename files. The sticky bit is commonly found on
+ directories, such as /tmp, that are world-writable.
+ </p><p>
+ When the set user or group ID bit (s) is set on a directory, then all files created within it will be owned by the user and/or
+ group whose 'set user or group' bit is set. This can be very helpful in setting up directories that for which it is desired that
+ all users who are in a group should be able to write to and read from a file, particularly when it is undesirable for that file
+ to be exclusively owned by a user who's primary group is not the group that all such users belong to.
+ </p><p>
+ When a directory is set <tt class="constant">drw-r-----</tt> this means that the owner can read and create (write) files in it, but because
+ the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the
+ directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then
+ group members will be able to write to (or delete) them.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2899915"></a>Share Definition Access Controls</h2></div></div><div></div></div><p>
+The following parameters in the <tt class="filename">smb.conf</tt> file sections that define a share control or affect access controls.
+Before using any of the following options please refer to the man page for <tt class="filename">smb.conf</tt>.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2899943"></a>User and Group Based Controls</h3></div></div><div></div></div><p>
+ User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all
+ file system operations as if a single user is doing this, the use of the <i class="parameter"><tt>force user</tt></i> and
+ <i class="parameter"><tt>force group</tt></i> behaviour will achieve this. In other situations it may be necessary to affect a
+ paranoia level of control to ensure that only particular authorised persons will be able to access a share or
+ it's contents, here the use of the <i class="parameter"><tt>valid users</tt></i> or the <i class="parameter"><tt>invalid users</tt></i> may
+ be most useful.
+ </p><p>
+ As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for
+ controlling access. Remember, that when you leave the scene someone else will need to provide assistance and
+ if that person finds too great a mess, or if they do not understand what you have done then there is risk of
+ Samba being removed and an alternative solution being adopted.
+ </p><div class="table"><a name="id2900001"></a><p class="title"><b>Table 13.2. User and Group Based Controls</b></p><table summary="User and Group Based Controls" border="1"><colgroup><col><col></colgroup><thead><tr><th align="center">Control Parameter</th><th align="center">Description - Action - Notes</th></tr></thead><tbody><tr><td>admin users</td><td><p>
+ List of users who will be granted administrative privileges on the share.
+ They will do all file operations as the super-user (root).
+ Any user in this list will be able to do anything they like on the share,
+ irrespective of file permissions.
+ </p></td></tr><tr><td>force group</td><td><p>
+ Specifies a UNIX group name that will be assigned as the default primary group
+ for all users connecting to this service.
+ </p></td></tr><tr><td>force user</td><td><p>
+ Specifies a UNIX user name that will be assigned as the default user for all users connecting to this service.
+ This is useful for sharing files. Incorrect use can cause security problems.
+ </p></td></tr><tr><td>guest ok</td><td><p>
+ If this parameter is set for a service, then no password is required to connect to the service. Privileges will be
+ those of the guest account.
+ </p></td></tr><tr><td>invalid users</td><td><p>
+ List of users that should not be allowed to login to this service.
+ </p></td></tr><tr><td>only user</td><td><p>
+ Controls whether connections with usernames not in the user list will be allowed.
+ </p></td></tr><tr><td>read list</td><td><p>
+ List of users that are given read-only access to a service. Users in this list
+ will not be given write access, no matter what the read only option is set to.
+ </p></td></tr><tr><td>username</td><td><p>
+ Refer to the <tt class="filename">smb.conf</tt> man page for more information - this is a complex and potentially misused parameter.
+ </p></td></tr><tr><td>valid users</td><td><p>
+ List of users that should be allowed to login to this service.
+ </p></td></tr><tr><td>write list</td><td><p>
+ List of users that are given read-write access to a service.
+ </p></td></tr></tbody></table></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2900215"></a>File and Directory Permissions Based Controls</h3></div></div><div></div></div><p>
+ The following file and directory permission based controls, if misused, can result in considerable difficulty to
+ diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one
+ undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually
+ re-instroduce them in a controlled fashion.
+ </p><div class="table"><a name="id2900234"></a><p class="title"><b>Table 13.3. File and Directory Permission Based Controls</b></p><table summary="File and Directory Permission Based Controls" border="1"><colgroup><col><col></colgroup><thead><tr><th align="center">Control Parameter</th><th align="center">Description - Action - Notes</th></tr></thead><tbody><tr><td>create mask</td><td><p>
+ Refer to the <tt class="filename">smb.conf</tt> man page.
+ </p></td></tr><tr><td>directory mask</td><td><p>
+ The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories.
+ See also: directory security mask.
+ </p></td></tr><tr><td>dos filemode</td><td><p>
+ Enabling this parameter allows a user who has write access to the file to modify the permissions on it.
+ </p></td></tr><tr><td>force create mode</td><td><p>
+ This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba.
+ </p></td></tr><tr><td>force directory mode</td><td><p>
+ This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba.
+ </p></td></tr><tr><td>force directory security mode</td><td><p>
+ Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory
+ </p></td></tr><tr><td>force security mode</td><td><p>
+ Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions.
+ </p></td></tr><tr><td>hide unreadable</td><td><p>
+ Prevents clients from seeing the existance of files that cannot be read.
+ </p></td></tr><tr><td>hide unwriteable files</td><td><p>
+ Prevents clients from seeing the existance of files that cannot be written to. Unwriteable directories are shown as usual.
+ </p></td></tr><tr><td>nt acl support</td><td><p>
+ This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists.
+ </p></td></tr><tr><td>security mask</td><td><p>
+ Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file.
+ </p></td></tr></tbody></table></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2900461"></a>Miscellaneous Controls</h3></div></div><div></div></div><p>
+ The following are documented because of the prevalence of administrators creating inadvertant barriers to file
+ access by not understanding the full implications of <tt class="filename">smb.conf</tt> file settings.
+ </p><div class="table"><a name="id2900482"></a><p class="title"><b>Table 13.4. Other Controls</b></p><table summary="Other Controls" border="1"><colgroup><col><col></colgroup><thead><tr><th align="center">Control Parameter</th><th align="center">Description - Action - Notes</th></tr></thead><tbody><tr><td>case sensitive, default case, short preserve case</td><td><p>
+ This means that all file name lookup will be done in a case sensitive manner.
+ Files will be created with the precise filename Samba received from the MS Windows client.
+ </p></td></tr><tr><td>csc policy</td><td><p>
+ Client Side Caching Policy - parallels MS Windows client side file caching capabilities.
+ </p></td></tr><tr><td>dont descend</td><td><p>
+ Allows to specify a comma-delimited list of directories that the server should always show as empty.
+ </p></td></tr><tr><td>dos filetime resolution</td><td><p>
+ This option is mainly used as a compatibility option for Visual C++ when used against Samba shares.
+ </p></td></tr><tr><td>dos filetimes</td><td><p>
+ DOS and Windows allows users to change file time stamps if they can write to the file. POSIX semantics prevent this.
+ This options allows DOS and Windows behaviour.
+ </p></td></tr><tr><td>fake oplocks</td><td><p>
+ Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an
+ oplock then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data.
+ </p></td></tr><tr><td>hide dot files, hide files, veto files</td><td><p>
+ Note: MS Windows Explorer allows over-ride of files marked as hidden so they will still be visible.
+ </p></td></tr><tr><td>read only</td><td><p>
+ If this parameter is yes, then users of a service may not create or modify files in the service's directory.
+ </p></td></tr><tr><td>veto files</td><td><p>
+ List of files and directories that are neither visible nor accessible.
+ </p></td></tr></tbody></table></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2905044"></a>Access Controls on Shares</h2></div></div><div></div></div><p>
+ This section deals with how to configure Samba per share access control restrictions.
+ By default samba sets no restrictions on the share itself. Restrictions on the share itself
+ can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can
+ connect to a share. In the absence of specific restrictions the default setting is to allow
+ the global user <tt class="constant">Everyone</tt> Full Control (ie: Full control, Change and Read).
+ </p><p>
+ At this time Samba does NOT provide a tool for configuring access control setting on the Share
+ itself. Samba does have the capacity to store and act on access control settings, but the only
+ way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for
+ Computer Management.
+ </p><p>
+ Samba stores the per share access control settings in a file called <tt class="filename">share_info.tdb</tt>.
+ The location of this file on your system will depend on how samba was compiled. The default location
+ for samba's tdb files is under <tt class="filename">/usr/local/samba/var</tt>. If the <tt class="filename">tdbdump</tt>
+ utility has been compiled and installed on your system then you can examine the contents of this file
+ by: <b class="userinput"><tt>tdbdump share_info.tdb</tt></b>.
+ </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2905115"></a>Share Permissions Management</h3></div></div><div></div></div><p>
+ The best tool for the task is platform dependant. Choose the best tool for your environmemt.
+ </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2905128"></a>Windows NT4 Workstation/Server</h4></div></div><div></div></div><p>
+ The tool you need to use to manage share permissions on a Samba server is the NT Server Manager.
+ Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation.
+ You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below.
+ </p><div class="procedure"><p class="title"><b>Procedure 13.1. Instructions</b></p><ol type="1"><li><p>
+ Launch the <span class="application">NT4 Server Manager</span>, click on the Samba server you want to administer, then from the menu
+ select <span class="guimenu">Computer</span>, then click on the <span class="guimenuitem">Shared Directories</span> entry.
+ </p></li><li><p>
+ Now click on the share that you wish to manage, then click on the <span class="guilabel">Properties</span> tab, next click on
+ the <span class="guilabel">Permissions</span> tab. Now you can add or change access control settings as you wish.
+ </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2905210"></a>Windows 200x/XP</h4></div></div><div></div></div><p>
+ On <span class="application">MS Windows NT4/200x/XP</span> system access control lists on the share itself are set using native
+ tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder,
+ then select <span class="guimenuitem">Sharing</span>, then click on <span class="guilabel">Permissions</span>. The default
+ Windows NT4/200x permission allows <span class="emphasis"><em>Everyone</em></span> Full Control on the Share.
+ </p><p>
+ MS Windows 200x and later all comes with a tool called the <span class="application">Computer Management</span> snap-in for the
+ Microsoft Management Console (MMC). This tool is located by clicking on <tt class="filename">Control Panel ->
+ Administrative Tools -> Computer Management</tt>.
+ </p><div class="procedure"><p class="title"><b>Procedure 13.2. Instructions</b></p><ol type="1"><li><p>
+ After launching the MMC with the Computer Management snap-in, click on the menu item <span class="guimenuitem">Action</span>,
+ select <span class="guilabel">Connect to another computer</span>. If you are not logged onto a domain you will be prompted
+ to enter a domain login user identifier and a password. This will authenticate you to the domain.
+ If you where already logged in with administrative privilidge this step is not offered.
+ </p></li><li><p>
+ If the Samba server is not shown in the <span class="guilabel">Select Computer</span> box, then type in the name of the target
+ Samba server in the field <span class="guilabel">Name:</span>. Now click on the <span class="guibutton">[+]</span> next to
+ <span class="guilabel">System Tools</span>, then on the <span class="guibutton">[+]</span> next to <span class="guilabel">Shared Folders</span> in the
+ left panel.
+ </p></li><li><p>
+ Now in the right panel, double-click on the share you wish to set access control permissions on.
+ Then click on the tab <span class="guilabel">Share Permissions</span>. It is now possible to add access control entities
+ to the shared folder. Do NOT forget to set what type of access (full control, change, read) you
+ wish to assign for each entry.
+ </p></li></ol></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+ Be careful. If you take away all permissions from the <tt class="constant">Everyone</tt> user without removing this user
+ then effectively no user will be able to access the share. This is a result of what is known as
+ ACL precedence. ie: Everyone with <span class="emphasis"><em>no access</em></span> means that MaryK who is part of the group
+ <tt class="constant">Everyone</tt> will have no access even if this user is given explicit full control access.
+ </p></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2905414"></a>MS Windows Access Control Lists and Unix Interoperability</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2905422"></a>Managing UNIX permissions Using NT Security Dialogs</h3></div></div><div></div></div><p>Windows NT clients can use their native security settings
+ dialog box to view and modify the underlying UNIX permissions.</p><p>Note that this ability is careful not to compromise
+ the security of the UNIX host Samba is running on, and
+ still obeys all the file permission rules that a Samba
+ administrator can set.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+ All access to Unix/Linux system file via Samba is controlled at
+ the operating system file access control level. When trying to
+ figure out file access problems it is vitally important to identify
+ the identity of the Windows user as it is presented by Samba at
+ the point of file access. This can best be determined from the
+ Samba log files.
+ </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2905460"></a>Viewing File Security on a Samba Share</h3></div></div><div></div></div><p>From an NT4/2000/XP client, single-click with the right
+ mouse button on any file or directory in a Samba mounted
+ drive letter or UNC path. When the menu pops-up, click
+ on the <span class="guilabel">Properties</span> entry at the bottom of
+ the menu. This brings up the file properties dialog
+ box. Click on the tab <span class="guilabel">Security</span> and you
+ will see three buttons, <span class="guibutton">Permissions</span>,
+ <span class="guibutton">Auditing</span>, and <span class="guibutton">Ownership</span>.
+ The <span class="guibutton">Auditing</span> button will cause either
+ an error message <span class="errorname">A requested privilege is not held
+ by the client</span> to appear if the user is not the
+ NT Administrator, or a dialog which is intended to allow an
+ Administrator to add auditing requirements to a file if the
+ user is logged on as the NT Administrator. This dialog is
+ non-functional with a Samba share at this time, as the only
+ useful button, the <span class="guibutton">Add</span> button will not currently
+ allow a list of users to be seen.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2905539"></a>Viewing file ownership</h3></div></div><div></div></div><p>Clicking on the <span class="guibutton">Ownership</span> button
+ brings up a dialog box telling you who owns the given file. The
+ owner name will be of the form :</p><p><b class="command">"SERVER\user (Long name)"</b></p><p>Where <i class="replaceable"><tt>SERVER</tt></i> is the NetBIOS name of
+ the Samba server, <i class="replaceable"><tt>user</tt></i> is the user name of
+ the UNIX user who owns the file, and <i class="replaceable"><tt>(Long name)</tt></i>
+ is the descriptive string identifying the user (normally found in the
+ GECOS field of the UNIX password database). Click on the
+ <span class="guibutton">Close </span> button to remove this dialog.</p><p>If the parameter <i class="parameter"><tt>nt acl support</tt></i>
+ is set to <tt class="constant">false</tt> then the file owner will
+ be shown as the NT user <tt class="constant">"Everyone"</tt>.</p><p>The <span class="guibutton">Take Ownership</span> button will not allow
+ you to change the ownership of this file to yourself (clicking on
+ it will display a dialog box complaining that the user you are
+ currently logged onto the NT client cannot be found). The reason
+ for this is that changing the ownership of a file is a privileged
+ operation in UNIX, available only to the <span class="emphasis"><em>root</em></span>
+ user. As clicking on this button causes NT to attempt to change
+ the ownership of a file to the current user logged into the NT
+ client this will not work with Samba at this time.</p><p>There is an NT chown command that will work with Samba
+ and allow a user with Administrator privilege connected
+ to a Samba server as root to change the ownership of
+ files on both a local NTFS filesystem or remote mounted NTFS
+ or Samba drive. This is available as part of the <span class="application">Seclib
+ </span> NT security library written by Jeremy Allison of
+ the Samba Team, available from the main Samba ftp site.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2905661"></a>Viewing File or Directory Permissions</h3></div></div><div></div></div><p>The third button is the <span class="guibutton">Permissions</span>
+ button. Clicking on this brings up a dialog box that shows both
+ the permissions and the UNIX owner of the file or directory.
+ The owner is displayed in the form :</p><p><b class="command">"<i class="replaceable"><tt>SERVER</tt></i>\
+ <i class="replaceable"><tt>user</tt></i>
+ <i class="replaceable"><tt>(Long name)</tt></i>"</b></p><p>Where <i class="replaceable"><tt>SERVER</tt></i> is the NetBIOS name of
+ the Samba server, <i class="replaceable"><tt>user</tt></i> is the user name of
+ the UNIX user who owns the file, and <i class="replaceable"><tt>(Long name)</tt></i>
+ is the descriptive string identifying the user (normally found in the
+ GECOS field of the UNIX password database).</p><p>If the parameter <i class="parameter"><tt>nt acl support</tt></i>
+ is set to <tt class="constant">false</tt> then the file owner will
+ be shown as the NT user <tt class="constant">"Everyone"</tt> and the
+ permissions will be shown as NT "Full Control".</p><p>The permissions field is displayed differently for files
+ and directories, so I'll describe the way file permissions
+ are displayed first.</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2905752"></a>File Permissions</h4></div></div><div></div></div><p>The standard UNIX user/group/world triple and
+ the corresponding "read", "write", "execute" permissions
+ triples are mapped by Samba into a three element NT ACL
+ with the 'r', 'w', and 'x' bits mapped into the corresponding
+ NT permissions. The UNIX world permissions are mapped into
+ the global NT group <tt class="constant">Everyone</tt>, followed
+ by the list of permissions allowed for UNIX world. The UNIX
+ owner and group permissions are displayed as an NT
+ <span class="guiicon">user</span> icon and an NT <span class="guiicon">local
+ group</span> icon respectively followed by the list
+ of permissions allowed for the UNIX user and group.</p><p>As many UNIX permission sets don't map into common
+ NT names such as <tt class="constant">read</tt>, <tt class="constant">
+ "change"</tt> or <tt class="constant">full control</tt> then
+ usually the permissions will be prefixed by the words <tt class="constant">
+ "Special Access"</tt> in the NT display list.</p><p>But what happens if the file has no permissions allowed
+ for a particular UNIX user group or world component ? In order
+ to allow "no permissions" to be seen and modified then Samba
+ overloads the NT <b class="command">"Take Ownership"</b> ACL attribute
+ (which has no meaning in UNIX) and reports a component with
+ no permissions as having the NT <b class="command">"O"</b> bit set.
+ This was chosen of course to make it look like a zero, meaning
+ zero permissions. More details on the decision behind this will
+ be given below.</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2905844"></a>Directory Permissions</h4></div></div><div></div></div><p>Directories on an NT NTFS file system have two
+ different sets of permissions. The first set of permissions
+ is the ACL set on the directory itself, this is usually displayed
+ in the first set of parentheses in the normal <tt class="constant">"RW"</tt>
+ NT style. This first set of permissions is created by Samba in
+ exactly the same way as normal file permissions are, described
+ above, and is displayed in the same way.</p><p>The second set of directory permissions has no real meaning
+ in the UNIX permissions world and represents the <tt class="constant">
+ inherited</tt> permissions that any file created within
+ this directory would inherit.</p><p>Samba synthesises these inherited permissions for NT by
+ returning as an NT ACL the UNIX permission mode that a new file
+ created by Samba on this share would receive.</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2905889"></a>Modifying file or directory permissions</h3></div></div><div></div></div><p>Modifying file and directory permissions is as simple
+ as changing the displayed permissions in the dialog box, and
+ clicking the <span class="guibutton">OK</span> button. However, there are
+ limitations that a user needs to be aware of, and also interactions
+ with the standard Samba permission masks and mapping of DOS
+ attributes that need to also be taken into account.</p><p>If the parameter <i class="parameter"><tt>nt acl support</tt></i>
+ is set to <tt class="constant">false</tt> then any attempt to set
+ security permissions will fail with an <span class="errorname">"Access Denied"
+ </span> message.</p><p>The first thing to note is that the <span class="guibutton">"Add"</span>
+ button will not return a list of users in Samba (it will give
+ an error message of <span class="errorname">The remote procedure call failed
+ and did not execute</span>). This means that you can only
+ manipulate the current user/group/world permissions listed in
+ the dialog box. This actually works quite well as these are the
+ only permissions that UNIX actually has.</p><p>If a permission triple (either user, group, or world)
+ is removed from the list of permissions in the NT dialog box,
+ then when the <span class="guibutton">OK</span> button is pressed it will
+ be applied as "no permissions" on the UNIX side. If you then
+ view the permissions again the "no permissions" entry will appear
+ as the NT <b class="command">"O"</b> flag, as described above. This
+ allows you to add permissions back to a file or directory once
+ you have removed them from a triple component.</p><p>As UNIX supports only the "r", "w" and "x" bits of
+ an NT ACL then if other NT security attributes such as "Delete
+ access" are selected then they will be ignored when applied on
+ the Samba server.</p><p>When setting permissions on a directory the second
+ set of permissions (in the second set of parentheses) is
+ by default applied to all files within that directory. If this
+ is not what you want you must uncheck the <span class="guilabel">Replace
+ permissions on existing files</span> checkbox in the NT
+ dialog before clicking <span class="guibutton">OK</span>.</p><p>If you wish to remove all permissions from a
+ user/group/world component then you may either highlight the
+ component and click the <span class="guibutton">Remove</span> button,
+ or set the component to only have the special <tt class="constant">Take
+ Ownership</tt> permission (displayed as <b class="command">"O"
+ </b>) highlighted.</p></div><div xmlns:ns31="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2906041"></a>Interaction with the standard Samba create mask
+ parameters</h3></div></div><div></div></div><ns31:p>There are four parameters
+ to control interaction with the standard Samba create mask parameters.
+ These are :
+
+ </ns31:p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>security mask</tt></i></td></tr><tr><td><i class="parameter"><tt>force security mode</tt></i></td></tr><tr><td><i class="parameter"><tt>directory security mask</tt></i></td></tr><tr><td><i class="parameter"><tt>force directory security mode</tt></i></td></tr></table><ns31:p>
+
+ </ns31:p><p>Once a user clicks <span class="guibutton">OK</span> to apply the
+ permissions Samba maps the given permissions into a user/group/world
+ r/w/x triple set, and then will check the changed permissions for a
+ file against the bits set in the <a href="smb.conf.5.html#SECURITYMASK" target="_top">
+ <i class="parameter"><tt>security mask</tt></i></a> parameter. Any bits that
+ were changed that are not set to '1' in this parameter are left alone
+ in the file permissions.</p><p>Essentially, zero bits in the <i class="parameter"><tt>security mask</tt></i>
+ mask may be treated as a set of bits the user is <span class="emphasis"><em>not</em></span>
+ allowed to change, and one bits are those the user is allowed to change.
+ </p><p>If not set explicitly this parameter is set to the same value as
+ the <a href="smb.conf.5.html#CREATEMASK" target="_top"><i class="parameter"><tt>create mask
+ </tt></i></a> parameter. To allow a user to modify all the
+ user/group/world permissions on a file, set this parameter
+ to 0777.</p><p>Next Samba checks the changed permissions for a file against
+ the bits set in the <a href="smb.conf.5.html#FORCESECURITYMODE" target="_top">
+ <i class="parameter"><tt>force security mode</tt></i></a> parameter. Any bits
+ that were changed that correspond to bits set to '1' in this parameter
+ are forced to be set.</p><p>Essentially, bits set in the <i class="parameter"><tt>force security mode
+ </tt></i> parameter may be treated as a set of bits that, when
+ modifying security on a file, the user has always set to be 'on'.</p><p>If not set explicitly this parameter is set to the same value
+ as the <a href="smb.conf.5.html#FORCECREATEMODE" target="_top"><i class="parameter"><tt>force
+ create mode</tt></i></a> parameter.
+ To allow a user to modify all the user/group/world permissions on a file
+ with no restrictions set this parameter to 000.</p><p>The <i class="parameter"><tt>security mask</tt></i> and <i class="parameter"><tt>force
+ security mode</tt></i> parameters are applied to the change
+ request in that order.</p><p>For a directory Samba will perform the same operations as
+ described above for a file except using the parameter <i class="parameter"><tt>
+ directory security mask</tt></i> instead of <i class="parameter"><tt>security
+ mask</tt></i>, and <i class="parameter"><tt>force directory security mode
+ </tt></i> parameter instead of <i class="parameter"><tt>force security mode
+ </tt></i>.</p><p>The <i class="parameter"><tt>directory security mask</tt></i> parameter
+ by default is set to the same value as the <i class="parameter"><tt>directory mask
+ </tt></i> parameter and the <i class="parameter"><tt>force directory security
+ mode</tt></i> parameter by default is set to the same value as
+ the <i class="parameter"><tt>force directory mode</tt></i> parameter. </p><p>In this way Samba enforces the permission restrictions that
+ an administrator can set on a Samba share, whilst still allowing users
+ to modify the permission bits within that restriction.</p><p>If you want to set up a share that allows users full control
+ in modifying the permission bits on their files and directories and
+ doesn't force any particular bits to be set 'on', then set the following
+ parameters in the <tt class="filename">smb.conf</tt> file in that share specific section :
+ </p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>security mask = 0777</tt></i></td></tr><tr><td><i class="parameter"><tt>force security mode = 0</tt></i></td></tr><tr><td><i class="parameter"><tt>directory security mask = 0777</tt></i></td></tr><tr><td><i class="parameter"><tt>force directory security mode = 0</tt></i></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2906370"></a>Interaction with the standard Samba file attribute
+ mapping</h3></div></div><div></div></div><p>Samba maps some of the DOS attribute bits (such as "read
+ only") into the UNIX permissions of a file. This means there can
+ be a conflict between the permission bits set via the security
+ dialog and the permission bits set by the file attribute mapping.
+ </p><p>One way this can show up is if a file has no UNIX read access
+ for the owner it will show up as "read only" in the standard
+ file attributes tabbed dialog. Unfortunately this dialog is
+ the same one that contains the security info in another tab.</p><p>What this can mean is that if the owner changes the permissions
+ to allow themselves read access using the security dialog, clicks
+ <span class="guibutton">OK</span> to get back to the standard attributes tab
+ dialog, and then clicks <span class="guibutton">OK</span> on that dialog, then
+ NT will set the file permissions back to read-only (as that is what
+ the attributes still say in the dialog). This means that after setting
+ permissions and clicking <span class="guibutton">OK</span> to get back to the
+ attributes dialog you should always hit <span class="guibutton">Cancel</span>
+ rather than <span class="guibutton">OK</span> to ensure that your changes
+ are not overridden.</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2906446"></a>Common Errors</h2></div></div><div></div></div><p>
+File, Directory and Share access problems are very common on the mailing list. The following
+are examples taken from the mailing list in recent times.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2906460"></a>Users can not write to a public share</h3></div></div><div></div></div><p>
+ “<span class="quote">
+ We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root),
+ and theres a public share, on which everyone needs to have permission to create / modify files, but only
+ root can change the file, no one else can. We need to constantly go to server to
+ <b class="userinput"><tt>chgrp -R users *</tt></b> and <b class="userinput"><tt>chown -R nobody *</tt></b> to allow others users to change the file.
+ </span>”
+ </p><p>
+ There are many ways to solve this problem, here are a few hints:
+ </p><div class="procedure"><p class="title"><b>Procedure 13.3. Example Solution:</b></p><ol type="1"><li><p>
+ Go to the top of the directory that is shared
+ </p></li><li xmlns:ns32=""><ns32:p>
+ Set the ownership to what ever public owner and group you want
+ </ns32:p><pre class="programlisting">
+ find 'directory_name' -type d -exec chown user.group {}\;
+ find 'directory_name' -type d -exec chmod 6775 'directory_name'
+ find 'directory_name' -type f -exec chmod 0775 {} \;
+ find 'directory_name' -type f -exec chown user.group {}\;
+ </pre><ns32:p>
+ </ns32:p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+ The above will set the 'sticky bit' on all directories. Read your
+ Unix/Linux man page on what that does. It causes the OS to assign
+ to all files created in the directories the ownership of the
+ directory.
+ </p></div></li><li xmlns:ns33=""><ns33:p>
+
+ Directory is: <i class="replaceable"><tt>/foodbar</tt></i>
+ </ns33:p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>chown jack.engr /foodbar</tt></b>
+ </pre><ns33:p>
+ </ns33:p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><ns33:p>
+ </ns33:p><p>This is the same as doing:</p><ns33:p>
+ </ns33:p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>chown jack /foodbar</tt></b>
+ <tt class="prompt">$ </tt><b class="userinput"><tt>chgrp engr /foodbar</tt></b>
+ </pre><ns33:p>
+ </ns33:p></div></li><li xmlns:ns34=""><ns34:p>Now do:
+
+ </ns34:p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>chmod 6775 /foodbar</tt></b>
+ <tt class="prompt">$ </tt><b class="userinput"><tt>ls -al /foodbar/..</tt></b>
+ </pre><ns34:p>
+
+ </ns34:p><ns34:p>You should see:
+ </ns34:p><pre class="screen">
+ drwsrwsr-x 2 jack engr 48 2003-02-04 09:55 foodbar
+ </pre><ns34:p>
+ </ns34:p></li><li xmlns:ns35=""><ns35:p>Now do:
+ </ns35:p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>su - jill</tt></b>
+ <tt class="prompt">$ </tt><b class="userinput"><tt>cd /foodbar</tt></b>
+ <tt class="prompt">$ </tt><b class="userinput"><tt>touch Afile</tt></b>
+ <tt class="prompt">$ </tt><b class="userinput"><tt>ls -al</tt></b>
+ </pre><ns35:p>
+ </ns35:p><ns35:p>
+ You should see that the file <tt class="filename">Afile</tt> created by Jill will have ownership
+ and permissions of Jack, as follows:
+ </ns35:p><pre class="screen">
+ -rw-r--r-- 1 jack engr 0 2003-02-04 09:57 Afile
+ </pre><ns35:p>
+ </ns35:p></li><li xmlns:ns36=""><ns36:p>
+ Now in your <tt class="filename">smb.conf</tt> for the share add:
+ </ns36:p><pre class="programlisting">
+ force create mode = 0775
+ force direcrtory mode = 6775
+ </pre><ns36:p>
+ </ns36:p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+ The above are only needed <span class="emphasis"><em>if</em></span> your users are <span class="emphasis"><em>not</em></span> members of the group
+ you have used. ie: Within the OS do not have write permission on the directory.
+ </p></div><ns36:p>
+ An alternative is to set in the <tt class="filename">smb.conf</tt> entry for the share:
+ </ns36:p><pre class="programlisting">
+ force user = jack
+ force group = engr
+ </pre><ns36:p>
+ </ns36:p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2906838"></a>I have set force user and samba still makes <span class="emphasis"><em>root</em></span> the owner of all the files
+ I touch!</h3></div></div><div></div></div><p>
+ When you have a user in 'admin users', samba will always do file operations for
+ this user as <span class="emphasis"><em>root</em></span>, even if <i class="parameter"><tt>force user</tt></i> has been set.
+ </p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="locking"></a>Chapter 14. File and Record Locking</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jeremy</span> <span class="surname">Allison</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jra@samba.org">jra@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Eric</span> <span class="surname">Roseme</span></h3><div class="affiliation"><span class="orgname">HP Oplocks Usage Recommendations Whitepaper<br></span><div class="address"><p><tt class="email"><<a href="mailto:eric.roseme@hp.com">eric.roseme@hp.com</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2908960">Features and Benefits</a></dt><dt><a href="#id2909016">Discussion</a></dt><dd><dl><dt><a href="#id2906890">Opportunistic Locking Overview</a></dt></dl></dd><dt><a href="#id2907521">Samba Opportunistic Locking Control</a></dt><dd><dl><dt><a href="#id2907630">Example Configuration</a></dt></dl></dd><dt><a href="#id2907890">MS Windows Opportunistic Locking and Caching Controls</a></dt><dd><dl><dt><a href="#id2910326">Workstation Service Entries</a></dt><dt><a href="#id2910353">Server Service Entries</a></dt></dl></dd><dt><a href="#id2910432">Persistent Data Corruption</a></dt><dt><a href="#id2910463">Common Errors</a></dt><dd><dl><dt><a href="#id2910536">locking.tdb error messages</a></dt></dl></dd><dt><a href="#id2910566">Additional Reading</a></dt></dl></div><p>
+One area which causes trouble for many network administrators is locking.
+The extent of the problem is readily evident from searches over the internet.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2908960"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Samba provides all the same locking semantics that MS Windows clients expect
+and that MS Windows NT4 / 200x servers provide also.
+</p><p>
+The term <span class="emphasis"><em>locking</em></span> has exceptionally broad meaning and covers
+a range of functions that are all categorized under this one term.
+</p><p>
+Opportunistic locking is a desirable feature when it can enhance the
+perceived performance of applications on a networked client. However, the
+opportunistic locking protocol is not robust, and therefore can
+encounter problems when invoked beyond a simplistic configuration, or
+on extended, slow, or faulty networks. In these cases, operating
+system management of opportunistic locking and/or recovering from
+repetitive errors can offset the perceived performance advantage that
+it is intended to provide.
+</p><p>
+The MS Windows network administrator needs to be aware that file and record
+locking semantics (behaviour) can be controlled either in Samba or by way of registry
+settings on the MS Windows client.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Sometimes it is necessary to disable locking control settings BOTH on the Samba
+server as well as on each MS Windows client!
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2909016"></a>Discussion</h2></div></div><div></div></div><p>
+There are two types of locking which need to be performed by a SMB server.
+The first is <span class="emphasis"><em>record locking</em></span> which allows a client to lock
+a range of bytes in a open file. The second is the <span class="emphasis"><em>deny modes</em></span>
+that are specified when a file is open.
+</p><p>
+Record locking semantics under Unix is very different from record locking under
+Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix
+system call to implement proper record locking between different Samba clients.
+This can not be fully correct due to several reasons. The simplest is the fact
+that a Windows client is allowed to lock a byte range up to 2^32 or 2^64,
+depending on the client OS. The unix locking only supports byte ranges up to 2^31.
+So it is not possible to correctly satisfy a lock request above 2^31. There are
+many more differences, too many to be listed here.
+</p><p>
+Samba 2.2 and above implements record locking completely independent of the
+underlying unix system. If a byte range lock that the client requests happens
+to fall into the range 0-2^31, Samba hands this request down to the Unix system.
+All other locks can not be seen by unix anyway.
+</p><p>
+Strictly a SMB server should check for locks before every read and write call on
+a file. Unfortunately with the way fcntl() works this can be slow and may overstress
+the <b class="command">rpc.lockd</b>. It is also almost always unnecessary as clients are supposed to
+independently make locking calls before reads and writes anyway if locking is
+important to them. By default Samba only makes locking calls when explicitly asked
+to by a client, but if you set <i class="parameter"><tt>strict locking = yes</tt></i> then it
+will make lock checking calls on every read and write.
+</p><p>
+You can also disable by range locking completely using <i class="parameter"><tt>locking = no</tt></i>.
+This is useful for those shares that don't support locking or don't need it
+(such as cdroms). In this case Samba fakes the return codes of locking calls to
+tell clients that everything is OK.
+</p><p>
+The second class of locking is the <i class="parameter"><tt>deny modes</tt></i>. These
+are set by an application when it opens a file to determine what types of
+access should be allowed simultaneously with its open. A client may ask for
+<tt class="constant">DENY_NONE</tt>, <tt class="constant">DENY_READ</tt>,
+<tt class="constant">DENY_WRITE</tt> or <tt class="constant">DENY_ALL</tt>. There are also special compatibility
+modes called <tt class="constant">DENY_FCB</tt> and <tt class="constant">DENY_DOS</tt>.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2906890"></a>Opportunistic Locking Overview</h3></div></div><div></div></div><p>
+Opportunistic locking (Oplocks) is invoked by the Windows file system
+(as opposed to an API) via registry entries (on the server AND client)
+for the purpose of enhancing network performance when accessing a file
+residing on a server. Performance is enhanced by caching the file
+locally on the client which allows:
+</p><div class="variablelist"><dl><dt><span class="term">Read-ahead:</span></dt><dd><p>
+ The client reads the local copy of the file, eliminating network latency
+ </p></dd><dt><span class="term">Write caching:</span></dt><dd><p>
+ The client writes to the local copy of the file, eliminating network latency
+ </p></dd><dt><span class="term">Lock caching:</span></dt><dd><p>
+ The client caches application locks locally, eliminating network latency
+ </p></dd></dl></div><p>
+The performance enhancement of oplocks is due to the opportunity of
+exclusive access to the file - even if it is opened with deny-none -
+because Windows monitors the file's status for concurrent access from
+other processes.
+</p><div class="variablelist"><p class="title"><b>Windows defines 4 kinds of Oplocks:</b></p><dl><dt><span class="term">Level1 Oplock:</span></dt><dd><p>
+ The redirector sees that the file was opened with deny
+ none (allowing concurrent access), verifies that no
+ other process is accessing the file, checks that
+ oplocks are enabled, then grants deny-all/read-write/ex-
+ clusive access to the file. The client now performs
+ operations on the cached local file.
+ </p><p>
+ If a second process attempts to open the file, the open
+ is deferred while the redirector "breaks" the original
+ oplock. The oplock break signals the caching client to
+ write the local file back to the server, flush the
+ local locks, and discard read-ahead data. The break is
+ then complete, the deferred open is granted, and the
+ multiple processes can enjoy concurrent file access as
+ dictated by mandatory or byte-range locking options.
+ However, if the original opening process opened the
+ file with a share mode other than deny-none, then the
+ second process is granted limited or no access, despite
+ the oplock break.
+ </p></dd><dt><span class="term">Level2 Oplock:</span></dt><dd><p>
+ Performs like a level1 oplock, except caching is only
+ operative for reads. All other operations are performed
+ on the server disk copy of the file.
+ </p></dd><dt><span class="term">Filter Oplock:</span></dt><dd><p>
+ Does not allow write or delete file access
+ </p></dd><dt><span class="term">Batch Oplock:</span></dt><dd><p>
+ Manipulates file openings and closings - allows caching
+ of file attributes
+ </p></dd></dl></div><p>
+An important detail is that oplocks are invoked by the file system, not
+an application API. Therefore, an application can close an oplocked
+file, but the file system does not relinquish the oplock. When the
+oplock break is issued, the file system then simply closes the file in
+preparation for the subsequent open by the second process.
+</p><p>
+<span class="emphasis"><em>Opportunistic Locking</em></span> is actually an improper name for this feature.
+The true benefit of this feature is client-side data caching, and
+oplocks is merely a notification mechanism for writing data back to the
+networked storage disk. The limitation of opportunistic locking is the
+reliability of the mechanism to process an oplock break (notification)
+between the server and the caching client. If this exchange is faulty
+(usually due to timing out for any number of reasons) then the
+client-side caching benefit is negated.
+</p><p>
+The actual decision that a user or administrator should consider is
+whether it is sensible to share amongst multiple users data that will
+be cached locally on a client. In many cases the answer is no.
+Deciding when to cache or not cache data is the real question, and thus
+"opportunistic locking" should be treated as a toggle for client-side
+caching. Turn it "ON" when client-side caching is desirable and
+reliable. Turn it "OFF" when client-side caching is redundant,
+unreliable, or counter-productive.
+</p><p>
+Opportunistic locking is by default set to "on" by Samba on all
+configured shares, so careful attention should be given to each case to
+determine if the potential benefit is worth the potential for delays.
+The following recommendations will help to characterize the environment
+where opportunistic locking may be effectively configured.
+</p><p>
+Windows Opportunistic Locking is a lightweight performance-enhancing
+feature. It is not a robust and reliable protocol. Every
+implementation of Opportunistic Locking should be evaluated as a
+tradeoff between perceived performance and reliability. Reliability
+decreases as each successive rule above is not enforced. Consider a
+share with oplocks enabled, over a wide area network, to a client on a
+South Pacific atoll, on a high-availability server, serving a
+mission-critical multi-user corporate database, during a tropical
+storm. This configuration will likely encounter problems with oplocks.
+</p><p>
+Oplocks can be beneficial to perceived client performance when treated
+as a configuration toggle for client-side data caching. If the data
+caching is likely to be interrupted, then oplock usage should be
+reviewed. Samba enables opportunistic locking by default on all
+shares. Careful attention should be given to the client usage of
+shared data on the server, the server network reliability, and the
+opportunistic locking configuration of each share.
+n mission critical high availability environments, data integrity is
+often a priority. Complex and expensive configurations are implemented
+to ensure that if a client loses connectivity with a file server, a
+failover replacement will be available immediately to provide
+continuous data availability.
+</p><p>
+Windows client failover behavior is more at risk of application
+interruption than other platforms because it is dependant upon an
+established TCP transport connection. If the connection is interrupted
+- as in a file server failover - a new session must be established.
+It is rare for Windows client applications to be coded to recover
+correctly from a transport connection loss, therefore most applications
+will experience some sort of interruption - at worst, abort and
+require restarting.
+</p><p>
+If a client session has been caching writes and reads locally due to
+opportunistic locking, it is likely that the data will be lost when the
+application restarts, or recovers from the TCP interrupt. When the TCP
+connection drops, the client state is lost. When the file server
+recovers, an oplock break is not sent to the client. In this case, the
+work from the prior session is lost. Observing this scenario with
+oplocks disabled, and the client was writing data to the file server
+real-time, then the failover will provide the data on disk as it
+existed at the time of the disconnect.
+</p><p>
+In mission critical high availability environments, careful attention
+should be given to opportunistic locking. Ideally, comprehensive
+testing should be done with all affected applications with oplocks
+enabled and disabled.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907180"></a>Exclusively Accessed Shares</h4></div></div><div></div></div><p>
+Opportunistic locking is most effective when it is confined to shares
+that are exclusively accessed by a single user, or by only one user at
+a time. Because the true value of opportunistic locking is the local
+client caching of data, any operation that interrupts the caching
+mechanism will cause a delay.
+</p><p>
+Home directories are the most obvious examples of where the performance
+benefit of opportunistic locking can be safely realized.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907206"></a>Multiple-Accessed Shares or Files</h4></div></div><div></div></div><p>
+As each additional user accesses a file in a share with opportunistic
+locking enabled, the potential for delays and resulting perceived poor
+performance increases. When multiple users are accessing a file on a
+share that has oplocks enabled, the management impact of sending and
+receiving oplock breaks, and the resulting latency while other clients
+wait for the caching client to flush data, offset the performance gains
+of the caching user.
+</p><p>
+As each additional client attempts to access a file with oplocks set,
+the potential performance improvement is negated and eventually results
+in a performance bottleneck.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907234"></a>Unix or NFS Client Accessed Files</h4></div></div><div></div></div><p>
+Local Unix and NFS clients access files without a mandatory
+file locking mechanism. Thus, these client platforms are incapable of
+initiating an oplock break request from the server to a Windows client
+that has a file cached. Local Unix or NFS file access can therefore
+write to a file that has been cached by a Windows client, which
+exposes the file to likely data corruption.
+</p><p>
+If files are shared between Windows clients, and either loca Unix
+or NFS users, then turn opportunistic locking off.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907261"></a>Slow and/or Unreliable Networks</h4></div></div><div></div></div><p>
+The biggest potential performance improvement for opportunistic locking
+occurs when the client-side caching of reads and writes delivers the
+most differential over sending those reads and writes over the wire.
+This is most likely to occur when the network is extremely slow,
+congested, or distributed (as in a WAN). However, network latency also
+has a very high impact on the reliability of the oplock break
+mechanism, and thus increases the likelihood of encountering oplock
+problems that more than offset the potential perceived performance
+gain. Of course, if an oplock break never has to be sent, then this is
+the most advantageous scenario to utilize opportunistic locking.
+</p><p>
+If the network is slow, unreliable, or a WAN, then do not configure
+opportunistic locking if there is any chance of multiple users
+regularly opening the same file.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907294"></a>Multi-User Databases</h4></div></div><div></div></div><p>
+Multi-user databases clearly pose a risk due to their very nature -
+they are typically heavily accessed by numerous users at random
+intervals. Placing a multi-user database on a share with opportunistic
+locking enabled will likely result in a locking management bottleneck
+on the Samba server. Whether the database application is developed
+in-house or a commercially available product, ensure that the share
+has opportunistic locking disabled.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907315"></a>PDM Data Shares</h4></div></div><div></div></div><p>
+Process Data Management (PDM) applications such as IMAN, Enovia, and
+Clearcase, are increasing in usage with Windows client platforms, and
+therefore SMB data stores. PDM applications manage multi-user
+environments for critical data security and access. The typical PDM
+environment is usually associated with sophisticated client design
+applications that will load data locally as demanded. In addition, the
+PDM application will usually monitor the data-state of each client.
+In this case, client-side data caching is best left to the local
+application and PDM server to negotiate and maintain. It is
+appropriate to eliminate the client OS from any caching tasks, and the
+server from any oplock management, by disabling opportunistic locking on
+the share.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907342"></a>Beware of Force User</h4></div></div><div></div></div><p>
+Samba includes an <tt class="filename">smb.conf</tt> parameter called <i class="parameter"><tt>force user</tt></i> that changes
+the user accessing a share from the incoming user to whatever user is
+defined by the smb.conf variable. If opportunistic locking is enabled
+on a share, the change in user access causes an oplock break to be sent
+to the client, even if the user has not explicitly loaded a file. In
+cases where the network is slow or unreliable, an oplock break can
+become lost without the user even accessing a file. This can cause
+apparent performance degradation as the client continually reconnects
+to overcome the lost oplock break.
+</p><p>
+Avoid the combination of the following:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ <i class="parameter"><tt>force user</tt></i> in the <tt class="filename">smb.conf</tt> share configuration.
+ </p></li><li><p>
+ Slow or unreliable networks
+ </p></li><li><p>
+ Opportunistic Locking Enabled
+ </p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907419"></a>Advanced Samba Opportunistic Locking Parameters</h4></div></div><div></div></div><p>
+Samba provides opportunistic locking parameters that allow the
+administrator to adjust various properties of the oplock mechanism to
+account for timing and usage levels. These parameters provide good
+versatility for implementing oplocks in environments where they would
+likely cause problems. The parameters are:
+<i class="parameter"><tt>oplock break wait time</tt></i>,
+<i class="parameter"><tt>oplock contention limit</tt></i>.
+</p><p>
+For most users, administrators, and environments, if these parameters
+are required, then the better option is to simply turn oplocks off.
+The samba SWAT help text for both parameters reads "DO NOT CHANGE THIS
+PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE."
+This is good advice.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907462"></a>Mission Critical High Availability</h4></div></div><div></div></div><p>
+In mission critical high availability environments, data integrity is
+often a priority. Complex and expensive configurations are implemented
+to ensure that if a client loses connectivity with a file server, a
+failover replacement will be available immediately to provide
+continuous data availability.
+</p><p>
+Windows client failover behavior is more at risk of application
+interruption than other platforms because it is dependant upon an
+established TCP transport connection. If the connection is interrupted
+- as in a file server failover - a new session must be established.
+It is rare for Windows client applications to be coded to recover
+correctly from a transport connection loss, therefore most applications
+will experience some sort of interruption - at worst, abort and
+require restarting.
+</p><p>
+If a client session has been caching writes and reads locally due to
+opportunistic locking, it is likely that the data will be lost when the
+application restarts, or recovers from the TCP interrupt. When the TCP
+connection drops, the client state is lost. When the file server
+recovers, an oplock break is not sent to the client. In this case, the
+work from the prior session is lost. Observing this scenario with
+oplocks disabled, and the client was writing data to the file server
+real-time, then the failover will provide the data on disk as it
+existed at the time of the disconnect.
+</p><p>
+In mission critical high availability environments, careful attention
+should be given to opportunistic locking. Ideally, comprehensive
+testing should be done with all affected applications with oplocks
+enabled and disabled.
+</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2907521"></a>Samba Opportunistic Locking Control</h2></div></div><div></div></div><p>
+Opportunistic Locking is a unique Windows file locking feature. It is
+not really file locking, but is included in most discussions of Windows
+file locking, so is considered a defacto locking feature.
+Opportunistic Locking is actually part of the Windows client file
+caching mechanism. It is not a particularly robust or reliable feature
+when implemented on the variety of customized networks that exist in
+enterprise computing.
+</p><p>
+Like Windows, Samba implements Opportunistic Locking as a server-side
+component of the client caching mechanism. Because of the lightweight
+nature of the Windows feature design, effective configuration of
+Opportunistic Locking requires a good understanding of its limitations,
+and then applying that understanding when configuring data access for
+each particular customized network and client usage state.
+</p><p>
+Opportunistic locking essentially means that the client is allowed to download and cache
+a file on their hard drive while making changes; if a second client wants to access the
+file, the first client receives a break and must synchronise the file back to the server.
+This can give significant performance gains in some cases; some programs insist on
+synchronising the contents of the entire file back to the server for a single change.
+</p><p>
+Level1 Oplocks (aka just plain "oplocks") is another term for opportunistic locking.
+</p><p>
+Level2 Oplocks provids opportunistic locking for a file that will be treated as
+<span class="emphasis"><em>read only</em></span>. Typically this is used on files that are read-only or
+on files that the client has no initial intention to write to at time of opening the file.
+</p><p>
+Kernel Oplocks are essentially a method that allows the Linux kernel to co-exist with
+Samba's oplocked files, although this has provided better integration of MS Windows network
+file locking with the under lying OS, SGI IRIX and Linux are the only two OS's that are
+oplock aware at this time.
+</p><p>
+Unless your system supports kernel oplocks, you should disable oplocks if you are
+accessing the same files from both Unix/Linux and SMB clients. Regardless, oplocks should
+always be disabled if you are sharing a database file (e.g., Microsoft Access) between
+multiple clients, as any break the first client receives will affect synchronisation of
+the entire file (not just the single record), which will result in a noticable performance
+impairment and, more likely, problems accessing the database in the first place. Notably,
+Microsoft Outlook's personal folders (*.pst) react very badly to oplocks. If in doubt,
+disable oplocks and tune your system from that point.
+</p><p>
+If client-side caching is desirable and reliable on your network, you will benefit from
+turning on oplocks. If your network is slow and/or unreliable, or you are sharing your
+files among other file sharing mechanisms (e.g., NFS) or across a WAN, or multiple people
+will be accessing the same files frequently, you probably will not benefit from the overhead
+of your client sending oplock breaks and will instead want to disable oplocks for the share.
+</p><p>
+Another factor to consider is the perceived performance of file access. If oplocks provide no
+measurable speed benefit on your network, it might not be worth the hassle of dealing with them.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2907630"></a>Example Configuration</h3></div></div><div></div></div><p>
+In the following we examine two destinct aspects of samba locking controls.
+</p><div xmlns:ns37="" class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907643"></a>Disabling Oplocks</h4></div></div><div></div></div><p>
+You can disable oplocks on a per-share basis with the following:
+</p><ns37:p>
+</ns37:p><pre class="programlisting">
+[acctdata]
+ oplocks = False
+ level2 oplocks = False
+</pre><ns37:p>
+</ns37:p><p>
+The default oplock type is Level1. Level2 Oplocks are enabled on a per-share basis
+in the <tt class="filename">smb.conf</tt> file.
+</p><p>
+Alternately, you could disable oplocks on a per-file basis within the share:
+</p><ns37:p>
+</ns37:p><pre class="programlisting">
+ veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/
+</pre><ns37:p>
+</ns37:p><p>
+If you are experiencing problems with oplocks as apparent from Samba's log entries,
+you may want to play it safe and disable oplocks and level2 oplocks.
+</p></div><div xmlns:ns38="" class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2907706"></a>Disabling Kernel OpLocks</h4></div></div><div></div></div><p>
+Kernel OpLocks is an <tt class="filename">smb.conf</tt> parameter that notifies Samba (if
+the UNIX kernel has the capability to send a Windows client an oplock
+break) when a UNIX process is attempting to open the file that is
+cached. This parameter addresses sharing files between UNIX and
+Windows with Oplocks enabled on the Samba server: the UNIX process
+can open the file that is Oplocked (cached) by the Windows client and
+the smbd process will not send an oplock break, which exposes the file
+to the risk of data corruption. If the UNIX kernel has the ability to
+send an oplock break, then the kernel oplocks parameter enables Samba
+to send the oplock break. Kernel oplocks are enabled on a per-server
+basis in the <tt class="filename">smb.conf</tt> file.
+</p><ns38:p>
+</ns38:p><pre class="programlisting">
+[global]
+kernel oplocks = yes
+</pre><ns38:p>
+The default is "no".
+</ns38:p><p>
+Veto OpLocks is an <tt class="filename">smb.conf</tt> parameter that identifies specific files for
+which Oplocks are disabled. When a Windows client opens a file that
+has been configured for veto oplocks, the client will not be granted
+the oplock, and all operations will be executed on the original file on
+disk instead of a client-cached file copy. By explicitly identifying
+files that are shared with UNIX processes, and disabling oplocks for
+those files, the server-wide Oplock configuration can be enabled to
+allow Windows clients to utilize the performance benefit of file
+caching without the risk of data corruption. Veto Oplocks can be
+enabled on a per-share basis, or globally for the entire server, in the
+<tt class="filename">smb.conf</tt> file:
+</p><ns38:p>
+</ns38:p><pre class="programlisting"><font color="red"><title>Example Veto OpLock Settings</title></font>
+[global]
+ veto oplock files = /filename.htm/*.txt/
+
+[share_name]
+ veto oplock files = /*.exe/filename.ext/
+</pre><ns38:p>
+</ns38:p><p>
+<span class="emphasis"><em>Oplock break wait time</em></span> is an <tt class="filename">smb.conf</tt> parameter that adjusts the time
+interval for Samba to reply to an oplock break request. Samba
+recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND
+UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be
+configured globally in the <tt class="filename">smb.conf</tt> file:
+</p><ns38:p>
+</ns38:p><pre class="programlisting">
+[global]
+ oplock break wait time = 0 (default)
+</pre><ns38:p>
+</ns38:p><p>
+<span class="emphasis"><em>Oplock break contention limit</em></span> is an <tt class="filename">smb.conf</tt> parameter that limits the
+response of the Samba server to grant an oplock if the configured
+number of contending clients reaches the limit specified by the
+parameter. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU
+HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break
+Contention Limit can be enable on a per-share basis, or globally for
+the entire server, in the <tt class="filename">smb.conf</tt> file:
+</p><ns38:p>
+</ns38:p><pre class="programlisting">
+[global]
+ oplock break contention limit = 2 (default)
+
+[share_name]
+ oplock break contention limit = 2 (default)
+</pre><ns38:p>
+</ns38:p></div></div></div><div xmlns:ns39="" class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2907890"></a>MS Windows Opportunistic Locking and Caching Controls</h2></div></div><div></div></div><p>
+There is a known issue when running applications (like Norton Anti-Virus) on a Windows 2000/ XP
+workstation computer that can affect any application attempting to access shared database files
+across a network. This is a result of a default setting configured in the Windows 2000/XP
+operating system known as <span class="emphasis"><em>Opportunistic Locking</em></span>. When a workstation
+attempts to access shared data files located on another Windows 2000/XP computer,
+the Windows 2000/XP operating system will attempt to increase performance by locking the
+files and caching information locally. When this occurs, the application is unable to
+properly function, which results in an <span class="errorname">Access Denied</span>
+ error message being displayed during network operations.
+</p><p>
+All Windows operating systems in the NT family that act as database servers for data files
+(meaning that data files are stored there and accessed by other Windows PCs) may need to
+have opportunistic locking disabled in order to minimize the risk of data file corruption.
+This includes Windows 9x/Me, Windows NT, Windows 200x and Windows XP.
+</p><p>
+If you are using a Windows NT family workstation in place of a server, you must also
+disable opportunistic locking (oplocks) on that workstation. For example, if you use a
+PC with the Windows NT Workstation operating system instead of Windows NT Server, and you
+have data files located on it that are accessed from other Windows PCs, you may need to
+disable oplocks on that system.
+</p><p>
+The major difference is the location in the Windows registry where the values for disabling
+oplocks are entered. Instead of the LanManServer location, the LanManWorkstation location
+may be used.
+</p><p>
+You can verify (or change or add, if necessary) this Registry value using the Windows
+Registry Editor. When you change this registry value, you will have to reboot the PC
+to ensure that the new setting goes into effect.
+</p><p>
+The location of the client registry entry for opportunistic locking has changed in
+Windows 2000 from the earlier location in Microsoft Windows NT.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Windows 2000 will still respect the EnableOplocks registry value used to disable oplocks
+in earlier versions of Windows.
+</p></div><p>
+You can also deny the granting of opportunistic locks by changing the following registry entries:
+</p><ns39:p>
+</ns39:p><pre class="programlisting">
+ HKEY_LOCAL_MACHINE\System\
+ CurrentControlSet\Services\MRXSmb\Parameters\
+
+ OplocksDisabled REG_DWORD 0 or 1
+ Default: 0 (not disabled)
+</pre><ns39:p>
+</ns39:p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The OplocksDisabled registry value configures Windows clients to either request or not
+request opportunistic locks on a remote file. To disable oplocks, the value of
+ OplocksDisabled must be set to 1.
+</p></div><ns39:p>
+</ns39:p><pre class="programlisting">
+ HKEY_LOCAL_MACHINE\System\
+ CurrentControlSet\Services\LanmanServer\Parameters
+
+ EnableOplocks REG_DWORD 0 or 1
+ Default: 1 (Enabled by Default)
+
+ EnableOpLockForceClose REG_DWORD 0 or 1
+ Default: 0 (Disabled by Default)
+</pre><ns39:p>
+</ns39:p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The EnableOplocks value configures Windows-based servers (including Workstations sharing
+files) to allow or deny opportunistic locks on local files.
+</p></div><p>
+To force closure of open oplocks on close or program exit EnableOpLockForceClose must be set to 1.
+</p><p>
+An illustration of how level II oplocks work:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Station 1 opens the file, requesting oplock.
+ </p></li><li><p>
+ Since no other station has the file open, the server grants station 1 exclusive oplock.
+ </p></li><li><p>
+ Station 2 opens the file, requesting oplock.
+ </p></li><li><p>
+ Since station 1 has not yet written to the file, the server asks station 1 to Break
+ to Level II Oplock.
+ </p></li><li><p>
+ Station 1 complies by flushing locally buffered lock information to the server.
+ </p></li><li><p>
+ Station 1 informs the server that it has Broken to Level II Oplock (alternatively,
+ station 1 could have closed the file).
+ </p></li><li><p>
+ The server responds to station 2's open request, granting it level II oplock.
+ Other stations can likewise open the file and obtain level II oplock.
+ </p></li><li><p>
+ Station 2 (or any station that has the file open) sends a write request SMB.
+ The server returns the write response.
+ </p></li><li><p>
+ The server asks all stations that have the file open to Break to None, meaning no
+ station holds any oplock on the file. Because the workstations can have no cached
+ writes or locks at this point, they need not respond to the break-to-none advisory;
+ all they need do is invalidate locally cashed read-ahead data.
+ </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2910326"></a>Workstation Service Entries</h3></div></div><div></div></div><pre class="programlisting">
+ \HKEY_LOCAL_MACHINE\System\
+ CurrentControlSet\Services\LanmanWorkstation\Parameters
+
+ UseOpportunisticLocking REG_DWORD 0 or 1
+ Default: 1 (true)
+</pre><p>
+Indicates whether the redirector should use opportunistic-locking (oplock) performance
+enhancement. This parameter should be disabled only to isolate problems.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2910353"></a>Server Service Entries</h3></div></div><div></div></div><pre class="programlisting">
+ \HKEY_LOCAL_MACHINE\System\
+ CurrentControlSet\Services\LanmanServer\Parameters
+
+ EnableOplocks REG_DWORD 0 or 1
+ Default: 1 (true)
+</pre><p>
+Specifies whether the server allows clients to use oplocks on files. Oplocks are a
+significant performance enhancement, but have the potential to cause lost cached
+data on some networks, particularly wide-area networks.
+</p><pre class="programlisting">
+ MinLinkThroughput REG_DWORD 0 to infinite bytes per second
+ Default: 0
+</pre><p>
+Specifies the minimum link throughput allowed by the server before it disables
+raw and opportunistic locks for this connection.
+</p><pre class="programlisting">
+ MaxLinkDelay REG_DWORD 0 to 100,000 seconds
+ Default: 60
+</pre><p>
+Specifies the maximum time allowed for a link delay. If delays exceed this number,
+the server disables raw I/O and opportunistic locking for this connection.
+</p><pre class="programlisting">
+ OplockBreakWait REG_DWORD 10 to 180 seconds
+ Default: 35
+</pre><p>
+Specifies the time that the server waits for a client to respond to an oplock break
+request. Smaller values can allow detection of crashed clients more quickly but can
+potentially cause loss of cached data.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2910432"></a>Persistent Data Corruption</h2></div></div><div></div></div><p>
+If you have applied all of the settings discussed in this paper but data corruption problems
+and other symptoms persist, here are some additional things to check out:
+</p><p>
+We have credible reports from developers that faulty network hardware, such as a single
+faulty network card, can cause symptoms similar to read caching and data corruption.
+If you see persistent data corruption even after repeated reindexing, you may have to
+rebuild the data files in question. This involves creating a new data file with the
+same definition as the file to be rebuilt and transferring the data from the old file
+to the new one. There are several known methods for doing this that can be found in
+our Knowledge Base.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2910463"></a>Common Errors</h2></div></div><div></div></div><p>
+In some sites locking problems surface as soon as a server is installed, in other sites
+locking problems may not surface for a long time. Almost without exeception, when a locking
+problem does surface it will cause embarassment and potential data corruption.
+</p><p>
+Over the past few years there have been a number of complaints on the samba mailing lists
+that have claimed that samba caused data corruption. Three causes have been identified
+so far:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Incorrect configuration of opportunistic locking (incompatible with the application
+ being used. This is a VERY common problem even where MS Windows NT4 or MS Windows 200x
+ based servers were in use. It is imperative that the software application vendors'
+ instructions for configuration of file locking should be followed. If in doubt,
+ disable oplocks on both the server and the client. Disabling of all forms of file
+ caching on the MS Windows client may be necessary also.
+ </p></li><li><p>
+ Defective network cards, cables, or HUBs / Switched. This is generally a more
+ prevalent factor with low cost networking hardware, though occasionally there
+ have been problems with incompatibilities in more up market hardware also.
+ </p></li><li><p>
+ There have been some random reports of samba log files being written over data
+ files. This has been reported by very few sites (about 5 in the past 3 years)
+ and all attempts to reproduce the problem have failed. The Samba-Team has been
+ unable to catch this happening and thus has NOT been able to isolate any particular
+ cause. Considering the millions of systems that use samba, for the sites that have
+ been affected by this as well as for the Samba-Team this is a frustrating and
+ a vexing challenge. If you see this type of thing happening please create a bug
+ report on https://bugzilla.samba.org without delay. Make sure that you give as much
+ information as you possibly can to help isolate the cause and to allow reproduction
+ of the problem (an essential step in problem isolation and correction).
+ </p></li></ul></div><div xmlns:ns40="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2910536"></a>locking.tdb error messages</h3></div></div><div></div></div><ns40:p>
+ </ns40:p><pre class="screen">
+ > We are seeing lots of errors in the samba logs like:
+ >
+ > tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic
+ > 0x4d6f4b61 at offset=36116
+ >
+ > What do these mean?
+ </pre><ns40:p>
+ </ns40:p><p>
+ Corrupted tdb. Stop all instancesd of smbd, delete locking.tdb, restart smbd.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2910566"></a>Additional Reading</h2></div></div><div></div></div><p>
+You may want to check for an updated version of this white paper on our Web site from
+time to time. Many of our white papers are updated as information changes. For those papers,
+the Last Edited date is always at the top of the paper.
+</p><p>
+Section of the Microsoft MSDN Library on opportunistic locking:
+</p><p>
+Opportunistic Locks, Microsoft Developer Network (MSDN), Windows Development >
+Windows Base Services > Files and I/O > SDK Documentation > File Storage > File Systems
+> About File Systems > Opportunistic Locks, Microsoft Corporation.
+<a href="http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp" target="_top">http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp</a>
+</p><p>
+Microsoft Knowledge Base Article Q224992 "Maintaining Transactional Integrity with OPLOCKS",
+Microsoft Corporation, April 1999, <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992" target="_top">http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992</a>.
+</p><p>
+Microsoft Knowledge Base Article Q296264 "Configuring Opportunistic Locking in Windows 2000",
+Microsoft Corporation, April 2001, <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264" target="_top">http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264</a>.
+</p><p>
+Microsoft Knowledge Base Article Q129202 "PC Ext: Explanation of Opportunistic Locking on Windows NT",
+ Microsoft Corporation, April 1995, <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202" target="_top">http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202</a>.
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="securing-samba"></a>Chapter 15. Securing Samba</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:tridge@samba.org">tridge@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">May 26, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2911991">Introduction</a></dt><dt><a href="#id2912024">Features and Benefits</a></dt><dt><a href="#id2910684">Technical Discussion of Protective Measures and Issues</a></dt><dd><dl><dt><a href="#id2910702">Using host based protection</a></dt><dt><a href="#id2910771">User based protection</a></dt><dt><a href="#id2910822">Using interface protection</a></dt><dt><a href="#id2910872">Using a firewall</a></dt><dt><a href="#id2910929">Using a IPC$ share deny</a></dt><dt><a href="#id2910994">NTLMv2 Security</a></dt></dl></dd><dt><a href="#id2911033">Upgrading Samba</a></dt><dt><a href="#id2911056">Common Errors</a></dt><dd><dl><dt><a href="#id2911075">Smbclient works on localhost, but the network is dead</a></dt><dt><a href="#id2911100">Why can users access home directories of other users?</a></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911991"></a>Introduction</h2></div></div><div></div></div><p>
+This note was attached to the Samba 2.2.8 release notes as it contained an
+important security fix. The information contained here applies to Samba
+installations in general.
+</p><p>
+A new apprentice reported for duty to the Chief Engineer of a boiler house. He said, "Here I am,
+if you will show me the boiler I'll start working on it." Then engineer replied, "You're leaning
+on it!"
+</p><p>
+Security concerns are just like that: You need to know a little about the subject to appreciate
+how obvious most of it really is. The challenge for most of us is to discover that first morsel
+of knowledge with which we may unlock the secrets of the masters.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2912024"></a>Features and Benefits</h2></div></div><div></div></div><p>
+There are three level at which security principals must be observed in order to render a site
+at least moderately secure. These are: the perimeter firewall, the configuration of the host
+server that is running Samba, and Samba itself.
+</p><p>
+Samba permits a most flexible approach to network security. As far as possible Samba implements
+the latest protocols to permit more secure MS Windows file and print operations.
+</p><p>
+Samba may be secured from connections that originate from outside the local network. This may be
+done using <span class="emphasis"><em>host based protection</em></span> (using samba's implementation of a technology
+known as "tcpwrappers", or it may be done be using <span class="emphasis"><em>interface based exclusion</em></span>
+so that <span class="application">smbd</span> will bind only to specifically permitted interfaces. It is also
+possible to set specific share or resource based exclusions, eg: on the <i class="parameter"><tt>IPC$</tt></i>
+auto-share. The <i class="parameter"><tt>IPC$</tt></i> share is used for browsing purposes as well as to establish
+TCP/IP connections.
+</p><p>
+Another method by which Samba may be secured is by way of setting Access Control Entries in an Access
+Control List on the shares themselves. This is discussed in the chapter on File, Directory and Share Access
+Control.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2910684"></a>Technical Discussion of Protective Measures and Issues</h2></div></div><div></div></div><p>
+The key challenge of security is the fact that protective measures suffice at best
+only to close the door on known exploits and breach techniques. Never assume that
+because you have followed these few measures that the Samba server is now an impenetrable
+fortress! Given the history of information systems so far, it is only a matter of time
+before someone will find yet another vulnerability.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2910702"></a>Using host based protection</h3></div></div><div></div></div><p>
+ In many installations of Samba the greatest threat comes for outside
+ your immediate network. By default Samba will accept connections from
+ any host, which means that if you run an insecure version of Samba on
+ a host that is directly connected to the Internet you can be
+ especially vulnerable.
+ </p><p>
+ One of the simplest fixes in this case is to use the <i class="parameter"><tt>hosts allow</tt></i> and
+ <i class="parameter"><tt>hosts deny</tt></i> options in the Samba <tt class="filename">smb.conf</tt> configuration file to only
+ allow access to your server from a specific range of hosts. An example
+ might be:
+ </p><pre class="programlisting">
+ hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
+ hosts deny = 0.0.0.0/0
+ </pre><p>
+ The above will only allow SMB connections from 'localhost' (your own
+ computer) and from the two private networks 192.168.2 and
+ 192.168.3. All other connections will be refused as soon
+ as the client sends its first packet. The refusal will be marked as a
+ <span class="errorname">not listening on called name</span> error.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2910771"></a>User based protection</h3></div></div><div></div></div><p>
+ If you want to restrict access to your server to valid users only then the following
+ method may be of use. In the <tt class="filename">smb.conf</tt> <i class="parameter"><tt>[globals]</tt></i> section put:
+ </p><pre class="programlisting">
+ valid users = @smbusers, jacko
+ </pre><p>
+ What this does is, it restricts all server access to either the user <span class="emphasis"><em>jacko</em></span>
+ or to members of the system group <span class="emphasis"><em>smbusers</em></span>.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2910822"></a>Using interface protection</h3></div></div><div></div></div><p>
+ By default Samba will accept connections on any network interface that
+ it finds on your system. That means if you have a ISDN line or a PPP
+ connection to the Internet then Samba will accept connections on those
+ links. This may not be what you want.
+ </p><p>
+ You can change this behaviour using options like the following:
+ </p><pre class="programlisting">
+ interfaces = eth* lo
+ bind interfaces only = yes
+ </pre><p>
+ This tells Samba to only listen for connections on interfaces with a
+ name starting with 'eth' such as eth0, eth1, plus on the loopback
+ interface called 'lo'. The name you will need to use depends on what
+ OS you are using, in the above I used the common name for Ethernet
+ adapters on Linux.
+ </p><p>
+ If you use the above and someone tries to make a SMB connection to
+ your host over a PPP interface called 'ppp0' then they will get a TCP
+ connection refused reply. In that case no Samba code is run at all as
+ the operating system has been told not to pass connections from that
+ interface to any samba process.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2910872"></a>Using a firewall</h3></div></div><div></div></div><p>
+ Many people use a firewall to deny access to services that they don't
+ want exposed outside their network. This can be a very good idea,
+ although I would recommend using it in conjunction with the above
+ methods so that you are protected even if your firewall is not active
+ for some reason.
+ </p><p>
+ If you are setting up a firewall then you need to know what TCP and
+ UDP ports to allow and block. Samba uses the following:
+ </p><table class="simplelist" border="0" summary="Simple list"><tr><td>UDP/137 - used by nmbd</td></tr><tr><td>UDP/138 - used by nmbd</td></tr><tr><td>TCP/139 - used by smbd</td></tr><tr><td>TCP/445 - used by smbd</td></tr></table><p>
+ The last one is important as many older firewall setups may not be
+ aware of it, given that this port was only added to the protocol in
+ recent years.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2910929"></a>Using a IPC$ share deny</h3></div></div><div></div></div><p>
+ If the above methods are not suitable, then you could also place a
+ more specific deny on the IPC$ share that is used in the recently
+ discovered security hole. This allows you to offer access to other
+ shares while denying access to IPC$ from potentially untrustworthy
+ hosts.
+ </p><p>
+ To do that you could use:
+ </p><pre class="programlisting">
+[ipc$]
+ hosts allow = 192.168.115.0/24 127.0.0.1
+ hosts deny = 0.0.0.0/0
+ </pre><p>
+ this would tell Samba that IPC$ connections are not allowed from
+ anywhere but the two listed places (localhost and a local
+ subnet). Connections to other shares would still be allowed. As the
+ IPC$ share is the only share that is always accessible anonymously
+ this provides some level of protection against attackers that do not
+ know a username/password for your host.
+ </p><p>
+ If you use this method then clients will be given a <span class="errorname">access denied</span>
+ reply when they try to access the IPC$ share. That means that those
+ clients will not be able to browse shares, and may also be unable to
+ access some other resources.
+ </p><p>
+ This is not recommended unless you cannot use one of the other
+ methods listed above for some reason.
+ </p></div><div xmlns:ns41="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2910994"></a>NTLMv2 Security</h3></div></div><div></div></div><p>
+ To configure NTLMv2 authentication the following registry keys are worth knowing about:
+ </p><ns41:p>
+ </ns41:p><pre class="screen">
+ [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
+ "lmcompatibilitylevel"=dword:00000003
+
+ 0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication,
+ use NTLMv2 session security if the server supports it. Domain
+ controllers accept LM, NTLM and NTLMv2 authentication.
+
+ [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
+ "NtlmMinClientSec"=dword:00080000
+
+ 0x80000 - NTLMv2 session security. If either NtlmMinClientSec or
+ NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2
+ session security is not negotiated.
+ </pre><ns41:p>
+ </ns41:p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911033"></a>Upgrading Samba</h2></div></div><div></div></div><p>
+Please check regularly on <a href="http://www.samba.org/" target="_top">http://www.samba.org/</a> for updates and
+important announcements. Occasionally security releases are made and
+it is highly recommended to upgrade Samba when a security vulnerability
+is discovered.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911056"></a>Common Errors</h2></div></div><div></div></div><p>
+If all of samba and host platform configuration were really as intuitive as one might like then this
+section would not be necessary. Security issues are often vexing for a support person to resolve, not
+because of the complexity of the problem, but for reason that most admininstrators who post what turns
+out to be a security problem request are totally convinced that the problem is with Samba.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2911075"></a>Smbclient works on localhost, but the network is dead</h3></div></div><div></div></div><p>
+ This is a very common problem. Red Hat Linux (as do others) will install a default firewall.
+ With the default firewall in place only traffic on the loopback adapter (IP address 127.0.0.1)
+ will be allowed through the firewall.
+ </p><p>
+ The solution is either to remove the firewall (stop it) or to modify the firewall script to
+ allow SMB networking traffic through. See section above in this chapter.
+ </p></div><div xmlns:ns42="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2911100"></a>Why can users access home directories of other users?</h3></div></div><div></div></div><p>
+ “<span class="quote">
+ We are unable to keep individual users from mapping to any other user's
+ home directory once they have supplied a valid password! They only need
+ to enter their own password. I have not found *any* method that I can
+ use to configure samba to enforce that only a user may map their own
+ home directory.
+ </span>”
+ </p><p>“<span class="quote">
+ User xyzzy can map his home directory. Once mapped user xyzzy can also map
+ *anyone* elses home directory!
+ </span>”</p><p>
+ This is not a security flaw, it is by design. Samba allows
+ users to have *exactly* the same access to the UNIX filesystem
+ as they would if they were logged onto the UNIX box, except
+ that it only allows such views onto the file system as are
+ allowed by the defined shares.
+ </p><p>
+ This means that if your UNIX home directories are set up
+ such that one user can happily cd into another users
+ directory and do an ls, the UNIX security solution is to
+ change the UNIX file permissions on the users home directories
+ such that the cd and ls would be denied.
+ </p><p>
+ Samba tries very hard not to second guess the UNIX administrators
+ security policies, and trusts the UNIX admin to set
+ the policies and permissions he or she desires.
+ </p><p>
+ Samba does allow the setup you require when you have set the
+ <i class="parameter"><tt>only user = yes</tt></i> option on the share, is that you have not set the
+ valid users list for the share.
+ </p><ns42:p>
+ Note that only user works in conjunction with the users= list,
+ so to get the behavior you require, add the line :
+ </ns42:p><pre class="programlisting">
+ users = %S
+ </pre><ns42:p>
+ this is equivalent to:
+ </ns42:p><pre class="programlisting">
+ valid users = %S
+ </pre><ns42:p>
+ to the definition of the <i class="parameter"><tt>[homes]</tt></i> share, as recommended in
+ the <tt class="filename">smb.conf</tt> man page.
+ </ns42:p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="InterdomainTrusts"></a>Chapter 16. Interdomain Trust Relationships</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Rafal</span> <span class="surname">Szczesniak</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:mimir@samba.org">mimir@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2911618">Features and Benefits</a></dt><dt><a href="#id2911646">Trust Relationship Background</a></dt><dt><a href="#id2911730">Native MS Windows NT4 Trusts Configuration</a></dt><dd><dl><dt><a href="#id2911742">NT4 as the Trusting Domain (ie. creating the trusted account)</a></dt><dt><a href="#id2913717">NT4 as the Trusted Domain (ie. creating trusted account's password)</a></dt></dl></dd><dt><a href="#id2913754">Configuring Samba NT-style Domain Trusts</a></dt><dd><dl><dt><a href="#id2913781">Samba-3 as the Trusting Domain</a></dt><dt><a href="#id2913908">Samba-3 as the Trusted Domain</a></dt></dl></dd><dt><a href="#id2911286">Common Errors</a></dt><dd><dl><dt><a href="#id2911301">Tell me about Trust Relationships using Samba</a></dt></dl></dd></dl></div><p>
+Samba-3 supports NT4 style domain trust relationships. This is feature that many sites
+will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to
+adopt Active Directory or an LDAP based authentication back end. This section explains
+some background information regarding trust relationships and how to create them. It is now
+possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911618"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style
+trust relationships. This imparts to Samba similar scalability as is possible with
+MS Windows NT4.
+</p><p>
+Given that Samba-3 has the capability to function with a scalable backend authentication
+database such as LDAP, and given it's ability to run in Primary as well as Backup Domain control
+modes, the administrator would be well advised to consider alternatives to the use of
+Interdomain trusts simplt because by the very nature of how this works it is fragile.
+That was after all a key reason for the development and adoption of Microsoft Active Directory.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911646"></a>Trust Relationship Background</h2></div></div><div></div></div><p>
+MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure.
+The limitations of this architecture as it affects the scalability of MS Windows networking
+in large organisations is well known. Additionally, the flat-name space that results from
+this design significantly impacts the delegation of administrative responsibilities in
+large and diverse organisations.
+</p><p>
+Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means
+of circumventing the limitations of the older technologies. Not every organisation is ready
+or willing to embrace ADS. For small companies the older NT4 style domain security paradigm
+is quite adequate, there thus remains an entrenched user base for whom there is no direct
+desire to go through a disruptive change to adopt ADS.
+</p><p>
+Microsoft introduced with MS Windows NT the ability to allow differing security domains
+to affect a mechanism so that users from one domain may be given access rights and privileges
+in another domain. The language that describes this capability is couched in terms of
+<span class="emphasis"><em>Trusts</em></span>. Specifically, one domain will <span class="emphasis"><em>trust</em></span> the users
+from another domain. The domain from which users are available to another security domain is
+said to be a trusted domain. The domain in which those users have assigned rights and privileges
+is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only,
+thus if users in both domains are to have privileges and rights in each others' domain, then it is
+necessary to establish two (2) relationships, one in each direction.
+</p><p>
+In an NT4 style MS security domain, all trusts are non-transitive. This means that if there
+are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust
+relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no
+implied trust between the RED and BLUE domains. ie: Relationships are explicit and not
+transitive.
+</p><p>
+New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way
+by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE
+domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is
+an inherent feature of ADS domains. Samba-3 implements MS Windows NT4
+style Interdomain trusts and interoperates with MS Windows 200x ADS
+security domains in similar manner to MS Windows NT4 style domains.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911730"></a>Native MS Windows NT4 Trusts Configuration</h2></div></div><div></div></div><p>
+There are two steps to creating an interdomain trust relationship.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2911742"></a>NT4 as the Trusting Domain (ie. creating the trusted account)</h3></div></div><div></div></div><p>
+For MS Windows NT4, all domain trust relationships are configured using the
+<span class="application">Domain User Manager</span>. To affect a two way trust relationship it is
+necessary for each domain administrator to make available (for use by an external domain) it's
+security resources. This is done from the Domain User Manager Policies entry on the menu bar.
+From the <span class="guimenu">Policy</span> menu, select <span class="guimenuitem">Trust Relationships</span>, then
+next to the lower box that is labelled <span class="guilabel">Permitted to Trust this Domain</span> are two
+buttons, <span class="guibutton">Add</span> and <span class="guibutton">Remove</span>. The <span class="guibutton">Add</span>
+button will open a panel in which needs to be entered the remote domain that will be able to assign
+user rights to your domain. In addition it is necessary to enter a password
+that is specific to this trust relationship. The password needs to be
+typed twice (for standard confirmation).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2913717"></a>NT4 as the Trusted Domain (ie. creating trusted account's password)</h3></div></div><div></div></div><p>
+A trust relationship will work only when the other (trusting) domain makes the appropriate connections
+with the trusted domain. To consumate the trust relationship the administrator will launch the
+Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the
+<span class="guibutton">Add</span> button that is next to the box that is labelled
+<span class="guilabel">Trusted Domains</span>. A panel will open in which must be entered the name of the remote
+domain as well as the password assigned to that trust.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2913754"></a>Configuring Samba NT-style Domain Trusts</h2></div></div><div></div></div><p>
+This description is meant to be a fairly short introduction about how to set up a Samba server so
+that it could participate in interdomain trust relationships. Trust relationship support in Samba
+is in its early stage, so lot of things don't work yet.
+</p><p>
+Each of the procedures described below is treated as they were performed with Windows NT4 Server on
+one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after
+reading this document, that combining Samba-specific parts of what's written below leads to trust
+between domains in purely Samba environment.
+</p><div xmlns:ns43="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2913781"></a>Samba-3 as the Trusting Domain</h3></div></div><div></div></div><p>
+In order to set the Samba PDC to be the trusted party of the relationship first you need
+to create special account for the domain that will be the trusting party. To do that,
+you can use the 'smbpasswd' utility. Creating the trusted domain account is very
+similiar to creating a trusted machine account. Suppose, your domain is
+called SAMBA, and the remote domain is called RUMBA. The first step
+will be to issue this command from your favourite shell:
+</p><ns43:p>
+</ns43:p><pre class="screen">
+<tt class="prompt">root# </tt> <b class="userinput"><tt>smbpasswd -a -i rumba</tt></b>
+ New SMB password: XXXXXXXX
+ Retype SMB password: XXXXXXXX
+ Added user rumba$
+</pre><ns43:p>
+
+where <tt class="option">-a</tt> means to add a new account into the
+passdb database and <tt class="option">-i</tt> means: ''create this
+account with the InterDomain trust flag''
+</ns43:p><p>
+The account name will be 'rumba$' (the name of the remote domain)
+</p><p>
+After issuing this command you'll be asked to enter the password for
+the account. You can use any password you want, but be aware that Windows NT will
+not change this password until 7 days following account creation.
+After the command returns successfully, you can look at the entry for the new account
+(in the stardard way depending on your configuration) and see that account's name is
+really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm
+the trust by establishing it from Windows NT Server.
+</p><p>
+Open <span class="application">User Manager for Domains</span> and from menu
+<span class="guimenu">Policies</span> select <span class="guimenuitem">Trust Relationships...</span>.
+Right beside <span class="guilabel">Trusted domains</span> list box press the
+<span class="guimenu">Add...</span> button. You will be prompted for
+the trusted domain name and the relationship password. Type in SAMBA, as this is
+your domain name, and the password used at the time of account creation.
+Press OK and, if everything went without incident, you will see
+<tt class="computeroutput">Trusted domain relationship successfully
+established</tt> message.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2913908"></a>Samba-3 as the Trusted Domain</h3></div></div><div></div></div><p>
+This time activities are somewhat reversed. Again, we'll assume that your domain
+controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA.
+</p><p>
+The very first thing requirement is to add an account for the SAMBA domain on RUMBA's PDC.
+</p><p>
+Launch the <span class="application">Domain User Manager</span>, then from the menu select
+<span class="guimenu">Policies</span>, <span class="guimenuitem">Trust Relationships</span>.
+Now, next to <span class="guilabel">Trusted Domains</span> box press the <span class="guibutton">Add</span>
+button, and type in the name of the trusted domain (SAMBA) and password securing
+the relationship.
+</p><p>
+The password can be arbitrarily chosen. It is easy to change the password
+from the Samba server whenever you want. After confirming the password your account is
+ready for use. Now it's Samba's turn.
+</p><p>
+Using your favourite shell while being logged in as root, issue this command:
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>net rpc trustdom establish rumba</tt></b>
+</p><p>
+You will be prompted for the password you just typed on your Windows NT4 Server box.
+Do not worry if you see an error message that mentions a returned code of
+<span class="errorname">NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT</span>. It means the
+password you gave is correct and the NT4 Server says the account is
+ready for interdomain connection and not for ordinary
+connection. After that, be patient it can take a while (especially
+in large networks), you should see the <tt class="computeroutput">Success</tt> message.
+Congratulations! Your trust relationship has just been established.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Note that you have to run this command as root because you must have write access to
+the <tt class="filename">secrets.tdb</tt> file.
+</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911286"></a>Common Errors</h2></div></div><div></div></div><p>
+Interdomain trust relationships should NOT be attempted on networks that are unstable
+or that suffer regular outages. Network stability and integrity are key concerns with
+distributed trusted domains.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2911301"></a>Tell me about Trust Relationships using Samba</h3></div></div><div></div></div><p>
+ Like many, I administer multiple LANs connected together using NT trust
+ relationships. This was implemented about 4 years ago. I now have the
+ occasion to consider performing this same task again, but this time, I
+ would like to implement it solely through samba - no Microsoft PDCs
+ anywhere.
+ </p><p>
+ I have read documentation on samba.org regarding NT-style trust
+ relationships and am now wondering, can I do what I want to? I already
+ have successfully implemented 2 samba servers, but they are not PDCs.
+ They merely act as file servers. I seem to remember, and it appears to
+ be true (according to samba.org) that trust relationships are a
+ challenge.
+ </p><p>
+ Please provide any helpful feedback that you may have.
+ </p><p>
+ These are almost complete in Samba 3.0 snapshots. The main catch
+ is getting winbindd to be able to allocate uid/gid's for trusted
+ users/groups. See the updated Samba HOWTO collection for more
+ details.
+ </p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="msdfs"></a>Chapter 17. Hosting a Microsoft Distributed File System tree on Samba</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Shirish</span> <span class="surname">Kalele</span></h3><div class="affiliation"><span class="orgname">Samba Team & Veritas Software<br></span><div class="address"><p><br>
+ <tt class="email"><<a href="mailto:samba@samba.org">samba@samba.org</a>></tt><br>
+ </p></div></div></div></div><div><p class="pubdate">12 Jul 2000</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2911399">Features and Benefits</a></dt><dt><a href="#id2912809">Common Errors</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911399"></a>Features and Benefits</h2></div></div><div></div></div><p>
+ The Distributed File System (or DFS) provides a means of separating the logical
+ view of files and directories that users see from the actual physical locations
+ of these resources on the network. It allows for higher availability, smoother
+ storage expansion, load balancing etc.
+ </p><p>
+ For information about DFS, refer to
+ <a href="http://www.microsoft.com/NTServer/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp" target="_top">
+ Microsoft documentation at http://www.microsoft.com/NTServer/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp</a>.
+ </p><p>
+ This document explains how to host a DFS tree on a Unix machine (for DFS-aware
+ clients to browse) using Samba.
+ </p><p>
+ To enable SMB-based DFS for Samba, configure it with the <i class="parameter"><tt>--with-msdfs</tt></i>
+ option. Once built, a Samba server can be made a DFS server by setting the global
+ boolean <a href="smb.conf.5.html#HOSTMSDFS" target="_top"><i class="parameter"><tt> host msdfs</tt></i></a>
+ parameter in the <tt class="filename">smb.conf </tt> file. You designate a share as a DFS
+ root using the share level boolean <a href="smb.conf.5.html#MSDFSROOT" target="_top"><i class="parameter"><tt>
+ msdfs root</tt></i></a> parameter. A DFS root directory on Samba hosts DFS
+ links in the form of symbolic links that point to other servers. For example, a symbolic link
+ <tt class="filename">junction->msdfs:storage1\share1</tt> in the share directory acts
+ as the DFS junction. When DFS-aware clients attempt to access the junction link,
+ they are redirected to the storage location (in this case, \\storage1\share1).
+ </p><p>
+ DFS trees on Samba work with all DFS-aware clients ranging from Windows 95 to 200x.
+ </p><p>
+ Here's an example of setting up a DFS tree on a Samba server.
+ </p><pre class="programlisting">
+# The smb.conf file:
+[global]
+ netbios name = SMOKEY
+ host msdfs = yes
+
+[dfs]
+ path = /export/dfsroot
+ msdfs root = yes
+ </pre><p>In the /export/dfsroot directory we set up our dfs links to
+ other servers on the network.</p><pre class="screen">
+ <tt class="prompt">root# </tt><b class="userinput"><tt>cd /export/dfsroot</tt></b>
+ <tt class="prompt">root# </tt><b class="userinput"><tt>chown root /export/dfsroot</tt></b>
+ <tt class="prompt">root# </tt><b class="userinput"><tt>chmod 755 /export/dfsroot</tt></b>
+ <tt class="prompt">root# </tt><b class="userinput"><tt>ln -s msdfs:storageA\\shareA linka</tt></b>
+ <tt class="prompt">root# </tt><b class="userinput"><tt>ln -s msdfs:serverB\\share,serverC\\share linkb</tt></b>
+ </pre><p>You should set up the permissions and ownership of
+ the directory acting as the DFS root such that only designated
+ users can create, delete or modify the msdfs links. Also note
+ that symlink names should be all lowercase. This limitation exists
+ to have Samba avoid trying all the case combinations to get at
+ the link name. Finally set up the symbolic links to point to the
+ network shares you want, and start Samba.</p><p>Users on DFS-aware clients can now browse the DFS tree
+ on the Samba server at \\samba\dfs. Accessing
+ links linka or linkb (which appear as directories to the client)
+ takes users directly to the appropriate shares on the network.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2912809"></a>Common Errors</h2></div></div><div></div></div><div class="itemizedlist"><ul type="disc"><li><p>Windows clients need to be rebooted
+ if a previously mounted non-dfs share is made a dfs
+ root or vice versa. A better way is to introduce a
+ new share and make it the dfs root.</p></li><li><p>Currently there's a restriction that msdfs
+ symlink names should all be lowercase.</p></li><li><p>For security purposes, the directory
+ acting as the root of the DFS tree should have ownership
+ and permissions set so that only designated users can
+ modify the symbolic links in the directory.</p></li></ul></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="printing"></a>Chapter 18. Classical Printing Support</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Kurt</span> <span class="surname">Pfeifle</span></h3><div class="affiliation"><span class="orgname"> Danka Deutschland GmbH <br></span><div class="address"><p><tt class="email"><<a href="mailto:kpfeifle@danka.de">kpfeifle@danka.de</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jerry@samba.org">jerry@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">May 32, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2914332">Features and Benefits</a></dt><dt><a href="#id2914396">Technical Introduction</a></dt><dd><dl><dt><a href="#id2914432">What happens if you send a Job from a Client</a></dt><dt><a href="#id2914502">Printing Related Configuration Parameters</a></dt><dt><a href="#id2917610">Parameters Recommended for Use</a></dt><dt><a href="#id2912970">Parameters for Backwards Compatibility</a></dt><dt><a href="#id2913079">Parameters no longer in use</a></dt></dl></dd><dt><a href="#id2913172">A simple Configuration to Print with Samba-3</a></dt><dd><dl><dt><a href="#id2915178">Verification of "Settings in Use" with testparm</a></dt><dt><a href="#id2915261">A little Experiment to warn you</a></dt></dl></dd><dt><a href="#id2915568">Extended Sample Configuration to Print with Samba-3</a></dt><dt><a href="#id2915660">Detailed Explanation of the Example's Settings</a></dt><dd><dl><dt><a href="#id2915673">The [global] Section</a></dt><dt><a href="#id2925133">The [printers] Section</a></dt><dt><a href="#id2925462">Any [my_printer_name] Section</a></dt><dt><a href="#id2925683">Print Commands</a></dt><dt><a href="#id2925734">Default Print Commands for various Unix Print Subsystems</a></dt><dt><a href="#id2926260">Setting up your own Print Commands</a></dt></dl></dd><dt><a href="#id2926537">Innovations in Samba Printing since 2.2</a></dt><dd><dl><dt><a href="#id2926691">Client Drivers on Samba Server for Point'n'Print</a></dt><dt><a href="#id2926842">The [printer$] Section is removed from Samba-3</a></dt><dt><a href="#id2926955">Creating the [print$] Share</a></dt><dt><a href="#id2927026">Parameters in the [print$] Section</a></dt><dt><a href="#id2927247">Subdirectory Structure in [print$]</a></dt></dl></dd><dt><a href="#id2927408">Installing Drivers into [print$]</a></dt><dd><dl><dt><a href="#id2927502">Setting Drivers for existing Printers with a Client GUI</a></dt><dt><a href="#id2927686">Setting Drivers for existing Printers with
+rpcclient</a></dt></dl></dd><dt><a href="#id2929284">"The Proof of the Pudding lies in the Eating" (Client Driver Insta
+Procedure)</a></dt><dd><dl><dt><a href="#id2929305">The first Client Driver Installation</a></dt><dt><a href="#id2929502">IMPORTANT! Setting Device Modes on new Printers</a></dt><dt><a href="#id2929792">Further Client Driver Install Procedures</a></dt><dt><a href="#id2929887">Always make first Client Connection as root or "printer admin"</a></dt></dl></dd><dt><a href="#id2930029">Other Gotchas</a></dt><dd><dl><dt><a href="#id2930062">Setting Default Print Options for the Client Drivers</a></dt><dt><a href="#id2930496">Supporting large Numbers of Printers</a></dt><dt><a href="#id2930798">Adding new Printers with the Windows NT APW</a></dt><dt><a href="#id2931042">Weird Error Message Cannot connect under a
+different Name</a></dt><dt><a href="#id2931140">Be careful when assembling Driver Files</a></dt><dt><a href="#id2931411">Samba and Printer Ports</a></dt><dt><a href="#id2931481">Avoiding the most common Misconfigurations of the Client Driver</a></dt></dl></dd><dt><a href="#id2931504">The Imprints Toolset</a></dt><dd><dl><dt><a href="#id2931549">What is Imprints?</a></dt><dt><a href="#id2931590">Creating Printer Driver Packages</a></dt><dt><a href="#id2931609">The Imprints Server</a></dt><dt><a href="#id2931634">The Installation Client</a></dt></dl></dd><dt><a href="#id2931786">Add Network Printers at Logon without User Interaction</a></dt><dt><a href="#id2932115">The addprinter command</a></dt><dt><a href="#id2932160">Migration of "Classical" printing to Samba-3</a></dt><dt><a href="#id2932329">Publishing Printer Information in Active Directory or LDAP</a></dt><dt><a href="#id2932343">Common Errors and Problems</a></dt><dd><dl><dt><a href="#id2932356">I give my root password but I don't get access</a></dt><dt><a href="#id2932390">My printjobs get spooled into the spooling directory, but then get lost</a></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2914332"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Printing is often a mission-critical service for the users. Samba can
+provide this service reliably and seamlessly for a client network
+consisting of Windows workstations.
+</p><p>
+A Samba-3.0 print service may be run on a Standalone or a Domain
+member server, side by side with file serving functions, or on a
+dedicated print server. It can be made as tight or as loosely secured
+as needs dictate. Configurations may be simple or complex. Available
+authentication schemes are essentially the same as described for file
+services in previous chapters. Overall, Samba's printing support is
+now able to replace an NT or Windows 2000 print server full-square,
+with additional benefits in many cases. Clients may download and
+install drivers and printers through their familiar "Point'n'Print"
+mechanism. Printer installations executed by "Logon Scripts" are no
+problem. Administrators can upload and manage drivers to be used by
+clients through the familiar "Add Printer Wizard". As an additional
+benefit, driver and printer management may be run from the commandline
+or through scripts, making it more efficient in case of large numbers
+of printers. If a central accounting of print jobs (tracking every
+single page and supplying the raw data for all sorts of statistical
+reports) is required, this is best supported by CUPS as the print
+subsystem underneath the Samba hood.
+</p><p>
+This chapter deals with the foundations of Samba printing, as they
+implemented by the more traditional UNIX (BSD- and System V-style)
+printing systems. Many things apply to CUPS, the newer Common UNIX
+Printing System, too; so if you use CUPS, you might be tempted to jump
+to the next chapter -- but you will certainly miss a few things if you
+do so. Better read this chapter too.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Most of the given examples have been verified on Windows XP
+Professional clients. Where this document describes the responses to
+commands given, bear in mind that Windows 2000 clients are very
+similar, but may differ in details. Windows NT is somewhat different
+again.
+</p></div></div><div xmlns:ns44="" class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2914396"></a>Technical Introduction</h2></div></div><div></div></div><ns44:p>
+Samba's printing support always relies on the installed print
+subsystem of the Unix OS it runs on. Samba is a "middleman". It takes
+printfiles from Windows (or other SMB) clients and passes them to the
+real printing system for further processing. Therefore it needs to
+"talk" to two sides: to the Windows print clients and to the Unix
+printing system. Hence we must differentiate between the various
+client OS types each of which behave differently, as well as the
+various UNIX print subsystems, which themselves have different
+features and are accessed differently. This part of the Samba HOWTO
+Collection deals with the "traditional" way of Unix printing first;
+the next chapter covers in great detail the more modern
+<span class="emphasis"><em>Common UNIX Printing System</em></span>
+(CUPS).
+
+</ns44:p><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Important</h3><p>CUPS users, be warned: don't just jump on to the next
+chapter. You might miss important information contained only
+here!</p></div><ns44:p>
+</ns44:p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2914432"></a>What happens if you send a Job from a Client</h3></div></div><div></div></div><p>
+To successfully print a job from a Windows client via a Samba
+print server to a UNIX printer, there are 6 (potentially 7)
+stages:
+</p><div class="orderedlist"><ol type="1"><li><p>Windows opens a connection to the printershare</p></li><li><p>Samba must authenticate the user</p></li><li><p>Windows sends a copy of the printfile over the network
+into Samba's spooling area</p></li><li><p>Windows closes the connection again</p></li><li><p>Samba invokes the print command to hand the file over
+to the UNIX print subsystem's spooling area</p></li><li><p>The Unix print subsystem processes the print
+job</p></li><li><p>The printfile may need to be explicitely deleted
+from the Samba spooling area.</p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2914502"></a>Printing Related Configuration Parameters</h3></div></div><div></div></div><p>
+There are a number of configuration parameters in
+ controlling Samba's printing
+behaviour. Please also refer to the man page for smb.conf to
+acquire an overview about these. As with other parameters, there are
+Global Level (tagged with a "<span class="emphasis"><em>G</em></span>" in the listings) and
+Service Level ("<span class="emphasis"><em>S</em></span>") parameters.
+</p><div class="variablelist"><dl><dt><span class="term">Service Level Parameters</span></dt><dd><p>These <span class="emphasis"><em>may</em></span> go into the
+<i class="parameter"><tt>[global]</tt></i> section of
+. In this case they define the default
+behaviour of all individual or service level shares (provided those
+don't have a different setting defined for the same parameter, thus
+overriding the global default).</p></dd><dt><span class="term">Global Parameters</span></dt><dd><p>These <span class="emphasis"><em>may not</em></span> go into individual
+shares. If they go in by error, the "testparm" utility can discover
+this (if you run it) and tell you so.</p></dd></dl></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2917610"></a>Parameters Recommended for Use</h3></div></div><div></div></div><p>The following <tt class="filename">smb.conf</tt> parameters directly
+related to printing are used in Samba-3. See also the
+<tt class="filename">smb.conf</tt> man page for detailed explanations:
+</p><ns44:p><b>List of printing related parameters in Samba-3. </b>
+</ns44:p><div class="itemizedlist"><p class="title"><b>Global level parameters:</b></p><ul type="disc"><li><p><i class="parameter"><tt>addprinter command (G)</tt></i></p></li><li><p><i class="parameter"><tt>deleteprinter command (G)</tt></i></p></li><li><p><i class="parameter"><tt>disable spoolss (G)</tt></i></p></li><li><p><i class="parameter"><tt>enumports command (G)</tt></i></p></li><li><p><i class="parameter"><tt>load printers (G)</tt></i></p></li><li><p><i class="parameter"><tt>lpq cache time (G)</tt></i></p></li><li><p><i class="parameter"><tt>os2 driver map (G)</tt></i></p></li><li><p><i class="parameter"><tt>printcap name (G), printcap (G)</tt></i></p></li><li><p><i class="parameter"><tt>show add printer wizard (G)</tt></i></p></li><li><p><i class="parameter"><tt>total print jobs (G)</tt></i></p></li><li><p><i class="parameter"><tt>use client driver (G)</tt></i></p></li></ul></div><ns44:p>
+
+</ns44:p><div class="itemizedlist"><p class="title"><b>Service level parameters:</b></p><ul type="disc"><li><p><i class="parameter"><tt>hosts allow (S)</tt></i></p></li><li><p><i class="parameter"><tt>hosts deny (S)</tt></i></p></li><li><p><i class="parameter"><tt>lppause command (S)</tt></i></p></li><li><p><i class="parameter"><tt>lpq command (S)</tt></i></p></li><li><p><i class="parameter"><tt>lpresume command (S)</tt></i></p></li><li><p><i class="parameter"><tt>lprm command (S)</tt></i></p></li><li><p><i class="parameter"><tt>max print jobs (S)</tt></i></p></li><li><p><i class="parameter"><tt>min print space (S)</tt></i></p></li><li><p><i class="parameter"><tt>print command (S)</tt></i></p></li><li><p><i class="parameter"><tt>printable (S), print ok (S)</tt></i></p></li><li><p><i class="parameter"><tt>printer name (S), printer (S)</tt></i></p></li><li><p><i class="parameter"><tt>printer admin (S)</tt></i></p></li><li><p><i class="parameter"><tt>printing = [cups|bsd|lprng...] (S)</tt></i></p></li><li><p><i class="parameter"><tt>queuepause command (S)</tt></i></p></li><li><p><i class="parameter"><tt>queueresume command (S)</tt></i></p></li><li><p><i class="parameter"><tt>total print jobs (S)</tt></i></p></li></ul></div><ns44:p>
+</ns44:p><p>
+Samba's printing support implements the Microsoft Remote Procedure
+Calls (MS-RPC) methods for printing. These are used by Windows NT (and
+later) print servers. The old "LanMan" protocol is still supported as
+a fallback resort, and for older clients to use. More details will
+follow further beneath.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2912970"></a>Parameters for Backwards Compatibility</h3></div></div><div></div></div><p>
+Two new parameters that were added in Samba 2.2.2, are still present
+in Samba-3.0. Both of these options are described in the
+<tt class="filename">smb.conf</tt> man page and are disabled by
+default. <span class="emphasis"><em>Use them with caution!</em></span>
+</p><div class="variablelist"><dl><dt><span class="term"><i class="parameter"><tt>disable spoolss(G)</tt></i></span></dt><dd><p> This is
+provided for better support of Samba 2.0.x backwards capability. It
+will disable Samba's support for MS-RPC printing and yield identical
+printing behaviour to Samba 2.0.x.</p></dd><dt><span class="term"><i class="parameter"><tt>use client driver (G)</tt></i></span></dt><dd><p> was provided
+for using local printer drivers on Windows NT/2000 clients. It does
+not apply to Windows 95/98/ME clients.</p></dd></dl></div><ns44:p><b>Parameters "for backward compatibility only", use with caution. </b>
+</ns44:p><div class="itemizedlist"><ul type="disc"><li><p><i class="parameter"><tt>disable spoolss (G)</tt></i></p></li><li><p><i class="parameter"><tt>use client driver (S)</tt></i></p></li></ul></div><ns44:p>
+</ns44:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2913079"></a>Parameters no longer in use</h3></div></div><div></div></div><p>
+Samba users upgrading from 2.2.x to 3.0 need to be aware that some
+previously available settings are no longer supported (as was
+announced some time ago). Here is a list of them:
+</p><ns44:p><b>"old" parameters, removed in Samba-3. </b>
+The following <tt class="filename">smb.conf</tt> parameters have been
+deprecated already in Samba 2.2 and are now completely removed from
+Samba-3. You cannot use them in new 3.0 installations:
+
+</ns44:p><div class="itemizedlist"><ul type="disc"><li><p><i class="parameter"><tt>printer driver file (G)</tt></i></p></li><li><p><i class="parameter"><tt>total print jobs (G)</tt></i></p></li><li><p><i class="parameter"><tt>postscript (S)</tt></i></p></li><li><p><i class="parameter"><tt>printer driver (S)</tt></i></p></li><li><p><i class="parameter"><tt>printer driver location (S)</tt></i></p></li></ul></div><ns44:p>
+</ns44:p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2913172"></a>A simple Configuration to Print with Samba-3</h2></div></div><div></div></div><p>
+Here is a very simple example configuration for print related settings
+in the file. If you compare it with your
+own system's , you probably find some
+additional parameters included there (as pre-configured by your OS
+vendor). Further below is a discussion and explanation of the
+parameters. Note, that this example doesn't use many parameters.
+However, in many environments these are enough to provide a valid
+ which enables all clients to print.
+</p><pre class="programlisting">
+ [global]
+ printing = bsd
+ load printers = yes
+
+ [printers]
+ path = /var/spool/samba
+ printable = yes
+ public = yes
+ writable = no
+</pre><p>
+This is only an example configuration. Many settings, if not
+explicitly set to a specific value, are used and set by Samba
+implicitly to its own default, because these have been compiled in.
+To see all settings, let root use the <b class="command">testparm</b>
+utility. <b class="command">testparm</b> also gives warnings if you have
+mis-configured certain things. Its complete output is easily 340 lines
+and more. You may want to pipe it through a pager program.
+</p><p>
+The syntax for the configuration file is easy to grasp. You should
+know that is not very picky about its
+syntax. It has been explained elsewhere in this document. A short
+reminder: It even tolerates some spelling errors (like "browsable"
+instead of "browseable"). Most spelling is case-insensitive. Also, you
+can use "Yes|No" or "True|False" for boolean settings. Lists of names
+may be separated by commas, spaces or tabs.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2915178"></a>Verification of "Settings in Use" with <b class="command">testparm</b></h3></div></div><div></div></div><p>
+To see all (or at least most) printing related settings in Samba,
+including the implicitly used ones, try the command outlined below
+(hit "ENTER" twice!). It greps for all occurrences of "lp", "print",
+"spool", "driver", "ports" and "[" in testparm's output and gives you
+a nice overview about the running smbd's print configuration. (Note
+that this command does not show individually created printer shares,
+or the spooling paths in each case). Here is the output of my Samba
+setup, with exactly the same settings in
+as shown above:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>testparm -v | egrep "(lp|print|spool|driver|ports|\[)"</tt></b>
+ Load smb config files from /etc/samba/smb.conf.simpleprinting
+ Processing section "[homes]"
+ Processing section "[printers]"
+
+ [global]
+ smb ports = 445 139
+ lpq cache time = 10
+ total print jobs = 0
+ load printers = Yes
+ printcap name = /etc/printcap
+ disable spoolss = No
+ enumports command =
+ addprinter command =
+ deleteprinter command =
+ show add printer wizard = Yes
+ os2 driver map =
+ printer admin =
+ min print space = 0
+ max print jobs = 1000
+ printable = No
+ printing = bsd
+ print command = lpr -r -P'%p' %s
+ lpq command = lpq -P'%p'
+ lprm command = lprm -P'%p' %j
+ lppause command =
+ lpresume command =
+ printer name =
+ use client driver = No
+
+ [homes]
+
+ [printers]
+ path = /var/spool/samba
+ printable = Yes
+
+</pre><p>
+You can easily verify which settings were implicitly added by Samba's
+default behaviour. <span class="emphasis"><em>Don't forget about this point: it may
+be important in your future dealings with Samba.</em></span>
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> testparm in Samba-3.0 behaves differently from 2.2.x: used
+without the "-v" switch it only shows you the settings actually
+written into ! To see the complete
+configuration used, add the "-v" parameter to testparm.</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2915261"></a>A little Experiment to warn you</h3></div></div><div></div></div><p>
+Should you need to troubleshoot at any stage, please always come back
+to this point first and verify if "testparm" shows the parameters you
+expect! To give you an example from personal experience as a warning,
+try to just "comment out" the <i class="parameter"><tt>load printers</tt></i>"
+parameter. If your 2.2.x system behaves like mine, you'll see this:
+</p><pre class="screen">
+<tt class="prompt">root# </tt>grep "load printers" /etc/samba/smb.conf
+ # load printers = Yes
+ # This setting is commented ooouuuuut!!
+
+<tt class="prompt">root# </tt>testparm -v /etc/samba/smb.conf | egrep "(load printers)"
+ load printers = Yes
+
+</pre><p>
+Despite my imagination that the commenting out of this setting should
+prevent Samba from publishing my printers, it still did! Oh Boy -- it
+cost me quite some time to find out the reason. But I am not fooled
+any more... at least not by this ;-)
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>grep -A1 "load printers" /etc/samba/smb.conf</tt></b>
+ load printers = No
+ # This setting is what I mean!!
+ # load printers = Yes
+ # This setting is commented ooouuuuut!!
+
+<tt class="prompt">root# </tt><b class="userinput"><tt>testparm -v smb.conf.simpleprinting | egrep "(load printers)"</tt></b>
+ load printers = No
+
+</pre><p>
+Only when setting the parameter explicitly to
+"<i class="parameter"><tt>load printers = No</tt></i>"
+would Samba recognize my intentions. So my strong advice is:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Never rely on "commented out" parameters!</p></li><li><p>Always set it up explicitly as you intend it to
+behave.</p></li><li><p>Use <b class="command">testparm</b> to uncover hidden
+settings which might not reflect your intentions.</p></li></ul></div><p>
+You can have a working Samba print configuration with this
+minimal :
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>cat /etc/samba/smb.conf-minimal</tt></b>
+ [printers]
+
+</pre><p>
+This example should show you that you can use testparm to test any
+filename for fitness as a Samba configuration. Actually, we want to
+encourage you <span class="emphasis"><em>not</em></span> to change your
+ on a working system (unless you know
+exactly what you are doing)! Don't rely on an assumption that changes
+will only take effect after you re-start smbd! This is not the
+case. Samba re-reads its every 60
+seconds and on each new client connection. You might have to face
+changes for your production clients that you didn't intend to apply at
+this time! You will now note a few more interesting things. Let's now
+ask <b class="command">testparm</b> what the Samba print configuration
+would be, if you used this minimalistic file as your real
+:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt> testparm -v /etc/samba/smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)"</tt></b>
+ Processing section "[printers]"
+ WARNING: [printers] service MUST be printable!
+ No path in service printers - using /tmp
+
+ lpq cache time = 10
+ total print jobs = 0
+ load printers = Yes
+ printcap name = /etc/printcap
+ disable spoolss = No
+ enumports command =
+ addprinter command =
+ deleteprinter command =
+ show add printer wizard = Yes
+ os2 driver map =
+ printer admin =
+ min print space = 0
+ max print jobs = 1000
+ printable = No
+ printing = bsd
+ print command = lpr -r -P%p %s
+ lpq command = lpq -P%p
+ printer name =
+ use client driver = No
+ [printers]
+ printable = Yes
+
+</pre><p>
+testparm issued 2 warnings:
+</p><div class="itemizedlist"><ul type="disc"><li><p>because we didn't specify the
+<i class="parameter"><tt>[printers]</tt></i> section as printable,
+and</p></li><li><p>because we didn't tell it which spool directory to
+use.</p></li></ul></div><p>
+However, this was not fatal, and Samba-3.0 will default to values that
+will work here. But, please!, don't rely on this and don't use this
+example! This was only meant to make you careful to design and specify
+your setup to be what you really want it to be. The outcome on your
+system may vary for some parameters, since you may have a Samba built
+with a different compile-time configuration.
+<span class="emphasis"><em>Warning:</em></span> don't put a comment sign <span class="emphasis"><em>at
+the end</em></span> of a valid line. It
+will cause the parameter to be ignored (just as if you had put the
+comment sign at the front). At first I regarded this as a bug in my
+Samba version(s). But the man page states: “<span class="quote">Internal whitespace
+in a parameter value is retained verbatim.</span>” This means that a
+line consisting of, for example,
+</p><pre class="screen">
+printing =lprng #This defines LPRng as the printing system"
+</pre><p>
+will regard the whole of the string after the "="
+sign as the value you want to define. And this is an invalid value
+that will be ignored, and a default value used instead.]
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2915568"></a>Extended Sample Configuration to Print with Samba-3</h2></div></div><div></div></div><p>
+Here we show a more verbose example configuration for print related
+settings in an . Below is a discussion
+and explanation of the various parameters. We chose to use BSD-style
+printing here, because we guess it is still the most commonly used
+system on legacy Linux installations (new installs now predominantly
+have CUPS, which is discussed entirely in the next chapter of this
+document). Note, that this example explicitly names many parameters
+which don't need to be stated because they are set by default. You
+might be able to do with a leaner .</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+if you read access it with the Samba Web Administration Tool (SWAT),
+and then write it to disk again, it will be optimized in a way such
+that it doesn't contain any superfluous parameters and comments. SWAT
+organizes the file for best performance. Remember that each smbd
+re-reads the Samba configuration once a minute, and that each
+connection spawns an smbd process of its own, so it is not a bad idea
+to optimize the in environments with
+hundreds or thousands of clients.</p></div><pre class="programlisting">
+ [global]
+ printing = bsd
+ load printers = yes
+ show add printer wizard = yes
+ printcap name = /etc/printcap
+ printer admin = @ntadmin, root
+ total print jobs = 100
+ lpq cache time = 20
+ use client driver = no
+
+ [printers]
+ comment = All Printers
+ printable = yes
+ path = /var/spool/samba
+ browseable = no
+ guest ok = yes
+ public = yes
+ read only = yes
+ writable = no
+
+ [my_printer_name]
+ comment = Printer with Restricted Access
+ path = /var/spool/samba_my_printer
+ printer admin = kurt
+ browseable = yes
+ printable = yes
+ writeable = no
+ hosts allow = 0.0.0.0
+ hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
+ guest ok = no
+</pre><p>
+This <span class="emphasis"><em>also</em></span> is only an example configuration. You
+may not find all the settings in your own
+ (as pre-configured by your OS
+vendor). Many configuration parameters, if not explicitly set to a
+specific value, are used and set by Samba implicitly to its own
+default, because these have been compiled in. To see all settings, let
+root use the <b class="command">testparm</b>
+utility. <b class="command">testparm</b> also gives warnings if you have
+mis-configured certain things..
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2915660"></a>Detailed Explanation of the Example's Settings</h2></div></div><div></div></div><p>
+Following is a discussion of the settings from above shown example.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2915673"></a>The [global] Section</h3></div></div><div></div></div><p>
+The <i class="parameter"><tt>[global]</tt></i> section is one of 4 special
+sections (along with [<i class="parameter"><tt>[homes]</tt></i>,
+<i class="parameter"><tt>[printers]</tt></i> and
+<i class="parameter"><tt>[print$]</tt></i>...) It contains all parameters which
+apply to the server as a whole. It is the place for parameters which
+have only a "global" meaning (G). It may also contain service level
+parameters (S) which then define default settings for all other
+sections and shares. This way you can simplify the configuration and
+avoid setting the same value repeatedly. (Within each individual
+section or share you may however override these globally set "share
+level" settings and specify other values).
+</p><div class="variablelist"><dl><dt><span class="term"><i class="parameter"><tt>printing = bsd</tt></i></span></dt><dd><p> this causes Samba to use default print commands
+applicable for the BSD (a.k.a. RFC 1179 style or LPR/LPD) printing
+system. In general, the "printing" parameter informs Samba about the
+print subsystem it should expect. Samba supports CUPS, LPD, LPRNG,
+SYSV, HPUX, AIX, QNX and PLP. Each of these systems defaults to a
+different <i class="parameter"><tt>print command</tt></i> (and other queue control
+commands).</p><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p>The <i class="parameter"><tt>printing</tt></i> parameter is
+normally a service level parameter. Since it is included here in the
+<i class="parameter"><tt>[global]</tt></i> section, it will take effect for all
+printer shares that are not defined differently. Samba-3.0 no longer
+supports the SOFTQ printing system.</p></div></dd><dt><span class="term"><i class="parameter"><tt>load printers = yes</tt></i></span></dt><dd><p> this tells Samba to create automatically all
+available printer shares. "Available" printer shares are discovered by
+scanning the printcap file. All created printer shares are also loaded
+for browsing. If you use this parameter, you do not need to specify
+separate shares for each printer. Each automatically created printer
+share will clone the configuration options found in the
+<i class="parameter"><tt>[printers]</tt></i> section. (A <i class="parameter"><tt>load printers
+= no</tt></i> setting will allow you to specify each UNIX printer
+you want to share separately, leaving out some you don't want to be
+publicly visible and available). </p></dd><dt><span class="term"><i class="parameter"><tt>show add printer wizard =
+yes</tt></i></span></dt><dd><p> this setting is normally
+enabled by default (even if the parameter is not written into the
+). It makes the <span class="guiicon">Add Printer Wizard</span> icon
+show up in the <span class="guiicon">Printers</span> folder of the Samba host's
+share listing (as shown in <span class="guiicon">Network Neighbourhood</span> or
+by the <b class="command">net view</b> command). To disable it, you need to
+explicitly set it to <tt class="constant">no</tt> (commenting it out
+will not suffice!). The Add Printer Wizard lets you upload printer
+drivers to the <i class="parameter"><tt>[print$]</tt></i> share and associate it
+with a printer (if the respective queue exists there before the
+action), or exchange a printer's driver against any other previously
+uploaded driver. </p></dd><dt><span class="term"><i class="parameter"><tt>total print jobs = 100</tt></i></span></dt><dd><p> this setting sets the upper limit to 100 print jobs
+being active on the Samba server at any one time. Should a client
+submit a job which exceeds this number, a “<span class="quote">no more space
+available on server</span>” type of error message will be returned by
+Samba to the client. A setting of "0" (the default) means there is
+<span class="emphasis"><em>no</em></span> limit at all!
+</p></dd><dt><span class="term"><i class="parameter"><tt>printcap name = /etc/printcap</tt></i></span></dt><dd><p> this tells Samba where to look for a list of
+available printer names. (If you use CUPS, make sure that a printcap
+file is written: this is controlled by the "Printcap" directive of
+<tt class="filename">cupsd.conf</tt>).
+</p></dd><dt><span class="term"><i class="parameter"><tt>printer admin = @ntadmin</tt></i></span></dt><dd><p> members of the ntadmin group should be able to add
+drivers and set printer properties ("ntadmin" is only an example name,
+it needs to be a valid UNIX group name); root is implicitly always a
+<i class="parameter"><tt>printer admin</tt></i>. The "@" sign precedes group names in
+. A printer admin can do anything to
+printers via the remote administration interfaces offered by MS-RPC
+(see below). Note that the <i class="parameter"><tt>printer admin</tt></i>
+parameter is normally a share level parameter, so you may associate
+different groups to different printer shares in larger installations,
+if you use the <i class="parameter"><tt>printer admin</tt></i> parameter on the
+share levels).
+</p></dd><dt><span class="term"><i class="parameter"><tt>lpq cache time = 20</tt></i></span></dt><dd><p> this controls the cache time for the results of the
+lpq command. It prevents the lpq command being called too often and
+reduces load on a heavily used print server.
+</p></dd><dt><span class="term"><i class="parameter"><tt>use client driver = no</tt></i></span></dt><dd><p> if set to <tt class="constant">yes</tt>, this setting only
+takes effect for Win NT/2k/XP clients (and not for Win 95/98/ME). Its
+default value is <tt class="constant">No</tt> (or <tt class="constant">False</tt>).
+It must <span class="emphasis"><em>not</em></span> be enabled on print shares
+(with a <tt class="constant">yes</tt> or <tt class="constant">true</tt> setting) which
+have valid drivers installed on the Samba server! For more detailed
+explanations see the man page of <tt class="filename">smb.conf</tt>.
+</p></dd></dl></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2925133"></a>The [printers] Section</h3></div></div><div></div></div><p>
+This is the second special section. If a section with this name
+appears in the <tt class="filename">smb.conf</tt>, users are able to
+connect to any printer specified in the Samba host's printcap file,
+because Samba on startup then creates a printer share for every
+printername it finds in the printcap file. You could regard this
+section as a general convenience shortcut to share all printers with
+minimal configuration. It is also a container for settings which
+should apply as default to all printers. (For more details see the
+<tt class="filename">smb.conf</tt> man page.) Settings inside this
+container must be share level parameters (S).
+</p><div class="variablelist"><dl><dt><span class="term"><i class="parameter"><tt>comment = All printers</tt></i></span></dt><dd><p> the <i class="parameter"><tt>comment</tt></i> is shown next to
+the share if a client queries the server, either via <span class="guiicon">Network
+Neighbourhood</span> or with the <b class="command">net view</b> command to list
+available shares.
+</p></dd><dt><span class="term"><i class="parameter"><tt>printable = yes</tt></i></span></dt><dd><p> please note well, that the
+<i class="parameter"><tt>[printers]</tt></i> service <span class="emphasis"><em>must</em></span> be
+declared as printable. If you specify otherwise, smbd will refuse to
+load at startup. This parameter allows
+connected clients to open, write to and submit spool files into the
+directory specified with the <i class="parameter"><tt>path</tt></i> parameter for
+this service. It is used by Samba to differentiate printer shares from
+file shares. </p></dd><dt><span class="term"><i class="parameter"><tt>path = /var/spool/samba</tt></i></span></dt><dd><p>this must point to a directory used by Samba to spool
+incoming print files. <span class="emphasis"><em>It must not be the same as the spool
+directory specified in the configuration of your UNIX print
+subsystem!</em></span> The path would typically point to a directory
+which is world writeable, with the "sticky" bit set to it.
+</p></dd><dt><span class="term"><i class="parameter"><tt>browseable = no</tt></i></span></dt><dd><p> this is always set to <tt class="constant">no</tt> if
+<i class="parameter"><tt>printable = yes</tt></i>. It makes the
+<i class="parameter"><tt>[printer]</tt></i> share itself invisible in the
+list of available shares in a <b class="command">net view</b> command or
+in the Explorer browse list. (Note that you will of course see the
+individual printers).
+</p></dd><dt><span class="term"><i class="parameter"><tt>guest ok = yes</tt></i></span></dt><dd><p>
+if set to <tt class="constant">yes</tt>, then no password is required to
+connect to the printers service. Access will be granted with the
+privileges of the <i class="parameter"><tt>guest account</tt></i>. On many systems the
+guest account will map to a user named "nobody". This user is in the UNIX
+passwd file with an empty password, but with no valid UNIX login.
+(Note: on some systems the guest account might not have the
+privilege to be able to print. Test this by logging in as your
+guest user using <b class="command">su - guest</b> and run a system print
+command like
+</p><p><b class="userinput"><tt>lpr -P printername /etc/motd</tt></b></p></dd><dt><span class="term"><i class="parameter"><tt>public = yes</tt></i></span></dt><dd><p> this is a synonym for <i class="parameter"><tt>guest ok =
+yes</tt></i>. Since we have <i class="parameter"><tt>guest ok = yes</tt></i>,
+it really doesn't need to be here! (This leads to the interesting
+question: “<span class="quote">What, if I by accident have to contradictory settings
+for the same share?</span>” The answer is: the last one encountered by
+Sambe wins. The "winner" is shown by testparm. Testparm doesn't
+complain about different settings of the same parameter for the same
+share! You can test this by setting up multiple lines for the "guest
+account" parameter with different usernames, and then run testparm to
+see which one is actually used by Samba.)
+</p></dd><dt><span class="term"><i class="parameter"><tt>read only = yes</tt></i></span></dt><dd><p>this normally (for other types of shares) prevents
+users creating or modifying files in the service's directory. However,
+in a "printable" service, it is <span class="emphasis"><em>always</em></span> allowed to
+write to the directory (if user privileges allow the connection), but
+only via print spooling operations. "Normal" write operations are not
+allowed. </p></dd><dt><span class="term"><i class="parameter"><tt>writeable = no</tt></i></span></dt><dd><p>
+synonym for <i class="parameter"><tt>read only = yes</tt></i>
+</p></dd></dl></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2925462"></a>Any [my_printer_name] Section</h3></div></div><div></div></div><p>
+If a section appears in the , which is
+tagged as <i class="parameter"><tt>printable = yes</tt></i>, Samba presents it as
+a printer share to its clients. Note, that Win95/98/ME clients may
+have problems with connecting or loading printer drivers if the share
+name has more than 8 characters! Also be very careful if you give a
+printer the same name as an existing user or file share name: upon a
+client's connection request to a certain sharename, Samba always tries
+to find file shares with that name first; if it finds one, it will
+connect to this and will never ultimately connect to a printer with
+the same name!
+</p><div class="variablelist"><dl><dt><span class="term"><i class="parameter"><tt>comment = Printer with Restricted Access</tt></i></span></dt><dd><p> the comment says it all.
+</p></dd><dt><span class="term"><i class="parameter"><tt>path = /var/spool/samba_my_printer</tt></i></span></dt><dd><p> here we set the spooling area for this printer to
+another directory than the default. It is not a requirement to set it
+differently, but the option is available.
+</p></dd><dt><span class="term"><i class="parameter"><tt>printer admin = kurt</tt></i></span></dt><dd><p> the printer admin definition is different for this
+explicitly defined printer share from the general
+<i class="parameter"><tt>[printers]</tt></i> share. It is not a requirement; we
+did it to show that it is possible if you want it.
+</p></dd><dt><span class="term"><i class="parameter"><tt>browseable = yes</tt></i></span></dt><dd><p> we also made this printer browseable (so that the
+clients may conveniently find it when browsing the <span class="guiicon">Network
+Neighbourhood</span>).
+</p></dd><dt><span class="term"><i class="parameter"><tt>printable = yes</tt></i></span></dt><dd><p>see explanation in last subsection.
+</p></dd><dt><span class="term"><i class="parameter"><tt>writeable = no</tt></i></span></dt><dd><p>see explanation in last subsection.
+</p></dd><dt><span class="term"><i class="parameter"><tt>hosts allow = 10.160.50.,10.160.51.</tt></i></span></dt><dd><p>here we exercise a certain degree of access control
+by using the <i class="parameter"><tt>hosts allow</tt></i> and <i class="parameter"><tt>hosts deny</tt></i> parameters. Note, that
+this is not by any means a safe bet. It is not a way to secure your
+printers. This line accepts all clients from a certain subnet in a
+first evaluation of access control
+</p></dd><dt><span class="term"><i class="parameter"><tt>hosts deny = turbo_xp,10.160.50.23,10.160.51.60
+</tt></i></span></dt><dd><p>all listed hosts are not allowed here (even if they
+belong to the "allowed subnets"). As you can see, you could name IP
+addresses as well as NetBIOS hostnames
+here.
+</p></dd><dt><span class="term"><i class="parameter"><tt>guest ok = no</tt></i></span></dt><dd><p>this printer is not open for the guest account!
+</p></dd></dl></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2925683"></a>Print Commands</h3></div></div><div></div></div><p>
+In each section defining a printer (or in the
+<i class="parameter"><tt>[printers]</tt></i> section), a <i class="parameter"><tt>print
+command</tt></i> parameter may be defined. It sets a command to
+process the files which have been placed into the Samba print spool
+directory for that printer. (That spool directory was, if you
+remember, set up with the <i class="parameter"><tt>path</tt></i>
+parameter). Typically, this command will submit the spool file to the
+Samba host's print subsystem, using the suitable system print
+command. But there is no requirement that this needs to be the
+case. For debugging purposes or some other reason you may want to do
+something completely different than "print" the file. An example is a
+command that just copies the print file to a temporary location for
+further investigation when you need to debug printing. If you craft
+your own print commands (or even develop print command shell scripts),
+make sure you pay attention to the need to remove the files from the
+Samba spool directory. Otherwise your hard disk may soon suffer from
+shortage of free space.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2925734"></a>Default Print Commands for various Unix Print Subsystems</h3></div></div><div></div></div><p>
+You learned earlier on, that Samba in most cases uses its built-in
+settings for many parameters if it can not find an explicitly stated
+one in its configuration file. The same is true for the
+<i class="parameter"><tt>print command</tt></i>. The default print command varies
+depending on the <i class="parameter"><tt>printing =...</tt></i> parameter
+setting. In the commands listed below, you will notice some parameters
+of the form <span class="emphasis"><em>%X</em></span> where <span class="emphasis"><em>X</em></span> is
+<span class="emphasis"><em>p, s, J</em></span> etc. These letters stand for
+"printername", "spoolfile" and "job ID" respectively. They are
+explained in more detail further below. Here is an overview (excluding
+the special case of CUPS, which is discussed in the next chapter):
+</p><div class="informaltable"><table border="1"><colgroup><col><col></colgroup><thead><tr><th align="left">If this setting is active...</th><th align="left">...this is used in lieu of an explicit command:</th></tr></thead><tbody><tr><td align="left"><i class="parameter"><tt>printing = bsd|aix|lprng|plp</tt></i></td><td align="left">print command is <b class="command">lpr -r -P%p %s</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = sysv|hpux</tt></i></td><td align="left">print command is <b class="command">lp -c -P%p %s; rm %s</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = qnx</tt></i></td><td align="left">print command is <b class="command">lp -r -P%p -s %s</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = bsd|aix|lprng|plp</tt></i></td><td align="left">lpq command is <b class="command">lpq -P%p</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = sysv|hpux</tt></i></td><td align="left">lpq command is <b class="command">lpstat -o%p</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = qnx</tt></i></td><td align="left">lpq command is <b class="command">lpq -P%p</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = bsd|aix|lprng|plp</tt></i></td><td align="left">lprm command is <b class="command">lprm -P%p %j</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = sysv|hpux</tt></i></td><td align="left">lprm command is <b class="command">cancel %p-%j</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = qnx</tt></i></td><td align="left">lprm command is <b class="command">cancel %p-%j</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = bsd|aix|lprng|plp</tt></i></td><td align="left">lppause command is <b class="command">lp -i %p-%j -H hold</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = sysv|hpux</tt></i></td><td align="left">lppause command (...is empty)</td></tr><tr><td align="left"><i class="parameter"><tt>printing = qnx</tt></i></td><td align="left">lppause command (...is empty)</td></tr><tr><td align="left"><i class="parameter"><tt>printing = bsd|aix|lprng|plp</tt></i></td><td align="left">lpresume command is <b class="command">lp -i %p-%j -H resume</b></td></tr><tr><td align="left"><i class="parameter"><tt>printing = sysv|hpux</tt></i></td><td align="left">lpresume command (...is empty)</td></tr><tr><td align="left"><i class="parameter"><tt>printing = qnx</tt></i></td><td align="left">lpresume command (...is empty)</td></tr></tbody></table></div><p>
+We excluded the special CUPS case here, because it is discussed in the
+next chapter. Just a short summary. For <i class="parameter"><tt>printing =
+CUPS</tt></i>: If SAMBA is compiled against libcups, it uses the
+CUPS API to submit jobs, etc. (It is a good idea also to set
+<i class="parameter"><tt>printcap = cups</tt></i> in case your
+<tt class="filename">cupsd.conf</tt> is set to write its autogenerated
+printcap file to an unusual place). Otherwise Samba maps to the System
+V printing commands with the -oraw option for printing, i.e. it uses
+<b class="command">lp -c -d%p -oraw; rm %s</b> With <i class="parameter"><tt>printing =
+cups</tt></i> , and if SAMBA is compiled against libcups, any
+manually set print command will be ignored!
+</p><p>
+Having listed the above mappings here, you should note that there used
+to be a <span class="emphasis"><em>bug</em></span> in recent 2.2.x versions which
+prevented the mapping from taking effect. It lead to the
+"bsd|aix|lprng|plp" settings taking effect for all other systems, for
+the most important commands (the <b class="command">print</b> command, the
+<b class="command">lpq</b> command and the <b class="command">lprm</b>
+command). The <b class="command">lppause</b> command and the
+<b class="command">lpresume</b> command remained empty. Of course, these
+commands worked on bsd|aix|lprng|plp but they didn't work on
+sysv|hpux|qnx systems. To work around this bug, you need to
+explicitly set the commands. Use <b class="command">testparm -v</b> to
+check which command takes effect. Then check that this command is
+adequate and actually works for your installed print subsystem. It is
+always a good idea to explicitly set up your configuration files the
+way you want them to work and not rely on any built-in defaults.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2926260"></a>Setting up your own Print Commands</h3></div></div><div></div></div><p>
+After a print job has finished spooling to a service, the
+<i class="parameter"><tt>print command</tt></i> will be used by Samba via a
+<span class="emphasis"><em>system()</em></span> call to process the spool file. Usually
+the command specified will submit the spool file to the host's
+printing subsystem. But there is no requirement at all that this must
+be the case. The print subsystem will probably not remove the spool
+file on its own. So whatever command you specify on your own you
+should ensure that the spool file is deleted after it has been
+processed.
+</p><p>
+There is no difficulty with using your own customized print commands
+with the traditional printing systems. However, if you don't wish to
+"roll your own", you should be well informed about the default
+built-in commands that Samba uses for each printing subsystem (see the
+table above). In all the commands listed in the last paragraphs you
+see parameters of the form <span class="emphasis"><em>%X</em></span> These are
+<span class="emphasis"><em>macros</em></span>, or shortcuts, used as place holders for
+the names of real objects. At the time of running a command with such
+a placeholder, Samba will insert the appropriate value
+automatically. Print commands can handle all Samba macro
+substitutions. In regard to printing, the following ones do have
+special relevance:
+</p><div class="itemizedlist"><ul type="disc"><li><p><i class="parameter"><tt>%s, %f</tt></i> - the path to the spool
+file name</p></li><li><p><i class="parameter"><tt>%p</tt></i> - the appropriate printer
+name</p></li><li><p><i class="parameter"><tt>%J</tt></i> - the job name as
+transmitted by the client.</p></li><li><p><i class="parameter"><tt>%c</tt></i> - the number of printed
+pages of the spooled job (if known).</p></li><li><p><i class="parameter"><tt>%z</tt></i> - the size of the spooled
+print job (in bytes)</p></li></ul></div><p>
+The print command MUST contain at least one occurrence of
+<i class="parameter"><tt>%s</tt></i> or <i class="parameter"><tt>%f</tt></i>. -- The
+<i class="parameter"><tt>%p</tt></i> is optional. If no printer name is supplied,
+the <i class="parameter"><tt>%p</tt></i> will be silently removed from the print
+command. In this case the job is sent to the default printer.
+</p><p>
+If specified in the <i class="parameter"><tt>[global]</tt></i> section, the print
+command given will be used for any printable service that does not
+have its own print command specified. If there is neither a specified
+print command for a printable service nor a global print command,
+spool files will be created but not processed! And (most importantly):
+print files will not be removed, so they will start filling your Samba
+hard disk.
+</p><p>
+Note that printing may fail on some UNIXes from the "nobody"
+account. If this happens, create an alternative guest account and
+supply it with the privilege to print. Set up this guest account in
+the <i class="parameter"><tt>[global]</tt></i> section with the <i class="parameter"><tt>guest
+account</tt></i> parameter.
+</p><p>
+You can form quite complex print commands. You need to realize that
+print commands are just passed to a UNIX shell. The shell is able to
+expand the included environment variables as usual. (The syntax to
+include a UNIX environment variable <i class="parameter"><tt>$variable</tt></i>
+in or in the Samba print command is
+<i class="parameter"><tt>%$variable</tt></i>.) To give you a working
+<i class="parameter"><tt>print command</tt></i> example, the following will log a
+print job to <tt class="filename">/tmp/print.log</tt>, print the file, then
+remove it. Note that ';' is the usual separator for commands in shell
+scripts:
+</p><pre class="programlisting">
+
+ print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s
+
+</pre><p>
+You may have to vary your own command considerably from this example
+depending on how you normally print files on your system. The default
+for the <i class="parameter"><tt>print command</tt></i> parameter varies depending on the setting of
+the <i class="parameter"><tt>printing</tt></i> parameter. Another example is:
+</p><pre class="programlisting">
+ print command = /usr/local/samba/bin/myprintscript %p %s
+</pre></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2926537"></a>Innovations in Samba Printing since 2.2</h2></div></div><div></div></div><p>
+Before version 2.2.0, Samba's print server support for Windows clients
+was limited to the level of <span class="emphasis"><em>LanMan</em></span> printing
+calls. This is the same protocol level as Windows 9x PCs offer when
+they share printers. Beginning with the 2.2.0 release, Samba started
+to support the native Windows NT printing mechanisms. These are
+implemented via <span class="emphasis"><em>MS-RPC</em></span> (RPC = <span class="emphasis"><em>Remote
+Procedure Calls</em></span> ). MS-RPCs use the
+<span class="emphasis"><em>SPOOLSS</em></span> named pipe for all printing.
+</p><p>
+The additional functionality provided by the new SPOOLSS support includes:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Support for downloading printer driver files to Windows
+95/98/NT/2000 clients upon demand (<span class="emphasis"><em>Point'n'Print</em></span>);
+</p></li><li><p>Uploading of printer drivers via the Windows NT
+<span class="emphasis"><em>Add Printer Wizard</em></span> (APW) or the
+<span class="emphasis"><em>Imprints</em></span> tool set (refer to <a href="http://imprints.sourceforge.net/" target="_top">http://imprints.sourceforge.net</a>);
+</p></li><li><p>Support for the native MS-RPC printing calls such as
+StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation
+at <a href="http://msdn.microsoft.com/" target="_top">http://msdn.microsoft.com/</a>
+for more information on the Win32 printing API);</p></li><li><p>Support for NT <span class="emphasis"><em>Access Control
+Lists</em></span> (ACL) on printer objects;</p></li><li><p>Improved support for printer queue manipulation
+through the use of internal databases for spooled job information
+(implemented by various <tt class="filename">*.tdb</tt>
+files).</p></li></ul></div><p>
+One other benefit of an update is this: Samba-3 is able to publish
+all its printers in Active Directory (or LDAP)!
+</p><p>
+One slight difference is here: it is possible on a Windows NT print
+server to have printers listed in the Printers folder which are
+<span class="emphasis"><em>not</em></span> shared. Samba does not make this
+distinction. By definition, the only printers of which Samba is aware
+are those which are specified as shares in
+. The reason is that Windows NT/2k/XPprof
+clients do not normally need to use the standard SMB printer share;
+rather they can print directly to any printer on another Windows NT
+host using MS-RPC. This of course assumes that the printing client has
+the necessary privileges on the remote host serving the printer. The
+default permissions assigned by Windows NT to a printer gives the
+"Print" permissions to the well-known <span class="emphasis"><em>Everyone</em></span>
+group. (The older clients of type Win9x can only print to "shared"
+printers).
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2926691"></a>Client Drivers on Samba Server for <span class="emphasis"><em>Point'n'Print</em></span></h3></div></div><div></div></div><p>
+There is still confusion about what all this means: <span class="emphasis"><em>Is it or
+is it not a requirement for printer drivers to be installed on a Samba
+host in order to support printing from Windows clients?</em></span> The
+answer to this is: No, it is not a
+<span class="emphasis"><em>requirement</em></span>. Windows NT/2000 clients can, of
+course, also run their APW to install drivers
+<span class="emphasis"><em>locally</em></span> (which then connect to a Samba served
+print queue). This is the same method as used by Windows 9x
+clients. (However, a <span class="emphasis"><em>bug</em></span> existed in Samba 2.2.0
+which made Windows NT/2000 clients require that the Samba server
+possess a valid driver for the printer. This was fixed in Samba
+2.2.1).
+</p><p>
+But it is a new <span class="emphasis"><em>option</em></span> to install the printer
+drivers into the <i class="parameter"><tt>[print$]</tt></i> share of the Samba
+server, and a big convenience too. Then <span class="emphasis"><em>all</em></span>
+clients (including 95/98/ME) get the driver installed when they first
+connect to this printer share. The <span class="emphasis"><em>uploading</em></span> or
+<span class="emphasis"><em>depositing</em></span> of the driver into this
+<i class="parameter"><tt>[print$]</tt></i> share, and the following binding of
+this driver to an existing Samba printer share can be achieved by
+different means:
+</p><div class="itemizedlist"><ul type="disc"><li><p>running the <span class="emphasis"><em>APW</em></span> on an
+NT/2k/XPprof client (this doesn't work from 95/98/ME
+clients);</p></li><li><p>using the <span class="emphasis"><em>Imprints</em></span>
+toolset;</p></li><li><p>using the <span class="emphasis"><em>smbclient</em></span> and
+<span class="emphasis"><em>rpcclient</em></span> commandline tools;</p></li><li><p>using <span class="emphasis"><em>cupsaddsmb</em></span>(only works for
+the CUPS printing system, not for LPR/LPD, LPRng
+etc.).</p></li></ul></div><p>
+Please take additional note of the following fact: <span class="emphasis"><em>Samba
+does not use these uploaded drivers in any way to process spooled
+files</em></span>. Drivers are utilized entirely by the clients, who
+download and install them via the "Point 'n'Print" mechanism supported
+by Samba. The clients use these drivers to generate print files in the
+format the printer (or the Unix print system) requires. Print files
+received by Samba are handed over to the Unix printing system, which
+is responsible for all further processing, if needed.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2926842"></a>The [printer$] Section is removed from Samba-3</h3></div></div><div></div></div><p><b>
+<i class="parameter"><tt>[print$]</tt></i> vs. <i class="parameter"><tt>[printer$]</tt></i>
+. </b>
+Versions of Samba prior to 2.2 made it possible to use a share
+named <span class="emphasis"><em>[printer$]</em></span>. This name was taken from the
+same named service created by Windows 9x clients when a printer was
+shared by them. Windows 9x printer servers always have a
+<i class="parameter"><tt>[printer$]</tt></i> service which provides read-only
+access (with no password required) in order to support printer driver
+downloads. However, Samba's initial implementation allowed for a
+parameter named <i class="parameter"><tt>printer driver location</tt></i> to be
+used on a per share basis. This specified the location of the driver
+files associated with that printer. Another parameter named
+<i class="parameter"><tt>printer driver</tt></i> provided a means of defining the
+printer driver name to be sent to the client. These parameters,
+including the <i class="parameter"><tt>printer driver file</tt></i> parameter,
+are now removed and can not be used in installations of Samba-3.0.
+Now the share name <i class="parameter"><tt>[print$]</tt></i> is used for the
+location of downloadable printer drivers. It is taken from the
+<i class="parameter"><tt>[print$]</tt></i> service created by Windows NT PCs when
+a printer is shared by them. Windows NT print servers always have a
+<i class="parameter"><tt>[print$]</tt></i> service which provides read-write
+access (in the context of its ACLs) in order to support printer driver
+down- and uploads. Don't fear -- this does not mean Windows 9x
+clients are thrown aside now. They can use Samba's
+<i class="parameter"><tt>[print$]</tt></i> share support just fine.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2926955"></a>Creating the [print$] Share</h3></div></div><div></div></div><p>
+In order to support the up- and downloading of printer driver files,
+you must first configure a file share named
+<i class="parameter"><tt>[print$]</tt></i>. The "public" name of this share is
+hard coded in Samba's internals (because it is hardcoded in the MS
+Windows clients too). It cannot be renamed since Windows clients are
+programmed to search for a service of exactly this name if they want
+to retrieve printer driver files.
+</p><p>
+You should modify the server's file to
+add the global parameters and create the
+<i class="parameter"><tt>[print$]</tt></i> file share (of course, some of the
+parameter values, such as 'path' are arbitrary and should be replaced
+with appropriate values for your site):
+</p><pre class="screen">
+ [global]
+ ; members of the ntadmin group should be able to add drivers and set
+ ; printer properties. root is implicitly always a 'printer admin'.
+ printer admin = @ntadmin
+ [....]
+
+ [printers]
+ [....]
+
+ [print$]
+ comment = Printer Driver Download Area
+ path = /etc/samba/drivers
+ browseable = yes
+ guest ok = yes
+ read only = yes
+ write list = @ntadmin, root
+</pre><p>
+Of course, you also need to ensure that the directory named by the
+<i class="parameter"><tt>path</tt></i> parameter exists on the Unix file system.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2927026"></a>Parameters in the [print$] Section</h3></div></div><div></div></div><p>
+<i class="parameter"><tt>[print$]</tt></i> is a special section in
+. It contains settings relevant to
+potential printer driver download and local installation by clients.
+</p><div class="variablelist"><dl><dt><span class="term"><i class="parameter"><tt>comment = Printer Driver
+Download Area</tt></i></span></dt><dd><p> the comment appears next to the share name if it is
+listed in a share list (usually Windows clients won't see it often but
+it will also appear up in a <b class="command">smbclient -L sambaserver
+</b> output). </p></dd><dt><span class="term"><i class="parameter"><tt>path = /etc/samba/printers</tt></i></span></dt><dd><p> this is the path to the location of the Windows
+driver file deposit from the UNIX point of
+view.</p></dd><dt><span class="term"><i class="parameter"><tt>browseable = no</tt></i></span></dt><dd><p> this makes the <i class="parameter"><tt>[print$]</tt></i> share
+"invisible" in Network Neighbourhood to clients. However, you can
+still "mount" it from any client using the <b class="command">net use
+g:\\sambaserver\print$</b> command in a "DOS box" or the
+"Connect network drive" menu from Windows
+Explorer.</p></dd><dt><span class="term"><i class="parameter"><tt>guest ok = yes</tt></i></span></dt><dd><p>this gives read only access to this share for all
+guest users. Access may be used to download and install printer
+drivers on clients. The requirement for <i class="parameter"><tt>guest ok =
+yes</tt></i> depends upon how your site is configured. If users
+will be guaranteed to have an account on the Samba host, then this is
+a non-issue.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The non-issue is this: if all your Windows NT users are guaranteed to
+be authenticated by the Samba server (for example if Samba
+authenticates via an NT domain server and the NT user has already been
+validated by the Domain Controller in order to logon to the Windows NT
+session), then guest access is not necessary. Of course, in a
+workgroup environment where you just want to be able to print without
+worrying about silly accounts and security, then configure the share
+for guest access. You'll probably want to add <i class="parameter"><tt>map to guest
+= Bad User</tt></i> in the <i class="parameter"><tt>[global]</tt></i> section
+as well. Make sure you understand what this parameter does before
+using it.
+</p></div></dd><dt><span class="term"><i class="parameter"><tt>read only = yes</tt></i></span></dt><dd><p>as we don't want everybody to upload driver files (or
+even change driver settings) we tagged this share as not
+writeable.</p></dd><dt><span class="term"><i class="parameter"><tt>write list = @ntadmin,root</tt></i></span></dt><dd><p>since the <i class="parameter"><tt>[print$]</tt></i> was made
+read only by the previous setting, we need to create a "write list"
+also. UNIX groups (denoted with a leading "@" character) and users
+listed here are allowed write access (as an exception to the general
+public's "read-only" access), which they need to update files on the
+share. Normally you will want to only name administrative level user
+accounts in this setting. Check the file system permissions to make
+sure these accounts can copy files to the share. If this is a non-root
+account, then the account should also be mentioned in the global
+<i class="parameter"><tt>printer admin </tt></i> parameter. See the
+ man page for more information on
+configuring file shares. </p></dd></dl></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2927247"></a>Subdirectory Structure in [print$]</h3></div></div><div></div></div><p>
+In order for a Windows NT print server to support the downloading of
+driver files by multiple client architectures, you must create several
+subdirectories within the <i class="parameter"><tt>[print$]</tt></i> service
+(i.e. the Unix directory named by the <i class="parameter"><tt>path</tt></i>
+parameter). These correspond to each of the supported client
+architectures. Samba follows this model as well. Just like the name of
+the <i class="parameter"><tt>[print$]</tt></i> share itself, the subdirectories
+*must* be exactly the names listed below (you may leave out the
+subdirectories of architectures you don't want to support).
+</p><p>
+Therefore, create a directory tree below the
+<i class="parameter"><tt>[print$]</tt></i> share for each architecture you wish
+to support.
+</p><pre class="programlisting">
+[print$]--+--
+ |--W32X86 # serves drivers to "Windows NT x86"
+ |--WIN40 # serves drivers to "Windows 95/98"
+ |--W32ALPHA # serves drivers to "Windows NT Alpha_AXP"
+ |--W32MIPS # serves drivers to "Windows NT R4000"
+ |--W32PPC # serves drivers to "Windows NT PowerPC"
+</pre><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Required permissions</h3><p>
+In order to add a new driver to your Samba host, one of two conditions
+must hold true:
+</p><div class="itemizedlist"><ul type="disc"><li><p>The account used to connect to the Samba host must
+have a UID of 0 (i.e. a root account)</p></li><li><p>The account used to connect to the Samba host must be
+named in the <span class="emphasis"><em>printer admin</em></span>list.</p></li></ul></div><p>
+Of course, the connected account must still possess access to add
+files to the subdirectories beneath
+<i class="parameter"><tt>[print$]</tt></i>. Remember that all file shares are set
+to 'read only' by default.
+</p></div><p>
+Once you have created the required <i class="parameter"><tt>[print$]</tt></i>
+service and associated subdirectories, go to a Windows NT 4.0/2k/XP
+client workstation. Open <span class="guiicon">Network Neighbourhood</span> or
+<span class="guiicon">My Network Places</span> and browse for the Samba host.
+Once you have located the server, navigate to its <span class="guiicon">Printers and
+Faxes</span> folder. You should see an initial listing of printers
+that matches the printer shares defined on your Samba host.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2927408"></a>Installing Drivers into [print$]</h2></div></div><div></div></div><p>
+You have successfully created the <i class="parameter"><tt>[print$]</tt></i>
+share in ? And Samba has re-read its
+configuration? Good. But you are not yet ready to take off. The
+<span class="emphasis"><em>driver files</em></span> need to be present in this share,
+too! So far it is still an empty share. Unfortunatly, it is not enough
+to just copy the driver files over. They need to be <span class="emphasis"><em>set
+up</em></span> too. And that is a bit tricky, to say the least. We
+will now discuss two alternative ways to install the drivers into
+<i class="parameter"><tt>[print$]</tt></i>:
+</p><div class="itemizedlist"><ul type="disc"><li><p>using the Samba commandline utility
+<b class="command">rpcclient</b> with its various subcommands (here:
+<b class="command">adddriver</b> and <b class="command">setdriver</b>) from
+any UNIX workstation;</p></li><li><p>running a GUI (<span class="emphasis"><em>Printer
+Properties</em></span> and <span class="emphasis"><em>Add Printer Wizard</em></span>)
+from any Windows NT/2k/XP client workstation.</p></li></ul></div><p>
+The latter option is probably the easier one (even if the only
+entrance to this realm seems a little bit weird at first).
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2927502"></a>Setting Drivers for existing Printers with a Client GUI</h3></div></div><div></div></div><p>
+The initial listing of printers in the Samba host's
+<span class="guiicon">Printers</span> folder accessed from a client's Explorer
+will have no real printer driver assigned to them. By default, in
+Samba-3 (as in 2.2.1 and later) this driver name is set to a NULL
+string. This must be changed now. The local <span class="emphasis"><em>Add Printer
+Wizard</em></span>, run from NT/2000/XP clients, will help us in this
+task.
+</p><p>
+However, the job to set a valid driver for the printer is not a
+straightforward one: You must attempt to view the printer properties
+for the printer to which you want the driver assigned. Open the
+Windows Explorer, open Network Neighbourhood, browse to the Samba
+host, open Samba's <span class="guiicon">Printers</span> folder, right-click the printer icon and
+select <span class="guimenu">Properties...</span>. You are now trying to view printer and driver
+properties for a queue which has this default <tt class="constant">NULL</tt> driver
+assigned. This will result in an error message (this is normal here):
+</p><p><span class="errorname"> Device settings cannot be displayed. The driver
+for the specified printer is not installed, only spooler properties
+will be displayed. Do you want to install the driver
+now?</span></p><p>
+<span class="emphasis"><em>Important:</em></span>Don't click <span class="guibutton">Yes</span>! Instead,
+<span class="emphasis"><em>click <span class="guibutton">No</span></em></span> in the error dialog.
+Only now you will be presented with the printer properties window. From here,
+the way to assign a driver to a printer is open to us. You have now the choice
+either:
+</p><div class="itemizedlist"><ul type="disc"><li><p>select a driver from the popup list of installed
+drivers. <span class="emphasis"><em>Initially this list will be empty.</em></span>
+Or</p></li><li><p>use the <span class="guibutton">New Driver...</span> button to
+install a new printer driver (which will in fact start up the
+APW).</p></li></ul></div><p>
+Once the APW is started, the procedure is exactly the same as the one
+you are familiar with in Wiindows (we assume here that you are
+familiar with the printer driver installations procedure on Windows
+NT). Make sure your connection is in fact setup as a user with
+<i class="parameter"><tt>printer admin</tt></i> privileges (if in doubt, use
+<b class="command">smbstatus</b> to check for this). If you wish to
+install printer drivers for client operating systems other than
+<span class="application">Windows NT x86</span>, you will need to use the
+<span class="guilabel">Sharing</span> tab of the printer properties dialog.
+</p><p>
+Assuming you have connected with an administrative (or root) account
+(as named by the <i class="parameter"><tt>printer admin</tt></i> parameter),
+you will also be able to modify other printer properties such as ACLs
+and default device settings using this dialog. For the default device
+settings, please consider the advice given further below.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2927686"></a>Setting Drivers for existing Printers with
+<b class="command">rpcclient</b></h3></div></div><div></div></div><p>
+The second way to install printer drivers into
+<i class="parameter"><tt>[print$]</tt></i> and set them up in a valid way can be
+done from the UNIX command line. This involves four distinct steps:
+</p><div class="orderedlist"><ol type="1"><li><p>gathering the info about the required driver files
+and collecting the files together;</p></li><li><p>deposit the driver files into the
+<i class="parameter"><tt>[print$]</tt></i> share's correct subdirectories
+(possibly by using <b class="command">smbclient</b>);</p></li><li><p>running the <b class="command">rpcclient</b>
+commandline utility once with the <b class="command">addriver</b>
+subcommand,</p></li><li><p>running <b class="command">rpcclient</b> a second
+time with the <b class="command">setdriver</b>
+subcommand.</p></li></ol></div><p>
+We will provide detailed hints for each of these steps in the next few
+paragraphs.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2927794"></a>Identifying the Driver Files</h4></div></div><div></div></div><p>
+To find out about the driver files, you have two options: you could
+investigate the driver CD which comes with your printer. Study the
+<tt class="filename">*.inf</tt> file on the CD, if it is contained. This
+may not be the possible, since the *.inf file might be
+missing. Unfortunately, many vendors have now started to use their own
+installation programs. These installations packages are often some
+sort of Windows platform archive format, plus, the files may get
+re-named during the installation process. This makes it extremely
+difficult to identify the driver files you need.
+</p><p>
+Then you only have the second option: install the driver first on a
+Windows client *locally* and investigate which file names and paths it
+uses after they are installed. (Note, that you need to repeat this
+procedure for every client platform you want to support. We are going
+to show it here for the <span class="application">W32X86</span> platform only, a
+name used by Microsoft for all WinNT/2k/XP clients...)
+</p><p>
+A good method to recognize the driver files this is to print the test
+page from the driver's <span class="guilabel">Properties</span> Dialog
+(<span class="guilabel">General</span> tab). Then look at the list of driver
+files named on the printout. You'll need to recognize what Windows
+(and Samba) are calling the <span class="guilabel">Driver File</span> , the
+<span class="guilabel">Data File</span>, the <span class="guilabel">Config File</span>,
+the <span class="guilabel">Help File</span> and (optionally) the
+<span class="guilabel">Dependent Driver Files</span> (this may vary slightly
+for Windows NT). You need to remember all names (or better take a
+note) for the next steps.
+</p><p>
+Another method to quickly test the driver filenames and related paths
+is provided by the <b class="command">rpcclient</b> utility. Run it with
+<b class="command">enumdrivers</b> or with the
+<b class="command">getdriver</b> subcommand, each in the
+<span class="emphasis"><em>3</em></span> level. In the following example,
+<span class="emphasis"><em>TURBO_XP</em></span> is the name of the Windows PC (in this
+case it was a Windows XP Professional laptop, BTW). I had installed
+the driver locally to TURBO_XP while <span class="emphasis"><em>kde-bitshop</em></span> is
+the name of the Linux host from which I am working. We could run an
+<span class="emphasis"><em>interactive</em></span> <b class="command">rpcclient</b> session;
+then we'd get an <span class="emphasis"><em>rpcclient /></em></span> prompt and would
+type the subcommands at this prompt. This is left as a good exercise
+to the reader. For now we use <b class="command">rpcclient</b> with the
+<tt class="option">-c</tt> parameter to execute a single subcommand
+line and exit again. This is the method you would use if you want to
+create scripts to automate the procedure for a large number of
+printers and drivers. Note the different quotes used to overcome the
+different spaces in between words:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient -U'Danka%xxxx' -c 'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP</tt></b>
+ cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
+
+ [Windows NT x86]
+ Printer Driver Info 3:
+ Version: [2]
+ Driver Name: [Heidelberg Digimaster 9110 (PS)]
+ Architecture: [Windows NT x86]
+ Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.DLL]
+ Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.ppd]
+ Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.DLL]
+ Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.HLP]
+
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll]
+ Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF]
+
+ Monitorname: []
+ Defaultdatatype: []
+
+</pre><p>
+You may notice, that this driver has quite a big number of
+<span class="guilabel">Dependentfiles</span> (I know worse cases however). Also,
+strangely, the <span class="guilabel">Driver File</span> is here tagged as
+<span class="guilabel">Driver Path</span>.... oh, well. Here we don't have yet
+support for the so-called <span class="application">WIN40</span> architecture
+installed. This name is used by Microsoft for the Win95/98/ME platforms.
+If we want to support these, we need to install the Win95/98/ME driver
+files in addition to those for <span class="application">W32X86</span>
+(i.e. the WinNT72000/XP clients) onto a Windows PC. This PC
+can also host the Win9x drivers, even if itself runs on Windows NT,
+2000 or XP.
+</p><p>
+Since the <i class="parameter"><tt>[print$]</tt></i> share is usually accessible
+through the <span class="guiicon">Network Neighbourhood</span>, you can also use the UNC notation
+from Windows Explorer to poke at it. The Win9x driver files will end
+up in subdirectory "0" of the "WIN40" directory. The full path to
+access them will be
+<tt class="filename">\\WINDOWSHOST\print$\WIN40\0\</tt>.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> more recent drivers on Windows 2000 and Wndows XP are
+installed into the "3" subdirectory instead of the "2". The version 2
+of drivers, as used in Windows NT, were running in Kernel Mode.
+Windows 2000 changed this. While it still can use the Kernel Mode
+drivers (if this is enabled by the Admin), its native mode for printer
+drivers is User Mode execution. This requires drivers designed for
+this. These type of drivers install into the "3" subdirectory.
+</p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2928122"></a>Collecting the Driver Files from a Windows Host's
+[print$] Share</h4></div></div><div></div></div><p>
+Now we need to collect all the driver files we identified. in our
+previous step. Where do we get them from? Well, why not retrieve them
+from the very PC and the same <i class="parameter"><tt>[print$]</tt></i> share
+which we investigated in our last step to identify the files? We can
+use <b class="command">smbclient</b> to do this. We will use the paths and
+names which were leaked to us by <b class="command">getdriver</b>. The
+listing is edited to include linebreaks for readability:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>smbclient //TURBO_XP/print\$ -U'Danka%xxxx' \
+ -c 'cd W32X86/2;mget HD*_de.* \
+ hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL'</tt></b>
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Got a positive name query response from 10.160.50.8 ( 10.160.50.8 )
+ Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager]
+ <tt class="prompt">Get file Hddm91c1_de.ABD? </tt><b class="userinput"><tt>n</tt></b>
+ <tt class="prompt">Get file Hddm91c1_de.def? </tt><b class="userinput"><tt>y</tt></b>
+ getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def (22.0 kb/s) (average 22.0 kb/s)
+ <tt class="prompt">Get file Hddm91c1_de.DLL? </tt><b class="userinput"><tt>y</tt></b>
+ getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL (737.3 kb/s) (average 737.3 kb/s)
+ [...]
+
+</pre><p>
+After this command is complete, the files are in our current local
+directory. You probably have noticed that this time we passed several
+commands to the <tt class="option">-c</tt> parameter, separated by semi-colons. This
+effects that all commands are executed in sequence on the remote
+Windows server before smbclient exits again.
+</p><p>
+Don't forget to repeat the procedure for the <span class="application">WIN40</span>
+architecture should you need to support Win95/98/XP clients. Remember, the
+files for these architectures are in the WIN40/0/ subdir. Once we are
+complete, we can run <b class="command">smbclient ... put</b> to store
+the collected files on the Samba server's
+<i class="parameter"><tt>[print$]</tt></i> share.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2928275"></a>Depositing the Driver Files into [print$]</h4></div></div><div></div></div><p>
+So, now we are going to put the driver files into the
+<i class="parameter"><tt>[print$]</tt></i> share. Remember, the UNIX path to this
+share has been defined previously in your
+. You also have created subdirectories
+for the different Windows client types you want to support. Supposing
+your <i class="parameter"><tt>[print$]</tt></i> share maps to the UNIX path
+<tt class="filename">/etc/samba/drivers/</tt>, your driver files should now
+go here:
+</p><div class="itemizedlist"><ul type="disc"><li><p>for all Windows NT, 2000 and XP clients into
+<tt class="filename">/etc/samba/drivers/W32X86/</tt> <span class="emphasis"><em>but
+*not*(yet) into the "2" subdir</em></span>!</p></li><li><p>for all Windows 95, 98 and ME clients into
+<tt class="filename">/etc/samba/drivers/WIN40/</tt> -- <span class="emphasis"><em>but *not*
+(yet) into the "0" subdir</em></span>!</p></li></ul></div><p>
+We again use smbclient to transfer the driver files across the
+network. We specify the same files and paths as were leaked to us by
+running <b class="command">getdriver</b> against the original
+<span class="emphasis"><em>Windows</em></span> install. However, now we are going to
+store the files into a <span class="emphasis"><em>Samba/UNIX</em></span> print server's
+<i class="parameter"><tt>[print$]</tt></i> share...
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c 'cd W32X86; put HDNIS01_de.DLL; \
+ put Hddm91c1_de.ppd; put HDNIS01U_de.DLL; \
+ put HDNIS01U_de.HLP; put Hddm91c1_de.DLL; \
+ put Hddm91c1_de.INI; put Hddm91c1KMMin.DLL; \
+ put Hddm91c1_de.dat; put Hddm91c1_de.dat; \
+ put Hddm91c1_de.def; put Hddm91c1_de.hre; \
+ put Hddm91c1_de.vnd; put Hddm91c1_de.hlp; \
+ put Hddm91c1_de_reg.HLP; put HDNIS01Aux.dll; \
+ put HDNIS01_de.NTF'</tt></b>
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+ putting file HDNIS01_de.DLL as \W32X86\HDNIS01_de.DLL (4465.5 kb/s) (average 4465.5 kb/s)
+ putting file Hddm91c1_de.ppd as \W32X86\Hddm91c1_de.ppd (12876.8 kb/s) (average 4638.9 kb/s)
+ putting file HDNIS01U_de.DLL as \W32X86\HDNIS01U_de.DLL (20249.8 kb/s) (average 5828.3 kb/s)
+ putting file HDNIS01U_de.HLP as \W32X86\HDNIS01U_de.HLP (9652.8 kb/s) (average 5899.8 kb/s)
+ putting file Hddm91c1_de.DLL as \W32X86\Hddm91c1_de.DLL (23777.7 kb/s) (average 10400.6 kb/s)
+ putting file Hddm91c1_de.INI as \W32X86\Hddm91c1_de.INI (98.6 kb/s) (average 10329.0 kb/s)
+ putting file Hddm91c1KMMin.DLL as \W32X86\Hddm91c1KMMin.DLL (22931.5 kb/s) (average 10501.7 kb/s)
+ putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (2462.8 kb/s) (average 10393.0 kb/s)
+ putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (4925.3 kb/s) (average 10356.3 kb/s)
+ putting file Hddm91c1_de.def as \W32X86\Hddm91c1_de.def (417.9 kb/s) (average 10290.1 kb/s)
+ putting file Hddm91c1_de.hre as \W32X86\Hddm91c1_de.hre (22571.3 kb/s) (average 11338.5 kb/s)
+ putting file Hddm91c1_de.vnd as \W32X86\Hddm91c1_de.vnd (3384.6 kb/s) (average 10754.3 kb/s)
+ putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp (18406.8 kb/s) (average 10839.8 kb/s)
+ putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP (20278.3 kb/s) (average 11386.3 kb/s)
+ putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll (14994.6 kb/s) (average 11405.2 kb/s)
+ putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF (23390.2 kb/s) (average 13170.8 kb/s)
+
+</pre><p>
+Phewww -- that was a lot of typing! Most drivers are a lot smaller --
+many only having 3 generic PostScript driver files plus 1 PPD. Note,
+that while we did retrieve the files from the "2" subdirectory of the
+"W32X86" directory from the Windows box, we <span class="emphasis"><em>don't</em></span>
+put them (for now) in this same subdirectory of the Samba box! This
+re-location will automatically be done by the
+<b class="command">adddriver</b> command which we will run shortly (and
+don't forget to also put the files for the Win95/98/ME architecture
+into the <tt class="filename">WIN40/</tt> subdirectory should you need
+them).
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2928478"></a>Check if the Driver Files are there (with smbclient)</h4></div></div><div></div></div><p>
+For now we verify that our files are there. This can be done with
+<b class="command">smbclient</b> too (but of course you can log in via SSH
+also and do this through a standard UNIX shell access too):
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' -c 'cd W32X86; pwd; dir; cd 2; pwd; dir'</tt></b>
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+
+ Current directory is \\SAMBA-CUPS\print$\W32X86\
+ . D 0 Sun May 4 03:56:35 2003
+ .. D 0 Thu Apr 10 23:47:40 2003
+ 2 D 0 Sun May 4 03:56:18 2003
+ HDNIS01Aux.dll A 15356 Sun May 4 03:58:59 2003
+ Hddm91c1KMMin.DLL A 46966 Sun May 4 03:58:59 2003
+ HDNIS01_de.DLL A 434400 Sun May 4 03:58:59 2003
+ HDNIS01_de.NTF A 790404 Sun May 4 03:56:35 2003
+ Hddm91c1_de.DLL A 876544 Sun May 4 03:58:59 2003
+ Hddm91c1_de.INI A 101 Sun May 4 03:58:59 2003
+ Hddm91c1_de.dat A 5044 Sun May 4 03:58:59 2003
+ Hddm91c1_de.def A 428 Sun May 4 03:58:59 2003
+ Hddm91c1_de.hlp A 37699 Sun May 4 03:58:59 2003
+ Hddm91c1_de.hre A 323584 Sun May 4 03:58:59 2003
+ Hddm91c1_de.ppd A 26373 Sun May 4 03:58:59 2003
+ Hddm91c1_de.vnd A 45056 Sun May 4 03:58:59 2003
+ HDNIS01U_de.DLL A 165888 Sun May 4 03:58:59 2003
+ HDNIS01U_de.HLP A 19770 Sun May 4 03:58:59 2003
+ Hddm91c1_de_reg.HLP A 228417 Sun May 4 03:58:59 2003
+ 40976 blocks of size 262144. 709 blocks available
+
+ Current directory is \\SAMBA-CUPS\print$\W32X86\2\
+ . D 0 Sun May 4 03:56:18 2003
+ .. D 0 Sun May 4 03:56:35 2003
+ ADOBEPS5.DLL A 434400 Sat May 3 23:18:45 2003
+ laserjet4.ppd A 9639 Thu Apr 24 01:05:32 2003
+ ADOBEPSU.DLL A 109568 Sat May 3 23:18:45 2003
+ ADOBEPSU.HLP A 18082 Sat May 3 23:18:45 2003
+ PDFcreator2.PPD A 15746 Sun Apr 20 22:24:07 2003
+ 40976 blocks of size 262144. 709 blocks available
+
+</pre><p>
+Notice that there are already driver files present in the
+<tt class="filename">2</tt> subdir (probably from a previous
+installation). Once the files for the new driver are there too, you
+are still a few steps away from being able to use them on the
+clients. The only thing you could do *now* is to retrieve them from a
+client just like you retrieve ordinary files from a file share, by
+opening print$ in Windows Explorer. But that wouldn't install them per
+Point'n'Print. The reason is: Samba doesn't know yet that these files
+are something special, namely <span class="emphasis"><em>printer driver
+files</em></span> and it doesn't know yet to which print queue(s) these
+driver files belong.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2928594"></a>Running <b class="command">rpcclient</b> with
+<b class="command">adddriver</b></h4></div></div><div></div></div><p>
+So, next you must tell Samba about the special category of the files
+you just uploaded into the <i class="parameter"><tt>[print$]</tt></i> share. This
+is done by the <b class="command">adddriver</b> command. It will
+prompt Samba to register the driver files into its internal TDB
+database files. The following command and its output has been edited,
+again, for readability:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL: \
+ Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \
+ NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
+ Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \
+ Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+ HDNIS01Aux.dll,HDNIS01_de.NTF, \
+ Hddm91c1_de_reg.HLP' SAMBA-CUPS</tt></b>
+
+ cmd = adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL: \
+ HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
+ Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \
+ Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+ HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+
+ Printer Driver dm9110 successfully installed.
+
+</pre><p>
+After this step the driver should be recognized by Samba on the print
+server. You need to be very carefull when typing the command. Don't
+exchange the order of the fields. Some changes would lead to a
+<tt class="computeroutput">NT_STATUS_UNSUCCESSFUL</tt> error
+message. These become obvious. Other changes might install the driver
+files successfully, but render the driver unworkable. So take care!
+Hints about the syntax of the adddriver command are in the man
+page. The CUPS printing chapter of this HOWTO collection provides a
+more detailed description, if you should need it.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2928693"></a>Check how Driver Files have been moved after
+<b class="command">adddriver</b> finished</h4></div></div><div></div></div><p>
+One indication for Samba's recognition of the files as driver files is
+the <tt class="computeroutput">successfully installed</tt> message.
+Another one is the fact, that our files have been moved by the
+<b class="command">adddriver</b> command into the <tt class="filename">2</tt>
+subdirectory. You can check this again with
+<b class="command">smbclient</b>:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>smbclient //SAMBA-CUPS/print\$ -Uroot%xxxx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd'</tt></b>
+ added interface ip=10.160.51.162 bcast=10.160.51.255 nmask=255.255.252.0
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+
+ Current directory is \\SAMBA-CUPS\print$\W32X86\
+ . D 0 Sun May 4 04:32:48 2003
+ .. D 0 Thu Apr 10 23:47:40 2003
+ 2 D 0 Sun May 4 04:32:48 2003
+ 40976 blocks of size 262144. 731 blocks available
+
+ Current directory is \\SAMBA-CUPS\print$\W32X86\2\
+ . D 0 Sun May 4 04:32:48 2003
+ .. D 0 Sun May 4 04:32:48 2003
+ DigiMaster.PPD A 148336 Thu Apr 24 01:07:00 2003
+ ADOBEPS5.DLL A 434400 Sat May 3 23:18:45 2003
+ laserjet4.ppd A 9639 Thu Apr 24 01:05:32 2003
+ ADOBEPSU.DLL A 109568 Sat May 3 23:18:45 2003
+ ADOBEPSU.HLP A 18082 Sat May 3 23:18:45 2003
+ PDFcreator2.PPD A 15746 Sun Apr 20 22:24:07 2003
+ HDNIS01Aux.dll A 15356 Sun May 4 04:32:18 2003
+ Hddm91c1KMMin.DLL A 46966 Sun May 4 04:32:18 2003
+ HDNIS01_de.DLL A 434400 Sun May 4 04:32:18 2003
+ HDNIS01_de.NTF A 790404 Sun May 4 04:32:18 2003
+ Hddm91c1_de.DLL A 876544 Sun May 4 04:32:18 2003
+ Hddm91c1_de.INI A 101 Sun May 4 04:32:18 2003
+ Hddm91c1_de.dat A 5044 Sun May 4 04:32:18 2003
+ Hddm91c1_de.def A 428 Sun May 4 04:32:18 2003
+ Hddm91c1_de.hlp A 37699 Sun May 4 04:32:18 2003
+ Hddm91c1_de.hre A 323584 Sun May 4 04:32:18 2003
+ Hddm91c1_de.ppd A 26373 Sun May 4 04:32:18 2003
+ Hddm91c1_de.vnd A 45056 Sun May 4 04:32:18 2003
+ HDNIS01U_de.DLL A 165888 Sun May 4 04:32:18 2003
+ HDNIS01U_de.HLP A 19770 Sun May 4 04:32:18 2003
+ Hddm91c1_de_reg.HLP A 228417 Sun May 4 04:32:18 2003
+ 40976 blocks of size 262144. 731 blocks available
+
+</pre><p>
+Another verification is that the timestamp of the printing TDB files
+is now updated (and possibly their filesize has increased).
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2928817"></a>Check if the Driver is recognized by Samba</h4></div></div><div></div></div><p>
+Now the driver should be registered with Samba. We can easily verify
+this, and will do so in a moment. However, this driver is
+<span class="emphasis"><em>not yet</em></span> associated with a particular
+<span class="emphasis"><em>printer</em></span>. We may check the driver status of the
+files by at least three methods:
+</p><div class="itemizedlist"><ul type="disc"><li><p>from any Windows client browse Network Neighbourhood,
+finde the Samba host and open the Samba <span class="guiicon">Printers and
+Faxes</span> folder. Select any printer icon, right-click and
+select the printer <span class="guimenuitem">Properties</span>. Click on the
+<span class="guilabel">Advanced</span> tab. Here is a field indicating the
+driver for that printer. A drop down menu allows you to change that
+driver (be carefull to not do this unwittingly.). You can use this
+list to view all drivers know to Samba. Your new one should be amongst
+them. (Each type of client will only see his own architecture's
+list. If you don't have every driver installed for each platform, the
+list will differ if you look at it from Windows95/98/ME or
+WindowsNT/2000/XP.)</p></li><li><p>from a Windows 2000 or XP client (not WinNT) browse
+<span class="guiicon">Network Neighbourhood</span>, search for the Samba
+server and open the server's <span class="guiicon">Printers</span> folder,
+right-click the white background (with no printer highlighted). Select
+<span class="guimenuitem">Server Properties</span>. On the
+<span class="guilabel">Drivers</span> tab you will see the new driver listed
+now. This view enables you to also inspect the list of files belonging
+to that driver<span class="emphasis"><em> (this doesn't work on Windows NT, but only on
+Windows 2000 and Windows XP. WinNT doesn't provide the "Drivers"
+tab).</em></span>. An alternative, much quicker method for Windows
+2000/XP to start this dialog is by typing into a DOS box (you must of
+course adapt the name to your Samba server instead of <i class="replaceable"><tt>SAMBA-CUPS</tt></i>):
+</p><p><b class="userinput"><tt> rundll32 printui.dll,PrintUIEntry /s /t2 /n\\<i class="replaceable"><tt>SAMBA-CUPS</tt></i></tt></b></p></li><li><p>from a UNIX prompt run this command (or a variant
+thereof), where <i class="replaceable"><tt>SAMBA-CUPS</tt></i> is the name of the Samba
+host and "xxxx" represents the actual Samba password assigned to root:
+</p><p><b class="userinput"><tt>rpcclient -U'root%xxxx' -c 'enumdrivers' <i class="replaceable"><tt>SAMBA-CUPS</tt></i></tt></b></p><p>
+You will see a listing of all drivers Samba knows about. Your new one
+should be amongst them. But it is only listed under the <i class="parameter"><tt>[Windows NT
+x86]</tt></i> heading, not under <i class="parameter"><tt>[Windows 4.0]</tt></i>,
+since we didn't install that part. Or did *you*? -- You will see a listing of
+all drivers Samba knows about. Your new one should be amongst them. In our
+example it is named <span class="emphasis"><em>dm9110</em></span>. Note that the 3rd column
+shows the other installed drivers twice, for each supported architecture one
+time. Our new driver only shows up for
+<span class="application">Windows NT 4.0 or 2000</span>. To
+have it present for <span class="application">Windows 95, 98 and ME</span> you'll
+have to repeat the whole procedure with the WIN40 architecture and subdirectory.
+</p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2929021"></a>A sidenote: you are not bound to specific driver names</h4></div></div><div></div></div><p>
+You can name the driver as you like. If you repeat the
+<b class="command">adddriver</b> step, with the same files as before, but
+with a different driver name, it will work the same:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient -Uroot%xxxx \
+ -c 'adddriver "Windows NT x86" \
+ "myphantasydrivername:HDNIS01_de.DLL: \
+ Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \
+ NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
+ Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \
+ Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+ HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS
+ </tt></b>
+
+ cmd = adddriver "Windows NT x86"
+ "myphantasydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\
+ HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
+ Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \
+ Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+ HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+
+ Printer Driver myphantasydrivername successfully installed.
+
+</pre><p>
+You will also be able to bind that driver to any print queue (however,
+you are responsible yourself that you associate drivers to queues
+which make sense to the target printer). Note, that you can't run the
+<b class="command">rpcclient</b> <b class="command">adddriver</b> command
+repeatedly. Each run "consumes" the files you had put into the
+<i class="parameter"><tt>[print$]</tt></i> share by moving them into the
+respective subdirectories. So you <span class="emphasis"><em>must</em></span> precede an
+<b class="command">smbclient ... put</b> command before each
+<b class="command">rpcclient ... addriver</b>" command.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2929132"></a>La Grande Finale: Running <b class="command">rpcclient</b> with
+<b class="command">setdriver</b></h4></div></div><div></div></div><p>
+Samba still needs to know <span class="emphasis"><em>which</em></span> printer's driver
+this is. It needs to create a mapping of the driver to a printer, and
+store this info in its "memory", the TDB files. The <b class="command">rpcclient
+setdriver</b> command achieves exactly this:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient -U'root%xxxx' -c 'setdriver dm9110 myphantasydrivername' <i class="replaceable"><tt>SAMBA-CUPS</tt></i></tt></b>
+ cmd = setdriver dm9110 myphantasydrivername
+ Successfully set dm9110 to driver myphantasydrivername.
+</pre><p>
+Ahhhhh -- no, I didn't want to do that. Repeat, this time with the
+name I intended:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient -U'root%xxxx' -c 'setdriver dm9110 dm9110' <i class="replaceable"><tt>SAMBA-CUPS</tt></i></tt></b>
+ cmd = setdriver dm9110 dm9110
+ Succesfully set dm9110 to driver dm9110.
+</pre><p>
+The syntax of the command is <b class="userinput"><tt>rpcclient
+-U'root%<i class="replaceable"><tt>sambapassword</tt></i>' -c 'setdriver
+"<i class="replaceable"><tt>printername</tt></i>"
+"<i class="replaceable"><tt>drivername</tt></i>'
+<i class="replaceable"><tt>SAMBA-Hostname</tt></i></tt></b> . --
+Now we have done *most* of the work. But not yet all....
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+the <b class="command">setdriver</b> command will only succeed if the printer is
+known to
+Samba already. A bug in 2.2.x prevented Samba from recognizing freshly
+installed printers. You had to restart Samba, or at least send a HUP
+signal to all running smbd processes to work around this:
+<b class="userinput"><tt>kill -HUP `pidof smbd`</tt></b>. </p></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2929284"></a>"The Proof of the Pudding lies in the Eating" (Client Driver Insta
+Procedure)</h2></div></div><div></div></div><p>
+A famous philosopher said once: “<span class="quote">The Proof of the Pudding lies
+in the Eating</span>”. The proof for our setup lies in the printing.
+So let's install the printer driver onto the client PCs. This is not
+as straightforward as it may seem. Read on.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2929305"></a>The first Client Driver Installation</h3></div></div><div></div></div><p>
+Especially important is the installation onto the first client PC (for
+each architectural platform separately). Once this is done correctly,
+all further clients are easy to setup and shouldn't need further
+attention. What follows is a description for the recommended first
+procedure. You work now from a client workstation. First you should
+guarantee that your connection is not unwittingly mapped to
+<i class="parameter"><tt>bad user</tt></i> "nobody". In a DOS box type:
+</p><p><b class="userinput"><tt>net use \\<i class="replaceable"><tt>SAMBA-SERVER</tt></i>\print$ /user:root</tt></b></p><p>
+Replace root, if needed, by another valid
+<i class="replaceable"><tt>printer admin</tt></i> user as given in the definition.
+Should you already be connected as a different user, you'll get an error
+message. There is no easy way to get rid of that connection, because
+Windows doesn't seem to know a concept of "logging off" from a share
+connection (don't confuse this with logging off from the local
+workstation; that is a different matter). You can try to close
+<span class="emphasis"><em>all</em></span> Windows file explorer and Internet Explorer
+windows. As a last resort, you may have to reboot. Make sure there is
+no automatic re-connection set up. It may be easier to go to a
+different workstation and try from there. After you have made sure you
+are connected as a printer admin user (you can check this with the
+<b class="command">smbstatus</b> command on Samba) do this from the
+Windows workstation:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Open <span class="guiicon">Network
+Neighbourhood</span></p></li><li><p>Browse to Samba server</p></li><li><p>Open its <span class="guiicon">Printers and
+Faxes</span> folder</p></li><li><p>Highlight and right-click the printer</p></li><li><p>Select <span class="guimenuitem">Connect...</span> (for WinNT4/2K
+it is possibly <span class="guimenuitem">Install...</span>)</p></li></ul></div><p>
+A new printer (named <i class="replaceable"><tt>printername</tt></i> on
+samba-server) should now have appeared in your
+<span class="emphasis"><em>local</em></span> Printer folder (check <span class="guimenu">Start</span> --
+<span class="guimenuitem">Settings</span> -- <span class="guimenuitem">Control Panel</span>
+-- <span class="guiicon">Printers and Faxes</span>).
+</p><p>
+Most likely you are now tempted to try and print a test page. After
+all, you now can open the printer properties and on the "General" tab,
+there is a button offering to do just that. But chances are that you
+get an error message saying <span class="errorname">Unable to print Test
+Page</span>. The reason might be that there is not yet a
+valid Device Mode set for the driver, or that the "Printer Driver
+Data" set is still incomplete.
+</p><p>
+You must now make sure that a valid "Device Mode" is set for the
+driver. Don't fear -- we will explain now what that means.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2929502"></a>IMPORTANT! Setting Device Modes on new Printers</h3></div></div><div></div></div><p>
+In order for a printer to be truly usable by a Windows NT/2K/XP
+client, it must possess:
+</p><div class="itemizedlist"><ul type="disc"><li><p>a valid <span class="emphasis"><em>Device Mode</em></span> generated by
+the driver for the printer (defining things like paper size,
+orientation and duplex settings), and</p></li><li><p>a complete set of
+<span class="emphasis"><em>Printer Driver Data</em></span> generated by the
+driver.</p></li></ul></div><p>
+If either one of these is incomplete, the clients can produce less
+than optimal output at best. In the worst cases, unreadable garbage or
+nothing at all comes from the printer or they produce a harvest of
+error messages when attempting to print. Samba stores the named values
+and all printing related info in its internal TDB database files
+<tt class="filename">(ntprinters.tdb</tt>,
+<tt class="filename">ntdrivers.tdb</tt>, <tt class="filename">printing.tdb</tt>
+and <tt class="filename">ntforms.tdb</tt>).
+</p><p>
+What do these two words stand for? Basically, the Device Mode and the
+set of Printer Driver Data is a collection of settings for all print
+queue properties, initialized in a sensible way. Device Modes and
+Printer Driver Data should initially be set on the print server (that is
+here: the Samba host) to healthy values so that the clients can start
+to use them immediately. How do we set these initial healthy values?
+This can be achieved by accessing the drivers remotely from an NT (or
+2k/XP) client, as is discussed in the next paragraphs.
+</p><p>
+Be aware, that a valid Device Mode can only be initiated by a
+<i class="parameter"><tt>printer admin</tt></i>, or root (the reason should be
+obvious). Device Modes can only correctly be set by executing the
+printer driver program itself. Since Samba can not execute this Win32
+platform driver code, it sets this field initially to NULL (which is
+not a valid setting for clients to use). Fortunately, most drivers
+generate themselves the Printer Driver Data that is needed, when they
+are uploaded to the <i class="parameter"><tt>[print$]</tt></i> share with the
+help of the APW or rpcclient.
+</p><p>
+The generation and setting of a first valid Device Mode however
+requires some "tickling" from a client, to set it on the Samba
+server. The easiest means of doing so is to simply change the page
+orientation on the server's printer. This "executes" enough of the
+printer driver program on the client for the desired effect to happen,
+and feeds back the new Device Mode to our Samba server. You can use the
+native Windows NT/2K/XP printer properties page from a Window client
+for this:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Browse the <span class="guiicon">Network Neighbourhood</span></p></li><li><p>Find the Samba server</p></li><li><p>Open the Samba server's <span class="guiicon">Printers and
+ Faxes</span> folder</p></li><li><p>Highlight the shared printer in question</p></li><li><p>Right-click the printer (you may already be here, if you
+followed the last section's description)</p></li><li><p>At the bottom of the context menu select
+<span class="guimenu">Properties....</span> (if the menu still offers the
+<span class="guimenuitem">Connect...</span> entry
+further above, you need to click that one first to achieve the driver
+installation as shown in the last section)</p></li><li><p>Go to the <span class="guilabel">Advanced</span> tab; click on
+<span class="guibutton">Printing Defaults...</span></p></li><li><p>Change the "Portrait" page setting to "Landscape" (and
+back)</p></li><li><p>(Oh, and make sure to <span class="emphasis"><em>apply</em></span>
+changes between swapping the page orientation to cause the change to
+actually take effect...).</p></li><li><p>While you're at it, you may optionally also want to
+set the desired printing defaults here, which then apply to all future
+client driver installations on the remaining from now
+on.</p></li></ul></div><p>
+This procedure has executed the printer driver program on the client
+platform and fed back the correct Device Mode to Samba, which now
+stored it in its TDB files. Once the driver is installed on the
+client, you can follow the analogous steps by accessing the
+<span class="emphasis"><em>local</em></span> <span class="guiicon">Printers</span> folder too if you are
+a Samba printer admin user. From now on printing should work as expected.
+</p><p>
+Samba also includes a service level parameter name <i class="parameter"><tt>default
+devmode</tt></i> for generating a default Device Mode for a
+printer. Some drivers will function well with Samba's default set of
+properties. Others may crash the client's spooler service. So use this
+parameter with caution. It is always better to have the client
+generate a valid device mode for the printer and store it on the
+server for you.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2929792"></a>Further Client Driver Install Procedures</h3></div></div><div></div></div><p>
+Every further driver may be done by any user, along the lines
+described above: Browse network, open printers folder on Samba server,
+right-click printer and choose <span class="guimenuitem">Connect...</span>. Once
+this completes (should be not more than a few seconds, but could also take
+a minute, depending on network conditions), you should find the new printer in
+your client workstation local <span class="guiicon">Printers and
+Faxes</span> folder.
+</p><p>
+You can also open your local <span class="guiicon">Printers and Faxes</span> folder by
+using this command on Windows 2000 and Windows XP Professional workstations:
+</p><p><b class="userinput"><tt>rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder
+</tt></b></p><p>
+or this command on Windows NT 4.0 workstations:
+</p><p><b class="userinput"><tt>
+rundll32 shell32.dll,Control_RunDLL MAIN.CPL @2
+</tt></b></p><p>
+You can enter the commands either inside a <span class="guilabel">DOS box</span> window
+or in the <span class="guimenuitem">Run command...</span> field from the
+<span class="guimenu">Start</span> menu.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2929887"></a>Always make first Client Connection as root or "printer admin"</h3></div></div><div></div></div><p>
+After you installed the driver on the Samba server (in its
+<i class="parameter"><tt>[print$]</tt></i> share, you should always make sure
+that your first client installation completes correctly. Make it a habit for
+yourself to build that the very first connection from a client as
+<i class="parameter"><tt>printer admin</tt></i>. This is to make sure that:
+</p><div class="itemizedlist"><ul type="disc"><li><p> a first valid <span class="emphasis"><em>Device Mode</em></span> is
+really initialized (see above for more explanation details), and
+that</p></li><li><p> the default print settings of your printer for all
+further client installations are as you want them</p></li></ul></div><p>
+Do this by changing the orientation to landscape, click
+<span class="emphasis"><em>Apply</em></span>, and then change it back again. Then modify
+the other settings (for example, you don't want the default media size
+set to <span class="emphasis"><em>Letter</em></span>, when you are all using
+<span class="emphasis"><em>A4</em></span>, right? You may want to set the printer for
+<span class="emphasis"><em>duplex</em></span> as the default; etc.).
+</p><p>
+To connect as root to a Samba printer, try this command from a Windows
+2K/XP DOS box command prompt:
+</p><p><b class="userinput"><tt>runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n \\<i class="replaceable"><tt>SAMBA-SERVER</tt></i>\<i class="replaceable"><tt>printername</tt></i>"</tt></b>
+</p><p>
+You will be prompted for root's Samba-password; type it, wait a few
+seconds, click on <span class="guibutton">Printing Defaults...</span> and
+proceed to set the job options as should be used as defaults by all
+clients. Alternatively, instead of root you can name one other member
+of the <i class="parameter"><tt>printer admins</tt></i> from the setting.
+</p><p>
+Now all the other users downloading and installing the driver
+the same way (called <span class="emphasis"><em>Point'n'Print</em></span>) will
+have the same defaults set for them. If you miss this step you'll
+get a lot of helpdesk calls from your users. But maybe you like to
+talk to people.... ;-)
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2930029"></a>Other Gotchas</h2></div></div><div></div></div><p>
+Your driver is installed. It is ready for
+<span class="emphasis"><em>Point'n'Print</em></span> installation by the clients
+now. You <span class="emphasis"><em>may</em></span> have tried to download and use it
+onto your first client machine now. But wait... let's make you
+acquainted first with a few tips and tricks you may find useful. For
+example, suppose you didn't manage to "set the defaults" on the
+printer, as advised in the preceeding paragraphs? And your users
+complain about various issues (such as “<span class="quote">We need to set the paper
+size for each job from Letter to A4 and it won't store it!</span>”)
+</p><div xmlns:ns48="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2930062"></a>Setting Default Print Options for the Client Drivers</h3></div></div><div></div></div><p>
+The last sentence might be viewed with mixed feelings by some users and
+admins. They have struggled for hours and hours and couldn't arrive at
+a point were their settings seemed to be saved. It is not their
+fault. The confusing thing is this: in the multi-tabbed dialog that pops
+up when you right-click the printer name and select
+<span class="guimenuitem">Properties...</span>, you can arrive at two identically
+looking dialogs, each claiming that they help you to set printer options,
+in three different ways. Here is the definite answer to the "Samba
+Default Driver Setting FAQ":
+</p><ns48:p><b>“<span class="quote">I can't set and save default print options
+for all users on Win2K/XP! Why not?</span>” </b>
+How are you doing it? I bet the wrong way.... (it is not very
+easy to find out, though). There are 3 different ways to bring you to
+a dialog that <span class="emphasis"><em>seems</em></span> to set everything. All three
+dialogs <span class="emphasis"><em>look</em></span> the same. Only one of them
+<span class="emphasis"><em>does</em></span> what you intend.
+<span class="emphasis"><em>Important:</em></span> you need to be Administrator or Print
+Administrator to do this for all users. Here is how I reproduce it in
+on XP Professional:
+
+</ns48:p><div class="orderedlist"><ol type="A"><li xmlns:ns45=""><ns45:p>The first "wrong" way:
+
+</ns45:p><div class="orderedlist"><ol type="1"><li><p>Open the <span class="guiicon">Printers</span>
+folder.</p></li><li><p>Right-click on the printer
+(<span class="emphasis"><em>remoteprinter on cupshost</em></span>) and
+select in context menu <span class="guimenu">Printing
+Preferences...</span></p></li><li><p>Look at this dialog closely and remember what it looks
+like.</p></li></ol></div><ns45:p>
+</ns45:p></li><li xmlns:ns46=""><ns46:p>The second "wrong" way:
+
+</ns46:p><div class="orderedlist"><ol type="1"><li><p>Open the <span class="guimenu">Printers</span>
+folder.</p></li><li><p>Right-click on the printer (<span class="emphasis"><em>remoteprinter on
+cupshost</em></span>) and select in the context menu
+<span class="guimenuitem">Properties</span></p></li><li><p>Click on the <span class="guilabel">General</span>
+tab</p></li><li><p>Click on the button <span class="guibutton">Printing
+Preferences...</span></p></li><li><p>A new dialog opens. Keep this dialog open and go back
+to the parent dialog.</p></li></ol></div><ns46:p>
+</ns46:p></li><li xmlns:ns47=""><ns47:p>The third, the "correct" way: (should you do
+this from the beginning, just carry out steps 1. and 2. from second
+"way" above)
+
+</ns47:p><div class="orderedlist"><ol type="1"><li><p>Click on the <span class="guilabel">Advanced</span>
+tab. (Hmmm... if everything is "Grayed Out", then you are not logged
+in as a user with enough privileges).</p></li><li><p>Click on the <span class="guibutton">Printing
+Defaults...</span> button.</p></li><li><p>On any of the two new tabs, click on the
+<span class="guilabel">Advanced...</span> button.</p></li><li><p>A new dialog opens. Compare this one to the other,
+identical looking one from "B.5" or A.3".</p></li></ol></div><ns47:p>
+</ns47:p></li></ol></div><ns48:p>
+
+Do you see any difference in the two settings dialogs? I don't
+either. However, only the last one, which you arrived at with steps
+C.1.-6. will permanently save any settings which will then become the
+defaults for new users. If you want all clients to have the same
+defaults, you need to conduct these steps as administrator
+(<i class="parameter"><tt>printer admin</tt></i> in )
+<span class="emphasis"><em>before</em></span> a client downloads the driver (the clients
+can later set their own <span class="emphasis"><em>per-user defaults</em></span> by
+following the procedures<span class="emphasis"><em>A.</em></span>
+or<span class="emphasis"><em>B.</em></span> above...). (This is new: Windows 2000 and
+Windows XP allow <span class="emphasis"><em>per-user</em></span> default settings and
+the ones the administrator gives them, before they set up their own).
+The "parents" of the identically looking dialogs have a slight
+difference in their window names: one is called
+<tt class="computeroutput">Default Print Values for Printer Foo on Server
+Bar"</tt> (which is the one you need) and the other is
+called "<tt class="computeroutput">Print Settings for Printer Foo on Server
+Bar</tt>". The last one is the one you arrive at when you
+right-click on the printer and select <span class="guimenuitem">Print
+Settings...</span>. This is the one what you were
+taught to use back in the days of Windows NT! So it is only natural to
+try the same way with Win2k or WinXP. You wouldn't dream
+that there is now a different "clicking path" to arrive at an
+identically looking, but functionally different dialog to set defaults
+for all users!
+</ns48:p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>Try (on Win2000 and WinXP) to run this command (as a user
+with the right privileges):
+</p><p><b class="userinput"><tt>
+rundll32 printui.dll,PrintUIEntry /p /t3 /n\\<i class="replaceable"><tt>SAMBA-SERVER</tt></i>\<i class="replaceable"><tt>printersharename</tt></i>
+</tt></b></p><p>
+to see the tab with the <span class="guilabel">Printing Defaults...</span>
+button (the one you need). Also run this command:
+</p><p><b class="userinput"><tt>
+rundll32 printui.dll,PrintUIEntry /p /t0 /n\\<i class="replaceable"><tt>SAMBA-SERVER</tt></i>\<i class="replaceable"><tt>printersharename</tt></i>
+</tt></b></p><p>
+to see the tab with the <span class="guilabel">Printing Preferences...</span>
+button (the one which doesn't set system-wide defaults). You can
+start the commands from inside a DOS box" or from the <span class="guimenu">Start</span>
+-- <span class="guimenuitem">Run...</span> menu.
+</p></div></div><div xmlns:ns49="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2930496"></a>Supporting large Numbers of Printers</h3></div></div><div></div></div><p>
+One issue that has arisen during the recent development phase of Samba
+is the need to support driver downloads for 100's of printers. Using
+Windows NT APW here is somewhat awkward (to say the least). If you
+don't want to acquire RSS pains from such the printer installation
+clicking orgy alone, you need to think about a non-interactive script.
+</p><p>
+If more than one printer is using the same driver, the
+<b class="command">rpcclient setdriver</b> command can be used to set the
+driver associated with an installed queue. If the driver is uploaded
+to <i class="parameter"><tt>[print$]</tt></i> once and registered with the
+printing TDBs, it can be used by multiple print queues. In this case
+you just need to repeat the <b class="command">setprinter</b> subcommand
+of <b class="command">rpcclient</b> for every queue (without the need to
+conduct the <b class="command">adddriver</b> again and again). The
+following is an example of how this could be accomplished:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient <i class="replaceable"><tt>SAMBA-CUPS</tt></i> -U root%<i class="replaceable"><tt>secret</tt></i> -c 'enumdrivers'</tt></b>
+ cmd = enumdrivers
+
+ [Windows NT x86]
+ Printer Driver Info 1:
+ Driver Name: [infotec IS 2075 PCL 6]
+
+ Printer Driver Info 1:
+ Driver Name: [DANKA InfoStream]
+
+ Printer Driver Info 1:
+ Driver Name: [Heidelberg Digimaster 9110 (PS)]
+
+ Printer Driver Info 1:
+ Driver Name: [dm9110]
+
+ Printer Driver Info 1:
+ Driver Name: [myphantasydrivername]
+
+ [....]
+</pre><ns49:p>
+
+</ns49:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient <i class="replaceable"><tt>SAMBA-CUPS</tt></i> -U root%<i class="replaceable"><tt>secret</tt></i> -c 'enumprinters'</tt></b>
+ cmd = enumprinters
+ flags:[0x800000]
+ name:[\\SAMBA-CUPS\dm9110]
+ description:[\\SAMBA-CUPS\dm9110,,110ppm HiVolume DANKA Stuttgart]
+ comment:[110 ppm HiVolume DANKA Stuttgart]
+ [....]
+</pre><ns49:p>
+
+</ns49:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient <i class="replaceable"><tt>SAMBA-CUPS</tt></i> -U root%<i class="replaceable"><tt>secret</tt></i> -c 'setdriver <i class="replaceable"><tt>dm9110</tt></i> "<i class="replaceable"><tt>Heidelberg Digimaster 9110 (PS)</tt></i>"'</tt></b>
+ cmd = setdriver dm9110 Heidelberg Digimaster 9110 (PPD)
+ Successfully set dm9110 to driver Heidelberg Digimaster 9110 (PS).
+</pre><ns49:p>
+
+</ns49:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient <i class="replaceable"><tt>SAMBA-CUPS</tt></i> -U root%<i class="replaceable"><tt>secret</tt></i> -c 'enumprinters'</tt></b>
+ cmd = enumprinters
+ flags:[0x800000]
+ name:[\\SAMBA-CUPS\dm9110]
+ description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),110ppm HiVolume DANKA Stuttgart]
+ comment:[110ppm HiVolume DANKA Stuttgart]
+ [....]
+</pre><ns49:p>
+
+</ns49:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient <i class="replaceable"><tt>SAMBA-CUPS</tt></i> -U root%<i class="replaceable"><tt>secret</tt></i> -c 'setdriver <i class="replaceable"><tt>dm9110</tt></i> <i class="replaceable"><tt>myphantasydrivername</tt></i>'</tt></b>
+ cmd = setdriver dm9110 myphantasydrivername
+ Successfully set dm9110 to myphantasydrivername.
+</pre><ns49:p>
+
+</ns49:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient <i class="replaceable"><tt>SAMBA-CUPS</tt></i> -U root%<i class="replaceable"><tt>secret</tt></i> -c 'enumprinters'</tt></b>
+ cmd = enumprinters
+ flags:[0x800000]
+ name:[\\SAMBA-CUPS\dm9110]
+ description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,110ppm HiVolume DANKA Stuttgart]
+ comment:[110ppm HiVolume DANKA Stuttgart]
+ [....]
+</pre><p>
+It may be not easy to recognize: but the first call to
+<b class="command">enumprinters</b> showed the "dm9110" printer with an
+empty string where the driver should have been listed (between the 2
+commas in the "description" field). After the
+<b class="command">setdriver</b> command succeeded, all is well. (The
+CUPS Printing chapter has more info about the installation of printer
+drivers with the help of <b class="command">rpccclient</b>).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2930798"></a>Adding new Printers with the Windows NT APW</h3></div></div><div></div></div><p>
+By default, Samba exhibits all printer shares defined in
+<tt class="filename">smb.conf</tt> in the
+<span class="guiicon">Printers...</span> folder. Also located in this folder
+is the Windows NT Add Printer Wizard icon. The APW will be shown only
+if:
+</p><div class="itemizedlist"><ul type="disc"><li><p>...the connected user is able to successfully execute
+an <b class="command">OpenPrinterEx(\\server)</b> with administrative
+privileges (i.e. root or <i class="parameter"><tt>printer admin</tt></i>).
+</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p> Try this from a Windows 2K/XP DOS box command prompt:
+</p><p><b class="userinput"><tt>
+runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\<i class="replaceable"><tt>SAMBA-SERVER</tt></i>\<i class="replaceable"><tt>printersharename</tt></i>
+</tt></b></p><p>
+and click on <span class="guibutton">Printing Preferences...</span>
+</p></div></li><li><p>... contains the setting
+<i class="parameter"><tt>show add printer wizard = yes</tt></i> (the
+default).</p></li></ul></div><p>
+The APW can do various things:
+</p><div class="itemizedlist"><ul type="disc"><li><p>upload a new driver to the Samba
+<i class="parameter"><tt>[print$]</tt></i> share;</p></li><li><p>associate an uploaded driver with an existing (but
+still "driverless") print queue;</p></li><li><p>exchange the currently used driver for an existing
+print queue with one that has been uploaded before;</p></li><li><p>add an entirely new printer to the Samba host (only in
+conjunction with a working <i class="parameter"><tt>add printer command</tt></i>;
+a corresponding <i class="parameter"><tt>delete printer command</tt></i> for
+removing entries from the <span class="guiicon">Printers...</span> folder
+may be provided too)</p></li></ul></div><p>
+The last one (add a new printer) requires more effort than the
+previous ones. In order to use the APW to successfully add a printer
+to a Samba server, the <i class="parameter"><tt>add printer command</tt></i> must
+have a defined value. The program hook must successfully add the
+printer to the Unix print system (i.e. to
+<tt class="filename">/etc/printcap</tt>,
+<tt class="filename">/etc/cups/printers.conf</tt> or other appropriate
+files) and to if necessary.
+</p><p>
+When using the APW from a client, if the named printer share does not
+exist, smbd will execute the <i class="parameter"><tt>add printer
+command</tt></i> and reparse to the
+to attempt to locate the new printer share. If the share is still not
+defined, an error of <span class="errorname">Access Denied</span> is
+returned to the client. Note that the <i class="parameter"><tt>add printer
+command</tt></i> is executed under the context of the connected
+user, not necessarily a root account. A <i class="parameter"><tt>map to guest = bad
+user</tt></i> may have connected you unwittingly under the wrong
+privilege; you should check it by using the
+<b class="command">smbstatus</b> command.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2931042"></a>Weird Error Message <span class="errorname">Cannot connect under a
+different Name</span></h3></div></div><div></div></div><p>
+Once you are connected with the wrong credentials, there is no means
+to reverse the situation other than to close all Explorer windows, and
+perhaps reboot.
+</p><div class="itemizedlist"><ul type="disc"><li><p>The <b class="command">net use \\SAMBA-SERVER\sharename
+/user:root</b> gives you an error message: <tt class="computeroutput">Multiple
+connections to a server or a shared resource by the same user
+utilizing the several user names are not allowed. Disconnect all
+previous connections to the server, resp. the shared resource, and try
+again.</tt></p></li><li><p>Every attempt to "connect a network drive" to
+<tt class="filename">\\SAMBASERVER\\print$</tt> to z: is countered by the
+pertinacious message. <tt class="computeroutput">This network folder is currently
+connected under different credentials (username and password).
+Disconnect first any existing connection to this network share in
+order to connect again under a different username and
+password</tt>.</p></li></ul></div><p>
+So you close all connections. You try again. You get the same
+message. You check from the Samba side, using
+<b class="command">smbstatus</b>. Yes, there are some more
+connections. You kill them all. The client still gives you the same
+error message. You watch the smbd.log file on a very high debug level
+and try re-connect. Same error message, but not a single line in the
+log. You start to wonder if there was a connection attempt at all. You
+run ethereal and tcpdump while you try to connect. Result: not a
+single byte goes on the wire. Windows still gives the error
+message. You close all Explorer Windows and start it again. You try to
+connect - and this times it works! Windows seems to cache connection
+info somewhere and doesn't keep it up to date (if you are unlucky you
+might need to reboot to get rid of the error message).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2931140"></a>Be careful when assembling Driver Files</h3></div></div><div></div></div><p>
+You need to be very careful when you take notes about the files and
+belonging to a particular driver. Don't confuse the files for driver
+version "0" (for Win95/98/ME, going into
+<tt class="filename">[print$]/WIN/0/</tt>), driver version "2" (Kernel Mode
+driver for WinNT, going into <tt class="filename">[print$]/W32X86/2/</tt>
+<span class="emphasis"><em>may</em></span> be used on Win2K/XP too), and driver version
+"3" (non-Kernel Mode driver going into
+<tt class="filename">[print$]/W32X86/3/</tt> <span class="emphasis"><em>can not</em></span>
+be used on WinNT). Very often these different driver versions contain
+files carrying the same name; but still the files are very different!
+Also, if you look at them from the Windows Explorer (they reside in
+<tt class="filename">%WINDOWS%\system32\spool\drivers\W32X86\</tt>) you
+will probably see names in capital letters, while an "enumdrivers"
+command from Samba would show mixed or lower case letters. So it is
+easy to confuse them. If you install them manually using
+<b class="command">rpcclient</b> and subcommands, you may even succeed
+without an error message. Only later, when you try install on a
+client, you will encounter error messages like <tt class="computeroutput">This
+server has no appropriate driver for the printer</tt>.
+</p><p>
+Here is an example. You are invited to look very closely at the
+various files, compare their names and their spelling, and discover
+the differences in the composition of the version-2 and -3 sets
+Note: the version-0 set contained 40 (!)
+<i class="parameter"><tt>Dependentfiles</tt></i>, so I left it out for space
+reasons:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>rpcclient -U 'Administrator%<i class="replaceable"><tt>secret</tt></i>' -c 'enumdrivers 3' 10.160.50.8 </tt></b>
+
+ Printer Driver Info 3:
+ Version: [3]
+ Driver Name: [Canon iR8500 PS3]
+ Architecture: [Windows NT x86]
+ Driver Path: [\\10.160.50.8\print$\W32X86\3\cns3g.dll]
+ Datafile: [\\10.160.50.8\print$\W32X86\3\iR8500sg.xpd]
+ Configfile: [\\10.160.50.8\print$\W32X86\3\cns3gui.dll]
+ Helpfile: [\\10.160.50.8\print$\W32X86\3\cns3g.hlp]
+
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aucplmNT.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\ucs32p.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\tnl32.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aussdrv.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cnspdc.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aussapi.dat]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cns3407.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\CnS3G.cnt]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\NBAPI.DLL]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\NBIPC.DLL]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcview.exe]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcdspl.exe]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcedit.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcqm.exe]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcspl.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cfine32.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcr407.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\Cpcqm407.hlp]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcqm407.cnt]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cns3ggr.dll]
+
+ Monitorname: []
+ Defaultdatatype: []
+
+ Printer Driver Info 3:
+ Version: [2]
+ Driver Name: [Canon iR5000-6000 PS3]
+ Architecture: [Windows NT x86]
+ Driver Path: [\\10.160.50.8\print$\W32X86\2\cns3g.dll]
+ Datafile: [\\10.160.50.8\print$\W32X86\2\IR5000sg.xpd]
+ Configfile: [\\10.160.50.8\print$\W32X86\2\cns3gui.dll]
+ Helpfile: [\\10.160.50.8\print$\W32X86\2\cns3g.hlp]
+
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\2\AUCPLMNT.DLL]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\2\aussdrv.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cnspdc.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\2\aussapi.dat]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cns3407.dll]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\2\CnS3G.cnt]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\2\NBAPI.DLL]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\2\NBIPC.DLL]
+ Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cns3gum.dll]
+
+ Monitorname: [CPCA Language Monitor2]
+ Defaultdatatype: []
+
+</pre><p>
+If we write the "version 2" files and the "version 3" files
+into different text files and compare the result, we see this
+picture:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>sdiff 2-files 3-files</tt></b>
+
+
+ cns3g.dll cns3g.dll
+ iR8500sg.xpd iR8500sg.xpd
+ cns3gui.dll cns3gui.dll
+ cns3g.hlp cns3g.hlp
+ AUCPLMNT.DLL | aucplmNT.dll
+ > ucs32p.dll
+ > tnl32.dll
+ aussdrv.dll aussdrv.dll
+ cnspdc.dll cnspdc.dll
+ aussapi.dat aussapi.dat
+ cns3407.dll cns3407.dll
+ CnS3G.cnt CnS3G.cnt
+ NBAPI.DLL NBAPI.DLL
+ NBIPC.DLL NBIPC.DLL
+ cns3gum.dll | cpcview.exe
+ > cpcdspl.exe
+ > cpcqm.exe
+ > cpcspl.dll
+ > cfine32.dll
+ > cpcr407.dll
+ > Cpcqm407.hlp
+ > cpcqm407.cnt
+ > cns3ggr.dll
+
+</pre><p>
+Don't be fooled though! Driver files for each version with identical
+names may be different in their content, as you can see from this size
+comparison:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>for i in cns3g.hlp cns3gui.dll cns3g.dll; do \
+ smbclient //10.160.50.8/print\$ -U 'Administrator%xxxx' \
+ -c "cd W32X86/3; dir $i; cd .. ; cd 2; dir $i"; \
+ done</tt></b>
+
+ CNS3G.HLP A 122981 Thu May 30 02:31:00 2002
+ CNS3G.HLP A 99948 Thu May 30 02:31:00 2002
+
+ CNS3GUI.DLL A 1805824 Thu May 30 02:31:00 2002
+ CNS3GUI.DLL A 1785344 Thu May 30 02:31:00 2002
+
+ CNS3G.DLL A 1145088 Thu May 30 02:31:00 2002
+ CNS3G.DLL A 15872 Thu May 30 02:31:00 2002
+
+</pre><p>
+In my example were even more differences than shown here. Conclusion:
+you must be very careful to select the correct driver files for each
+driver version. Don't rely on the names alone. Don't interchange files
+belonging to different driver versions.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2931411"></a>Samba and Printer Ports</h3></div></div><div></div></div><p>
+Windows NT/2000 print servers associate a port with each
+printer. These normally take the form of <tt class="filename">LPT1:</tt>,
+<tt class="filename">COM1:</tt>, <tt class="filename">FILE:</tt>, etc. Samba
+must also support the concept of ports associated with a printer. By
+default, only one printer port, named "Samba Printer Port", exists on
+a system. Samba does not really need such a "port" in order to print;
+it rather is a requirement of Windows clients. They insist on being
+told about an available port when they request this info, otherwise
+they throw an error message at you. So Samba fakes the port
+information to keep the Windows clients happy.
+</p><p>
+Note that Samba does not support the concept of "Printer Pooling"
+internally either. Printer Pooling assigns a logical printer to
+multiple ports as a form of load balancing or fail over.
+</p><p>
+If you require that multiple ports be defined for some reason or
+another (“<span class="quote">My users and my Boss should not know that they are
+working with Samba</span>”), possesses a
+<i class="parameter"><tt>enumports command</tt></i> which can be used to define
+an external program that generates a listing of ports on a system.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2931481"></a>Avoiding the most common Misconfigurations of the Client Driver</h3></div></div><div></div></div><p>
+So - printing works, but there are still problems. Most jobs print
+well, some don't print at all. Some jobs have problems with fonts,
+which don't look good at all. Some jobs print fast, and some are
+dead-slow. We can't cover it all; but we want to encourage you to read
+the little paragraph about "Avoiding the wrong PostScript Driver
+Settings" in the CUPS Printing part of this document.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2931504"></a>The Imprints Toolset</h2></div></div><div></div></div><p>
+The Imprints tool set provides a UNIX equivalent of the
+Windows NT Add Printer Wizard. For complete information, please
+refer to the Imprints web site
+at<a href="http://imprints.sourceforge.net/" target="_top">http://imprints.sourceforge.net/</a>
+as well as the documentation included with the imprints source
+distribution. This section will only provide a brief introduction
+to the features of Imprints.
+</p><p><b>Attention! Maintainer required. </b>
+Unfortunately, the Imprints toolset is no longer maintained. As of
+December, 2000, the project is in need of a new maintainer. The most
+important skill to have is decent perl coding and an interest in
+MS-RPC based printing using Samba. If you wish to volunteer, please
+coordinate your efforts on the samba-technical mailing list. The
+toolset is still in usable form; but only for a series of older
+printer models, where there are prepared packages to use. Packages for
+more up to date print devices are needed if Imprints should have a
+future.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2931549"></a>What is Imprints?</h3></div></div><div></div></div><p>
+Imprints is a collection of tools for supporting these goals:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Providing a central repository information regarding
+Windows NT and 95/98 printer driver packages</p></li><li><p>Providing the tools necessary for creating the
+Imprints printer driver packages.</p></li><li><p>Providing an installation client which will obtain
+printer drivers from a central internet (or intranet) Imprints Server
+repository and install them on remote Samba and Windows NT4 print
+servers.</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2931590"></a>Creating Printer Driver Packages</h3></div></div><div></div></div><p>
+The process of creating printer driver packages is beyond the scope of
+this document (refer to Imprints.txt also included with the Samba
+distribution for more information). In short, an Imprints driver
+package is a gzipped tarball containing the driver files, related INF
+files, and a control file needed by the installation client.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2931609"></a>The Imprints Server</h3></div></div><div></div></div><p>
+The Imprints server is really a database server that may be queried
+via standard HTTP mechanisms. Each printer entry in the database has
+an associated URL for the actual downloading of the package. Each
+package is digitally signed via GnuPG which can be used to verify that
+package downloaded is actually the one referred in the Imprints
+database. It is strongly recommended that this security check
+<span class="emphasis"><em>not</em></span> be disabled.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2931634"></a>The Installation Client</h3></div></div><div></div></div><p>
+More information regarding the Imprints installation client is
+available in the <tt class="filename">Imprints-Client-HOWTO.ps</tt> file
+included with the imprints source package.
+</p><p>
+The Imprints installation client comes in two forms.
+</p><div class="itemizedlist"><ul type="disc"><li><p>a set of command line Perl scripts</p></li><li><p>a GTK+ based graphical interface to the command line Perl
+scripts</p></li></ul></div><p>
+The installation client (in both forms) provides a means of querying
+the Imprints database server for a matching list of known printer
+model names as well as a means to download and install the drivers on
+remote Samba and Windows NT print servers.
+</p><p>
+The basic installation process is in four steps and perl code is
+wrapped around smbclient and rpcclient
+</p><div class="itemizedlist"><ul type="disc"><li xmlns:ns50=""><ns50:p>
+ foreach (supported architecture for a given driver)
+ </ns50:p><div class="orderedlist"><ol type="1"><li><p>rpcclient: Get the appropriate upload directory on the remote server</p></li><li><p>smbclient: Upload the driver files</p></li><li><p>rpcclient: Issues an AddPrinterDriver() MS-RPC</p></li></ol></div><ns50:p>
+ </ns50:p></li><li><p>rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer</p></li></ul></div><p>
+One of the problems encountered when implementing the Imprints tool
+set was the name space issues between various supported client
+architectures. For example, Windows NT includes a driver named "Apple
+LaserWriter II NTX v51.8" and Windows 95 calls its version of this
+driver "Apple LaserWriter II NTX"
+</p><p>
+The problem is how to know what client drivers have been uploaded for
+a printer. An astute reader will remember that the Windows NT Printer
+Properties dialog only includes space for one printer driver name. A
+quick look in the Windows NT 4.0 system registry at
+</p><p><tt class="filename">
+ HKLM\System\CurrentControlSet\Control\Print\Environment
+</tt></p><p>
+will reveal that Windows NT always uses the NT driver name. This is
+ok as Windows NT always requires that at least the Windows NT version
+of the printer driver is present. However, Samba does not have the
+requirement internally. Therefore, how can you use the NT driver name
+if is has not already been installed?
+</p><p>
+The way of sidestepping this limitation is to require that all
+Imprints printer driver packages include both the Intel Windows NT and
+95/98 printer drivers and that NT driver is installed first.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2931786"></a>Add Network Printers at Logon without User Interaction</h2></div></div><div></div></div><p>
+The following MS Knowledge Base article may be of some help if you
+need to handle Windows 2000 clients: <span class="emphasis"><em>How to Add Printers
+with No User Interaction in Windows 2000.</em></span> ( <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;189105" target="_top">http://support.microsoft.com/default.aspx?scid=kb;en-us;189105</a>
+). It also applies to Windows XP Professional clients.
+</p><p>
+The ideas sketched out below are inspired by this article. It
+describes a commandline method which can be applied to install
+network and local printers and their drivers. This is most useful
+if integrated in Logon Scripts. You can see what options are
+available by typing in a command prompt ("DOS box") this:
+</p><p><b class="userinput"><tt>rundll32 printui.dll,PrintUIEntry /?</tt></b></p><p>
+A window pops up which shows you all of the commandline switches
+available. An extensive list of examples is also provided. This is
+only for Win 2k/XP. It doesn't work on WinNT. WinNT has probably some
+other tools in the respective Resource Kit. Here is a suggestion about
+what a client logon script might contain, with a short explanation of
+what the lines actually do (it works if 2k/XP Windows clients access
+printers via Samba, but works for Windows-based print servers too):
+</p><pre class="screen">
+<b class="userinput"><tt>rundll32 printui.dll,PrintUIEntry /dn /n "\\sambacupsserver\infotec2105-IPDS" /q</tt></b>
+<b class="userinput"><tt>rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\infotec2105-PS"</tt></b>
+<b class="userinput"><tt>rundll32 printui.dll,PrintUIEntry /y /n "\\sambacupsserver\infotec2105-PS"</tt></b>
+</pre><p>
+Here is a list of the used commandline parameters:
+</p><div class="variablelist"><dl><dt><span class="term">/dn</span></dt><dd><p>deletes a network printer</p></dd><dt><span class="term">/q</span></dt><dd><p>quiet modus</p></dd><dt><span class="term">/n</span></dt><dd><p>names a printer</p></dd><dt><span class="term">/in</span></dt><dd><p>adds a network printer connection</p></dd><dt><span class="term">/y</span></dt><dd><p>sets printer as default printer</p></dd></dl></div><p>
+I have tested this with a Samba 2.2.7a and a Samba-3alpha24
+installation and Windows XP Professional clients. Note that this
+specific command set works with network print queues (installing
+local print queues requires different parameters, but this is of no
+interest here).
+</p><div class="itemizedlist"><ul type="disc"><li><p>Line 1 deletes a possibly existing previous network
+printer <span class="emphasis"><em>infotec2105-IPDS</em></span> (which had used native
+Windows drivers with LPRng that were removed from the server which was
+converted to CUPS). The <b class="command">/q</b> at the end eliminates
+"Confirm" or error dialog boxes popping up. They should not be
+presented to the user logging on.</p></li><li><p>Line 2 adds the new printer
+<span class="emphasis"><em>infotec2105-PS</em></span> (which actually is same physical
+device but is now run by the new CUPS printing system and associated
+with the CUPS/Adobe PS drivers). The printer and its driver
+<span class="emphasis"><em>must</em></span> have been added to Samba prior to the user
+logging in (e.g. by a procedure as discussed earlier in this chapter,
+or by running <b class="command">cupsaddsmb</b>). The driver is now
+auto-downloaded to the client PC where the user is about to log
+in.</p></li><li><p>Line 3 sets the default printer to this new network
+printer (there might be several other printers installed with this
+same method and some may be local as well -- so we deside for a
+default printer). The default printer selection may of course be
+different for different users.</p></li></ul></div><p>
+Note that the second line only works if the printer
+<span class="emphasis"><em>infotec2105-PS</em></span> has an already working printqueue
+on "sambacupsserver", and if the printer drivers have sucessfully been
+uploaded (via <b class="command">APW</b> ,
+<b class="command">smbclient/rpcclient</b> or
+<b class="command">cupsaddsmb</b>) into the
+<i class="parameter"><tt>[print$]</tt></i> driver repository of Samba. Also, some
+Samba versions prior to version 3.0 required a re-start of smbd after
+the printer install and the driver upload, otherwise the script (or
+any other client driver download) would fail.
+</p><p>
+Since there no easy way to test for the existence of an installed
+network printer from the logon script, the suggestion is: don't bother
+checking and just allow the deinstallation/reinstallation to occur
+every time a user logs in; it's really quick anyway (1 to 2 seconds).
+</p><p>
+The additional benefits for this are:
+</p><div class="itemizedlist"><ul type="disc"><li><p>It puts in place any printer default setup changes
+automatically at every user logon.</p></li><li><p>It allows for "roaming" users' login into the domain from
+different workstations.</p></li></ul></div><p>
+Since network printers are installed per user this much simplifies the
+process of keeping the installation up-to-date. The extra few seconds
+at logon time will not really be noticeable. Printers can be centrally
+added, changed, and deleted at will on the server with no user
+intervention required on the clients (you just need to keep the logon
+scripts up to date).
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2932115"></a>The <b class="command">addprinter</b> command</h2></div></div><div></div></div><p>
+The <b class="command">addprinter</b> command can be configured to be a
+shell script or program executed by Samba. It is triggered by running
+the APW from a client against the Samba print server. The APW asks the
+user to fill in several fields (such as printer name, driver to be
+used, comment, port monitor, etc.). These parameters are passed on to
+Samba by the APW. If the addprinter command is designed in a way that
+it can create a new printer (through writing correct printcap entries
+on legacy systems, or execute the <b class="command">lpadmin</b> command
+on more modern systems) and create the associated share in
+, then the APW will in effect really
+create a new printer on Samba and the UNIX print subsystem!
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2932160"></a>Migration of "Classical" printing to Samba-3</h2></div></div><div></div></div><p>
+The basic "NT-style" printer driver management has not changed
+considerably in 3.0 over the 2.2.x releases (apart from many small
+improvements). Here migration should be quite easy, especially if you
+followed previous advice to stop using deprecated parameters in your
+setup. For migrations from an existing 2.0.x setup, or if you
+continued "Win9x-style" printing in your Samba 2.2 installations, it
+is more of an effort. Please read the appropriate release notes and
+the HOWTO Collection for 2.2. You can follow several paths. Here are
+possible scenarios for migration:
+</p><div class="itemizedlist"><ul type="disc"><li><p>You need to study and apply the new Windows NT printer
+and driver support. Previously used parameters "<i class="parameter"><tt>printer
+driver file</tt></i>", " <i class="parameter"><tt>printer driver</tt></i>" and
+"<i class="parameter"><tt>printer driver location</tt></i>" are no longer
+supported.</p></li><li><p>If you want to take advantage of WinNT printer driver
+support you also need to migrate theWin9x/ME drivers to the new
+setup.</p></li><li><p>An existing <tt class="filename">printers.def</tt> file
+(the one specified in the now removed parameter <i class="parameter"><tt>printer
+driver file = ...</tt></i>) will work no longer with Samba-3.0. In
+3.0, smbd attempts to locate a Win9x/ME driver files for the printer
+in <i class="parameter"><tt>[print$]</tt></i> and additional settings in the TDB
+and only there; if it fails it will <span class="emphasis"><em>not</em></span> (as 2.2.x
+used to do) drop down to using a <tt class="filename">printers.def</tt>
+(and all associated parameters). The make_printerdef tool is removed
+and there is no backwards compatibility for this.</p></li><li><p>You need to install a Windows 9x driver into the
+<i class="parameter"><tt>[print$]</tt></i> share for a printer on your Samba
+host. The driver files will be stored in the "WIN40/0" subdirectory of
+<i class="parameter"><tt>[print$]</tt></i>, and some other settings and info go
+into the printing-related TDBs.</p></li><li><p>If you want to migrate an existing
+<tt class="filename">printers.def</tt> file into the new setup, the current
+only solution is to use the Windows NT APW to install the NT drivers
+and the 9x drivers. This can be scripted using smbclient and
+rpcclient. See the Imprints installation client at:
+</p><p>
+<a href="http://imprints.sourceforge.net/" target="_top"><span class="emphasis"><em>http://imprints.sourceforge.net/</em></span></a>
+</p><p>
+for an example. See also the discussion of rpcclient usage in the
+"CUPS Printing" section.</p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2932329"></a>Publishing Printer Information in Active Directory or LDAP</h2></div></div><div></div></div><p>
+We will publish an update to this section shortly.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2932343"></a>Common Errors and Problems</h2></div></div><div></div></div><p>
+Here are a few typical errors and problems people have
+encountered. You can avoid them. Read on.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2932356"></a>I give my root password but I don't get access</h3></div></div><div></div></div><p>
+Don't confuse the root password which is valid for the Unix system
+(and in most cases stored in the form of a one-way hash in a file
+named <tt class="filename">/etc/shadow</tt>) with the password used to
+authenticate against Samba!. Samba doesn't know the UNIX password; for
+root to access Samba resources via Samba-type access, a Samba account
+for root must be created first. This is often done with the
+<b class="command">smbpasswd</b> command.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2932390"></a>My printjobs get spooled into the spooling directory, but then get lost</h3></div></div><div></div></div><p>
+Don't use the existing Unix print system spool directory for the Samba
+spool directory. It may seem convenient and a saving of space, but it
+only leads to problems. The two <span class="emphasis"><em>must</em></span> be separate.
+</p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="CUPS-printing"></a>Chapter 19. CUPS Printing Support in Samba 3.0</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Kurt</span> <span class="surname">Pfeifle</span></h3><div class="affiliation"><span class="orgname"> Danka Deutschland GmbH <br></span><div class="address"><p><tt class="email"><<a href="mailto:kpfeifle@danka.de">kpfeifle@danka.de</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Ciprian</span> <span class="surname">Vizitiu</span></h3><span class="contrib">drawings</span><div class="affiliation"><div class="address"><p><tt class="email"><<a href="mailto:CVizitiu@gbif.org">CVizitiu@gbif.org</a>></tt></p></div></div></div></div><div><p class="pubdate"> (3 June 2003) </p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2939414">Introduction</a></dt><dd><dl><dt><a href="#id2939421">Features and Benefits</a></dt><dt><a href="#id2939469">Overview</a></dt></dl></dd><dt><a href="#id2939521">Basic Configuration of CUPS support</a></dt><dd><dl><dt><a href="#id2939600">Linking of smbd with libcups.so</a></dt><dt><a href="#id2932509">Simple smb.conf Settings for CUPS</a></dt><dt><a href="#id2932572">More complex smb.conf Settings for
+CUPS</a></dt></dl></dd><dt><a href="#id2932671">Advanced Configuration</a></dt><dd><dl><dt><a href="#id2932692">Central spooling vs. "Peer-to-Peer" printing</a></dt><dt><a href="#id2932719">CUPS/Samba as a "spooling-only" Print Server; "raw" printing
+with Vendor Drivers on Windows Clients</a></dt><dt><a href="#id2932755">Driver Installation Methods on Windows Clients</a></dt><dt><a href="#id2932814">Explicitly enable "raw" printing for
+application/octet-stream!</a></dt><dt><a href="#id2932975">Three familiar Methods for driver upload plus a new one</a></dt></dl></dd><dt><a href="#id2933068">Using CUPS/Samba in an advanced Way -- intelligent printing
+with PostScript Driver Download</a></dt><dd><dl><dt><a href="#id2933143">GDI on Windows -- PostScript on Unix</a></dt><dt><a href="#id2933188">Windows Drivers, GDI and EMF</a></dt><dt><a href="#id2933286">Unix Printfile Conversion and GUI Basics</a></dt><dt><a href="#id2933358">PostScript and Ghostscript</a></dt><dt><a href="#id2933454">Ghostscript -- the Software RIP for non-PostScript Printers</a></dt><dt><a href="#id2933550">PostScript Printer Description (PPD) Specification</a></dt><dt><a href="#id2946373">CUPS can use all Windows-formatted Vendor PPDs</a></dt><dt><a href="#id2946462">CUPS also uses PPDs for non-PostScript Printers</a></dt></dl></dd><dt><a href="#id2946485">The CUPS Filtering Architecture</a></dt><dd><dl><dt><a href="#id2946623">MIME types and CUPS Filters</a></dt><dt><a href="#id2946811">MIME type Conversion Rules</a></dt><dt><a href="#id2946927">Filter Requirements</a></dt><dt><a href="#id2947096">Prefilters</a></dt><dt><a href="#id2947181">pstops</a></dt><dt><a href="#id2947284">pstoraster</a></dt><dt><a href="#id2947440">imagetops and imagetoraster</a></dt><dt><a href="#id2947495">rasterto [printerspecific]</a></dt><dt><a href="#id2947580">CUPS Backends</a></dt><dt><a href="#id2947894">cupsomatic/Foomatic -- how do they fit into the Picture?</a></dt><dt><a href="#id2947997">The Complete Picture</a></dt><dt><a href="#id2948012">mime.convs</a></dt><dt><a href="#id2948065">"Raw" printing</a></dt><dt><a href="#id2948120">"application/octet-stream" printing</a></dt><dt><a href="#id2948335">PostScript Printer Descriptions (PPDs) for non-PS Printers</a></dt><dt><a href="#id2948562">Difference between cupsomatic/foomatic-rip and
+native CUPS printing</a></dt><dt><a href="#id2948719">Examples for filtering Chains</a></dt><dt><a href="#id2948948">Sources of CUPS drivers / PPDs</a></dt><dt><a href="#id2949073">Printing with Interface Scripts</a></dt></dl></dd><dt><a href="#id2949135">Network printing (purely Windows)</a></dt><dd><dl><dt><a href="#id2949151">From Windows Clients to an NT Print Server</a></dt><dt><a href="#id2949190">Driver Execution on the Client</a></dt><dt><a href="#id2949249">Driver Execution on the Server</a></dt></dl></dd><dt><a href="#id2949312">Network Printing (Windows clients -- UNIX/Samba Print
+Servers)</a></dt><dd><dl><dt><a href="#id2949333">From Windows Clients to a CUPS/Samba Print Server</a></dt><dt><a href="#id2949493">Samba receiving Jobfiles and passing them to CUPS</a></dt></dl></dd><dt><a href="#id2949571">Network PostScript RIP: CUPS Filters on Server -- clients use
+PostScript Driver with CUPS-PPDs</a></dt><dd><dl><dt><a href="#id2949626">PPDs for non-PS Printers on UNIX</a></dt><dt><a href="#id2949667">PPDs for non-PS Printers on Windows</a></dt></dl></dd><dt><a href="#id2949732">Windows Terminal Servers (WTS) as CUPS Clients</a></dt><dd><dl><dt><a href="#id2949750">Printer Drivers running in "Kernel Mode" cause many
+Problems</a></dt><dt><a href="#id2949784">Workarounds impose Heavy Limitations</a></dt><dt><a href="#id2949805">CUPS: a "Magical Stone"?</a></dt><dt><a href="#id2949832">PostScript Drivers with no major problems -- even in Kernel
+Mode</a></dt></dl></dd><dt><a href="#id2949866"> Setting up CUPS for driver Download</a></dt><dd><dl><dt><a href="#id2949885">cupsaddsmb: the unknown Utility</a></dt><dt><a href="#id2949976">Prepare your smb.conf for
+cupsaddsmb</a></dt><dt><a href="#id2950023">CUPS Package of "PostScript Driver for WinNT/2k/XP"</a></dt><dt><a href="#id2950220">Recognize the different Driver Files</a></dt><dt><a href="#id2950278">Acquiring the Adobe Driver Files</a></dt><dt><a href="#id2950311">ESP Print Pro Package of "PostScript Driver for
+WinNT/2k/XP"</a></dt><dt><a href="#id2950361">Caveats to be considered</a></dt><dt><a href="#id2950582">What are the Benefits of using the "CUPS PostScript Driver for
+Windows NT/2k/XP" as compared to the Adobe Driver?</a></dt><dt><a href="#id2950763">Run "cupsaddsmb" (quiet Mode)</a></dt><dt><a href="#id2950864">Run "cupsaddsmb" with verbose Output</a></dt><dt><a href="#id2951007">Understanding cupsaddsmb</a></dt><dt><a href="#id2951101">How to recognize if cupsaddsm completed successfully</a></dt><dt><a href="#id2951188">cupsaddsmb with a Samba PDC</a></dt><dt><a href="#id2951223">cupsaddsmb Flowchart</a></dt><dt><a href="#id2951274">Installing the PostScript Driver on a Client</a></dt><dt><a href="#id2951389">Avoiding critical PostScript Driver Settings on the
+Client</a></dt></dl></dd><dt><a href="#id2951523">Installing PostScript Driver Files manually (using
+rpcclient)</a></dt><dd><dl><dt><a href="#id2951638">A Check of the rpcclient man Page</a></dt><dt><a href="#id2951750">Understanding the rpcclient man Page</a></dt><dt><a href="#id2951829">Producing an Example by querying a Windows Box</a></dt><dt><a href="#id2951919">What is required for adddriver and setdriver to succeed</a></dt><dt><a href="#id2952081">Manual Commandline Driver Installation in 15 little Steps</a></dt><dt><a href="#id2952701">Troubleshooting revisited</a></dt></dl></dd><dt><a href="#id2952803">The printing *.tdb Files</a></dt><dd><dl><dt><a href="#id2952906">Trivial DataBase Files</a></dt><dt><a href="#id2952976">Binary Format</a></dt><dt><a href="#id2953038">Losing *.tdb Files</a></dt><dt><a href="#id2953097">Using tdbbackup</a></dt></dl></dd><dt><a href="#id2953159">CUPS Print Drivers from Linuxprinting.org</a></dt><dd><dl><dt><a href="#id2953265">foomatic-rip and Foomatic explained</a></dt><dt><a href="#id2953893">foomatic-rip and Foomatic-PPD Download and Installation</a></dt></dl></dd><dt><a href="#id2954351">Page Accounting with CUPS</a></dt><dd><dl><dt><a href="#id2954382">Setting up Quotas</a></dt><dt><a href="#id2954413">Correct and incorrect Accounting</a></dt><dt><a href="#id2954454">Adobe and CUPS PostScript Drivers for Windows Clients</a></dt><dt><a href="#id2954526">The page_log File Syntax</a></dt><dt><a href="#id2954628">Possible Shortcomings</a></dt><dt><a href="#id2954699">Future Developments</a></dt><dt><a href="#id2954747">Other Accounting Tools</a></dt></dl></dd><dt><a href="#id2954762">Additional Material</a></dt><dt><a href="#id2954956">Auto-Deletion or Preservation of CUPS Spool Files</a></dt><dd><dl><dt><a href="#id2955001">CUPS Configuration Settings explained</a></dt><dt><a href="#id2955083">Pre-conditions</a></dt><dt><a href="#id2955144">Manual Configuration</a></dt></dl></dd><dt><a href="#id2955162">When not to use Samba to print to
+CUPS</a></dt><dt><a href="#id2955180">In Case of Trouble.....</a></dt><dd><dl><dt><a href="#id2955214">Where to find Documentation</a></dt><dt><a href="#id2955227">How to ask for Help</a></dt><dt><a href="#id2955240">Where to find Help</a></dt></dl></dd><dt><a href="#id2955254">Appendix</a></dt><dd><dl><dt><a href="#id2955261">Printing from CUPS to Windows attached
+Printers</a></dt><dt><a href="#id2955455">More CUPS filtering Chains</a></dt><dt><a href="#id2955709">Trouble Shooting Guidelines to fix typical Samba printing
+Problems</a></dt><dt><a href="#id2956815">An Overview of the CUPS Printing Processes</a></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2939414"></a>Introduction</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2939421"></a>Features and Benefits</h3></div></div><div></div></div><p>
+ The Common Unix Print System (<a href="http://www.cups.org/" target="_top">CUPS</a>) has become very popular. All
+ big Linux distributions now ship it as their default printing
+ system. But to many it is still a very mystical tool. Normally it
+ "just works" (TM). People tend to regard it as a sort of "black box",
+ which they don't want to look into, as long as it works OK. But once
+ there is a little problem, they are in trouble to find out where to
+ start debugging it. Also, even the most recent and otherwise excellent
+ printed Samba documentation has only limited attention paid to CUPS
+ printing, leaving out important pieces or even writing plain wrong
+ things about it. This demands rectification. But before you dive into
+ this chapter, make sure that you don't forget to refer to the
+ "Classical Printing" chapter also. It contains a lot of information
+ that is relevant for CUPS too.
+ </p><p>
+ CUPS sports quite a few unique and powerful features. While their
+ basic functions may be grasped quite easily, they are also
+ new. Because they are different from other, more traditional printing
+ systems, it is best to try and not apply any prior knowledge about
+ printing upon this new system. Rather try to start understand CUPS
+ from the beginning. This documentation will lead you here to a
+ complete understanding of CUPS, if you study all of the material
+ contained. But lets start with the most basic things first. Maybe this
+ is all you need for now. Then you can skip most of the other
+ paragraphs.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2939469"></a>Overview</h3></div></div><div></div></div><p>
+ CUPS is more than just a print spooling system. It is a complete
+ printer management system that complies with the new IPP
+ (<span class="emphasis"><em>Internet Printing Protocol</em></span>). IPP is an industry
+ and IETF (<span class="emphasis"><em>Internet Engineering Task Force</em></span>)
+ standard for network printing. Many of its functions can be managed
+ remotely (or locally) via a web browser (giving you a
+ platform-independent access to the CUPS print server). In addition it
+ has the traditional commandline and several more modern GUI interfaces
+ (GUI interfaces developed by 3rd parties, like KDE's
+ overwhelming <a href="http://printing.kde.org/" target="_top">KDEPrint</a>).
+ </p><p>
+ CUPS allows creation of "raw" printers (ie: NO print file
+ format translation) as well as "smart" printers (i.e. CUPS does
+ file format conversion as required for the printer). In many ways
+ this gives CUPS similar capabilities to the MS Windows print
+ monitoring system. Of course, if you are a CUPS advocate, you would
+ argue that CUPS is better! In any case, let us now move on to
+ explore how one may configure CUPS for interfacing with MS Windows
+ print clients via Samba.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2939521"></a>Basic Configuration of CUPS support</h2></div></div><div></div></div><p>
+ Printing with CUPS in the most basic <tt class="filename">smb.conf</tt>
+ setup in Samba 3.0 (as was true for 2.2.x) only needs two
+ settings: <i class="parameter"><tt>printing = cups</tt></i> and <i class="parameter"><tt>printcap
+ = cups</tt></i>. CUPS itself doesn't need a printcap file
+ anymore. However, the <tt class="filename">cupsd.conf</tt> configuration
+ file knows two related directives: they control if such a file should
+ be automatically created and maintained by CUPS for the convenience of
+ third party applications (example: <i class="parameter"><tt>Printcap
+ /etc/printcap</tt></i> and <i class="parameter"><tt>PrintcapFormat
+ BSD</tt></i>). These legacy programs often require the existence of
+ printcap file containing printernames or they will refuse to
+ print. Make sure CUPS is set to generate and maintain a printcap! For
+ details see <b class="command">man cupsd.conf</b> and other CUPS-related
+ documentation, like the wealth of documents on your CUPS server
+ itself: <a href="http://localhost:631/documentation.html" target="_top">http://localhost:631/documentation.html</a>.
+ </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2939600"></a>Linking of smbd with <tt class="filename">libcups.so</tt></h3></div></div><div></div></div><p>
+ Samba has a very special relationship to CUPS. The reason is: Samba
+ can be compiled with CUPS library support. Most recent installations
+ have this support enabled, and per default CUPS linking is compiled
+ into smbd and other Samba binaries. Of course, you can use CUPS even
+ if Samba is not linked against <tt class="filename">libcups.so</tt> -- but
+ there are some differences in required or supported configuration
+ then.
+ </p><p>
+ If SAMBA is compiled against libcups, then <i class="parameter"><tt>printcap =
+ cups</tt></i> uses the CUPS API to list printers, submit jobs,
+ query queues, etc. Otherwise it maps to the System V commands with an
+ additional <b class="command">-oraw</b> option for printing. On a Linux
+ system, you can use the <b class="command">ldd</b> utility to find out
+ details (ldd may not be present on other OS platforms, or its function
+ may be embodied by a different command):
+ </p><pre class="screen">
+ transmeta:/home/kurt # ldd `which smbd`
+ libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000)
+ libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
+ libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)
+ [....]
+ </pre><p>
+ The line <tt class="computeroutput">libcups.so.2 => /usr/lib/libcups.so.2
+ (0x40123000)</tt> shows there is CUPS support compiled
+ into this version of Samba. If this is the case, and printing = cups
+ is set, then <span class="emphasis"><em>any otherwise manually set print command in
+ <tt class="filename">smb.conf</tt> is ignored</em></span>. This is an
+ important point to remember!
+ </p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p> Should you require -- for any reason -- to set your own
+ print commands, you can still do this by setting <i class="parameter"><tt>printing =
+ sysv</tt></i>. However, you'll loose all the benefits from the
+ close CUPS/Samba integration. You are on your own then to manually
+ configure the rest of the printing system commands (most important:
+ <i class="parameter"><tt>print command</tt></i>; other commands are
+ <i class="parameter"><tt>lppause command, lpresume command, lpq command, lprm
+ command, queuepause command </tt></i> and <i class="parameter"><tt>queue resume
+ command</tt></i>).</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2932509"></a>Simple <tt class="filename">smb.conf</tt> Settings for CUPS</h3></div></div><div></div></div><p>
+ To summarize, here is the simplest printing-related setup
+ for<tt class="filename">smb.conf</tt> to enable basic CUPS support:
+ </p><pre class="screen">
+
+ [global]
+ load printers = yes
+ printing = cups
+ printcap name = cups
+
+ [printers]
+ comment = All Printers
+ path = /var/spool/samba
+ browseable = no
+ public = yes
+ guest ok = yes
+ writable = no
+ printable = yes
+ printer admin = root, @ntadmins
+
+ </pre><p>
+ This is all you need for basic printing setup for CUPS. It will print
+ all Graphic, Text, PDF and PostScript file submitted from Windows
+ clients. However, most of your Windows users would not know how to
+ send these kind of files to print without opening a GUI
+ application. Windows clients tend to have local printer drivers
+ installed. And the GUI application's print buttons start a printer
+ driver. Your users also very rarely send files from the command
+ line. Unlike UNIX clients, they hardly submit graphic, text or PDF
+ formatted files directly to the spooler. They nearly exclusively print
+ from GUI applications, with a "printer driver" hooked in between the
+ applications native format and the print data stream. If the backend
+ printer is not a PostScript device, the print data stream is "binary",
+ sensible only for the target printer. Read on to learn which problem
+ this may cause and how to avoid it.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2932572"></a>More complex <tt class="filename">smb.conf</tt> Settings for
+CUPS</h3></div></div><div></div></div><p>
+Here is a slightly more complex printing-related setup
+for<tt class="filename">smb.conf</tt>. It enables general CUPS printing
+support for all printers, but defines one printer share which is set
+up differently.
+</p><pre class="screen">
+
+ [global]
+ printing = cups
+ printcap name = cups
+ load printers = yes
+
+ [printers]
+ comment = All Printers
+ path = /var/spool/samba
+ public = yes
+ guest ok = yes
+ writable = no
+ printable = yes
+ printer admin = root, @ntadmins
+
+ [special_printer]
+ comment = A special printer with his own settings
+ path = /var/spool/samba-special
+ printing = sysv
+ printcap = lpstat
+ print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ;\
+ echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ;\
+ echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log :\
+ rm %f
+ public = no
+ guest ok = no
+ writeable = no
+ printable = yes
+ printer admin = kurt
+ hosts deny = 0.0.0.0
+ hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60
+
+</pre><p>
+This special share is only there for my testing purposes. It doesn't
+even write the printjob to a file. It just logs the job parameters
+known to Samba into the <tt class="filename">/tmp/smbprn.log</tt> file and
+deletes the jobfile. Moreover, the <i class="parameter"><tt>printer
+admin</tt></i> of this share is "kurt" (not the "@ntadmins" group);
+guest access is not allowed; the share isn't announced in Network
+Neighbourhood (so you need to know it is there), and it is only
+allowing access from three hosts. To prevent CUPS kicking in and
+taking over the print jobs for that share, we need to set
+<i class="parameter"><tt>printing = sysv</tt></i> and <i class="parameter"><tt>printcap =
+lpstat</tt></i>.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2932671"></a>Advanced Configuration</h2></div></div><div></div></div><p>
+Before we dive into all the configuration options, let's clarify a few
+points. <span class="emphasis"><em>Network printing needs to be organized and setup
+correctly</em></span>. Often this is not done correctly. Legacy systems
+or small LANs in business environments often lack a clear design and
+good housekeeping.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2932692"></a>Central spooling vs. "Peer-to-Peer" printing</h3></div></div><div></div></div><p>
+Many small office or home networks, as well as badly organized larger
+environments, allow each client a direct access to available network
+printers. Generally, this is a bad idea. It often blocks one client's
+access to the printer when another client's job is printing. It also
+might freeze the first client's application while it is waiting to get
+rid of the job. Also, there are frequent complaints about various jobs
+being printed with their pages mixed with each other. A better concept
+is the usage of a "print server": it routes all jobs through one
+central system, which responds immediately, takes jobs from multiple
+concurrent clients at the same time and in turn transfers them to the
+printer(s) in the correct order.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2932719"></a>CUPS/Samba as a "spooling-only" Print Server; "raw" printing
+with Vendor Drivers on Windows Clients</h3></div></div><div></div></div><p>
+Most traditionally configured Unix print servers acting on behalf of
+Samba's Windows clients represented a really simple setup. Their only
+task was to manage the "raw" spooling of all jobs handed to them by
+Samba. This approach meant that the Windows clients were expected to
+prepare the printjob file in such a way that it became fit to be fed to
+the printing device. Here a native (vendor-supplied) Windows printer
+driver for the target device needed to be installed on each and every
+client.
+</p><p>
+Of course you can setup CUPS, Samba and your Windows clients in the
+same, traditional and simple way. When CUPS printers are configured
+for RAW print-through mode operation it is the responsibility of the
+Samba client to fully render the print job (file). The file must be
+sent in a format that is suitable for direct delivery to the
+printer. Clients need to run the vendor-provided drivers to do
+this. In this case CUPS will NOT do any print file format conversion
+work.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2932755"></a>Driver Installation Methods on Windows Clients</h3></div></div><div></div></div><p>
+The printer drivers on the Windows clients may be installed
+in two functionally different ways:
+</p><div class="itemizedlist"><ul type="disc"><li><p>manually install the drivers locally on each client,
+one by one; this yields the old <span class="emphasis"><em>LanMan</em></span> style
+printing; it uses a <tt class="filename">\\sambaserver\printershare</tt>
+type of connection.</p></li><li><p>deposit and prepare the drivers (for later download) on
+the print server (Samba); this enables the clients to use
+"Point'n'Print" to get drivers semi-automatically installed the
+first time they access the printer; with this method NT/2K/XP
+clients use the <span class="emphasis"><em>SPOOLSS/MS-RPC</em></span>
+type printing calls.</p></li></ul></div><p>
+The second method is recommended for use over the first.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2932814"></a>Explicitly enable "raw" printing for
+<span class="emphasis"><em>application/octet-stream</em></span>!</h3></div></div><div></div></div><p>
+If you use the first option (drivers are installed on the client
+side), there is one setting to take care of: CUPS needs to be told
+that it should allow "raw" printing of deliberate (binary) file
+formats. The CUPS files that need to be correctly set for RAW mode
+printers to work are:
+</p><div class="itemizedlist"><ul type="disc"><li><p>/etc/cups/mime.types
+</p></li><li><p>/etc/cups/mime.convs</p></li></ul></div><p>
+Both contain entries (at the end of the respective files) which must
+be uncommented to allow RAW mode operation.
+In<tt class="filename">/etc/cups/mime.types</tt> make sure this line is
+present:
+</p><pre class="screen">
+
+ application/octet-stream
+
+</pre><p>
+In <tt class="filename">/etc/cups/mime.convs</tt>,
+have this line:
+</p><pre class="screen">
+
+ application/octet-stream application/vnd.cups-raw 0 -
+
+</pre><p>
+If these two files are not set up correctly for raw Windows client
+printing, you may encounter the dreaded <tt class="computeroutput">Unable to
+convert file 0</tt> in your CUPS error_log file.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>editing the <tt class="filename">mime.convs</tt> and the
+<tt class="filename">mime.types</tt> file does not
+<span class="emphasis"><em>enforce</em></span> "raw" printing, it only
+<span class="emphasis"><em>allows</em></span> it.
+</p></div><p><b>Background. </b>
+CUPS being a more security-aware printing system than traditional ones
+does not by default allow a user to send deliberate (possibly binary)
+data to printing devices. This could be easily abused to launch a
+"Denial of Service" attack on your printer(s), causing at the least
+the loss of a lot of paper and ink. "Unknown" data are tagged by CUPS
+as <span class="emphasis"><em>MIME type: application/octet-stream</em></span> and not
+allowed to go to the printer. By default, you can only send other
+(known) MIME types "raw". Sending data "raw" means that CUPS does not
+try to convert them and passes them to the printer untouched (see next
+chapter for even more background explanations).
+</p><p>
+This is all you need to know to get the CUPS/Samba combo printing
+"raw" files prepared by Windows clients, which have vendor drivers
+locally installed. If you are not interested in background information about
+more advanced CUPS/Samba printing, simply skip the remaining sections
+of this chapter.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2932975"></a>Three familiar Methods for driver upload plus a new one</h3></div></div><div></div></div><p>
+If you want to use the MS-RPC type printing, you must upload the
+drivers onto the Samba server first (<i class="parameter"><tt>[print$]</tt></i>
+share). For a discussion on how to deposit printer drivers on the
+Samba host (so that the Windows clients can download and use them via
+"Point'n'Print") please also refer to the previous chapter of this
+HOWTO Collection. There you will find a description or reference to
+three methods of preparing the client drivers on the Samba server:
+</p><div class="itemizedlist"><ul type="disc"><li><p>the GUI, "Add Printer Wizard"
+<span class="emphasis"><em>upload-from-a-Windows-client</em></span>
+method;</p></li><li><p>the commandline, "smbclient/rpcclient"
+<span class="emphasis"><em>upload-from-a-UNIX-workstation</em></span>
+method;</p></li><li><p>the <span class="emphasis"><em>Imprints</em></span> Toolset
+method.</p></li></ul></div><p>
+These 3 methods apply to CUPS all the same. A new and more
+convenient way to load the Windows drivers into Samba is provided
+provided if you use CUPS:
+</p><div class="itemizedlist"><ul type="disc"><li><p>the <span class="emphasis"><em>cupsaddsmb</em></span>
+utility.</p></li></ul></div><p>
+cupsaddsmb is discussed in much detail further below. But we will
+first explore the CUPS filtering system and compare the Windows and
+UNIX printing architectures.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2933068"></a>Using CUPS/Samba in an advanced Way -- intelligent printing
+with PostScript Driver Download</h2></div></div><div></div></div><p>
+Still reading on? Good. Let's go into more detail then. We now know
+how to set up a "dump" printserver, that is, a server which is spooling
+printjobs "raw", leaving the print data untouched.
+</p><p>
+Possibly you need to setup CUPS in a more smart way. The reasons could
+be manifold:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Maybe your boss wants to get monthly statistics: Which
+printer did how many pages? What was the average data size of a job?
+What was the average print run per day? What are the typical hourly
+peaks in printing? Which departments prints how
+much?</p></li><li><p>Maybe you are asked to setup a print quota system:
+users should not be able to print more jobs, once they have surpassed
+a given limit per period?</p></li><li><p>Maybe your previous network printing setup is a mess
+and shall be re-organized from a clean beginning?</p></li><li><p>Maybe you have experiencing too many "Blue Screens",
+originating from poorly debugged printer drivers running in NT "kernel
+mode"?</p></li></ul></div><p>
+These goals cannot be achieved by a raw print server. To build a
+server meeting these requirements, you'll first need to learn about
+how CUPS works and how you can enable its features.
+</p><p>
+What follows is the comparison of some fundamental concepts for
+Windows and Unix printing; then is the time for a description of the
+CUPS filtering system, how it works and how you can tweak it.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2933143"></a>GDI on Windows -- PostScript on Unix</h3></div></div><div></div></div><p>
+Network printing is one of the most complicated and error-prone
+day-to-day tasks any user or an administrator may encounter. This is
+true for all OS platforms. And there are reasons for this.
+</p><p>
+You can't expect for most file formats to just throw them towards
+printers and they get printed. There needs to be a file format
+conversion in between. The problem is: there is no common standard for
+print file formats across all manufacturers and printer types. While
+<span class="emphasis"><em>PostScript</em></span> (trademark held by Adobe), and to an
+extend<span class="emphasis"><em>PCL</em></span> (trademark held by HP), have developed
+into semi-official "standards", by being the most widely used PDLs
+(<span class="emphasis"><em>Page Description Languages</em></span>), there are still
+many manufacturers who "roll their own" (their reasons may be
+unacceptable license fees for using printer-embedded PostScript
+interpreters, etc.).
+</p></div><div xmlns:ns51="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2933188"></a>Windows Drivers, GDI and EMF</h3></div></div><div></div></div><p>
+In Windows OS, the format conversion job is done by the printer
+drivers. On MS Windows OS platforms all application programmers have
+at their disposal a built-in API, the GDI (<span class="emphasis"><em>Graphical Device
+Interface</em></span>), as part and parcel of the OS itself, to base
+themselves on. This GDI core is used as one common unified ground, for
+all Windows programs, to draw pictures, fonts and documents
+<span class="emphasis"><em>on screen</em></span> as well as <span class="emphasis"><em>on
+paper</em></span> (=print). Therefore printer driver developers can
+standardize on a well-defined GDI output for their own driver
+input. Achieving WYSIWYG ("What You See Is What You Get") is
+relatively easy, because the on-screen graphic primitives, as well as
+the on-paper drawn objects, come from one common source. This source,
+the GDI, produces often a file format called EMF (<span class="emphasis"><em>Enhanced
+MetaFile</em></span>). The EMF is processed by the printer driver and
+converted to the printer-specific file format.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+To the GDI foundation in MS Windows, Apple has chosen to
+put paper and screen output on a common foundation for their
+(BSD-Unix-based, did you know??) Mac OS X and Darwin Operating
+Systems.Their <span class="emphasis"><em>Core Graphic Engine</em></span> uses a
+<span class="emphasis"><em>PDF</em></span> derivate for all display work.
+</p></div><ns51:p>
+
+</ns51:p><div class="figure"><a name="id2933252"></a><p class="title"><b>Figure 19.1. Windows Printing to a local Printer</b></p><div class="mediaobject"><img src="projdoc/imagefiles/1small.png" alt="Windows Printing to a local Printer"></div></div><ns51:p>
+</ns51:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2933286"></a>Unix Printfile Conversion and GUI Basics</h3></div></div><div></div></div><p>
+In Unix and Linux, there is no comparable layer built into the OS
+kernel(s) or the X (screen display) server. Every application is
+responsible for itself to create its print output. Fortunately, most
+use PostScript. That gives at least some common ground. Unfortunately,
+there are many different levels of quality for this PostScript. And
+worse: there is a huge difference (and no common root) in the way how
+the same document is displayed on screen and how it is presented on
+paper. WYSIWYG is more difficult to achieve. This goes back to the
+time decades ago, when the predecessors of <span class="emphasis"><em>X.org</em></span>,
+designing the UNIX foundations and protocols for Graphical User
+Interfaces refused to take over responsibility for "paper output"
+also, as some had demanded at the time, and restricted itself to
+"on-screen only". (For some years now, the "Xprint" project has been
+under development, attempting to build printing support into the X
+framework, including a PostScript and a PCL driver, but it is not yet
+ready for prime time.) You can see this unfavorable inheritance up to
+the present day by looking into the various "font" directories on your
+system; there are separate ones for fonts used for X display and fonts
+to be used on paper.
+</p><p><b>Background. </b>
+The PostScript programming language is an "invention" by Adobe Inc.,
+but its specifications have been published to the full. Its strength
+lies in its powerful abilities to describe graphical objects (fonts,
+shapes, patterns, lines, curves, dots...), their attributes (color,
+linewidth...) and the way to manipulate (scale, distort, rotate,
+shift...) them. Because of its open specification, anybody with the
+skill can start writing his own implementation of a PostScript
+interpreter and use it to display PostScript files on screen or on
+paper. Most graphical output devices are based on the concept of
+"raster images" or "pixels" (one notable exception are pen
+plotters). Of course, you can look at a PostScript file in its textual
+form and you will be reading its PostScript code, the language
+instructions which need to be interpreted by a rasterizer. Rasterizers
+produce pixel images, which may be displayed on screen by a viewer
+program or on paper by a printer.
+</p></div><div xmlns:ns52="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2933358"></a>PostScript and Ghostscript</h3></div></div><div></div></div><p>
+So, Unix is lacking a common ground for printing on paper and
+displaying on screen. Despite this unfavorable legacy for Unix, basic
+printing is fairly easy: if you have PostScript printers at your
+disposal! The reason is: these devices have a built-in PostScript
+language "interpreter", also called a <span class="emphasis"><em>Raster Image
+Processor</em></span> (RIP), (which makes them more expensive than
+other types of printers); throw PostScript towards them, and they will
+spit out your printed pages. Their RIP is doing all the hard work of
+converting the PostScript drawing commands into a bitmap picture as
+you see it on paper, in a resolution as done by your printer. This is
+no different to PostScript printing of a file from a Windows origin.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Traditional Unix programs and printing systems -- while
+using PostScript -- are largely not PPD-aware. PPDs are "PostScript
+Printer Description" files. They enable you to specify and control all
+options a printer supports: duplexing, stapling, punching... Therefore
+Unix users for a long time couldn't choose many of the supported
+device and job options, unlike Windows or Apple users. But now there
+is CUPS.... ;-)
+</p></div><ns52:p>
+</ns52:p><div class="figure"><a name="id2933404"></a><p class="title"><b>Figure 19.2. Printing to a Postscript Printer</b></p><div class="mediaobject"><img src="projdoc/imagefiles/2small.png" alt="Printing to a Postscript Printer"></div></div><ns52:p>
+</ns52:p><p>
+However, there are other types of printers out there. These don't know
+how to print PostScript. They use their own <span class="emphasis"><em>Page Description
+Language</em></span> (PDL, often proprietary). To print to them is much
+more demanding. Since your Unix applications mostly produce
+PostScript, and since these devices don't understand PostScript, you
+need to convert the printfiles to a format suitable for your printer
+on the host, before you can send it away.
+</p></div><div xmlns:ns53="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2933454"></a>Ghostscript -- the Software RIP for non-PostScript Printers</h3></div></div><div></div></div><p>
+Here is where<span class="emphasis"><em>Ghostscript</em></span> kicks in. Ghostscript is
+the traditional (and quite powerful) PostScript interpreter used on
+Unix platforms. It is a RIP in software, capable to do a
+<span class="emphasis"><em>lot</em></span> of file format conversions, for a very broad
+spectrum of hardware devices as well as software file formats.
+Ghostscript technology and drivers is what enables PostScript printing
+to non-PostScript hardware.
+</p><ns53:p>
+</ns53:p><div class="figure"><a name="id2933484"></a><p class="title"><b>Figure 19.3. Ghostscript as a RIP for non-postscript printers</b></p><div class="mediaobject"><img src="projdoc/imagefiles/3small.png" alt="Ghostscript as a RIP for non-postscript printers"></div></div><ns53:p>
+</ns53:p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+Use the "gs -h" command to check for all built-in "devices" of your
+Ghostscript version. If you specify e.g. a parameter of
+<i class="parameter"><tt>-sDEVICE=png256</tt></i> on your Ghostscript command
+line, you are asking Ghostscript to convert the input into a PNG
+file. Naming a "device" on the commandline is the most important
+single parameter to tell Ghostscript how exactly it should render the
+input. New Ghostscript versions are released at fairly regular
+intervals, now by artofcode LLC. They are initially put under the
+"AFPL" license, but re-released under the GNU GPL as soon as the next
+AFPL version appears. GNU Ghostscript is probably the version
+installed on most Samba systems. But it has got some
+deficiencies. Therefore ESP Ghostscript was developed as an
+enhancement over GNU Ghostscript, with lots of bug-fixes, additional
+devices and improvements. It is jointly maintained by developers from
+CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes
+the "cups" device (essential to print to non-PS printers from CUPS).
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2933550"></a>PostScript Printer Description (PPD) Specification</h3></div></div><div></div></div><p>
+While PostScript in essence is a <span class="emphasis"><em>Page Description
+Language</em></span> (PDL) to represent the page layout in a
+<span class="emphasis"><em>device independent</em></span> way, real world print jobs are
+always ending up to be output on a hardware with device-specific
+features. To take care of all the differences in hardware, and to
+allow for innovations, Adobe has specified a syntax and file format
+for <span class="emphasis"><em>PostScript Printer Description</em></span> (PPD)
+files. Every PostScript printer ships with one of these files.
+</p><p>
+PPDs contain all information about general and special features of the
+given printer model: Which different resolutions can it handle? Does
+it have a Duplexing Unit? How many paper trays are there? What media
+types and sizes does it take? For each item it also names the special
+command string to be sent to the printer (mostly inside the PostScript
+file) in order to enable it.
+</p><p>
+Information from these PPDs is meant to be taken into account by the
+printer drivers. Therefore, installed as part of the Windows
+PostScript driver for a given printer is the printer's PPD. Where it
+makes sense, the PPD features are presented in the drivers' UI dialogs
+to display to the user as choice of print options. In the end, the
+user selections are somehow written (in the form of special
+PostScript, PJL, JCL or vendor-dependent commands) into the PostScript
+file created by the driver.
+</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+A PostScript file that was created to contain device-specific commands
+for achieving a certain print job output (e.g. duplexed, stapled and
+punched) on a specific target machine, may not print as expected, or
+may not be printable at all on other models; it also may not be fit
+for further processing by software (e.g. by a PDF distilling program).
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2946373"></a>CUPS can use all Windows-formatted Vendor PPDs</h3></div></div><div></div></div><p>
+CUPS can handle all spec-compliant PPDs as supplied by the
+manufacturers for their PostScript models. Even if a
+Unix/Linux-illiterate vendor might not have mentioned our favorite
+OS in his manuals and brochures -- you can safely trust this:
+<span class="emphasis"><em>if you get hold of the Windows NT version of the PPD, you
+can use it unchanged in CUPS</em></span> and thus access the full
+power of your printer just like a Windows NT user could!
+</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+To check the spec compliance of any PPD online, go to <a href="http://www.cups.org/testppd.php" target="_top">http://www.cups.org/testppd.php</a>
+and upload your PPD. You will see the results displayed
+immediately. CUPS in all versions after 1.1.19 has a much more strict
+internal PPD parsing and checking code enabled; in case of printing
+trouble this online resource should be one of your first pitstops.
+</p></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+For real PostScript printers <span class="emphasis"><em>don't</em></span> use the
+<span class="emphasis"><em>Foomatic</em></span> or <span class="emphasis"><em>cupsomatic</em></span>
+PPDs from Linuxprinting.org. With these devices the original
+vendor-provided PPDs are always the first choice!
+</p></div><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+If you are looking for an original vendor-provided PPD of a specific
+device, and you know that an NT4 box (or any other Windows box) on
+your LAN has the PostScript driver installed, just use
+<b class="command">smbclient //NT4-box/print\$ -U username</b> to
+access the Windows directory where all printer driver files are
+stored. First look in the <tt class="filename">W32X86/2</tt> subdir for
+the PPD you are seeking.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2946462"></a>CUPS also uses PPDs for non-PostScript Printers</h3></div></div><div></div></div><p>
+CUPS also uses specially crafted PPDs to handle non-PostScript
+printers. These PPDs are usually not available from the vendors (and
+no, you can't just take the PPD of a Postscript printer with the same
+model name and hope it works for the non-PostScript version too). To
+understand how these PPDs work for non-PS printers we first need to
+dive deeply into the CUPS filtering and file format conversion
+architecture. Stay tuned.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2946485"></a>The CUPS Filtering Architecture</h2></div></div><div></div></div><p>
+The core of the CUPS filtering system is based on
+<span class="emphasis"><em>Ghostscript</em></span>. In addition to Ghostscript, CUPS
+uses some other filters of its own. You (or your OS vendor) may have
+plugged in even more filters. CUPS handles all data file formats under
+the label of various <span class="emphasis"><em>MIME types</em></span>. Every incoming
+printfile is subjected to an initial
+<span class="emphasis"><em>auto-typing</em></span>. The auto-typing determines its given
+MIME type. A given MIME type implies zero or more possible filtering
+chains relevant to the selected target printer. This section discusses
+how MIME types recognition and conversion rules interact. They are
+used by CUPS to automatically setup a working filtering chain for any
+given input data format.
+</p><p>
+If CUPS rasterizes a PostScript file <span class="emphasis"><em>natively</em></span> to
+a bitmap, this is done in 2 stages:
+</p><div class="itemizedlist"><ul type="disc"><li><p>the first stage uses a Ghostscript device named "cups"
+(this is since version 1.1.15) and produces a generic raster format
+called "CUPS raster".
+</p></li><li><p>the second stage uses a "raster driver" which converts
+the generic CUPS raster to a device specific raster.</p></li></ul></div><p>
+Make sure your Ghostscript version has the "cups" device compiled in
+(check with <b class="command">gs -h | grep cups</b>). Otherwise you
+may encounter the dreaded <tt class="computeroutput">Unable to convert file
+0</tt> in your CUPS error_log file. To have "cups" as a
+device in your Ghostscript, you either need to <span class="emphasis"><em>patch GNU
+Ghostscript</em></span> and re-compile or use <a href="http://www.cups.org/ghostscript.php" target="_top">ESP Ghostscript</a>. The
+superior alternative is ESP Ghostscript: it supports not just CUPS,
+but 300 other devices too (while GNU Ghostscript supports only about
+180). Because of this broad output device support, ESP Ghostscript is
+the first choice for non-CUPS spoolers too. It is now recommended by
+Linuxprinting.org for all spoolers.
+</p><p>
+CUPS printers may be setup to use <span class="emphasis"><em>external</em></span>
+rendering paths. One of the most common ones is provided by the
+<span class="emphasis"><em>Foomatic/cupsomatic</em></span> concept, from <a href="http://www.linuxprinting.org/" target="_top">Linuxprinting.org</a>. This
+uses the classical Ghostscript approach, doing everything in one
+step. It doesn't use the "cups" device, but one of the many
+others. However, even for Foomatic/cupsomatic usage, best results and
+broadest printer model support is provided by ESP Ghostscript (more
+about cupsomatic/Foomatic, particularly the new version called now
+<span class="emphasis"><em>foomatic-rip</em></span>, follows below).
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2946623"></a>MIME types and CUPS Filters</h3></div></div><div></div></div><p>
+CUPS reads the file <tt class="filename">/etc/cups/mime.types</tt>
+(and all other files carrying a <tt class="filename">*.types</tt> suffix
+in the same directory) upon startup. These files contain the MIME
+type recognition rules which are applied when CUPS runs its
+auto-typing routines. The rule syntax is explained in the man page
+for <tt class="filename">mime.types</tt> and in the comments section of the
+<tt class="filename">mime.types</tt> file itself. A simple rule reads
+like this:
+</p><pre class="screen">
+
+ application/pdf pdf string(0,%PDF)
+
+</pre><p>
+This means: if a filename has either a
+<tt class="filename">.pdf</tt> suffix, or if the magic
+string <span class="emphasis"><em>%PDF</em></span> is right at the
+beginning of the file itself (offset 0 from the start), then it is
+a PDF file (<span class="emphasis"><em>application/pdf</em></span>).
+Another rule is this:
+</p><pre class="screen">
+
+ application/postscript ai eps ps string(0,%!) string(0,<04>%!)
+
+</pre><p>
+Its meaning: if the filename has one of the suffixes
+<tt class="filename">.ai</tt>, <tt class="filename">.eps</tt>,
+<tt class="filename">.ps</tt> or if the file itself starts with one of the
+strings <span class="emphasis"><em>%!</em></span> or <span class="emphasis"><em><04>%!</em></span>, it
+is a generic PostScript file
+(<span class="emphasis"><em>application/postscript</em></span>).
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+There is a very important difference between two similar MIME type in
+CUPS: one is <span class="emphasis"><em>application/postscript</em></span>, the other is
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span>. While
+<span class="emphasis"><em>application/postscript</em></span> is meant to be device
+independent (job options for the file are still outside the PS file
+content, embedded in commandline or environment variables by CUPS),
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span> may have the job
+options inserted into the PostScript data itself (were
+applicable). The transformation of the generic PostScript
+(application/postscript) to the device-specific version
+(application/vnd.cups-postscript) is the responsibility of the
+CUPS <span class="emphasis"><em>pstops</em></span> filter. pstops uses information
+contained in the PPD to do the transformation.
+</p></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+Don't confuse the other mime.types file your system might be using
+with the one in the <tt class="filename">/etc/cups/</tt> directory.
+</p></div><p>
+CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a
+lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster,
+PNM, PBM, SGI-RGB and some more) and their associated MIME types
+with its filters.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2946811"></a>MIME type Conversion Rules</h3></div></div><div></div></div><p>
+CUPS reads the file <tt class="filename">/etc/cups/mime.convs</tt>
+(and all other files named with a <tt class="filename">*.convs</tt>
+suffix in the same directory) upon startup. These files contain
+lines naming an input MIME type, an output MIME type, a format
+conversion filter which can produce the output from the input type
+and virtual costs associated with this conversion. One example line
+reads like this:
+</p><pre class="screen">
+
+ application/pdf application/postscript 33 pdftops
+
+</pre><p>
+This means that the <span class="emphasis"><em>pdftops</em></span> filter will take
+<span class="emphasis"><em>application/pdf</em></span> as input and produce
+<span class="emphasis"><em>application/postscript</em></span> as output, the virtual
+cost of this operation is 33 CUPS-$. The next filter is more
+expensive, costing 66 CUPS-$:
+</p><pre class="screen">
+
+ application/vnd.hp-HPGL application/postscript 66 hpgltops
+
+</pre><p>
+This is the <span class="emphasis"><em>hpgltops</em></span>, which processes HP-GL
+plotter files to PostScript.
+</p><pre class="screen">
+
+ application/octet-stream
+
+</pre><p>
+Here are two more examples:
+</p><pre class="screen">
+
+ application/x-shell application/postscript 33 texttops
+ text/plain application/postscript 33 texttops
+
+</pre><p>
+The last two examples name the <span class="emphasis"><em>texttops</em></span> filter
+to work on "text/plain" as well as on "application/x-shell". (Hint:
+this differentiation is needed for the syntax highlighting feature of
+"texttops").
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2946927"></a>Filter Requirements</h3></div></div><div></div></div><p>
+There are many more combinations named in mime.convs. However, you
+are not limited to use the ones pre-defined there. You can plug in any
+filter you like into the CUPS framework. It must meet, or must be made
+to meet some minimal requirements. If you find (or write) a cool
+conversion filter of some kind, make sure it complies to what CUPS
+needs, and put in the right lines in <tt class="filename">mime.types</tt>
+and <tt class="filename">mime.convs</tt>, then it will work seamlessly
+inside CUPS!
+</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+The mentioned "CUPS requirements" for filters are simple. Take
+filenames or <tt class="filename">stdin</tt> as input and write to
+<tt class="filename">stdout</tt>. They should take these 5 or 6 arguments:
+<span class="emphasis"><em>printer job user title copies options [filename]</em></span>
+</p><div class="variablelist"><dl><dt><span class="term">Printer</span></dt><dd><p>The name of the printer queue (normally this is the
+name of the filter being run)</p></dd><dt><span class="term">job</span></dt><dd><p>The numeric job ID for the job being
+printed</p></dd><dt><span class="term">Printer</span></dt><dd><p>The string from the originating-user-name
+attribute</p></dd><dt><span class="term">Printer</span></dt><dd><p>The string from the job-name attribute</p></dd><dt><span class="term">Printer</span></dt><dd><p>The numeric value from the number-copies
+attribute</p></dd><dt><span class="term">Printer</span></dt><dd><p>The job options</p></dd><dt><span class="term">Printer</span></dt><dd><p>(Optionally) The print request file (if missing,
+filters expected data fed through <tt class="filename">stdin</tt>). In most
+cases it is very easy to write a simple wrapper script around existing
+filters to make them work with CUPS.</p></dd></dl></div></div></div><div xmlns:ns54="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2947096"></a>Prefilters</h3></div></div><div></div></div><p>
+As was said, PostScript is the central file format to any Unix based
+printing system. From PostScript, CUPS generates raster data to feed
+non-PostScript printers.
+</p><p>
+But what is happening if you send one of the supported non-PS formats
+to print? Then CUPS runs "pre-filters" on these input formats to
+generate PostScript first. There are pre-filters to create PS from
+ASCII text, PDF, DVI or HP-GL. The outcome of these filters is always
+of MIME type <span class="emphasis"><em>application/postscript</em></span> (meaning that
+any device-specific print options are not yet embedded into the
+PostScript by CUPS, and that the next filter to be called is
+pstops). Another pre-filter is running on all supported image formats,
+the <span class="emphasis"><em>imagetops</em></span> filter. Its outcome is always of
+MIME type <span class="emphasis"><em>application/vnd.cups-postscript</em></span>
+(<span class="emphasis"><em>not</em></span> application/postscript), meaning it has the
+print options already embedded into the file.
+</p><ns54:p>
+</ns54:p><div class="figure"><a name="id2947147"></a><p class="title"><b>Figure 19.4. Prefiltering in CUPS to form Postscript</b></p><div class="mediaobject"><img src="projdoc/imagefiles/4small.png" alt="Prefiltering in CUPS to form Postscript"></div></div><ns54:p>
+</ns54:p></div><div xmlns:ns55="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2947181"></a>pstops</h3></div></div><div></div></div><p>
+<span class="emphasis"><em>pstops</em></span>is the filter to convert
+<span class="emphasis"><em>application/postscript</em></span> to
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span>. It was said
+above that this filter inserts all device-specific print options
+(commands to the printer to ask for the duplexing of output, or
+stapling an punching it, etc.) into the PostScript file.
+</p><ns55:p>
+</ns55:p><div class="figure"><a name="id2947212"></a><p class="title"><b>Figure 19.5. Adding Device-specific Print Options</b></p><div class="mediaobject"><img src="projdoc/imagefiles/5small.png" alt="Adding Device-specific Print Options"></div></div><ns55:p>
+</ns55:p><p>
+This is not all: other tasks performed by it are:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+selecting the range of pages to be printed (if you choose to
+print only pages "3, 6, 8-11, 16, 19-21", or only the odd numbered
+ones)
+</p></li><li><p>
+putting 2 or more logical pages on one sheet of paper (the
+so-called "number-up" function)
+</p></li><li><p>counting the pages of the job to insert the accounting
+information into the <tt class="filename">/var/log/cups/page_log</tt>
+</p></li></ul></div></div><div xmlns:ns56="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2947284"></a>pstoraster</h3></div></div><div></div></div><p>
+<span class="emphasis"><em>pstoraster</em></span> is at the core of the CUPS filtering
+system. It is responsible for the first stage of the rasterization
+process. Its input is of MIME type application/vnd.cups-postscript;
+its output is application/vnd.cups-raster. This output format is not
+yet meant to be printable. Its aim is to serve as a general purpose
+input format for more specialized <span class="emphasis"><em>raster drivers</em></span>,
+that are able to generate device-specific printer data.
+</p><ns56:p>
+</ns56:p><div class="figure"><a name="id2947314"></a><p class="title"><b>Figure 19.6. Postscript to intermediate Raster format</b></p><div class="mediaobject"><img src="projdoc/imagefiles/6small.png" alt="Postscript to intermediate Raster format"></div></div><ns56:p>
+</ns56:p><p>
+CUPS raster is a generic raster format with powerful features. It is
+able to include per-page information, color profiles and more to be
+used by the following downstream raster drivers. Its MIME type is
+registered with IANA and its specification is of course completely
+open. It is designed to make it very easy and inexpensive for
+manufacturers to develop Linux and Unix raster drivers for their
+printer models, should they choose to do so. CUPS always takes care
+for the first stage of rasterization so these vendors don't need to care
+about Ghostscript complications (in fact, there is currently more
+than one vendor financing the development of CUPS raster drivers).
+</p><ns56:p>
+</ns56:p><div class="figure"><a name="id2947366"></a><p class="title"><b>Figure 19.7. CUPS-raster production using Ghostscript</b></p><div class="mediaobject"><img src="projdoc/imagefiles/7small.png" alt="CUPS-raster production using Ghostscript"></div></div><ns56:p>
+</ns56:p><p>
+CUPS versions before version 1.1.15 were shipping a binary (or source
+code) standalone filter, named "pstoraster". pstoraster was derived
+from GNU Ghostscript 5.50, and could be installed besides and in
+addition to any GNU or AFPL Ghostscript package without conflicting.
+</p><p>
+From version 1.1.15, this has changed. The functions for this has been
+integrated back into Ghostscript (now based on GNU Ghostscript version
+7.05). The "pstoraster" filter is now a simple shell script calling
+<b class="command">gs</b> with the <b class="command">-sDEVICE=cups</b>
+parameter. If your Ghostscript doesn't show a success on asking for
+<b class="command">gs -h |grep cups</b>, you might not be able to
+print. Update your Ghostscript then!
+</p></div><div xmlns:ns57="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2947440"></a>imagetops and imagetoraster</h3></div></div><div></div></div><p>
+Above in the section about prefilters, we mentioned the prefilter
+that generates PostScript from image formats. The imagetoraster
+filter is used to convert directly from image to raster, without the
+intermediate PostScript stage. It is used more often than the above
+mentioned prefilters. Here is a summarizing flowchart of image file
+filtering:
+</p><ns57:p>
+</ns57:p><div class="figure"><a name="id2947461"></a><p class="title"><b>Figure 19.8. Image format to CUPS-raster format conversion</b></p><div class="mediaobject"><img src="projdoc/imagefiles/8small.png" alt="Image format to CUPS-raster format conversion"></div></div><ns57:p>
+</ns57:p></div><div xmlns:ns58="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2947495"></a>rasterto [printerspecific]</h3></div></div><div></div></div><p>
+CUPS ships with quite some different raster drivers processing CUPS
+raster. On my system I find in /usr/lib/cups/filter/ these:
+<i class="parameter"><tt>rastertoalps, rastertobj, rastertoepson, rastertoescp,
+rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo,
+rastertoescp, rastertohp</tt></i> and
+<i class="parameter"><tt>rastertoprinter</tt></i>. Don't worry if you have less
+than this; some of these are installed by commercial add-ons to CUPS
+(like <i class="parameter"><tt>rastertoturboprint</tt></i>), others (like
+<i class="parameter"><tt>rastertoprinter</tt></i>) by 3rd party driver
+development projects (such as Gimp-Print) wanting to cooperate as
+closely as possible with CUPS.
+</p><ns58:p>
+</ns58:p><div class="figure"><a name="id2947546"></a><p class="title"><b>Figure 19.9. Raster to Printer Specific formats</b></p><div class="mediaobject"><img src="projdoc/imagefiles/9small.png" alt="Raster to Printer Specific formats"></div></div><ns58:p>
+</ns58:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2947580"></a>CUPS Backends</h3></div></div><div></div></div><p>
+The last part of any CUPS filtering chain is a "backend". Backends
+are special programs that send the print-ready file to the final
+device. There is a separate backend program for any transfer
+"protocol" of sending printjobs over the network, or for every local
+interface. Every CUPS printqueue needs to have a CUPS "device-URI"
+associated with it. The device URI is the way to encode the backend
+used to send the job to its destination. Network device-URIs are using
+two slashes in their syntax, local device URIs only one, as you can
+see from the following list. Keep in mind that local interface names
+may vary much from my examples, if your OS is not Linux:
+</p><div class="variablelist"><dl><dt><span class="term">usb</span></dt><dd><p>
+This backend sends printfiles to USB-connected printers. An
+example for the CUPS device-URI to use is:
+<tt class="filename">usb:/dev/usb/lp0</tt>
+</p></dd><dt><span class="term">serial</span></dt><dd><p>
+This backend sends printfiles to serially connected printers.
+An example for the CUPS device-URI to use is:
+<tt class="filename">serial:/dev/ttyS0?baud=11500</tt>
+</p></dd><dt><span class="term">parallel</span></dt><dd><p>
+This backend sends printfiles to printers connected to the
+parallel port. An example for the CUPS device-URI to use is:
+<tt class="filename">parallel:/dev/lp0</tt>
+</p></dd><dt><span class="term">scsi</span></dt><dd><p>
+This backend sends printfiles to printers attached to the
+SCSI interface. An example for the CUPS device-URI to use is:
+<tt class="filename">scsi:/dev/sr1</tt>
+</p></dd><dt><span class="term">lpd</span></dt><dd><p>
+This backend sends printfiles to LPR/LPD connected network
+printers. An example for the CUPS device-URI to use is:
+<tt class="filename">lpd://remote_host_name/remote_queue_name</tt>
+</p></dd><dt><span class="term">AppSocket/HP JetDirect</span></dt><dd><p>
+This backend sends printfiles to AppSocket (a.k.a. "HP
+JetDirect") connected network printers. An example for the CUPS
+device-URI to use is:
+<tt class="filename">socket://10.11.12.13:9100</tt>
+</p></dd><dt><span class="term">ipp</span></dt><dd><p>
+This backend sends printfiles to IPP connected network
+printers (or to other CUPS servers). Examples for CUPS device-URIs
+to use are:
+<tt class="filename">ipp:://192.193.194.195/ipp</tt>
+(for many HP printers) or
+<tt class="filename">ipp://remote_cups_server/printers/remote_printer_name</tt>
+</p></dd><dt><span class="term">http</span></dt><dd><p>
+This backend sends printfiles to HTTP connected printers.
+(The http:// CUPS backend is only a symlink to the ipp:// backend.)
+Examples for the CUPS device-URIs to use are:
+<tt class="filename">http:://192.193.194.195:631/ipp</tt>
+(for many HP printers) or
+<tt class="filename">http://remote_cups_server:631/printers/remote_printer_name</tt>
+</p></dd><dt><span class="term">smb</span></dt><dd><p>
+This backend sends printfiles to printers shared by a Windows
+host. An example for CUPS device-URIs to use are:
+<tt class="filename">smb://workgroup/server/printersharename</tt>
+Or
+<tt class="filename">Smb://server/printersharename</tt>
+or
+<tt class="filename">smb://username:password@workgroup/server/printersharename</tt>
+or
+<tt class="filename">smb://username:password@server/printersharename</tt>.
+The smb:// backend is a symlink to the Samba utility
+<span class="emphasis"><em>smbspool</em></span> (doesn't ship with CUPS). If the
+symlink is not present in your CUPS backend directory, have your
+root user create it: <b class="command">ln -s `which smbspool`
+/usr/lib/cups/backend/smb</b>.
+</p></dd></dl></div><p>
+It is easy to write your own backends as Shell or Perl scripts, if you
+need any modification or extension to the CUPS print system. One
+reason could be that you want to create "special" printers which send
+the printjobs as email (through a "mailto:/" backend), convert them to
+PDF (through a "pdfgen:/" backend) or dump them to "/dev/null" (In
+fact I have the system-wide default printer set up to be connected to
+a "devnull:/" backend: there are just too many people sending jobs
+without specifying a printer, or scripts and programs which don't name
+a printer. The system-wided default deletes the job and sends a polite
+mail back to the $USER asking him to alsways specify a correct
+printername).
+</p><p>
+Not all of the mentioned backends may be present on your system or
+usable (depending on your hardware configuration). One test for all
+available CUPS backends is provided by the <span class="emphasis"><em>lpinfo</em></span>
+utility. Used with the <i class="parameter"><tt>-v</tt></i> parameter, it lists
+all available backends:
+</p><pre class="screen">
+
+ lpinfo -v
+
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2947894"></a>cupsomatic/Foomatic -- how do they fit into the Picture?</h3></div></div><div></div></div><p>
+"cupsomatic" filters may be the most widely used on CUPS
+installations. You must be clear about the fact that these were not
+developed by the CUPS people. They are a "Third Party" add-on to
+CUPS. They utilize the traditional Ghostscript devices to render jobs
+for CUPS. When troubleshooting, you should know about the
+difference. Here the whole rendering process is done in one stage,
+inside Ghostscript, using an appropriate "device" for the target
+printer. cupsomatic uses PPDs which are generated from the "Foomatic"
+Printer & Driver Database at Linuxprinting.org.
+</p><p>
+You can recognize these PPDs from the line calling the
+<span class="emphasis"><em>cupsomatic</em></span> filter:
+</p><pre class="screen">
+
+ *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic"
+
+</pre><p>
+This line you may find amongst the first 40 or so lines of the PPD
+file. If you have such a PPD installed, the printer shows up in the
+CUPS web interface with a <span class="emphasis"><em>foomatic</em></span> namepart for
+the driver description. cupsomatic is a Perlscript that runs
+Ghostscript, with all the complicated commandline options
+auto-constructed from the selected PPD and commandline options give to
+the printjob.
+</p><p>
+However, cupsomatic is now deprecated. Its PPDs (especially the first
+generation of them, still in heavy use out there) are not meeting the
+Adobe specifications. You might also suffer difficulties when you try
+to download them with "Point'n'Print" to Windows clients. A better,
+and more powerful successor is now in a very stable Beta-version
+available: it is called <span class="emphasis"><em>foomatic-rip</em></span>. To use
+foomatic-rip as a filter with CUPS, you need the new-type PPDs. These
+have a similar, but different line:
+</p><pre class="screen">
+
+ *cupsFilter: "application/vnd.cups-postscript 0 foomatic-rip"
+
+</pre><p>
+The PPD generating engine at Linuxprinting.org has been revamped.
+The new PPDs comply to the Adobe spec. On top, they also provide a
+new way to specify different quality levels (hi-res photo, normal
+color, grayscale, draft...) with a single click (whereas before you
+could have required 5 or more different selections (media type,
+resolution, inktype, dithering algorithm...). There is support for
+custom-size media built in. There is support to switch
+print-options from page to page, in the middle of a job. And the
+best thing is: the new foomatic-rip now works seamlessly with all
+legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing
+for them access to use PPDs for their printing!
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2947997"></a>The Complete Picture</h3></div></div><div></div></div><p>
+If you want to see an overview over all the filters and how they
+relate to each other, the complete picture of the puzzle is at the end
+of this document.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2948012"></a><tt class="filename">mime.convs</tt></h3></div></div><div></div></div><p>
+CUPS auto-constructs all possible filtering chain paths for any given
+MIME type, and every printer installed. But how does it decide in
+favor or against a specific alternative? (There may often be cases,
+where there is a choice of two or more possible filtering chains for
+the same target printer). Simple: you may have noticed the figures in
+the 3rd column of the mime.convs file. They represent virtual costs
+assigned to this filter. Every possible filtering chain will sum up to
+a total "filter cost". CUPS decides for the most "inexpensive" route.
+</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+The setting of <i class="parameter"><tt>FilterLimit 1000</tt></i> in
+<tt class="filename">cupsd.conf</tt> will not allow more filters to
+run concurrently than will consume a total of 1000 virtual filter
+cost. This is a very efficient way to limit the load of any CUPS
+server by setting an appropriate "FilterLimit" value. A FilterLimit of
+200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows
+approximately 5 jobs maximum at a time.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2948065"></a>"Raw" printing</h3></div></div><div></div></div><p>
+You can tell CUPS to print (nearly) any file "raw". "Raw" means it
+will not be filtered. CUPS will send the file to the printer "as is"
+without bothering if the printer is able to digest it. Users need to
+take care themselves that they send sensible data formats only. Raw
+printing can happen on any queue if the "-o raw" option is specified
+on the command line. You can also set up raw-only queues by simply not
+associating any PPD with it. This command:
+</p><pre class="screen">
+
+ lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E
+
+</pre><p>
+sets up a queue named "rawprinter", connected via the "socket"
+protocol (a.k.a. "HP JetDirect") to the device at IP address
+11.12.1.3.14, using port 9100. (If you had added a PPD with
+<b class="command">-P /path/to/PPD</b> to this command line, you would
+have installed a "normal" printqueue.
+</p><p>
+CUPS will automatically treat each job sent to a queue as a "raw" one,
+if it can't find a PPD associated with the queue. However, CUPS will
+only send known MIME types (as defined in its own mime.types file) and
+refuse others.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2948120"></a>"application/octet-stream" printing</h3></div></div><div></div></div><p>
+Any MIME type with no rule in the
+<tt class="filename">/etc/cups/mime.types</tt> file is regarded as unknown
+or <span class="emphasis"><em>application/octet-stream</em></span> and will not be
+sent. Because CUPS refuses to print unknown MIME types per default,
+you will probably have experienced the fact that printjobs originating
+from Windows clients were not printed. You may have found an error
+message in your CUPS logs like:
+</p><pre class="screen">
+
+ Unable to convert file 0 to printable format for job
+
+</pre><p>
+To enable the printing of "application/octet-stream" files, edit
+these two files:
+</p><div class="itemizedlist"><ul type="disc"><li><p><tt class="filename">/etc/cups/mime.convs</tt></p></li><li><p><tt class="filename">/etc/cups/mime.types</tt></p></li></ul></div><p>
+Both contain entries (at the end of the respective files) which must
+be uncommented to allow RAW mode operation for
+application/octet-stream. In <tt class="filename">/etc/cups/mime.types</tt>
+make sure this line is present:
+</p><pre class="screen">
+
+ application/octet-stream
+
+</pre><p>
+This line (with no specific auto-typing rule set) makes all files
+not otherwise auto-typed a member of application/octet-stream. In
+<tt class="filename">/etc/cups/mime.convs</tt>, have this
+line:
+</p><pre class="screen">
+
+ application/octet-stream application/vnd.cups-raw 0 -
+
+</pre><p>
+This line tells CUPS to use the <span class="emphasis"><em>Null Filter</em></span>
+(denoted as "-", doing... nothing at all) on
+<span class="emphasis"><em>application/octet-stream</em></span>, and tag the result as
+<span class="emphasis"><em>application/vnd.cups-raw</em></span>. This last one is
+always a green light to the CUPS scheduler to now hand the file over
+to the "backend" connecting to the printer and sending it over.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> Editing the <tt class="filename">mime.convs</tt> and the
+<tt class="filename">mime.types</tt> file does not
+<span class="emphasis"><em>enforce</em></span> "raw" printing, it only
+<span class="emphasis"><em>allows</em></span> it.
+</p></div><p><b>Background. </b>
+CUPS being a more security-aware printing system than traditional ones
+does not by default allow one to send deliberate (possibly binary)
+data to printing devices. (This could be easily abused to launch a
+Denial of Service attack on your printer(s), causing at least the loss
+of a lot of paper and ink...) "Unknown" data are regarded by CUPS
+as<span class="emphasis"><em>MIME type</em></span>
+<span class="emphasis"><em>application/octet-stream</em></span>. While you
+<span class="emphasis"><em>can</em></span> send data "raw", the MIME type for these must
+be one that is known to CUPS and an allowed one. The file
+<tt class="filename">/etc/cups/mime.types</tt> defines the "rules" how CUPS
+recognizes MIME types. The file
+<tt class="filename">/etc/cups/mime.convs</tt> decides which file
+conversion filter(s) may be applied to which MIME types.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2948335"></a>PostScript Printer Descriptions (PPDs) for non-PS Printers</h3></div></div><div></div></div><p>
+Originally PPDs were meant to be used for PostScript printers
+only. Here, they help to send device-specific commands and settings
+to the RIP which processes the jobfile. CUPS has extended this
+scope for PPDs to cover non-PostScript printers too. This was not
+very difficult, because it is a standardized file format. In a way
+it was logical too: CUPS handles PostScript and uses a PostScript
+RIP (=Ghostscript) to process the jobfiles. The only difference is:
+a PostScript printer has the RIP built-in, for other types of
+printers the Ghostscript RIP runs on the host computer.
+</p><p>
+PPDs for a non-PS printer have a few lines that are unique to
+CUPS. The most important one looks similar to this:
+</p><pre class="screen">
+
+ *cupsFilter: application/vnd.cups-raster 66 rastertoprinter
+
+</pre><p>
+It is the last piece in the CUPS filtering puzzle. This line tells the
+CUPS daemon to use as a last filter "rastertoprinter". This filter
+should be served as input an "application/vnd.cups-raster" MIME type
+file. Therefore CUPS should auto-construct a filtering chain, which
+delivers as its last output the specified MIME type. This is then
+taken as input to the specified "rastertoprinter" filter. After this
+the last filter has done its work ("rastertoprinter" is a Gimp-Print
+filter), the file should go to the backend, which sends it to the
+output device.
+</p><p>
+CUPS by default ships only a few generic PPDs, but they are good for
+several hundred printer models. You may not be able to control
+different paper trays, or you may get larger margins than your
+specific model supports):
+</p><div class="variablelist"><dl><dt><span class="term">deskjet.ppd</span></dt><dd><p>older HP inkjet printers and compatible
+</p></dd><dt><span class="term">deskjet2.ppd</span></dt><dd><p>newer HP inkjet printers and compatible
+</p></dd><dt><span class="term">dymo.ppd</span></dt><dd><p>label printers
+</p></dd><dt><span class="term">epson9.ppd</span></dt><dd><p>Epson 24pin impact printers and compatible
+</p></dd><dt><span class="term">epson24.ppd</span></dt><dd><p>Epson 24pin impact printers and compatible
+</p></dd><dt><span class="term">okidata9.ppd</span></dt><dd><p>Okidata 9pin impact printers and compatible
+</p></dd><dt><span class="term">okidat24.ppd</span></dt><dd><p>Okidata 24pin impact printers and compatible
+</p></dd><dt><span class="term">stcolor.ppd</span></dt><dd><p>older Epson Stylus Color printers
+</p></dd><dt><span class="term">stcolor2.ppd</span></dt><dd><p>newer Epson Stylus Color printers
+</p></dd><dt><span class="term">stphoto.ppd</span></dt><dd><p>older Epson Stylus Photo printers
+</p></dd><dt><span class="term">stphoto2.ppd</span></dt><dd><p>newer Epson Stylus Photo printers
+</p></dd><dt><span class="term">laserjet.ppd</span></dt><dd><p>all PCL printersFurther below is a discussion
+of several other driver/PPD-packages suitable fur use with CUPS.
+</p></dd></dl></div></div><div xmlns:ns59="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2948562"></a>Difference between <span class="emphasis"><em>cupsomatic/foomatic-rip</em></span> and
+<span class="emphasis"><em>native CUPS</em></span> printing</h3></div></div><div></div></div><p>
+Native CUPS rasterization works in two steps.
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+First is the "pstoraster" step. It uses the special "cups"
+device from ESP Ghostscript 7.05.x as its tool
+</p></li><li><p>
+Second comes the "rasterdriver" step. It uses various
+device-specific filters; there are several vendors who provide good
+quality filters for this step, some are Free Software, some are
+Shareware/Non-Free, some are proprietary.</p></li></ul></div><p>
+Often this produces better quality (and has several more
+advantages) than other methods.
+</p><ns59:p>
+</ns59:p><div class="figure"><a name="id2948613"></a><p class="title"><b>Figure 19.10. cupsomatic/foomatic processing versus Native CUPS</b></p><div class="mediaobject"><img src="projdoc/imagefiles/10small.png" alt="cupsomatic/foomatic processing versus Native CUPS"></div></div><ns59:p>
+</ns59:p><p>
+One other method is the <span class="emphasis"><em>cupsomatic/foomatic-rip</em></span>
+way. Note that cupsomatic is <span class="emphasis"><em>not</em></span> made by the CUPS
+developers. It is an independent contribution to printing development,
+made by people from Linuxprinting.org (see also <a href="http://www.cups.org/cups-help.html" target="_top">http://www.cups.org/cups-help.html</a>).
+cupsomatic is no longer developed and maintained and is no longer
+supported. It has now been replaced by
+<span class="emphasis"><em>foomatic-rip</em></span>. foomatic-rip is a complete re-write
+of the old cupsomatic idea, but very much improved and generalized to
+other (non-CUPS) spoolers. An upgrade to foomatic-rip is strongly
+adviced, especially if you are upgrading to a recent version of CUPS
+too.
+</p><p>
+Both the cupsomatic (old) and the foomatic-rip (new) methods from
+Linuxprinting.org use the traditional Ghostscript print file
+processing, doing everything in a single step. It therefore relies on
+all the other devices built-in into Ghostscript. The quality is as
+good (or bad) as Ghostscript rendering is in other spoolers. The
+advantage is that this method supports many printer models not
+supported (yet) by the more modern CUPS method.
+</p><p>
+Of course, you can use both methods side by side on one system (and
+even for one printer, if you set up different queues), and find out
+which works best for you.
+</p><p>
+cupsomatic "kidnaps" the printfile after the
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span> stage and
+deviates it through the CUPS-external, systemwide Ghostscript
+installation: Therefore the printfile bypasses the "pstoraster" filter
+(and thus also bypasses the CUPS-raster-drivers
+"rastertosomething"). After Ghostscript finished its rasterization,
+cupsomatic hands the rendered file directly to the CUPS backend. The
+flowchart above illustrates the difference between native CUPS
+rendering and the Foomatic/cupsomatic method.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2948719"></a>Examples for filtering Chains</h3></div></div><div></div></div><p>
+Here are a few examples of commonly occurring filtering chains to
+illustrate the workings of CUPS.
+</p><p>
+Assume you want to print a PDF file to a HP JetDirect-connected
+PostScript printer, but you want to print the pages 3-5, 7, 11-13
+only, and you want to print them "2-up" and "duplex":
+</p><div class="itemizedlist"><ul type="disc"><li><p>your print options (page selection as required, 2-up,
+duplex) are passed to CUPS on the commandline;</p></li><li><p>the (complete) PDF file is sent to CUPS and autotyped as
+<span class="emphasis"><em>application/pdf</em></span>;</p></li><li><p>the file therefore first must pass the
+<span class="emphasis"><em>pdftops</em></span> pre-filter, which produces PostScript
+MIME type <span class="emphasis"><em>application/postscript</em></span> (a preview here
+would still show all pages of the original PDF);</p></li><li><p>the file then passes the <span class="emphasis"><em>pstops</em></span>
+filter which applies the commandline options: it selects the pages
+2-5, 7 and 11-13, creates and imposed layout "2 pages on 1 sheet" and
+inserts the correct "duplex" command (as is defined in the printer's
+PPD) into the new PostScript file; the file now is of PostScript MIME
+type
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span>;</p></li><li><p>the file goes to the <span class="emphasis"><em>socket</em></span>
+backend, which transfers the job to the printers.</p></li></ul></div><p>
+The resulting filter chain therefore is:
+</p><pre class="screen">
+pdftops --> pstops --> socket
+</pre><p>
+Assume your want to print the same filter to an USB-connected
+Epson Stylus Photo printer, installed with the CUPS
+<tt class="filename">stphoto2.ppd</tt>. The first few filtering stages
+are nearly the same:
+</p><div class="itemizedlist"><ul type="disc"><li><p>your print options (page selection as required, 2-up,
+duplex) are passed to CUPS on the commandline;</p></li><li><p>the (complete) PDF file is sent to CUPS and autotyped as
+<span class="emphasis"><em>application/pdf</em></span>;</p></li><li><p>the file therefore first must pass the
+<span class="emphasis"><em>pdftops</em></span> pre-filter, which produces PostScript
+MIME type <span class="emphasis"><em>application/postscript</em></span> (a preview here
+would still show all pages of the original PDF);</p></li><li><p>the file then passes the "pstops" filter which applies
+the commandline options: it selects the pages 2-5, 7 and 11-13,
+creates and imposed layout "2 pages on 1 sheet" and inserts the
+correct "duplex" command... (OOoops -- this printer and his PPD
+don't support duplex printing at all -- this option will be ignored
+then) into the new PostScript file; the file now is of PostScript
+MIME type
+<span class="emphasis"><em>application/vnd.cups-postscript</em></span>;</p></li><li><p>the file then passes the
+<span class="emphasis"><em>pstoraster</em></span> stage and becomes MIME type
+<span class="emphasis"><em>application/cups-raster</em></span>;</p></li><li><p>finally, the <span class="emphasis"><em>rastertoepson</em></span> filter
+does its work (as is indicated in the printer's PPD), creating the
+printer-specific raster data and embedding any user-selected
+print-options into the print data stream;</p></li><li><p>the file goes to the <span class="emphasis"><em>usb</em></span> backend,
+which transfers the job to the printers.</p></li></ul></div><p>
+The resulting filter chain therefore is:
+</p><pre class="screen">
+pdftops --> pstops --> pstoraster --> rastertoepson --> usb
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2948948"></a>Sources of CUPS drivers / PPDs</h3></div></div><div></div></div><p>
+On the internet you can find now many thousand CUPS-PPD files
+(with their companion filters), in many national languages,
+supporting more than 1000 non-PostScript models.
+</p><div class="itemizedlist"><ul type="disc"><li><p><a href="http://wwwl.easysw.com/printpro/" target="_top">ESP
+PrintPro (http://wwwl.easysw.com/printpro/)</a> (commercial,
+non-Free) is packaged with more than 3000 PPDs, ready for
+successful use "out of the box" on Linux, Mac OS X, IBM-AIX,
+HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital Unix and some
+more commercial Unices (it is written by the CUPS developers
+themselves and its sales help finance the further development of
+CUPS, as they feed their creators).</p></li><li><p>the <a href="http://gimp-print.sourceforge.net/" target="_top">Gimp-Print-Project
+(http://gimp-print.sourceforge.net/)</a> (GPL, Free Software)
+provides around 140 PPDs (supporting nearly 400 printers, many driven
+to photo quality output), to be used alongside the Gimp-Print CUPS
+filters;</p></li><li><p><a href="http://www.turboprint.com/" target="_top">TurboPrint
+(http://www.turboprint.com/)</a> (Shareware, non-Free) supports
+roughly the same amount of printers in excellent
+quality;</p></li><li><p><a href="http://www-124.ibm.com/developerworks/oss/linux/projects/omni/" target="_top">OMNI
+(http://www-124.ibm.com/developerworks/oss/linux/projects/omni/)</a>
+(LPGL, Free) is a package made by IBM, now containing support for more
+than 400 printers, stemming from the inheritance of IBM OS/2 KnowHow
+ported over to Linux (CUPS support is in a Beta-stage at
+present);</p></li><li><p><a href="http://hpinkjet.sourceforge.net/" target="_top">HPIJS
+(http://hpinkjet.sourceforge.net/)</a> (BSD-style licenses, Free)
+supports around 150 of HP's own printers and is also providing
+excellent print quality now (currently available only via the Foomatic
+path);</p></li><li><p><a href="http://www.linuxprinting.org/" target="_top">Foomatic/cupsomatic
+(http://www.linuxprinting.org/)</a> (LPGL, Free) from
+Linuxprinting.org are providing PPDs for practically every Ghostscript
+filter known to the world (including Omni, Gimp-Print and
+HPIJS).</p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The cupsomatic/Foomatic trick from Linuxprinting.org works
+differently from the other drivers. This is explained elsewhere in this
+document.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949073"></a>Printing with Interface Scripts</h3></div></div><div></div></div><p>
+CUPS also supports the usage of "interface scripts" as known from
+System V AT&T printing systems. These are often used for PCL
+printers, from applications that generate PCL print jobs. Interface
+scripts are specific to printer models. They have a similar role as
+PPDs for PostScript printers. Interface scripts may inject the Escape
+sequences as required into the print data stream, if the user has
+chosen to select a certain paper tray, or print landscape, or use A3
+paper, etc. Interfaces scripts are practically unknown in the Linux
+realm. On HP-UX platforms they are more often used. You can use any
+working interface script on CUPS too. Just install the printer with
+the <b class="command">-i</b> option:
+</p><pre class="screen">
+
+ lpadmin -p pclprinter -v socket://11.12.13.14:9100 -i /path/to/interface-script
+
+</pre><p>
+Interface scripts might be the "unknown animal" to many. However,
+with CUPS they provide the most easy way to plug in your own
+custom-written filtering script or program into one specific print
+queue (some information about the traditional usage of interface scripts is
+to be found at <a href="http://playground.sun.com/printing/documentation/interface.html" target="_top">http://playground.sun.com/printing/documentation/interface.html</a>).
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2949135"></a>Network printing (purely Windows)</h2></div></div><div></div></div><p>
+Network printing covers a lot of ground. To understand what exactly
+goes on with Samba when it is printing on behalf of its Windows
+clients, let's first look at a "purely Windows" setup: Windows clients
+with a Windows NT print server.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949151"></a>From Windows Clients to an NT Print Server</h3></div></div><div></div></div><p>
+Windows clients printing to an NT-based print server have two
+options. They may
+</p><div class="itemizedlist"><ul type="disc"><li><p>execute the driver locally and render the GDI output
+(EMF) into the printer specific format on their own,
+or</p></li><li><p>send the GDI output (EMF) to the server, where the
+driver is executed to render the printer specific
+output.</p></li></ul></div><p>
+Both print paths are shown in the flowcharts below.
+</p></div><div xmlns:ns60="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949190"></a>Driver Execution on the Client</h3></div></div><div></div></div><p>
+In the first case the print server must spool the file as "raw",
+meaning it shouldn't touch the jobfile and try to convert it in any
+way. This is what traditional Unix-based print server can do too; and
+at a better performance and more reliably than NT print server. This
+is what most Samba administrators probably are familiar with. One
+advantage of this setup is that this "spooling-only" print server may
+be used even if no driver(s) for Unix are available it is sufficient
+to have the Windows client drivers available and installed on the
+clients.
+</p><ns60:p>
+</ns60:p><div class="figure"><a name="id2949215"></a><p class="title"><b>Figure 19.11. Print Driver execution on the Client</b></p><div class="mediaobject"><img src="projdoc/imagefiles/11small.png" alt="Print Driver execution on the Client"></div></div><ns60:p>
+</ns60:p></div><div xmlns:ns61="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949249"></a>Driver Execution on the Server</h3></div></div><div></div></div><p>
+The other path executes the printer driver on the server. The clients
+transfers print files in EMF format to the server. The server uses the
+PostScript, PCL, ESC/P or other driver to convert the EMF file into
+the printer-specific language. It is not possible for Unix to do the
+same. Currently there is no program or method to convert a Windows
+client's GDI output on a Unix server into something a printer could
+understand.
+</p><ns61:p>
+</ns61:p><div class="figure"><a name="id2949271"></a><p class="title"><b>Figure 19.12. Print Driver execution on the Server</b></p><div class="mediaobject"><img src="projdoc/imagefiles/12small.png" alt="Print Driver execution on the Server"></div></div><ns61:p>
+</ns61:p><p>
+However, there is something similar possible with CUPS. Read on...
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2949312"></a>Network Printing (Windows clients -- UNIX/Samba Print
+Servers)</h2></div></div><div></div></div><p>
+Since UNIX print servers <span class="emphasis"><em>cannot</em></span> execute the Win32
+program code on their platform, the picture is somewhat
+different. However, this doesn't limit your options all that
+much. In the contrary, you may have a way here to implement printing
+features which are not possible otherwise.
+</p><div xmlns:ns62="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949333"></a>From Windows Clients to a CUPS/Samba Print Server</h3></div></div><div></div></div><p>
+Here is a simple recipe showing how you can take advantage of CUPS
+powerful features for the benefit of your Windows network printing
+clients:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Let the Windows clients send PostScript to the CUPS
+server.</p></li><li><p>Let the CUPS server render the PostScript into device
+specific raster format.</p></li></ul></div><p>
+This requires the clients to use a PostScript driver (even if the
+printer is a non-PostScript model. It also requires that you have a
+"driver" on the CUPS server.
+</p><p>
+Firstly, to enable CUPS based printing through Samba the
+following options should be set in your <tt class="filename">smb.conf</tt> file [globals]
+section:
+</p><div class="itemizedlist"><ul type="disc"><li><p><i class="parameter"><tt>printing = CUPS</tt></i></p></li><li><p><i class="parameter"><tt>printcap = CUPS</tt></i></p></li></ul></div><p>
+When these parameters are specified, all manually set print directives
+(like <i class="parameter"><tt>print command =...</tt></i>, or <i class="parameter"><tt>lppause
+command =...</tt></i>) in <tt class="filename">smb.conf</tt> (as well as
+in samba itself) will be ignored. Instead, Samba will directly
+interface with CUPS through it's application program interface (API) -
+as long as Samba has been compiled with CUPS library (libcups)
+support. If Samba has NOT been compiled with CUPS support, and if no
+other print commands are set up, then printing will use the
+<span class="emphasis"><em>System V</em></span> AT&T command set, with the -oraw
+option automatically passing through (if you want your own defined
+print commands to work with a Samba that has CUPS support compiled in,
+simply use <i class="parameter"><tt>printing = sysv</tt></i>).
+</p><ns62:p>
+</ns62:p><div class="figure"><a name="id2949459"></a><p class="title"><b>Figure 19.13. Printing via CUPS/samba server</b></p><div class="mediaobject"><img src="projdoc/imagefiles/13small.png" alt="Printing via CUPS/samba server"></div></div><ns62:p>
+</ns62:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949493"></a>Samba receiving Jobfiles and passing them to CUPS</h3></div></div><div></div></div><p>
+Samba<span class="emphasis"><em>must</em></span> use its own spool directory (it is set
+by a line similar to <i class="parameter"><tt>path = /var/spool/samba</tt></i>,
+in the <i class="parameter"><tt>[printers]</tt></i> or
+<i class="parameter"><tt>[printername]</tt></i> section of
+<tt class="filename">smb.conf</tt>). Samba receives the job in its own
+spool space and passes it into the spool directory of CUPS (the CUPS
+spooling directory is set by the <i class="parameter"><tt>RequestRoot</tt></i>
+directive, in a line that defaults to <i class="parameter"><tt>RequestRoot
+/var/spool/cups</tt></i>). CUPS checks the access rights of its
+spool dir and resets it to healthy values with every re-start. We have
+seen quite some people who had used a common spooling space for Samba
+and CUPS, and were struggling for weeks with this "problem".
+</p><p>
+A Windows user authenticates only to Samba (by whatever means is
+configured). If Samba runs on the same host as CUPS, you only need to
+allow "localhost" to print. If they run on different machines, you
+need to make sure the Samba host gets access to printing on CUPS.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2949571"></a>Network PostScript RIP: CUPS Filters on Server -- clients use
+PostScript Driver with CUPS-PPDs</h2></div></div><div></div></div><p>
+PPDs can control all print device options. They are usually provided
+by the manufacturer; if you own a PostScript printer, that is. PPD
+files (PostScript Printer Descriptions) are always a component of
+PostScript printer drivers on MS Windows or Apple Mac OS systems. They
+are ASCII files containing user-selectable print options, mapped to
+appropriate PostScript, PCL or PJL commands for the target
+printer. Printer driver GUI dialogs translate these options
+"on-the-fly" into buttons and drop-down lists for the user to select.
+</p><p>
+CUPS can load, without any conversions, the PPD file from any Windows
+(NT is recommended) PostScript driver and handle the options. There is
+a web browser interface to the print options (select <a href="http://localhost:631/printers/" target="_top">http://localhost:631/printers/</a>
+and click on one <span class="emphasis"><em>Configure Printer</em></span> button to see
+it), or a commandline interface (see <b class="command">man lpoptions</b>
+or see if you have lphelp on your system). There are also some
+different GUI frontends on Linux/UNIX, which can present PPD options
+to users. PPD options are normally meant to be evaluated by the
+PostScript RIP on the real PostScript printer.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949626"></a>PPDs for non-PS Printers on UNIX</h3></div></div><div></div></div><p>
+CUPS doesn't limit itself to "real" PostScript printers in its usage
+of PPDs. The CUPS developers have extended the scope of the PPD
+concept, to also describe available device and driver options for
+non-PostScript printers through CUPS-PPDs.
+</p><p>
+This is logical, as CUPS includes a fully featured PostScript
+interpreter (RIP). This RIP is based on Ghostscript. It can process
+all received PostScript (and additionally many other file formats)
+from clients. All CUPS-PPDs geared to non-PostScript printers contain
+an additional line, starting with the keyword
+<i class="parameter"><tt>*cupsFilter</tt></i> . This line tells the CUPS print
+system which printer-specific filter to use for the interpretation of
+the supplied PostScript. Thus CUPS lets all its printers appear as
+PostScript devices to its clients, because it can act as a PostScript
+RIP for those printers, processing the received PostScript code into a
+proper raster print format.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949667"></a>PPDs for non-PS Printers on Windows</h3></div></div><div></div></div><p>
+CUPS-PPDs can also be used on Windows-Clients, on top of a
+"core" PostScript driver (now recommended is the "CUPS PostScript
+Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with
+limitations). This feature enables CUPS to do a few tricks no other
+spooler can do:
+</p><div class="itemizedlist"><ul type="disc"><li><p>act as a networked PostScript RIP (Raster Image
+Processor), handling printfiles from all client platforms in a uniform
+way;</p></li><li><p>act as a central accounting and billing server, since
+all files are passed through the pstops filter and are therefore
+logged in the CUPS <tt class="filename">page_log</tt> file.
+<span class="emphasis"><em>NOTE:</em></span> this can not happen with "raw" print jobs,
+which always remain unfiltered per definition;</p></li><li><p>enable clients to consolidate on a single PostScript
+driver, even for many different target printers.</p></li></ul></div><p>
+Using CUPS PPDs on Windows clients enables these to control
+all print job settings just as a UNIX client can do too.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2949732"></a>Windows Terminal Servers (WTS) as CUPS Clients</h2></div></div><div></div></div><p>
+This setup may be of special interest to people experiencing major
+problems in WTS environments. WTS need often a multitude of
+non-PostScript drivers installed to run their clients' variety of
+different printer models. This often imposes the price of much
+increased instability.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949750"></a>Printer Drivers running in "Kernel Mode" cause many
+Problems</h3></div></div><div></div></div><p>
+The reason is that in Win NT printer drivers run in "Kernel
+Mode", this introduces a high risk for the stability of the system
+if the driver is not really stable and well-tested. And there are a
+lot of bad drivers out there! Especially notorious is the example
+of the PCL printer driver that had an additional sound module
+running, to notify users via soundcard of their finished jobs. Do I
+need to say that this one was also reliably causing "Blue Screens
+of Death" on a regular basis?
+</p><p>
+PostScript drivers generally are very well tested. They are not known
+to cause any problems, even though they run in Kernel Mode too. This
+might be because there have so far only been 2 different PostScript
+drivers the ones from Adobe and the one from Microsoft. Both are
+very well tested and are as stable as you ever can imagine on
+Windows. The CUPS driver is derived from the Microsoft one.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949784"></a>Workarounds impose Heavy Limitations</h3></div></div><div></div></div><p>
+In many cases, in an attempt to work around this problem, site
+administrators have resorted to restrict the allowed drivers installed
+on their WTS to one generic PCL- and one PostScript driver. This
+however restricts the clients in the amount of printer options
+available for them; often they can't get out more than simplex
+prints from one standard paper tray, while their devices could do much
+better, if driven by a different driver! )
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949805"></a>CUPS: a "Magical Stone"?</h3></div></div><div></div></div><p>
+Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very
+elegant way to overcome all these shortcomings. There are, depending
+on the version of Windows OS you use, up to 3 different PostScript
+drivers available: Adobe, Microsoft and CUPS PostScript drivers. None
+of them is known to cause major stability problems on WTS (even if
+used with many different PPDs). The clients will be able to (again)
+chose paper trays, duplex printing and other settings. However, there
+is a certain price for this too: a CUPS server acting as a PostScript
+RIP for its clients requires more CPU and RAM than when just acting as
+a "raw spooling" device. Plus, this setup is not yet widely tested,
+although the first feedbacks look very promising.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949832"></a>PostScript Drivers with no major problems -- even in Kernel
+Mode</h3></div></div><div></div></div><p>
+More recent printer drivers on W2K and XP don't run in Kernel mode
+(unlike Win NT) any more. However, both operating systems can still
+use the NT drivers, running in Kernel mode (you can roughly tell which
+is which as the drivers in subdirectory "2" of "W32X86" are "old"
+ones). As was said before, the Adobe as well as the Microsoft
+PostScript drivers are not known to cause any stability problems. The
+CUPS driver is derived from the Microsoft one. There is a simple
+reason for this: The MS DDK (Device Development Kit) for Win NT (which
+used to be available at no cost to licensees of Visual Studio)
+includes the source code of the Microsoft driver, and licensees of
+Visual Studio are allowed to use and modify it for their own driver
+development efforts. This is what the CUPS people have done. The
+license doesn't allow them to publish the whole of the source code.
+However, they have released the "diff" under the GPL, and if you are
+owner of an "MS DDK for Win NT", you can check the driver yourself.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2949866"></a> Setting up CUPS for driver Download</h2></div></div><div></div></div><p>
+As we have said before: all previously known methods to prepare client
+printer drivers on the Samba server for download and "Point'n'Print"
+convenience of Windows workstations are working with CUPS too. These
+methods were described in the previous chapter. In reality, this is a
+pure Samba business, and only relates to the Samba/Win client
+relationship.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949885"></a><span class="emphasis"><em>cupsaddsmb</em></span>: the unknown Utility</h3></div></div><div></div></div><p>
+The cupsaddsmb utility (shipped with all current CUPS versions) is an
+alternative method to transfer printer drivers into the Samba
+<i class="parameter"><tt>[print$]</tt></i> share. Remember, this share is where
+clients expect drivers deposited and setup for download and
+installation. It makes the sharing of any (or all) installed CUPS
+printers very easy. cupsaddsmb can use the Adobe PostScript driver as
+well as the newly developed <span class="emphasis"><em>CUPS PostScript Driver for
+WinNT/2K/XP</em></span>. Note, that cupsaddsmb does
+<span class="emphasis"><em>not</em></span> work with arbitrary vendor printer drivers,
+but only with the <span class="emphasis"><em>exact</em></span> driver files that are
+named in its man page.
+</p><p>
+The CUPS printer driver is available from the CUPS download site. Its
+package name is <tt class="filename">cups-samba-[version].tar.gz</tt> . It
+is prefered over the Adobe drivers since it has a number of
+advantages:
+</p><div class="itemizedlist"><ul type="disc"><li><p>it supports a much more accurate page
+accounting;</p></li><li><p>it supports banner pages, and page labels on all
+printers;</p></li><li><p>it supports the setting of a number of job IPP
+attributes (such as job-priority, page-label and
+job-billing)</p></li></ul></div><p>
+However, currently only Windows NT, 2000, and XP are supported by the
+CUPS drivers. You will need to get the respective part of Adobe driver
+too if you need to support Windows 95, 98, and ME clients.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2949976"></a>Prepare your <tt class="filename">smb.conf</tt> for
+cupsaddsmb</h3></div></div><div></div></div><p>
+Prior to running cupsaddsmb, you need the following settings in
+<tt class="filename">smb.conf</tt>:
+</p><pre class="screen">
+
+ [global]
+ load printers = yes
+ printing = cups
+ printcap name = cups
+
+ [printers]
+ comment = All Printers
+ path = /var/spool/samba
+ browseable = no
+ public = yes
+ guest ok = yes # setting depends on your requirements
+ writable = no
+ printable = yes
+ printer admin = root
+
+ [print$]
+ comment = Printer Drivers
+ path = /etc/samba/drivers
+ browseable = yes
+ guest ok = no
+ read only = yes
+ write list = root
+
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950023"></a>CUPS Package of "PostScript Driver for WinNT/2k/XP"</h3></div></div><div></div></div><p>
+CUPS users may get the exactly same packages from<a href="http://www.cups.org/software.html" target="_top"><span class="emphasis"><em>http://www.cups.org/software.html</em></span></a>.
+It is a separate package from the CUPS base software files, tagged as
+<span class="emphasis"><em>CUPS 1.1.x Windows NT/2k/XP Printer Driver for SAMBA
+(tar.gz, 192k)</em></span>. The filename to download is
+<tt class="filename">cups-samba-1.1.x.tar.gz</tt>. Upon untar-/unzip-ing,
+it will reveal these files:
+</p><pre class="screen">
+
+# tar xvzf cups-samba-1.1.19.tar.gz
+
+ cups-samba.install
+ cups-samba.license
+ cups-samba.readme
+ cups-samba.remove
+ cups-samba.ss
+
+</pre><p>
+These have been packaged with the ESP meta packager software
+"EPM". The <tt class="filename">*.install</tt> and
+<tt class="filename">*.remove</tt> files are simple shell scripts, which
+untars the <tt class="filename">*.ss</tt> (the <tt class="filename">*.ss</tt> is
+nothing else but a tar-archive, which can be untar-ed by "tar"
+too). Then it puts the content into
+<tt class="filename">/usr/share/cups/drivers/</tt>. This content includes 3
+files:
+</p><pre class="screen">
+
+# tar tv cups-samba.ss
+
+ cupsdrvr.dll
+ cupsui.dll
+ cups.hlp
+
+</pre><p>
+The <span class="emphasis"><em>cups-samba.install</em></span> shell scripts is easy to
+handle:
+</p><pre class="screen">
+
+# ./cups-samba.install
+
+ [....]
+ Installing software...
+ Updating file permissions...
+ Running post-install commands...
+ Installation is complete.
+
+</pre><p>
+The script should automatically put the driver files into the
+<tt class="filename">/usr/share/cups/drivers/</tt> directory.
+</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+Due to a bug, one recent CUPS release puts the
+<tt class="filename">cups.hlp</tt> driver file
+into<tt class="filename">/usr/share/drivers/</tt> instead of
+<tt class="filename">/usr/share/cups/drivers/</tt>. To work around this,
+copy/move the file (after running the
+<b class="command">./cups-samba.install</b> script) manually to the
+right place.
+</p></div><pre class="screen">
+
+ cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
+
+</pre><p>
+This new CUPS PostScript driver is currently binary-only, but free of
+charge. No complete source code is provided (yet). The reason is this:
+it has been developed with the help of the <span class="emphasis"><em>Microsoft Driver
+Developer Kit</em></span> (DDK) and compiled with Microsoft Visual
+Studio 6. Driver developers are not allowed to distribute the whole of
+the source code as Free Software. However, CUPS developers released
+the "diff" in source code under the GPL, so anybody with a license of
+Visual Studio and a DDK will be able to compile for him/herself.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950220"></a>Recognize the different Driver Files</h3></div></div><div></div></div><p>
+The CUPS drivers don't support the "older" Windows 95/98/ME, but only
+the Windows NT/2000/XP client:
+</p><pre class="screen">
+
+ [Windows NT, 2000, and XP are supported by:]
+ cups.hlp
+ cupsdrvr.dll
+ cupsui.dll
+
+</pre><p>
+Adobe drivers are available for the older Windows 95/98/ME as well as
+the Windows NT/2000/XP clients. The set of files is different for the
+different platforms.
+</p><pre class="screen">
+
+ [Windows 95, 98, and Me are supported by:]
+ ADFONTS.MFM
+ ADOBEPS4.DRV
+ ADOBEPS4.HLP
+ DEFPRTR2.PPD
+ ICONLIB.DLL
+ PSMON.DLL
+
+ [Windows NT, 2000, and XP are supported by:]
+ ADOBEPS5.DLL
+ ADOBEPSU.DLL
+ ADOBEPSU.HLP
+
+</pre><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+If both, the Adobe driver files and the CUPS driver files for the
+support of WinNT/2k/XP are present in , the Adobe ones will be ignored
+and the CUPS ones will be used. If you prefer -- for whatever reason
+-- to use Adobe-only drivers, move away the 3 CUPS driver files. The
+Win95/98/ME clients use the Adobe drivers in any case.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950278"></a>Acquiring the Adobe Driver Files</h3></div></div><div></div></div><p>
+Acquiring the Adobe driver files seems to be unexpectedly difficult
+for many users. They are not available on the Adobe website as single
+files and the self-extracting and/or self-installing Windows-exe is
+not easy to locate either. Probably you need to use the included
+native installer and run the installation process on one client
+once. This will install the drivers (and one Generic PostScript
+printer) locally on the client. When they are installed, share the
+Generic PostScript printer. After this, the client's
+<i class="parameter"><tt>[print$]</tt></i> share holds the Adobe files, from
+where you can get them with smbclient from the CUPS host. A more
+detailed description about this is in the next (the CUPS printing)
+chapter.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950311"></a>ESP Print Pro Package of "PostScript Driver for
+WinNT/2k/XP"</h3></div></div><div></div></div><p>
+Users of the ESP Print Pro software are able to install their "Samba
+Drivers" package for this purpose with no problem. Retrieve the driver
+files from the normal download area of the ESP Print Pro software
+at<a href="http://www.easysw.com/software.html" target="_top">http://www.easysw.com/software.html</a>.
+You need to locate the link labelled "SAMBA" amongst the
+<span class="emphasis"><em>Download Printer Drivers for ESP Print Pro 4.x</em></span>
+area and download the package. Once installed, you can prepare any
+driver by simply highlighting the printer in the Printer Manager GUI
+and select <span class="emphasis"><em>Export Driver...</em></span> from the menu. Of
+course you need to have prepared Samba beforehand too to handle the
+driver files; i.e. mainly setup the <i class="parameter"><tt>[print$]</tt></i>
+share, etc. The ESP Print Pro package includes the CUPS driver files
+as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME
+client family.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950361"></a>Caveats to be considered</h3></div></div><div></div></div><p>
+Once you have run the install script (and possibly manually
+moved the <tt class="filename">cups.hlp</tt> file to
+<tt class="filename">/usr/share/cups/drivers/</tt>), the driver is
+ready to be put into Samba's <i class="parameter"><tt>[print$]</tt></i> share (which often maps to
+<tt class="filename">/etc/samba/drivers/</tt> and contains a subdir
+tree with <span class="emphasis"><em>WIN40</em></span> and
+<span class="emphasis"><em>W32X86</em></span> branches): You do this by running
+"cupsaddsmb" (see also <b class="command">man cupsaddsmb</b> for
+CUPS since release 1.1.16).
+</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Tip</h3><p>
+You may need to put root into the smbpasswd file by running
+<b class="command">smbpasswd</b>; this is especially important if you
+should run this whole procedure for the first time, and are not
+working in an environment where everything is configured for
+<span class="emphasis"><em>Single Sign On</em></span> to a Windows Domain Controller.
+</p></div><p>
+Once the driver files are in the <i class="parameter"><tt>[print$]</tt></i> share
+and are initialized, they are ready to be downloaded and installed by
+the Win NT/2k/XP clients.
+</p><div xmlns:ns63="" class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><ns63:p>
+</ns63:p><div class="orderedlist"><ol type="1"><li><p>
+Win 9x/ME clients won't work with the CUPS PostScript driver. For
+these you'd still need to use the <tt class="filename">ADOBE*.*</tt>
+drivers as previously.
+</p></li><li><p>
+It is not harmful if you still have the
+<tt class="filename">ADOBE*.*</tt> driver files from previous
+installations in the <tt class="filename">/usr/share/cups/drivers/</tt>
+directory. The new <span class="emphasis"><em>cupsaddsmb</em></span> (from 1.1.16) will
+automatically prefer "its own" drivers if it finds both.
+</p></li><li><p>
+Should your Win clients have had the old <tt class="filename">ADOBE*.*</tt>
+files for the Adobe PostScript driver installed, the download and
+installation of the new CUPS PostScript driver for Windows NT/2k/XP
+will fail at first. You need to wipe the old driver from the clients
+first. It is not enough to "delete" the printer, as the driver files
+will still be kept by the clients and re-used if you try to re-install
+the printer. To really get rid of the Adobe driver files on the
+clients, open the "Printers" folder (possibly via <span class="emphasis"><em>Start
+--> Settings --> Control Panel --> Printers</em></span>),
+right-click onto the folder background and select <span class="emphasis"><em>Server
+Properties</em></span>. When the new dialog opens, select the
+<span class="emphasis"><em>Drivers</em></span> tab. On the list select the driver you
+want to delete and click on the <span class="emphasis"><em>Delete</em></span>
+button. This will only work if there is not one single printer left
+which uses that particular driver. You need to "delete" all printers
+using this driver in the "Printers" folder first. You will need
+Administrator privileges to do this.
+</p></li><li><p>
+Once you have successfully downloaded the CUPS PostScript driver to a
+client, you can easily switch all printers to this one by proceeding
+as described elsewhere in the "Samba HOWTO Collection": either change
+a driver for an existing printer by running the "Printer Properties"
+dialog, or use <b class="command">rpcclient</b> with the
+<b class="command">setdriver</b> sub-command.
+</p></li></ol></div><ns63:p>
+</ns63:p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950582"></a>What are the Benefits of using the "CUPS PostScript Driver for
+Windows NT/2k/XP" as compared to the Adobe Driver?</h3></div></div><div></div></div><p>
+You are interested in a comparison between the CUPS and the Adobe
+PostScript drivers? For our purposes these are the most important
+items which weigh in favor of the CUPS ones:
+</p><div class="itemizedlist"><ul type="disc"><li><p>no hassle with the Adobe EULA</p></li><li><p>no hassle with the question “<span class="quote">Where do I
+get the ADOBE*.* driver files from?</span>”</p></li><li><p>the Adobe drivers (on request of the printer PPD
+associated with them) often put a PJL header in front of the main
+PostScript part of the print file. Thus the printfile starts with
+<i class="parameter"><tt><1B >%-12345X</tt></i> or
+<i class="parameter"><tt><escape>%-12345X</tt></i> instead
+of <i class="parameter"><tt>%!PS</tt></i>). This leads to the
+CUPS daemon auto-typing the incoming file as a print-ready file,
+not initiating a pass through the "pstops" filter (to speak more
+technically, it is not regarded as the generic MIME type
+<span class="emphasis"><em>application/postscript</em></span>, but as
+the more special MIME type
+<span class="emphasis"><em>application/cups.vnd-postscript</em></span>),
+which therefore also leads to the page accounting in
+<span class="emphasis"><em>/var/log/cups/page_log</em></span> not
+receiving the exact mumber of pages; instead the dummy page number
+of "1" is logged in a standard setup)</p></li><li><p>the Adobe driver has more options to "mis-configure" the
+PostScript generated by it (like setting it inadvertedly to
+<span class="emphasis"><em>Optimize for Speed</em></span>, instead of
+<span class="emphasis"><em>Optimize for Portability</em></span>, which
+could lead to CUPS being unable to process it)</p></li><li><p>the CUPS PostScript driver output sent by Windows
+clients to the CUPS server will be guaranteed to be auto-typed always
+as generic MIME type <span class="emphasis"><em>application/postscript</em></span>,
+thusly passing through the CUPS "pstops" filter and logging the
+correct number of pages in the <tt class="filename">page_log</tt> for
+accounting and quota purposes</p></li><li><p>the CUPS PostScript driver supports the sending of
+additional standard (IPP) print options by Win NT/2k/XP clients. Such
+additional print options are: naming the CUPS standard
+<span class="emphasis"><em>banner pages</em></span> (or the custom ones, should they be
+installed at the time of driver download), using the CUPS
+<span class="emphasis"><em>page-label</em></span> option, setting a
+<span class="emphasis"><em>job-priority</em></span> and setting the <span class="emphasis"><em>scheduled
+time of printing</em></span> (with the option to support additional
+useful IPP job attributes in the future).</p></li><li><p>the CUPS PostScript driver supports the inclusion of
+the new <span class="emphasis"><em>*cupsJobTicket</em></span> comments at the
+beginning of the PostScript file (which could be used in the future
+for all sort of beneficial extensions on the CUPS side, but which will
+not disturb any other applications as they will regard it as a comment
+and simply ignore it).</p></li><li><p>the CUPS PostScript driver will be the heart of the
+fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon
+(probably alongside the first Beta release for CUPS
+1.2).</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950763"></a>Run "cupsaddsmb" (quiet Mode)</h3></div></div><div></div></div><p>
+The cupsaddsmb command copies the needed files into your
+<i class="parameter"><tt>[print$]</tt></i> share. Additionally, the PPD
+associated with this printer is copied from
+<tt class="filename">/etc/cups/ppd/</tt> to
+<i class="parameter"><tt>[print$]</tt></i>. There the files wait for convenient
+Windows client installations via Point'n'Print. Before we can run the
+command successfully, we need to be sure that we can authenticate
+towards Samba. If you have a small network you are probably using user
+level security (<i class="parameter"><tt>security = user</tt></i>). Probably your
+root has already a Samba account. Otherwise, create it now, using
+<b class="command">smbpasswd</b>:
+</p><pre class="screen">
+
+ # smbpasswd -a root
+ New SMB password: [type in password 'secret']
+ Retype new SMB password: [type in password 'secret']
+
+</pre><p>
+Here is an example of a successfully run cupsaddsmb command.
+</p><pre class="screen">
+
+ # cupsaddsmb -U root infotec_IS2027
+ Password for root required to access localhost via SAMBA: [type in password 'secret']
+
+</pre><p>
+To share<span class="emphasis"><em>all</em></span> printers and drivers, use the
+<i class="parameter"><tt>-a</tt></i> parameter instead of a printer name. Since
+cupsaddsmb "exports" the printer drivers to Samba, it should be
+obvious that it only works for queues with a CUPS driver associated.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2950864"></a>Run "cupsaddsmb" with verbose Output</h3></div></div><div></div></div><p>
+Probably you want to see what's going on. Use the
+<i class="parameter"><tt>-v</tt></i> parameter to get a more verbose output. The
+output below was edited for better readability: all "\" at the end of
+a line indicate that I inserted an artificial line break plus some
+indentation here:
+</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+You will see the root password for the Samba account printed on
+screen. If you use remote access, the password will go over the wire
+unencrypted!
+</p></div><pre class="screen">
+
+ # cupsaddsmb -U root -v infotec_2105
+ Password for root required to access localhost via SAMBA:
+ Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put \
+ /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd;put \
+ /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll;put \
+ /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll;put \
+ /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp'
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+ NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
+ putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd (2328.8 kb/s) \
+ (average 2328.8 kb/s)
+ putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll (9374.3 kb/s) \
+ (average 5206.6 kb/s)
+ putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll (8107.2 kb/s) \
+ (average 5984.1 kb/s)
+ putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp (3475.0 kb/s) \
+ (average 5884.7 kb/s)
+
+ Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86" \
+ "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \
+ RAW:NULL"'
+ cmd = adddriver "Windows NT x86" "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll: \
+ cups.hlp:NULL:RAW:NULL"
+ Printer Driver infotec_2105 successfully installed.
+
+ Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put \
+ /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; put \
+ /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put \
+ /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put \
+ /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put \
+ /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put \
+ /usr/share/cups/drivers/ICONLIB.DLL
+ WIN40/ICONLIB.DLL;put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+ NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40
+ putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD (2328.8 kb/s) \
+ (average 2328.8 kb/s)
+ putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (9368.0 kb/s) \
+ (average 6469.6 kb/s)
+ putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (9958.2 kb/s) \
+ (average 8404.3 kb/s)
+ putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (8341.5 kb/s) \
+ (average 8398.6 kb/s)
+ putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (2195.9 kb/s) \
+ (average 8254.3 kb/s)
+ putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (8239.9 kb/s) \
+ (average 8253.6 kb/s)
+ putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (6222.2 kb/s) \
+ (average 8188.5 kb/s)
+
+ Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0" \
+ "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \
+ PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \
+ ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
+ cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL: \
+ ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP, \
+ PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
+ Printer Driver infotec_2105 successfully installed.
+
+ Running command: rpcclient localhost -N -U'root%secret' \
+ -c 'setdriver infotec_2105 infotec_2105'
+ cmd = setdriver infotec_2105 infotec_2105
+ Succesfully set infotec_2105 to driver infotec_2105.
+
+</pre><p>
+If you look closely, you'll discover your root password was transfered
+unencrypted over the wire, so beware! Also, if you look further her,
+you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in
+between. They occur, because the directories WIN40 and W32X86 already
+existed in the <i class="parameter"><tt>[print$]</tt></i> driver download share
+(from a previous driver installation). They are harmless here.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951007"></a>Understanding cupsaddsmb</h3></div></div><div></div></div><p>
+What has happened? What did cupsaddsmb do? There are five stages of
+the procedure
+</p><div class="orderedlist"><ol type="1"><li><p>call the CUPS server via IPP and request the
+driver files and the PPD file for the named printer;</p></li><li><p>store the files temporarily in the local
+TEMPDIR (as defined in
+<tt class="filename">cupsd.conf</tt>);</p></li><li><p>connect via smbclient to the Samba server's
+ <i class="parameter"><tt>[print$]</tt></i> share and put the files into the
+ share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub
+ directories;</p></li><li><p>connect via rpcclient to the Samba server and
+execute the "adddriver" command with the correct
+parameters;</p></li><li><p>connect via rpcclient to the Samba server a second
+time and execute the "setdriver" command.</p></li></ol></div><p>
+Note, that you can run the cupsaddsmb utility with parameters to
+specify one remote host as Samba host and a second remote host as CUPS
+host. Especially if you want to get a deeper understanding, it is a
+good idea try it and see more clearly what is going on (though in real
+life most people will have their CUPS and Samba servers run on the
+same host):
+</p><pre class="screen">
+
+ # cupsaddsmb -H sambaserver -h cupsserver -v printername
+
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951101"></a>How to recognize if cupsaddsm completed successfully</h3></div></div><div></div></div><p>
+You <span class="emphasis"><em>must</em></span> always check if the utility completed
+successfully in all fields. You need as a minimum these 3 messages
+amongst the output:
+</p><div class="orderedlist"><ol type="1"><li><p><span class="emphasis"><em>Printer Driver infotec_2105 successfully
+installed.</em></span> # (for the W32X86 == WinNT/2K/XP
+architecture...)</p></li><li><p><span class="emphasis"><em>Printer Driver infotec_2105 successfully
+installed.</em></span> # (for the WIN40 == Win9x/ME
+architecture...)</p></li><li><p><span class="emphasis"><em>Succesfully set [printerXPZ] to driver
+[printerXYZ].</em></span></p></li></ol></div><p>
+These messages probably not easily recognized in the general
+output. If you run cupsaddsmb with the <i class="parameter"><tt>-a</tt></i>
+parameter (which tries to prepare <span class="emphasis"><em>all</em></span> active CUPS
+printer drivers for download), you might miss if individual printers
+drivers had problems to install properly. Here a redirection of the
+output will help you analyze the results in retrospective.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+It is impossible to see any diagnostic output if you don't run
+cupsaddsmb in verbose mode. Therefore we strongly recommend to not
+use the default quiet mode. It will hide any problems from you which
+might occur.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951188"></a>cupsaddsmb with a Samba PDC</h3></div></div><div></div></div><p>
+You can't get the standard cupsaddsmb command to run on a Samba PDC?
+You are asked for the password credential all over again and again and
+the command just will not take off at all? Try one of these
+variations:
+</p><pre class="screen">
+
+ # cupsaddsmb -U DOMAINNAME\\root -v printername
+ # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -v printername
+ # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -h cups-server -v printername
+
+</pre><p>
+(Note the two backslashes: the first one is required to
+"escape" the second one).
+</p></div><div xmlns:ns64="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951223"></a>cupsaddsmb Flowchart</h3></div></div><div></div></div><p>
+Here is a chart about the procedures, commandflows and
+dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is
+not intended to, and does not work with, "raw" queues!
+</p><ns64:p>
+</ns64:p><div class="figure"><a name="id2951240"></a><p class="title"><b>Figure 19.14. cupsaddsmb flowchart</b></p><div class="mediaobject"><img src="projdoc/imagefiles/1small.png" alt="cupsaddsmb flowchart"></div></div><ns64:p>
+</ns64:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951274"></a>Installing the PostScript Driver on a Client</h3></div></div><div></div></div><p>
+After cupsaddsmb completed, your driver is prepared for the clients to
+use. Here are the steps you must perform to download and install it
+via "Point'n'Print". From a Windows client, browse to the CUPS/Samba
+server;
+</p><div class="itemizedlist"><ul type="disc"><li><p>open the <span class="emphasis"><em>Printers</em></span>
+share of Samba in Network Neighbourhood;</p></li><li><p>right-click on the printer in
+question;</p></li><li><p>from the opening context-menu select
+<span class="emphasis"><em>Install...</em></span> or
+<span class="emphasis"><em>Connect...</em></span> (depending on the Windows version you
+use).</p></li></ul></div><p>
+After a few seconds, there should be a new printer in your
+client's <span class="emphasis"><em>local</em></span> "Printers" folder: On Windows
+XP it will follow a naming convention of <span class="emphasis"><em>PrinterName on
+SambaServer</em></span>. (In my current case it is "infotec_2105 on
+kde-bitshop"). If you want to test it and send your first job from
+an application like Winword, the new printer will appears in a
+<tt class="filename">\\SambaServer\PrinterName</tt> entry in the
+dropdown list of available printers.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher
+and Samba from 2.2.4. If it doesn't work, or if the automatic printer
+driver download to the clients doesn't succeed, you can still manually
+install the CUPS printer PPD on top of the Adobe PostScript driver on
+clients. Then point the client's printer queue to the Samba printer
+share for a UNC type of connection:
+</p></div><pre class="screen">
+
+ net use lpt1: \\sambaserver\printershare /user:ntadmin
+
+</pre><p>
+should you desire to use the CUPS networked PostScript RIP
+functions. (Note that user "ntadmin" needs to be a valid Samba user
+with the required privileges to access the printershare) This would
+set up the printer connection in the traditional
+<span class="emphasis"><em>LanMan</em></span> way (not using MS-RPC).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951389"></a>Avoiding critical PostScript Driver Settings on the
+Client</h3></div></div><div></div></div><p>
+Soooo: printing works, but there are still problems. Most jobs print
+well, some don't print at all. Some jobs have problems with fonts,
+which don't look very good. Some jobs print fast, and some are
+dead-slow. Many of these problems can be greatly reduced or even
+completely eliminated if you follow a few guidelines. Remember, if
+your print device is not PostScript-enabled, you are treating your
+Ghostscript installation on your CUPS host with the output your client
+driver settings produce. Treat it well:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Avoid the <span class="emphasis"><em>PostScript Output Option: Optimize
+for Speed</em></span> settting. Rather use the <span class="emphasis"><em>Optimize for
+Portability</em></span> instead (Adobe PostScript
+driver).</p></li><li><p>Don't use the <span class="emphasis"><em>Page Independence:
+NO</em></span> setting. Instead use <span class="emphasis"><em>Page Independence
+YES</em></span> (CUPS PostScript Driver)</p></li><li><p>Recommended is the <span class="emphasis"><em>True Type Font
+Downloading Option: Native True Type</em></span> over
+<span class="emphasis"><em>Automatic</em></span> and <span class="emphasis"><em>Outline</em></span>; you
+should by all means avoid <span class="emphasis"><em>Bitmap</em></span> (Adobe
+PostScript Driver)</p></li><li><p>Choose <span class="emphasis"><em>True Type Font: Download as Softfont
+into Printer</em></span> over the default <span class="emphasis"><em>Replace by Device
+Font</em></span> (for exotic fonts you may need to change it back to
+get a printout at all) (Adobe)</p></li><li><p>Sometimes you can choose <span class="emphasis"><em>PostScript Language
+Level</em></span>: in case of problems try <span class="emphasis"><em>2</em></span>
+instead of <span class="emphasis"><em>3</em></span> (the latest ESP Ghostscript package
+handels Level 3 PostScript very well) (Adobe).</p></li><li><p>Say <span class="emphasis"><em>Yes</em></span> to <span class="emphasis"><em>PostScript
+Error Handler</em></span> (Adobe)</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2951523"></a>Installing PostScript Driver Files manually (using
+rpcclient)</h2></div></div><div></div></div><p>
+Of course you can run all the commands which are embedded into the
+cupsaddsmb convenience utility yourself, one by one, and hereby upload
+and prepare the driver files for future client downloads.
+</p><div class="orderedlist"><ol type="1"><li><p>prepare Samba (a CUPS printqueue with the name of the
+printer should be there. We are providing the driver
+now);</p></li><li><p>copy all files to
+<i class="parameter"><tt>[print$]:</tt></i></p></li><li><p>run <b class="command">rpcclient adddriver</b>
+(for each client architecture you want to support):</p></li><li><p>run <b class="command">rpcclient
+setdriver.</b></p></li></ol></div><p>
+We are going to do this now. First, read the man page on "rpcclient"
+to get a first idea. Look at all the printing related
+sub-commands. <b class="command">enumprinters</b>,
+<b class="command">enumdrivers</b>, <b class="command">enumports</b>,
+<b class="command">adddriver</b>, <b class="command">setdriver</b> are amongst
+the most interesting ones. rpcclient implements an important part of
+the MS-RPC protocol. You can use it to query (and command) a Win NT
+(or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other
+things, to benefit from the "Point'n' Print" features. Samba can now
+mimic this too.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951638"></a>A Check of the rpcclient man Page</h3></div></div><div></div></div><p>
+First let's have a little check of the rpcclient man page. Here are
+two relevant passages:
+</p><p>
+<b class="command">adddriver <arch> <config></b> Execute an
+AddPrinterDriver() RPC to install the printer driver information on
+the server. Note that the driver files should already exist in the
+directory returned by <b class="command">getdriverdir</b>. Possible
+values for <i class="parameter"><tt>arch</tt></i> are the same as those for the
+<b class="command">getdriverdir</b> command. The
+<i class="parameter"><tt>config</tt></i> parameter is defined as follows:
+</p><pre class="screen">
+Long Printer Name:\
+Driver File Name:\
+Data File Name:\
+Config File Name:\
+Help File Name:\
+Language Monitor Name:\
+Default Data Type:\
+Comma Separated list of Files
+</pre><p>Any empty fields should be enter as the string "NULL". </p><p>Samba does not need to support the concept of Print Monitors
+since these only apply to local printers whose driver can make use of
+a bi-directional link for communication. This field should be "NULL".
+On a remote NT print server, the Print Monitor for a driver must
+already be installed prior to adding the driver or else the RPC will
+fail
+</p><p>
+<b class="command">setdriver <printername> <drivername></b>
+Execute a <b class="command">SetPrinter()</b> command to update the
+printer driver associated with an installed printer. The printer
+driver must already be correctly installed on the print server.
+</p><p> See also the enumprinters and enumdrivers commands for
+obtaining a list of installed printers and drivers.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951750"></a>Understanding the rpcclient man Page</h3></div></div><div></div></div><p>
+The <span class="emphasis"><em>exact</em></span> format isn't made too clear by the man
+page, since you have to deal with some parameters containing
+spaces. Here is a better description for it. We have line-broken the
+command and indicated the breaks with "\". Usually you would type the
+command in one line without the linebreaks:
+</p><pre class="screen">
+
+ adddriver "Architecture" \
+ "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
+ LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
+
+</pre><p>
+What the man pages denotes as a simple <config>
+keyword, does in reality consist of 8 colon-separated fields. The
+last field may take multiple (in some, very insane, cases, even
+20 different additional files. This might sound confusing at first.
+Note, that what the man pages names the "LongPrinterName" in
+reality should rather be called the "Driver Name". You can name it
+anything you want, as long as you use this name later in the
+<span class="emphasis"><em>rpcclient ... setdriver</em></span> command. For
+practical reasons, many name the driver the same as the
+printer.
+</p><p>
+True: it isn't simple at all. I hear you asking:
+<span class="emphasis"><em>How do I know which files are "Driver
+File", "Data File", "Config File", "Help File" and "Language
+Monitor File" in each case?</em></span> -- For an answer you may
+want to have a look at how a Windows NT box with a shared printer
+presents the files to us. Remember, that this whole procedure has
+to be developed by the Samba Team by overhearing the traffic caused
+by Windows computers on the wire. We may as well turn to a Windows
+box now, and access it from a UNIX workstation. We will query it
+with <b class="command">rpcclient</b> to see what it tells us and
+try to understand the man page more clearly which we've read just
+now.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951829"></a>Producing an Example by querying a Windows Box</h3></div></div><div></div></div><p>
+We could run <b class="command">rpcclient</b> with a
+<b class="command">getdriver</b> or a <b class="command">getprinter</b>
+subcommand (in level 3 verbosity) against it. Just sit down at UNIX or
+Linux workstation with the Samba utilities installed. Then type the
+following command:
+</p><pre class="screen">
+
+ rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3'
+
+</pre><p>
+From the result it should become clear which is which. Here is an
+example from my installation:
+</p><pre class="screen">
+
+# rpcclient -U'Danka%xxxx' W2KSERVER -c'getdriver "DANKA InfoStream Virtual Printer" 3'
+ cmd = getdriver "DANKA InfoStream Virtual Printer" 3
+
+ [Windows NT x86]
+ Printer Driver Info 3:
+ Version: [2]
+ Driver Name: [DANKA InfoStream]
+ Architecture: [Windows NT x86]
+ Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.DLL]
+ Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\INFOSTRM.PPD]
+ Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRPTUI.DLL]
+ Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.HLP]
+
+ Dependentfiles: []
+ Dependentfiles: []
+ Dependentfiles: []
+ Dependentfiles: []
+ Dependentfiles: []
+ Dependentfiles: []
+ Dependentfiles: []
+
+ Monitorname: []
+ Defaultdatatype: []
+
+</pre><p>
+Some printer drivers list additional files under the label
+"Dependentfiles": these would go into the last field
+<span class="emphasis"><em>ListOfFiles,Comma-separated</em></span>. For the CUPS
+PostScript drivers we don't need any (nor would we for the Adobe
+PostScript driver): therefore the field will get a "NULL" entry.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2951919"></a>What is required for adddriver and setdriver to succeed</h3></div></div><div></div></div><p>
+From the manpage (and from the quoted output
+of<span class="emphasis"><em>cupsaddsmb</em></span>, above) it becomes clear that you
+need to have certain conditions in order to make the manual uploading
+and initializing of the driver files succeed. The two rpcclient
+subcommands (<b class="command">adddriver</b> and
+<b class="command">setdriver</b>) need to encounter the following
+pre-conditions to complete successfully:
+</p><div class="itemizedlist"><ul type="disc"><li><p>you are connected as "printer admin", or root (note,
+that this is <span class="emphasis"><em>not</em></span> the "Printer Operators" group in
+NT, but the <span class="emphasis"><em>printer admin</em></span> group, as defined in
+the <i class="parameter"><tt>[global]</tt></i> section of
+<tt class="filename">smb.conf</tt>);</p></li><li><p>copy all required driver files to
+<tt class="filename">\\sambaserver\print$\w32x86</tt> and
+<tt class="filename">\\sambaserver\print$\win40</tt> as appropriate. They
+will end up in the "0" respective "2" subdirectories later -- for now
+<span class="emphasis"><em>don't</em></span> put them there, they'll be automatically
+used by the <b class="command">adddriver</b> subcommand.! (if you use
+"smbclient" to put the driver files into the share, note that you need
+to escape the "$": <b class="command">smbclient //sambaserver/print\$ -U
+root</b>);</p></li><li><p>the user you're connecting as must be able to write to
+the <i class="parameter"><tt>[print$]</tt></i> share and create
+subdirectories;</p></li><li><p>the printer you are going to setup for the Windows
+clients, needs to be installed in CUPS already;</p></li><li><p>the CUPS printer must be known to Samba, otherwise the
+<b class="command">setdriver</b> subcommand fails with an
+NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by
+Samba you may use the <b class="command">enumprinters</b> subcommand to
+rpcclient. A long-standing bug prevented a proper update of the
+printer list until every smbd process had received a SIGHUP or was
+restarted. Remember this in case you've created the CUPS printer just
+shortly ago and encounter problems: try restarting
+Samba.</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2952081"></a>Manual Commandline Driver Installation in 15 little Steps</h3></div></div><div></div></div><p>
+We are going to install a printer driver now by manually executing all
+required commands. As this may seem a rather complicated process at
+first, we go through the procedure step by step, explaining every
+single action item as it comes up.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952098"></a>First Step: Install the Printer on CUPS</h4></div></div><div></div></div><pre class="screen">
+
+# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P /home/kurt/canonIR85.ppd
+
+</pre><p>
+This installs printer with the name <span class="emphasis"><em>mysmbtstprn</em></span>
+to the CUPS system. The printer is accessed via a socket
+(a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root
+for this step
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952128"></a>Second Step (optional): Check if the Printer is recognized by
+Samba</h4></div></div><div></div></div><pre class="screen">
+
+ # rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn
+
+ flags:[0x800000]
+ name:[\\kde-bitshop\mysmbtstprn]
+ description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
+ comment:[mysmbtstprn]
+
+</pre><p>
+This should show the printer in the list. If not, stop and re-start
+the Samba daemon (smbd), or send a HUP signal: <b class="command">kill -HUP
+`pidof smbd`</b>. Check again. Troubleshoot and repeat until
+success. Note the "empty" field between the two commas in the
+"description" line. Here would the driver name appear if there was one
+already. You need to know root's Samba password (as set by the
+<b class="command">smbpasswd</b> command) for this step and most of the
+following steps. Alternatively you can authenticate as one of the
+users from the "write list" as defined in <tt class="filename">smb.conf</tt> for
+<i class="parameter"><tt>[print$]</tt></i>.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952191"></a>Third Step (optional): Check if Samba knows a Driver for the
+Printer</h4></div></div><div></div></div><pre class="screen">
+
+# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
+ drivername:[]
+
+# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
+ servername:[\\kde-bitshop]
+ printername:[\\kde-bitshop\mysmbtstprn]
+ sharename:[mysmbtstprn]
+ portname:[Samba Printer Port]
+ drivername:[]
+ comment:[mysmbtstprn]
+ location:[]
+ sepfile:[]
+ printprocessor:[winprint]
+
+# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+ result was WERR_UNKNOWN_PRINTER_DRIVER
+
+</pre><p>
+Neither method of the three commands shown above should show a driver.
+This step was done for the purpose of demonstrating this condition. An
+attempt to connect to the printer at this stage will prompt the
+message along the lines: "The server has not the required printer
+driver installed".
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952229"></a>Fourth Step: Put all required Driver Files into Samba's
+[print$]</h4></div></div><div></div></div><pre class="screen">
+
+# smbclient //localhost/print\$ -U 'root%xxxx' \
+ -c 'cd W32X86; \
+ put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD; \
+ put /usr/share/cups/drivers/cupsui.dll cupsui.dll; \
+ put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
+ put /usr/share/cups/drivers/cups.hlp cups.hlp'
+
+</pre><p>
+(Note that this command should be entered in one long single
+line. Line-breaks and the line-end indicating "\" has been inserted
+for readability reasons.) This step is <span class="emphasis"><em>required</em></span>
+for the next one to succeed. It makes the driver files physically
+present in the <i class="parameter"><tt>[print$]</tt></i> share. However, clients
+would still not be able to install them, because Samba does not yet
+treat them as driver files. A client asking for the driver would still
+be presented with a "not installed here" message.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952280"></a>Fifth Step: Verify where the Driver Files are now</h4></div></div><div></div></div><pre class="screen">
+
+# ls -l /etc/samba/drivers/W32X86/
+ total 669
+ drwxr-sr-x 2 root ntadmin 532 May 25 23:08 2
+ drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3
+ -rwxr--r-- 1 root ntadmin 14234 May 25 23:21 cups.hlp
+ -rwxr--r-- 1 root ntadmin 278380 May 25 23:21 cupsdrvr.dll
+ -rwxr--r-- 1 root ntadmin 215848 May 25 23:21 cupsui.dll
+ -rwxr--r-- 1 root ntadmin 169458 May 25 23:21 mysmbtstprn.PPD
+
+</pre><p>
+The driver files now are in the W32X86 architecture "root" of
+<i class="parameter"><tt>[print$]</tt></i>.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952318"></a>Sixth Step: Tell Samba that these are
+<span class="emphasis"><em>Driver</em></span> Files
+(<b class="command">adddriver</b>)</h4></div></div><div></div></div><pre class="screen">
+
+# rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \
+ cupsdrvr.dll:mysmbtstprn.PPD: \
+ cupsui.dll:cups.hlp:NULL:RAW[<span class="citation">:</span>]NULL" \
+ localhost
+
+ Printer Driver mydrivername successfully installed.
+
+</pre><p>
+Note that your cannot repeat this step if it fails. It could fail even
+as a result of a simple typo. It will most likely have moved a part of
+the driver files into the "2" subdirectory. If this step fails, you
+need to go back to the fourth step and repeat it, before you can try
+this one again. In this step you need to choose a name for your
+driver. It is normally a good idea to use the same name as is used for
+the printername; however, in big installations you may use this driver
+for a number of printers which have obviously different names. So the
+name of the driver is not fixed.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952373"></a>Seventh Step: Verify where the Driver Files are now</h4></div></div><div></div></div><pre class="screen">
+
+# ls -l /etc/samba/drivers/W32X86/
+ total 1
+ drwxr-sr-x 2 root ntadmin 532 May 25 23:22 2
+ drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3
+
+
+# ls -l /etc/samba/drivers/W32X86/2
+ total 5039
+ [....]
+ -rwxr--r-- 1 root ntadmin 14234 May 25 23:21 cups.hlp
+ -rwxr--r-- 1 root ntadmin 278380 May 13 13:53 cupsdrvr.dll
+ -rwxr--r-- 1 root ntadmin 215848 May 13 13:53 cupsui.dll
+ -rwxr--r-- 1 root ntadmin 169458 May 25 23:21 mysmbtstprn.PPD
+
+</pre><p>
+Notice how step 6 did also move the driver files to the appropriate
+subdirectory. Compare with the situation after step 5.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952406"></a>Eighth Step (optional): Verify if Samba now recognizes the
+Driver</h4></div></div><div></div></div><pre class="screen">
+
+# rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost | grep -B2 -A5 mydrivername
+
+ Printer Driver Info 3:
+ Version: [2]
+ Driver Name: [mydrivername]
+ Architecture: [Windows NT x86]
+ Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+ Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+ Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+ Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
+
+</pre><p>
+Remember, this command greps for the name you did choose for the
+driver in step Six. This command must succeed before you can proceed.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952439"></a>Ninth Step: Tell Samba which Printer should use these Driver
+Files (<b class="command">setdriver</b>)</h4></div></div><div></div></div><pre class="screen">
+
+# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
+
+ Successfully set mysmbtstprn to driver mydrivername
+
+</pre><p>
+Since you can bind any printername (=printqueue) to any driver, this
+is a very convenient way to setup many queues which use the same
+driver. You don't need to repeat all the previous steps for the
+setdriver command to succeed. The only pre-conditions are:
+<b class="command">enumdrivers</b> must find the driver and
+<b class="command">enumprinters</b> must find the printer.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952490"></a>Tenth Step (optional): Verify if Samba has this Association
+recognized</h4></div></div><div></div></div><pre class="screen">
+
+# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
+ drivername:[mydrivername]
+
+# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
+ servername:[\\kde-bitshop]
+ printername:[\\kde-bitshop\mysmbtstprn]
+ sharename:[mysmbtstprn]
+ portname:[Done]
+ drivername:[mydrivername]
+ comment:[mysmbtstprn]
+ location:[]
+ sepfile:[]
+ printprocessor:[winprint]
+
+# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+ [Windows NT x86]
+ Printer Driver Info 3:
+ Version: [2]
+ Driver Name: [mydrivername]
+ Architecture: [Windows NT x86]
+ Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+ Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+ Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+ Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
+ Monitorname: []
+ Defaultdatatype: [RAW]
+ Monitorname: []
+ Defaultdatatype: [RAW]
+
+# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn
+ name:[\\kde-bitshop\mysmbtstprn]
+ description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
+ comment:[mysmbtstprn]
+
+</pre><p>
+Compare these results with the ones from steps 2 and 3. Note that
+every single of these commands show the driver is installed. Even
+the <b class="command">enumprinters</b> command now lists the driver
+on the "description" line.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952546"></a>Eleventh Step (optional): Tickle the Driver into a correct
+Device Mode</h4></div></div><div></div></div><p>
+You certainly know how to install the driver on the client. In case
+you are not particularly familiar with Windows, here is a short
+recipe: browse the Network Neighbourhood, go to the Samba server, look
+for the shares. You should see all shared Samba printers.
+Double-click on the one in question. The driver should get
+installed, and the network connection set up. An alternative way is to
+open the "Printers (and Faxes)" folder, right-click on the printer in
+question and select "Connect" or "Install". As a result, a new printer
+should have appeared in your client's local "Printers (and Faxes)"
+folder, named something like "printersharename on Sambahostname".
+</p><p>
+It is important that you execute this step as a Samba printer admin
+(as defined in <tt class="filename">smb.conf</tt>). Here is another method
+to do this on Windows XP. It uses a commandline, which you may type
+into the "DOS box" (type root's smbpassword when prompted):
+</p><pre class="screen">
+
+ C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n \\sambacupsserver\mysmbtstprn"
+
+</pre><p>
+Change any printer setting once (like <span class="emphasis"><em>"portrait"
+--> "landscape"</em></span>), click "Apply"; change the setting
+back.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952607"></a>Twelveth Step: Install the Printer on a Client
+("Point'n'Print")</h4></div></div><div></div></div><pre class="screen">
+
+ C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
+
+</pre><p>
+If it doesn't work it could be a permission problem with the
+<i class="parameter"><tt>[print$]</tt></i> share.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952638"></a>Thirteenth Step (optional): Print a Test Page</h4></div></div><div></div></div><pre class="screen">
+
+ C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"
+
+</pre><p>
+Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again
+and march to the printer.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952663"></a>Fourteenth Step (recommended): Study the Test Page</h4></div></div><div></div></div><p>
+Hmmm.... just kidding! By now you know everything about printer
+installations and you don't need to read a word. Just put it in a
+frame and bolt it to the wall with the heading "MY FIRST
+RPCCLIENT-INSTALLED PRINTER" - why not just throw it away!
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2952681"></a>Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your
+Success</h4></div></div><div></div></div><pre class="screen">
+
+# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd
+
+</pre></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2952701"></a>Troubleshooting revisited</h3></div></div><div></div></div><p>
+The setdriver command will fail, if in Samba's mind the queue is not
+already there. You had promising messages about the:
+</p><pre class="screen">
+
+ Printer Driver ABC successfully installed.
+
+</pre><p>
+after the "adddriver" parts of the procedure? But you are also seeing
+a disappointing message like this one beneath?
+</p><pre class="screen">
+
+ result was NT_STATUS_UNSUCCESSFUL
+
+</pre><p>
+It is not good enough that <span class="emphasis"><em>you</em></span>
+can see the queue <span class="emphasis"><em>in CUPS</em></span>, using
+the <b class="command">lpstat -p ir85wm</b> command. A
+bug in most recent versions of Samba prevents the proper update of
+the queuelist. The recognition of newly installed CUPS printers
+fails unless you re-start Samba or send a HUP to all smbd
+processes. To verify if this is the reason why Samba doesn't
+execute the setdriver command successfully, check if Samba "sees"
+the printer:
+</p><pre class="screen">
+
+# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep ir85wm
+ printername:[ir85wm]
+
+</pre><p>
+An alternative command could be this:
+</p><pre class="screen">
+
+# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm'
+ cmd = getprinter ir85wm
+ flags:[0x800000]
+ name:[\\transmeta\ir85wm]
+ description:[\\transmeta\ir85wm,ir85wm,DPD]
+ comment:[CUPS PostScript-Treiber for WinNT/2K/XP]
+
+</pre><p>
+BTW, you can use these commands, plus a few more, of course,
+to install drivers on remote Windows NT print servers too!
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2952803"></a>The printing <tt class="filename">*.tdb</tt> Files</h2></div></div><div></div></div><p>
+Some mystery is associated with the series of files with a
+tdb-suffix appearing in every Samba installation. They are
+<tt class="filename">connections.tdb</tt>,
+<tt class="filename">printing.tdb</tt>,
+<tt class="filename">share_info.tdb</tt> ,
+<tt class="filename">ntdrivers.tdb</tt>,
+<tt class="filename">unexpected.tdb</tt>,
+<tt class="filename">brlock.tdb</tt> ,
+<tt class="filename">locking.tdb</tt>,
+<tt class="filename">ntforms.tdb</tt>,
+<tt class="filename">messages.tdb</tt> ,
+<tt class="filename">ntprinters.tdb</tt>,
+<tt class="filename">sessionid.tdb</tt> and
+<tt class="filename">secrets.tdb</tt>. What is their purpose?
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2952906"></a>Trivial DataBase Files</h3></div></div><div></div></div><p>
+A Windows NT (Print) Server keeps track of all information needed to serve
+its duty toward its clients by storing entries in the Windows
+"Registry". Client queries are answered by reading from the registry,
+Administrator or user configuration settings are saved by writing into
+the Registry. Samba and Unix obviously don't have such a kind of
+Registry. Samba instead keeps track of all client related information in a
+series of <tt class="filename">*.tdb</tt> files. (TDB = Trivial Data
+Base). These are often located in <tt class="filename">/var/lib/samba/</tt>
+or <tt class="filename">/var/lock/samba/</tt> . The printing related files
+are <tt class="filename">ntprinters.tdb</tt>,
+<tt class="filename">printing.tdb</tt>,<tt class="filename">ntforms.tdb</tt> and
+<tt class="filename">ntdrivers.tdb</tt>.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2952976"></a>Binary Format</h3></div></div><div></div></div><p>
+<tt class="filename">*.tdb</tt> files are not human readable. They are
+written in a binary format. "Why not ASCII?", you may ask. "After all,
+ASCII configuration files are a good and proofed tradition on UNIX."
+-- The reason for this design decision by the Samba Team is mainly
+performance. Samba needs to be fast; it runs a separate
+<b class="command">smbd</b> process for each client connection, in some
+environments many thousand of them. Some of these smbds might need to
+write-access the same <tt class="filename">*.tdb</tt> file <span class="emphasis"><em>at the
+same time</em></span>. The file format of Samba's
+<tt class="filename">*.tdb</tt> files allows for this provision. Many smbd
+processes may write to the same <tt class="filename">*.tdb</tt> file at the
+same time. This wouldn't be possible with pure ASCII files.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2953038"></a>Losing <tt class="filename">*.tdb</tt> Files</h3></div></div><div></div></div><p>
+It is very important that all <tt class="filename">*.tdb</tt> files remain
+consistent over all write and read accesses. However, it may happen
+that these files <span class="emphasis"><em>do</em></span> get corrupted. (A
+<b class="command">kill -9 `pidof smbd`</b> while a write access is in
+progress could do the damage as well as a power interruption,
+etc.). In cases of trouble, a deletion of the old printing-related
+<tt class="filename">*.tdb</tt> files may be the only option. You need to
+re-create all print related setup after that. Or you have made a
+backup of the <tt class="filename">*.tdb</tt> files in time.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2953097"></a>Using <span class="emphasis"><em>tdbbackup</em></span></h3></div></div><div></div></div><p>
+Samba ships with a little utility which helps the root user of your
+system to back up your <tt class="filename">*.tdb</tt> files. If you run it
+with no argument, it prints a little usage message:
+</p><pre class="screen">
+
+# tdbbackup
+ Usage: tdbbackup [options] <fname...>
+
+ Version:3.0a
+ -h this help message
+ -s suffix set the backup suffix
+ -v veryify mode (restore if corrupt)
+
+</pre><p>
+Here is how I backed up my printing.tdb file:
+</p><pre class="screen">
+
+# ls
+ . browse.dat locking.tdb ntdrivers.tdb printing.tdb share_info.tdb
+ .. connections.tdb messages.tdb ntforms.tdb printing.tdbkp unexpected.tdb
+ brlock.tdb gmon.out namelist.debug ntprinters.tdb sessionid.tdb
+
+ kde-bitshop:/var/lock/samba # tdbbackup -s .bak printing.tdb
+ printing.tdb : 135 records
+
+ kde-bitshop:/var/lock/samba # ls -l printing.tdb*
+ -rw------- 1 root root 40960 May 2 03:44 printing.tdb
+ -rw------- 1 root root 40960 May 2 03:44 printing.tdb.bak
+
+</pre></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2953159"></a>CUPS Print Drivers from Linuxprinting.org</h2></div></div><div></div></div><p>
+CUPS ships with good support for HP LaserJet type printers. You can
+install the generic driver as follows:
+</p><pre class="screen">
+
+lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
+
+</pre><p>
+The <i class="parameter"><tt>-m</tt></i> switch will retrieve the
+<tt class="filename">laserjet.ppd</tt> from the standard repository for
+not-yet-installed-PPDs, which CUPS typically stores in
+<tt class="filename">/usr/share/cups/model</tt>. Alternatively, you may use
+<i class="parameter"><tt>-P /path/to/your.ppd</tt></i>.
+</p><p>
+The generic laserjet.ppd however does not support every special option
+for every LaserJet-compatible model. It constitutes a sort of "least
+denominator" of all the models. If for some reason it is ruled out to
+you to pay for the commercially available ESP Print Pro drivers, your
+first move should be to consult the database on <a href="http://www.linuxprinting.org/printer_list.cgi" target="_top">http://www.linuxprinting.org/printer_list.cgi</a>.
+Linuxprinting.org has excellent recommendations about which driver is
+best used for each printer. Its database is kept current by the
+tireless work of Till Kamppeter from MandrakeSoft, who is also the
+principal author of the foomatic-rip utility.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The former "cupsomatic" concept is now be replaced by the new, much
+more powerful "foomatic-rip". foomatic-rip is the successor of
+cupsomatic. cupsomatic is no longer maintained. Here is the new URL
+to the Foomatic-3.0 database:<a href="http://www.linuxprinting.org/driver_list.cgi" target="_top">http://www.linuxprinting.org/driver_list.cgi</a>.
+If you upgrade to foomatic-rip, don't forget to also upgrade to the
+new-style PPDs for your foomatic-driven printers. foomatic-rip will
+not work with PPDs generated for the old cupsomatic. The new-style
+PPDs are 100% compliant to the Adobe PPD specification. They are
+intended to be used by Samba and the cupsaddsmb utility also, to
+provide the driver files for the Windows clients also!
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2953265"></a>foomatic-rip and Foomatic explained</h3></div></div><div></div></div><p>
+Nowadays most Linux distros rely on the utilities of Linuxprinting.org
+to create their printing related software (which, BTW, works on all
+UNIXes and on Mac OS X or Darwin too). It is not known as well as it
+should be, that it also has a very end-user friendly interface which
+allows for an easy update of drivers and PPDs, for all supported
+models, all spoolers, all operatings systems and all package formats
+(because there is none). Its history goes back a few years.
+</p><p>
+Recently Foomatic has achieved the astonishing milestone of <a href="http://www.linuxprinting.org/printer_list.cgi?make=Anyone" target="_top">1000
+listed</a> printer models. Linuxprinting.org keeps all the
+important facts about printer drivers, supported models and which
+options are available for the various driver/printer combinations in
+its <a href="http://www.linuxprinting.org/foomatic.html" target="_top">Foomatic</a>
+database. Currently there are <a href="http://www.linuxprinting.org/driver_list.cgi" target="_top">245 drivers</a>
+in the database: many drivers support various models, and many models
+may be driven by different drivers; it's your choice!
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2953320"></a>690 "perfect" Printers</h4></div></div><div></div></div><p>
+At present there are 690 devices dubbed as working "perfectly", 181
+"mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind
+that most of these are non-PostScript models (PostScript printers are
+automatically supported supported by CUPS to perfection, by using
+their own manufacturer-provided Windows-PPD...), and that a
+multifunctional device never qualifies as working "perfectly" if it
+doesn't also scan and copy and fax under GNU/Linux: then this is a
+truely astonishing achievement. Three years ago the number was not
+more than 500, and Linux or UNIX "printing" at the time wasn't
+anywhere near the quality it is today!
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2953345"></a>How the "Printing HOWTO" started it all</h4></div></div><div></div></div><p>
+A few years ago <a href="http://www2.picante.com:81/~gtaylor/" target="_top">Grant Taylor</a>
+started it all. The roots of today's Linuxprinting.org are in the
+first <a href="http://www.linuxprinting.org/foomatic2.9/howto/" target="_top">Linux Printing
+HOWTO</a> which he authored. As a side-project to this document,
+which served many Linux users and admins to guide their first steps in
+this complicated and delicate setup (to a scientist, printing is
+"applying a structured deposition of distinct patterns of ink or toner
+particles on paper substrates" <span class="emphasis"><em>;-)</em></span>, he started to
+build in a little Postgres database with information about the
+hardware and driver zoo that made up Linux printing of the time. This
+database became the core component of today's Foomatic collection of
+tools and data. In the meantime it has moved to an XML representation
+of the data.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2953390"></a>Foomatic's strange Name</h4></div></div><div></div></div><p>
+"Why the funny name?", you ask. When it really took off, around spring
+2000, CUPS was far less popular than today, and most systems used LPD,
+LPRng or even PDQ to print. CUPS shipped with a few generic "drivers"
+(good for a few hundred different printer models). These didn't
+support many device-specific options. CUPS also shipped with its own
+built-in rasterization filter ("pstoraster", derived from
+Ghostscript). On the other hand, CUPS provided brilliant support for
+<span class="emphasis"><em>controlling</em></span> all printer options through
+standardized and well-defined "PPD files" (PostScript Printers
+Description files). Plus, CUPS was designed to be easily extensible.
+</p><p>
+Grant already had in his database a respectable compilation
+of facts about a many more printers, and the Ghostscript "drivers"
+they run with. His idea, to generate PPDs from the database info
+and use them to make standard Ghostscript filters work within CUPS,
+proved to work very well. It also "killed several birds with one
+stone":
+</p><div class="itemizedlist"><ul type="disc"><li><p>It made all current and future Ghostscript filter
+developments available for CUPS;</p></li><li><p>It made available a lot of additional printer models
+to CUPS users (because often the "traditional" Ghostscript way of
+printing was the only one available);</p></li><li><p>It gave all the advanced CUPS options (web interface,
+GUI driver configurations) to users wanting (or needing) to use
+Ghostscript filters.</p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2953457"></a>cupsomatic, pdqomatic, lpdomatic, directomatic</h4></div></div><div></div></div><p>
+CUPS worked through a quickly-hacked up filter script named <a href="http://www.linuxprinting.org/download.cgi?filename=cupsomatic&show=0" target="_top">cupsomatic</a>.
+cupsomatic ran the printfile through Ghostscript, constructing
+automatically the rather complicated command line needed. It just
+required to be copied into the CUPS system to make it work. To
+"configure" the way cupsomatic controls the Ghostscript rendering
+process, it needs a CUPS-PPD. This PPD is generated directly from the
+contents of the database. For CUPS and the respective printer/filter
+combo another Perl script named "CUPS-O-Matic" did the PPD
+generation. After that was working, Grant implemented within a few
+days a similar thing for two other spoolers. Names chosen for the
+config-generator scripts were <a href="http://www.linuxprinting.org/download.cgi?filename=lpdomatic&show=0" target="_top">PDQ-O-Matic</a>
+(for PDQ) and <a href="http://www.linuxprinting.org/download.cgi?filename=lpdomatic&show=0" target="_top">LPD-O-Matic</a>
+(for - you guessed it - LPD); the configuration here didn't use PPDs
+but other spooler-specific files.
+</p><p>
+From late summer of that year, <a href="http://www.linuxprinting.org/till/" target="_top">Till Kamppeter</a>
+started to put work into the database. Till had been newly employed by
+<a href="http://www.mandrakesoft.com/" target="_top">MandrakeSoft</a> to
+convert their printing system over to CUPS, after they had seen his
+<a href="http://www.fltk.org/" target="_top">FLTK</a>-based <a href="http://cups.sourceforge.net/xpp/" target="_top">XPP</a> (a GUI frontend to
+the CUPS lp-command). He added a huge amount of new information and new
+printers. He also developed the support for other spoolers, like
+<a href="http://ppr.sourceforge.net/" target="_top">PPR</a> (via ppromatic),
+<a href="http://sourceforge.net/projects/lpr/" target="_top">GNUlpr</a> and
+<a href="http://www.lprng.org/" target="_top">LPRng</a> (both via an extended
+lpdomatic) and "spoolerless" printing (<a href="http://www.linuxprinting.org/download.cgi?filename=directomatic&show=0" target="_top">directomatic</a>)....
+</p><p>
+So, to answer your question: "Foomatic" is the general name for all
+the overlapping code and data behind the "*omatic" scripts.... --
+Foomatic up to versions 2.0.x required (ugly) Perl data structures
+attached the Linuxprinting.org PPDs for CUPS. It had a different
+"*omatic" script for every spooler, as well as different printer
+configuration files..
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2953589"></a>7.13.1.5.The <span class="emphasis"><em>Grand Unification</em></span>
+achieved...</h4></div></div><div></div></div><p>
+This all has changed in Foomatic versions 2.9 (Beta) and released as
+"stable" 3.0. This has now achieved the convergence of all *omatic
+scripts: it is called the <a href="http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0" target="_top">foomatic-rip</a>.
+This single script is the unification of the previously different
+spooler-specific *omatic scripts. foomatic-rip is used by all the
+different spoolers alike. Because foomatic-rip can read PPDs (both the
+original PostScript printer PPDs and the Linuxprinting.org-generated
+ones), all of a sudden all supported spoolers can have the power of
+PPDs at their disposal; users only need to plug "foomatic-rip" into
+their system.... For users there is improved media type and source
+support; paper sizes and trays are easier to configure.
+</p><p>
+Also, the New Generation of Linuxprinting.org PPDs doesn't contain
+Perl data structures any more. If you are a distro maintainer and have
+used the previous version of Foomatic, you may want to give the new
+one a spin: but don't forget to generate a new-version set of PPDs,
+via the new <a href="http://www.linuxprinting.org/download/foomatic/foomatic-db-engine-3.0.0beta1.tar.gz" target="_top">foomatic-db-engine</a>!
+Individual users just need to generate a single new PPD specific to
+their model by <a href="http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/II.Foomatic-User/II.tutorial-handout-foomatic-user.html" target="_top">following
+the steps</a> outlined in the Foomatic tutorial or further
+below. This new development is truly amazing.
+</p><p>
+foomatic-rip is a very clever wrapper around the need to run
+Ghostscript with a different syntax, different options, different
+device selections and/or different filters for each different printer
+or different spooler. At the same time it can read the PPD associated
+with a print queue and modify the print job according to the user
+selections. Together with this comes the 100% compliance of the new
+Foomatic PPDs with the Adobe spec. Some really innovative features of
+the Foomatic concept will surprise users: it will support custom paper
+sizes for many printers; and it will support printing on media drawn
+from different paper trays within the same job (in both cases: even
+where there is no support for this from Windows-based vendor printer
+drivers).
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2953677"></a>Driver Development outside</h4></div></div><div></div></div><p>
+Most driver development itself does not happen within
+Linuxprinting.org. Drivers are written by independent maintainers.
+Linuxprinting.org just pools all the information, and stores it in its
+database. In addition, it also provides the Foomatic glue to integrate
+the many drivers into any modern (or legacy) printing system known to
+the world.
+</p><p>
+Speaking of the different driver development groups: most of
+the work is currently done in three projects. These are:
+</p><div class="itemizedlist"><ul type="disc"><li><p><a href="http://www-124.ibm.com/developerworks/oss/linux/projects/omni/" target="_top">Omni</a>
+-- a Free Software project by IBM which tries to convert their printer
+driver knowledge from good-ol' OS/2 times into a modern, modular,
+universal driver architecture for Linux/Unix (still Beta). This
+currently supports 437 models.</p></li><li><p><a href="http://hpinkjet.sf.net/" target="_top">HPIJS</a> --
+a Free Software project by HP to provide the support for their own
+range of models (very mature, printing in most cases is perfect and
+provides true photo quality). This currently supports 369
+models.</p></li><li><p><a href="http://gimp-print.sf.net/" target="_top">Gimp-Print</a> -- a Free software
+effort, started by Michael Sweet (also lead developer for CUPS), now
+directed by Robert Krawitz, which has achieved an amazing level of
+photo print quality (many Epson users swear that its quality is
+better than the vendor drivers provided by Epson for the Microsoft
+platforms). This currently supports 522 models.</p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2953755"></a>Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and
+commercial Unix</h4></div></div><div></div></div><p>
+Linuxprinting.org today is the one-stop "shop" to download printer
+drivers. Look for printer information and <a href="http://www.linuxprinting.org//kpfeifle/LinuxKongress2002/Tutorial/" target="_top">tutorials</a>
+or solve printing problems in its popular <a href="http://www.linuxprinting.org/newsportal/" target="_top">forums</a>. But
+it's not just for GNU/Linux: users and admins of <a href="http://www.linuxprinting.org/macosx/" target="_top">commercial UNIX
+systems</a> are also going there, and the relatively new <a href="http://www.linuxprinting.org/newsportal/thread.php3?name=linuxprinting.macosx.general" target="_top">Mac
+OS X forum</a> has turned out to be one of the most frequented
+fora after only a few weeks.
+</p><p>
+Linuxprinting.org and the Foomatic driver wrappers around Ghostscript
+are now a standard toolchain for printing on all the important
+distros. Most of them also have CUPS underneath. While in recent years
+most printer data had been added by Till (who works at Mandrake), many
+additional contributions came from engineers with SuSE, RedHat,
+Connectiva, Debian and others. Vendor-neutrality is an important goal
+of the Foomatic project.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Till Kamppeter from MandrakeSoft is doing an excellent job in his
+spare time to maintain Linuxprinting.org and Foomatic. So if you use
+it often, please send him a note showing your appreciation.
+</p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2953828"></a>Foomatic Database generated PPDs</h4></div></div><div></div></div><p>
+The Foomatic database is an amazing piece of ingenuity in itself. Not
+only does it keep the printer and driver information, but it is
+organized in a way that it can generate "PPD" files "on the fly" from
+its internal XML-based datasets. While these PPDs are modelled to the
+Adobe specification of "PostScript Printer Descriptions" (PPDs), the
+Linuxprinting.org/Foomatic-PPDs don't normally drive PostScript
+printers: they are used to describe all the bells and whistles you
+could ring or blow on an Epson Stylus inkjet, or a HP Photosmart or
+what-have-you. The main "trick" is one little additional line, not
+envisaged by the PPD specification, starting with the "*cupsFilter"
+keyword: it tells the CUPS daemon how to proceed with the PostScript
+print file (old-style Foomatic-PPDs named the
+<span class="emphasis"><em>cupsomatic</em></span> filter script, while the new-style
+PPDs now call <span class="emphasis"><em>foomatic-rip</em></span>). This filter
+script calls Ghostscript on the host system (the recommended variant
+is ESP Ghostscript) to do the rendering work. foomatic-rip knows which
+filter or internal device setting it should ask from Ghostscript to
+convert the PostScript printjob into a raster format ready for the
+target device. This usage of PPDs to describe the options of non-PS
+printers was the invention of the CUPS developers. The rest is easy:
+GUI tools (like KDE's marvellous <a href="http://printing.kde.org/overview/kprinter.phtml" target="_top">"kprinter"</a>,
+or the GNOME <a href="http://gtklp.sourceforge.net/" target="_top">"gtklp"</a>, "xpp" and the CUPS
+web interface) read the PPD too and use this information to present
+the available settings to the user as an intuitive menu selection.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2953893"></a>foomatic-rip and Foomatic-PPD Download and Installation</h3></div></div><div></div></div><p>
+Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus"
+compatible printer in CUPS (note that recent distributions of SuSE,
+UnitedLinux and Mandrake may ship with a complete package of
+Foomatic-PPDs plus the foomatic-rip utility. going directly to
+Linuxprinting.org ensures you to get the latest driver/PPD files):
+</p><div class="itemizedlist"><ul type="disc"><li><p>Surf to <a href="http://www.linuxprinting.org/printer_list.cgi" target="_top">http://www.linuxprinting.org/printer_list.cgi</a>
+</p></li><li><p>Check the complete list of printers in the database:
+<a href="http://www.linuxprinting.org/printer_list.cgi?make=Anyone" target="_top">http://www.linuxprinting.org/printer_list.cgi?make=Anyone</a>
+</p></li><li><p>There select your model and click on the
+link.</p></li><li><p>You'll arrive at a page listing all drivers working
+with this model (for all printers, there will always be
+<span class="emphasis"><em>one</em></span> recommended driver. Try this one
+first).</p></li><li><p>In our case ("HP LaserJet 4 Plus"), we'll arrive here:
+<a href="http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus" target="_top">http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus</a>
+</p></li><li><p>The recommended driver is "ljet4".</p></li><li><p>There are several links provided here. You should
+visit them all, if you are not familiar with the Linuxprinting.org
+database.</p></li><li><p>There is a link to the database page for the "ljet4":
+<a href="http://www.linuxprinting.org/show_driver.cgi?driver=ljet4" target="_top">http://www.linuxprinting.org/show_driver.cgi?driver=ljet4</a>
+On the driver's page, you'll find important and detailed information
+about how to use that driver within the various available
+spoolers.</p></li><li><p>Another link may lead you to the homepage of the
+driver author or the driver.</p></li><li><p>Important links are the ones which provide hints with
+setup instructions for CUPS (<a href="http://www.linuxprinting.org/cups-doc.html" target="_top">http://www.linuxprinting.org/cups-doc.html</a>),
+PDQ (<a href="http://www.linuxprinting.org/pdq-doc.html" target="_top">http://www.linuxprinting.org/pdq-doc.html</a>),
+LPD, LPRng and GNUlpr (<a href="http://www.linuxprinting.org/lpd-doc.html" target="_top">http://www.linuxprinting.org/lpd-doc.html</a>)
+as well as PPR (<a href="http://www.linuxprinting.org/ppr-doc.html" target="_top">http://www.linuxprinting.org/ppr-doc.html)</a>
+or "spooler-less" printing (<a href="http://www.linuxprinting.org/direct-doc.html" target="_top">http://www.linuxprinting.org/direct-doc.html</a>
+).</p></li><li><p>You can view the PPD in your browser through this
+link: <a href="http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1" target="_top">http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1</a>
+</p></li><li><p>You can also (most importantly)
+generate and download the PPD: <a href="http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0" target="_top">http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0</a>
+</p></li><li><p>The PPD contains all the information needed to use our
+model and the driver; this is, once installed, working transparently
+for the user. Later you'll only need to choose resolution, paper size
+etc. from the web-based menu, or from the print dialog GUI, or from
+the commandline.</p></li><li><p>Should you have ended up on the driver's page (<a href="http://www.linuxprinting.org/show_driver.cgi?driver=ljet4" target="_top">http://www.linuxprinting.org/show_driver.cgi?driver=ljet4</a>),
+you can choose to use the "PPD-O-Matic" online PPD generator
+program.</p></li><li><p>Select the exact model and check either "download" or
+"display PPD file" and click on "Generate PPD file".</p></li><li><p>If you save the PPD file from the browser view, please
+don't use "cut'n'past" (since it could possibly damage line endings
+and tabs, which makes the PPD likely to fail its duty), but use "Save
+as..." in your browser's menu. (Best is to use the "download" option
+from the web page directly).</p></li><li><p>Another very interesting part on each driver page is
+the <span class="emphasis"><em>Show execution details</em></span> button. If you
+select your printer model and click that button, you will get
+displayed a complete Ghostscript command line, enumerating all options
+available for that driver/printermodel combo. This is a great way to
+"Learn Ghostscript By Doing". It is also an excellent "cheat sheet"
+for all experienced users who need to re-construct a good command line
+for that damn printing script, but can't remember the exact
+syntax. ;-)</p></li><li><p>Some time during your visit to Linuxprinting.org, save
+the PPD to a suitable place on your harddisk, say
+<tt class="filename">/path/to/my-printer.ppd</tt> (if you prefer to install
+your printers with the help of the CUPS web interface, save the PPD to
+the <tt class="filename">/usr/share/cups/model/</tt> path and re-start
+cupsd).</p></li><li><p>Then install the printer with a suitable commandline,
+e.g.:
+</p><pre class="screen">
+
+lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd
+
+</pre></li><li><p>Note again this: for all the new-style "Foomatic-PPDs"
+from Linuxprinting.org, you also need a special "CUPS filter" named
+"foomatic-rip".Get the latest version of "foomatic-rip" from: <a href="http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0" target="_top">http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0</a>
+</p></li><li><p>The foomatic-rip Perlscript itself also makes some
+interesting reading (<a href="http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1" target="_top">http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1</a>),
+because it is very well documented by Till's inline comments (even
+non-Perl hackers will learn quite a bit about printing by reading
+it... ;-)</p></li><li><p>Save foomatic-rip either directly in
+<tt class="filename">/usr/lib/cups/filter/foomatic-rip</tt> or somewhere in
+your $PATH (and don't forget to make it world-executable). Again,
+don't save by "copy'n'paste" but use the appropriate link, or the
+"Save as..." menu item in your browser.</p></li><li><p>If you save foomatic-rip in your $PATH, create a symlink:
+<b class="command">cd /usr/lib/cups/filter/ ; ln -s `which
+foomatic-rip`</b>. For CUPS to discover this new
+available filter at startup, you need to re-start
+cupsd.</p></li></ul></div><p>
+Once you print to a printqueue set up with the Foomatic-PPD, CUPS will
+insert the appropriate commands and comments into the resulting
+PostScript jobfile. foomatic-rip is able to read and act upon
+these. foomatic-rip uses some specially encoded Foomatic comments,
+embedded in the jobfile. These in turn are used to construct
+(transparently for you, the user) the complicated ghostscript command
+line telling for the printer driver how exactly the resulting raster
+data should look like and which printer commands to embed into the
+data stream.
+</p><p>
+You need:
+</p><div class="itemizedlist"><ul type="disc"><li><p>A "foomatic+something" PPD -- but it this not enough
+to print with CUPS (it is only <span class="emphasis"><em>one</em></span> important
+component)</p></li><li><p>The "foomatic-rip" filter script (Perl) in
+/usr/lib/cups/filters/</p></li><li><p>Perl to make foomatic-rip run</p></li><li><p>Ghostscript (because it is doing the main work,
+controlled by the PPD/foomatic-rip combo) to produce the raster data
+fit for your printermodel's consumption</p></li><li><p>Ghostscript <span class="emphasis"><em>must</em></span> (depending on
+the driver/model) contain support for a certain "device", representing
+the selected "driver" for your model (as shown by "gs
+-h")</p></li><li><p>foomatic-rip needs a new version of PPDs (PPD versions
+produced for cupsomatic don't work with
+foomatic-rip).</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2954351"></a>Page Accounting with CUPS</h2></div></div><div></div></div><p>
+Often there are questions regarding "print quotas" wherein Samba users
+(that is, Windows clients) should not be able to print beyond a
+certain amount of pages or data volume per day, week or month. This
+feature is dependent on the real print subsystem you're using.
+Samba's part is always to receive the job files from the clients
+(filtered <span class="emphasis"><em>or</em></span> unfiltered) and hand it over to this
+printing subsystem.
+</p><p>
+Of course one could "hack" things with one's own scripts. But then
+there is CUPS. CUPS supports "quotas" which can be based on sizes of
+jobs or on the number of pages or both, and are spanning any time
+period you want.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2954382"></a>Setting up Quotas</h3></div></div><div></div></div><p>
+This is an example command how root would set a print quota in CUPS,
+assuming an existing printer named "quotaprinter":
+</p><pre class="screen">
+
+ lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100
+
+</pre><p>
+This would limit every single user to print 100 pages or 1024 KB of
+data (whichever comes first) within the last 604,800 seconds ( = 1
+week).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2954413"></a>Correct and incorrect Accounting</h3></div></div><div></div></div><p>
+For CUPS to count correctly, the printfile needs to pass the CUPS
+"pstops" filter, otherwise it uses a "dummy" count of "1". Some
+printfiles don't pass it (eg: image files) but then those are mostly 1
+page jobs anyway. This also means that proprietary drivers for the
+target printer running on the client computers and CUPS/Samba, which
+then spool these files as "raw" (i.e. leaving them untouched, not
+filtering them), will be counted as "1-pagers" too!
+</p><p>
+You need to send PostScript from the clients (i.e. run a PostScript
+driver there) to have the chance to get accounting done. If the
+printer is a non-PostScript model, you need to let CUPS do the job to
+convert the file to a print-ready format for the target printer. This
+will be working for currently about 1,000 different printer models,
+see <a href="http://www.linuxprinting.org/printer_list.cgi" target="_top">http://www.linuxprinting.org/printer_list.cgi</a>).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2954454"></a>Adobe and CUPS PostScript Drivers for Windows Clients</h3></div></div><div></div></div><p>
+Before CUPS-1.1.16 your only option was to use the Adobe PostScript
+Driver on the Windows clients. The output of this driver was not
+always passed through the "pstops" filter on the CUPS/Samba side, and
+therefore was not counted correctly (the reason is that it often,
+depending on the "PPD" being used, wrote a "PJL"-header in front of
+the real PostScript which caused CUPS to skip pstops and go directly
+to the "pstoraster" stage).
+</p><p>
+From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for
+Windows NT/2K/XP clients" (which is tagged in the download area of
+http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does
+<span class="emphasis"><em>not</em></span> work for Win9x/ME clients. But it guarantees:
+</p><div class="itemizedlist"><ul type="disc"><li><p>to not write an PJL-header</p></li><li><p>to still read and support all PJL-options named in the
+driver PPD with its own means</p></li><li><p> that the file will pass through the "pstops" filter
+on the CUPS/Samba server</p></li><li><p>to page-count correctly the
+printfile</p></li></ul></div><p>
+You can read more about the setup of this combination in the manpage
+for "cupsaddsmb" (which is only present with CUPS installed, and only
+current from CUPS 1.1.16).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2954526"></a>The page_log File Syntax</h3></div></div><div></div></div><p>
+These are the items CUPS logs in the "page_log" for every
+single <span class="emphasis"><em>page</em></span> of a job:
+</p><div class="itemizedlist"><ul type="disc"><li><p>Printer name</p></li><li><p>User name</p></li><li><p>Job ID</p></li><li><p>Time of printing</p></li><li><p>the page number</p></li><li><p>the number of copies</p></li><li><p>a billing information string
+(optional)</p></li><li><p>the host which sent the job (included since version
+1.1.19)</p></li></ul></div><p>
+Here is an extract of my CUPS server's page_log file to illustrate the
+format and included items:
+</p><pre class="screen">
+
+ infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
+ infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
+ infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
+ infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
+ DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
+
+</pre><p>
+This was job ID "401", printed on "infotec_IS2027" by user "kurt", a
+64-page job printed in 3 copies and billed to "#marketing", sent
+from IP address 10.160.50.13. The next job had ID "402", was sent by
+user "boss" from IP address 10.160.51.33,printed from one page 440
+copies and is set to be billed to "finance-dep".
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2954628"></a>Possible Shortcomings</h3></div></div><div></div></div><p>
+What flaws or shortcomings are there with this quota system?
+</p><div class="itemizedlist"><ul type="disc"><li><p>the ones named above (wrongly logged job in case of
+printer hardware failure, etc.)</p></li><li><p>in reality, CUPS counts the job pages that are being
+processed in <span class="emphasis"><em>software</em></span> (that is, going through the
+"RIP") rather than the physical sheets successfully leaving the
+printing device. Thus if there is a jam while printing the 5th sheet out
+of 1000 and the job is aborted by the printer, the "page count" will
+still show the figure of 1000 for that job</p></li><li><p>all quotas are the same for all users (no flexibility
+to give the boss a higher quota than the clerk) no support for
+groups</p></li><li><p>no means to read out the current balance or the
+"used-up" number of current quota</p></li><li><p>a user having used up 99 sheets of 100 quota will
+still be able to send and print a 1,000 sheet job</p></li><li><p>a user being denied a job because of a filled-up quota
+doesn't get a meaningful error message from CUPS other than
+"client-error-not-possible".</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2954699"></a>Future Developments</h3></div></div><div></div></div><p>
+This is the best system currently available, and there are huge
+improvements under development for CUPS 1.2:
+</p><div class="itemizedlist"><ul type="disc"><li><p>page counting will go into the "backends" (these talk
+directly to the printer and will increase the count in sync with the
+actual printing process: thus a jam at the 5th sheet will lead to a
+stop in the counting)</p></li><li><p>quotas will be handled more flexibly</p></li><li><p>probably there will be support for users to inquire
+their "accounts" in advance</p></li><li><p>probably there will be support for some other tools
+around this topic</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2954747"></a>Other Accounting Tools</h3></div></div><div></div></div><p>
+PrintAnalyzer, pyKota, printbill, LogReport.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2954762"></a>Additional Material</h2></div></div><div></div></div><p>
+A printer queue with <span class="emphasis"><em>no</em></span> PPD associated to it is a
+"raw" printer and all files will go directly there as received by the
+spooler. The exceptions are file types "application/octet-stream"
+which need "passthrough feature" enabled. "Raw" queues don't do any
+filtering at all, they hand the file directly to the CUPS backend.
+This backend is responsible for the sending of the data to the device
+(as in the "device URI" notation: <tt class="filename">lpd://, socket://,
+smb://, ipp://, http://, parallel:/, serial:/, usb:/</tt> etc.)
+</p><p>
+"cupsomatic"/Foomatic are <span class="emphasis"><em>not</em></span> native CUPS drivers
+and they don't ship with CUPS. They are a Third Party add-on,
+developed at Linuxprinting.org. As such, they are a brilliant hack to
+make all models (driven by Ghostscript drivers/filters in traditional
+spoolers) also work via CUPS, with the same (good or bad!) quality as
+in these other spoolers. "cupsomatic" is only a vehicle to execute a
+ghostscript commandline at that stage in the CUPS filtering chain,
+where "normally" the native CUPS "pstoraster" filter would kick
+in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS
+away and re-directs it to go through Ghostscript. CUPS accepts this,
+because the associated CUPS-O-Matic-/Foomatic-PPD specifies:
+</p><pre class="screen">
+
+ *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic"
+
+</pre><p>
+This line persuades CUPS to hand the file to cupsomatic, once it has
+successfully converted it to the MIME type
+"application/vnd.cups-postscript". This conversion will not happen for
+Jobs arriving from Windows which are auto-typed
+"application/octet-stream", with the according changes in
+<tt class="filename">/etc/cups/mime.types</tt> in place.
+</p><p>
+CUPS is widely configurable and flexible, even regarding its filtering
+mechanism. Another workaround in some situations would be to have in
+<tt class="filename">/etc/cups/mime.types</tt> entries as follows:
+</p><pre class="screen">
+
+ application/postscript application/vnd.cups-raw 0 -
+ application/vnd.cups-postscript application/vnd.cups-raw 0 -
+
+</pre><p>
+This would prevent all Postscript files from being filtered (rather,
+they will through the virtual <span class="emphasis"><em>nullfilter</em></span>
+denoted with "-"). This could only be useful for PS printers. If you
+want to print PS code on non-PS printers (provided they support ASCII
+text printing) an entry as follows could be useful:
+</p><pre class="screen">
+
+ */* application/vnd.cups-raw 0 -
+
+</pre><p>
+and would effectively send <span class="emphasis"><em>all</em></span> files to the
+backend without further processing.
+</p><p>
+Lastly, you could have the following entry:
+</p><pre class="screen">
+
+ application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter
+
+</pre><p>
+You will need to write a <span class="emphasis"><em>my_PJL_stripping_filter</em></span>
+(could be a shellscript) that parses the PostScript and removes the
+unwanted PJL. This would need to conform to CUPS filter design
+(mainly, receive and pass the parameters printername, job-id,
+username, jobtitle, copies, print options and possibly the
+filename). It would be installed as world executable into
+<tt class="filename">/usr/lib/cups/filters/</tt> and will be called by CUPS
+if it encounters a MIME type "application/vnd.cups-postscript".
+</p><p>
+CUPS can handle <span class="emphasis"><em>-o job-hold-until=indefinite</em></span>.
+This keeps the job in the queue "on hold". It will only be printed
+upon manual release by the printer operator. This is a requirement in
+many "central reproduction departments", where a few operators manage
+the jobs of hundreds of users on some big machine, where no user is
+allowed to have direct access (such as when the operators often need
+to load the proper paper type before running the 10,000 page job
+requested by marketing for the mailing, etc.).
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2954956"></a>Auto-Deletion or Preservation of CUPS Spool Files</h2></div></div><div></div></div><p>
+Samba print files pass through two "spool" directories. One is the
+incoming directory managed by Samba, (set in the <span class="emphasis"><em>path =
+/var/spool/samba</em></span> directive in the
+<span class="emphasis"><em>[printers]</em></span> section of
+<tt class="filename">smb.conf</tt>). The other is the spool directory of
+your UNIX print subsystem. For CUPS it is normally
+<tt class="filename">/var/spool/cups/</tt>, as set by the cupsd.conf
+directive <tt class="filename">RequestRoot /var/spool/cups</tt>.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2955001"></a>CUPS Configuration Settings explained</h3></div></div><div></div></div><p>
+Some important parameter settings in the CUPS configuration file
+<tt class="filename">cupsd.conf</tt> are:
+</p><div class="variablelist"><dl><dt><span class="term">PreserveJobHistory Yes</span></dt><dd><p>
+This keeps some details of jobs in cupsd's mind (well it keeps the
+"c12345", "c12346" etc. files in the CUPS spool directory, which do a
+similar job as the old-fashioned BSD-LPD control files). This is set
+to "Yes" as a default.
+</p></dd><dt><span class="term">PreserveJobFiles Yes</span></dt><dd><p>
+This keeps the job files themselves in cupsd's mind
+(well it keeps the "d12345", "d12346" etc. files in the CUPS spool
+directory...). This is set to "No" as the CUPS
+default.
+</p></dd><dt><span class="term"><span class="emphasis"><em>"MaxJobs 500"</em></span></span></dt><dd><p>
+This directive controls the maximum number of jobs
+that are kept in memory. Once the number of jobs reaches the limit,
+the oldest completed job is automatically purged from the system to
+make room for the new one. If all of the known jobs are still
+pending or active then the new job will be rejected. Setting the
+maximum to 0 disables this functionality. The default setting is
+0.
+</p></dd></dl></div><p>
+(There are also additional settings for "MaxJobsPerUser" and
+"MaxJobsPerPrinter"...)
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2955083"></a>Pre-conditions</h3></div></div><div></div></div><p>
+For everything to work as announced, you need to have three
+things:
+</p><div class="itemizedlist"><ul type="disc"><li><p>a Samba-smbd which is compiled against "libcups" (Check
+on Linux by running "ldd `which smbd`")</p></li><li><p>a Samba-<tt class="filename">smb.conf</tt> setting of
+"printing = cups"</p></li><li><p>another Samba-<tt class="filename">smb.conf</tt> setting of
+"printcap = cups"</p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+In this case all other manually set printing-related commands (like
+"print command", "lpq command", "lprm command", "lppause command" or
+"lpresume command") are ignored and they should normally have no
+influence what-so-ever on your printing.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2955144"></a>Manual Configuration</h3></div></div><div></div></div><p>
+If you want to do things manually, replace the "printing =
+cups" by "printing = bsd". Then your manually set commands may work
+(haven't tested this), and a "print command = lp -d %P %s; rm %s"
+may do what you need.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2955162"></a>When <span class="emphasis"><em>not</em></span> to use Samba to print to
+CUPS</h2></div></div><div></div></div><p>
+[TO BE DONE]
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2955180"></a>In Case of Trouble.....</h2></div></div><div></div></div><p>
+If you have more problems, post the output of these commands
+to the CUPS or Samba mailing lists (choose the one which seems more
+relevant to your problem):
+</p><pre class="screen">
+
+ grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
+ grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
+
+</pre><p>
+(adapt paths as needed). These commands leave out the empty
+lines and lines with comments, providing the "naked settings" in a
+compact way. Don't forget to name the CUPS and Samba versions you
+are using! This saves bandwidth and makes for easier readability
+for experts (and you are expecting experts to read them, right?
+;-)
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2955214"></a>Where to find Documentation</h3></div></div><div></div></div><p>
+[TO BE DONE]
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2955227"></a>How to ask for Help</h3></div></div><div></div></div><p>
+[TO BE DONE]
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2955240"></a>Where to find Help</h3></div></div><div></div></div><p>
+[TO BE DONE]
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2955254"></a>Appendix</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2955261"></a>Printing <span class="emphasis"><em>from</em></span> CUPS to Windows attached
+Printers</h3></div></div><div></div></div><p>
+From time to time the question arises, how you can print
+<span class="emphasis"><em>to</em></span> a Windows attached printer
+<span class="emphasis"><em>from</em></span> Samba. Normally the local connection
+"Windows host <--> printer" would be done by USB or parallel
+cable, but this doesn't matter to Samba. From here only an SMB
+connection needs to be opened to the Windows host. Of course, this
+printer must be "shared" first. As you have learned by now, CUPS uses
+<span class="emphasis"><em>backends</em></span> to talk to printers and other
+servers. To talk to Windows shared printers you need to use the
+<span class="emphasis"><em>smb</em></span> (surprise, surprise!) backend. Check if this
+is in the CUPS backend directory. This resides usually in
+<tt class="filename">/usr/lib/cups/backend/</tt>. You need to find a "smb"
+file there. It should be a symlink to <tt class="filename">smbspool</tt>
+which file must exist and be executable:
+</p><pre class="screen">
+
+ # ls -l /usr/lib/cups/backend/
+ total 253
+ drwxr-xr-x 3 root root 720 Apr 30 19:04 .
+ drwxr-xr-x 6 root root 125 Dec 19 17:13 ..
+ -rwxr-xr-x 1 root root 10692 Feb 16 21:29 canon
+ -rwxr-xr-x 1 root root 10692 Feb 16 21:29 epson
+ lrwxrwxrwx 1 root root 3 Apr 17 22:50 http -> ipp
+ -rwxr-xr-x 1 root root 17316 Apr 17 22:50 ipp
+ -rwxr-xr-x 1 root root 15420 Apr 20 17:01 lpd
+ -rwxr-xr-x 1 root root 8656 Apr 20 17:01 parallel
+ -rwxr-xr-x 1 root root 2162 Mar 31 23:15 pdfdistiller
+ lrwxrwxrwx 1 root root 25 Apr 30 19:04 ptal -> /usr/local/sbin/ptal-cups
+ -rwxr-xr-x 1 root root 6284 Apr 20 17:01 scsi
+ lrwxrwxrwx 1 root root 17 Apr 2 03:11 smb -> /usr/bin/smbspool
+ -rwxr-xr-x 1 root root 7912 Apr 20 17:01 socket
+ -rwxr-xr-x 1 root root 9012 Apr 20 17:01 usb
+
+# ls -l `which smbspool`
+ -rwxr-xr-x 1 root root 563245 Dec 28 14:49 /usr/bin/smbspool
+
+</pre><p>
+If this symlink doesn't exist, create it:
+</p><pre class="screen">
+
+# ln -s `which smbspool` /usr/lib/cups/backend/smb
+
+</pre><p>
+smbspool has been written by Mike Sweet from the CUPS folks. It is
+included and ships with Samba. It may also be used with print
+subsystems other than CUPS, to spool jobs to Windows printer shares. To
+set up printer "winprinter" on CUPS, you need to have a "driver" for
+it. Essentially this means to convert the print data on the CUPS/Samba
+host to a format that the printer can digest (the Windows host is
+unable to convert any files you may send). This also means you should
+be able to print to the printer if it were hooked directly at your
+Samba/CUPS host. For troubleshooting purposes, this is what you
+should do, to determine if that part of the process chain is in
+order. Then proceed to fix the network connection/authentication to
+the Windows host, etc.
+</p><p>
+To install a printer with the smb backend on CUPS, use this command:
+</p><pre class="screen">
+
+# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename -P /path/to/PPD
+
+</pre><p>
+The <span class="emphasis"><em>PPD</em></span> must be able to direct CUPS to generate
+the print data for the target model. For PostScript printers just use
+the PPD that would be used with the Windows NT PostScript driver. But
+what can you do if the printer is only accessible with a password? Or
+if the printer's host is part of another workgroup? This is provided
+for: you can include the required parameters as part of the
+<tt class="filename">smb://</tt> device-URI. Like this:
+</p><pre class="screen">
+
+ smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename
+ smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename
+ smb://username:password@WINDOWSNETBIOSNAME/printersharename
+
+</pre><p>
+Note that the device-URI will be visible in the process list of the
+Samba server (e.g. when someone uses the <b class="command">ps -aux</b>
+command on Linux), even if the username and passwords are sanitized
+before they get written into the log files. So this is an inherently
+insecure option. However it is the only one. Don't use it if you want
+to protect your passwords. Better share the printer in a way that
+doesn't require a password! Printing will only work if you have a
+working netbios name resolution up and running. Note that this is a
+feature of CUPS and you don't necessarily need to have smbd running
+(but who wants that? :-).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2955455"></a>More CUPS filtering Chains</h3></div></div><div></div></div><p>
+The following diagrams reveal how CUPS handles print jobs.
+</p><pre class="screen">
+#########################################################################
+#
+# CUPS in and of itself has this (general) filter chain (CAPITAL
+# letters are FILE-FORMATS or MIME types, other are filters (this is
+# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT
+# |
+# V
+# pstoraster # as shipped with CUPS, independent from any Ghostscipt
+# | # installation on the system
+# | (= "postscipt interpreter")
+# V
+# APPLICATION/VND.CUPS-RASTER
+# |
+# V
+# rastertosomething (e.g. Gimp-Print filters may be plugged in here)
+# | (= "raster driver")
+# V
+# SOMETHING-DEVICE-SPECIFIC
+# |
+# V
+# backend
+#
+#
+# ESP PrintPro has some enhanced "rastertosomething" filters as compared to
+# CUPS, and also a somewhat improved "pstoraster" filter.
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+</pre><pre class="screen">
+#########################################################################
+#
+# This is how "cupsomatic" comes into play:
+# =========================================
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
+# | V
+# V cupsomatic
+# pstoraster (constructs complicated
+# | (= "postscipt interpreter") Ghostscript commandline
+# | to let the file be
+# V processed by a
+# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th."
+# | call...)
+# V |
+# rastertosomething V
+# | (= "raster driver") +-------------------------+
+# | | Ghostscript at work.... |
+# V | |
+# SOMETHING-DEVICE-SPECIFIC *-------------------------+
+# | |
+# V |
+# backend <------------------------------------+
+# |
+# V
+# THE PRINTER
+#
+#
+# Note, that cupsomatic "kidnaps" the printfile after the
+# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it gh
+# the CUPS-external, systemwide Ghostscript installation, bypassing the
+# "pstoraster" filter (therefore also bypassing the CUPS-raster-drivers
+# "rastertosomething", and hands the rasterized file directly to the CUPS
+# backend...
+#
+# cupsomatic is not made by the CUPS developers. It is an independent
+# contribution to printing development, made by people from
+# Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+</pre><pre class="screen">
+#########################################################################
+#
+# And this is how it works for ESP PrintPro from 4.3:
+# ===================================================
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT
+# |
+# V
+# gsrip
+# | (= "postscipt interpreter")
+# V
+# APPLICATION/VND.CUPS-RASTER
+# |
+# V
+# rastertosomething (e.g. Gimp-Print filters may be plugged in here)
+# | (= "raster driver")
+# V
+# SOMETHING-DEVICE-SPECIFIC
+# |
+# V
+# backend
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+</pre><pre class="screen">
+#########################################################################
+#
+# This is how "cupsomatic" would come into play with ESP PrintPro:
+# ================================================================
+#
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
+# | V
+# V cupsomatic
+# gsrip (constructs complicated
+# | (= "postscipt interpreter") Ghostscript commandline
+# | to let the file be
+# V processed by a
+# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th."
+# | call...)
+# V |
+# rastertosomething V
+# | (= "raster driver") +-------------------------+
+# | | Ghostscript at work.... |
+# V | |
+# SOMETHING-DEVICE-SPECIFIC *-------------------------+
+# | |
+# V |
+# backend <------------------------------------+
+# |
+# V
+# THE PRINTER
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+</pre><pre class="screen">
+#########################################################################
+#
+# And this is how it works for CUPS from 1.1.15:
+# ==============================================
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+# +------------------v------------------------------+
+# | Ghostscript |
+# | at work... |
+# | (with |
+# | "-sDEVICE=cups") |
+# | |
+# | (= "postscipt interpreter") |
+# | |
+# +------------------v------------------------------+
+# |
+# APPLICATION/VND.CUPS-RASTER >-------+
+# |
+# V
+# rastertosomething
+# | (= "raster driver")
+# V
+# SOMETHING-DEVICE-SPECIFIC
+# |
+# V
+# backend
+#
+#
+# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to
+# Ghostscript. GNU Ghostscript needs to be patched to handle the
+# CUPS requirement; ESP Ghostscript has this builtin. In any case,
+# "gs -h" needs to show up a "cups" device. pstoraster is now a
+# calling an appropriate "gs -sDEVICE=cups..." commandline to do
+# the job. It will output "application/vnd.cup-raster", which will
+# be finally processed by a CUPS raster driver "rastertosomething"
+# Note the difference to "cupsomatic", which will <span class="emphasis"><em>not</em></span> output
+# CUPS-raster, but a final version of the printfile, ready to be
+# sent to the printer. cupsomatic also doesn't use the "cups"
+# devicemode in Ghostscript, but one of the classical devicemodes....
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+</pre><pre class="screen">
+#########################################################################
+#
+# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
+# ========================================================================
+#
+# SOMETHNG-FILEFORMAT
+# |
+# V
+# somethingtops
+# |
+# V
+# APPLICATION/POSTSCRIPT
+# |
+# V
+# pstops
+# |
+# V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+# +------------------v------------------------------+
+# | Ghostscript . Ghostscript at work.... |
+# | at work... . (with "-sDEVICE= |
+# | (with . s.th." |
+# | "-sDEVICE=cups") . |
+# | . |
+# | (CUPS standard) . (cupsomatic) |
+# | . |
+# | (= "postscript interpreter") |
+# | . |
+# +------------------v--------------v---------------+
+# | |
+# APPLICATION/VND.CUPS-RASTER >-------+ |
+# | |
+# V |
+# rastertosomething |
+# | (= "raster driver") |
+# V |
+# SOMETHING-DEVICE-SPECIFIC >------------------------+
+# |
+# V
+# backend
+#
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+# CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+##########################################################################
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2955709"></a>Trouble Shooting Guidelines to fix typical Samba printing
+Problems</h3></div></div><div></div></div><p>
+This is a short description of how to debug printing problems
+with Samba. This describes how to debug problems with printing from
+a SMB client to a Samba server, not the other way around.
+</p><div class="variablelist"><dl><dt><span class="term">Win9x client can't install driver</span></dt><dd><p>For Win9x clients require the printer names to be 8
+chars (or "8 plus 3 chars suffix") max; otherwise the driver files
+won't get transferred when you want to download them from
+Samba.</p></dd><dt><span class="term">testparm</span></dt><dd><p>Run <b class="command">testparm</b>: It will tell you if
+<tt class="filename">smb.conf</tt> parameters are in the wrong
+section. Many people have had the "printer admin" parameter in the
+<i class="parameter"><tt>[printers]</tt></i> section and experienced
+problems. "testparm" will tell you if it sees
+this.</p></dd><dt><span class="term">"cupsaddsmb" keeps asking for a root password in a
+neverending loop</span></dt><dd><p>Have you <i class="parameter"><tt>security = user</tt></i>? Have
+you used <b class="command">smbpasswd</b> to give root a Samba account?
+You can do 2 things: open another terminal and execute
+<b class="command">smbpasswd -a root</b> to create the account, and
+continue with entering the password into the first terminal. Or break
+out of the loop by hitting ENTER twice (without trying to type a
+password).</p></dd><dt><span class="term">"cupsaddsmb" gives "No PPD file for printer..."
+message (but I swear there is one!)</span></dt><dd><div class="itemizedlist"><ul type="disc"><li><p>Have you enabled printer sharing on CUPS? This means:
+do you have a <i class="parameter"><tt><Location
+/printers>....</Location></tt></i> section in CUPS
+server's <tt class="filename">cupsd.conf</tt> which doesn't deny access to
+the host you run "cupsaddsmb" from? It <span class="emphasis"><em>could</em></span> be
+an issue if you use cupsaddsmb remotely, or if you use it with a
+<i class="parameter"><tt>-h</tt></i> parameter: <b class="command">cupsaddsmb -H
+sambaserver -h cupsserver -v printername</b>.
+</p></li><li><p>Is your
+"TempDir" directive in
+<span class="emphasis"><em>cupsd.conf</em></span>
+set to a valid value and is it writeable?
+</p></li></ul></div></dd><dt><span class="term">I can't connect client to Samba printer.</span></dt><dd><p>Use <b class="command">smbstatus</b> to check which user
+you are from Samba's point of view. Do you have the privileges to
+write into the <i class="parameter"><tt>[print$]</tt></i>
+share?</p></dd><dt><span class="term">I can't reconnect to Samba under a new account
+from Win2K/XP</span></dt><dd><p>Once you are connected as the "wrong" user (for
+example as "nobody", which often occurs if you have <i class="parameter"><tt>map to
+guest = bad user</tt></i>), Windows Explorer will not accept an
+attempt to connect again as a different user. There won't be any byte
+transfered on the wire to Samba, but still you'll see a stupid error
+message which makes you think that Samba has denied access. Use
+<b class="command">smbstatus</b> to check for active connections. Kill the
+PIDs. You still can't re-connect and get the dreaded
+<tt class="computeroutput">You can't connect with a second account from the same
+machine</tt> message, as soon as you are trying? And you
+don't see any single byte arriving at Samba (see logs; use "ethereal")
+indicating a renewed connection attempt? Shut all Explorer Windows.
+This makes Windows forget what it has cached in its memory as
+established connections. Then re-connect as the right user. Best
+method is to use a DOS terminal window and <span class="emphasis"><em>first</em></span>
+do <b class="command">net use z: \\SAMBAHOST\print$ /user:root</b>. Check
+with <b class="command">smbstatus</b> that you are connected under a
+different account. Now open the "Printers" folder (on the Samba server
+in the <span class="emphasis"><em>Network Neighbourhood</em></span>), right-click the
+printer in question and select
+<span class="emphasis"><em>Connect...</em></span></p></dd><dt><span class="term">Avoid being connected to the Samba server as the
+"wrong" user</span></dt><dd><p>You see per <b class="command">smbstatus</b> that you are
+connected as user "nobody"; while you wanted to be "root" or
+"printeradmin"? This is probably due to <i class="parameter"><tt>map to guest = bad
+user</tt></i>, which silently connects you under the guest account,
+when you gave (maybe by accident) an incorrect username. Remove
+<i class="parameter"><tt>map to guest</tt></i>, if you want to prevent
+this.</p></dd><dt><span class="term">Upgrading to CUPS drivers from Adobe drivers on
+NT/2K/XP clients gives problems</span></dt><dd><p>First delete all "old" Adobe-using printers. Then
+delete all "old" Adobe drivers. (On Win2K/XP, right-click in
+background of "Printers" folder, select "Server Properties...", select
+tab "Drivers" and delete here).</p></dd><dt><span class="term">I can't use "cupsaddsmb"on a Samba server which is
+a PDC</span></dt><dd><p>Do you use the "naked" root user name? Try to do it
+this way: <span class="emphasis"><em>cupsaddsmb -U DOMAINNAME\\root -v
+printername</em></span> (note the two backslashes: the first one is
+required to "escape" the second one).</p></dd><dt><span class="term">I deleted a printer on Win2K; but I still see
+its driver</span></dt><dd><p>Deleting a printer on the client won't delete the
+driver too (to verify, right-click on the white background of the
+"Printers" folder, select "Server Properties" and click on the
+"Drivers" tab). These same old drivers will be re-used when you try to
+install a printer with the same name. If you want to update to a new
+driver, delete the old ones first. Deletion is only possible if no
+other printer uses the same driver.</p></dd><dt><span class="term">Win2K/XP "Local Security
+Policies"</span></dt><dd><p><span class="emphasis"><em>Local Security Policies</em></span> may not
+allow the installation of unsigned drivers. "Local Security Policies"
+may not allow the installation of printer drivers at
+all.</p></dd><dt><span class="term">WinXP clients: "Administrator can not install
+printers for all local users"</span></dt><dd><p>Windows XP handles SMB printers on a "per-user" basis.
+This means every user needs to install the printer himself. To have a
+printer available for everybody, you might want to use the built-in
+IPP client capabilities of WinXP. Add a printer with the print path of
+<span class="emphasis"><em>http://cupsserver:631/printers/printername</em></span>.
+Still looking into this one: maybe a "logon script" could
+automatically install printers for all
+users.</p></dd><dt><span class="term">"Print Change Notify" functions on
+NT-clients</span></dt><dd><p>For "print change notify" functions on NT++ clients,
+these need to run the "Server" service first (re-named to
+<span class="emphasis"><em>File & Print Sharing for MS Networks</em></span> in
+XP).</p></dd><dt><span class="term">WinXP-SP1</span></dt><dd><p>WinXP-SP1 introduced a <span class="emphasis"><em>Point and Print
+Restriction Policy</em></span> (this restriction doesn't apply to
+"Administrator" or "Power User" groups of users). In Group Policy
+Object Editor: go to <span class="emphasis"><em>User Configuration -->
+Administrative Templates --> Control Panel -->
+Printers</em></span>. The policy is automatically set to
+<span class="emphasis"><em>Enabled</em></span> and the <span class="emphasis"><em>Users can only Point
+and Print to machines in their Forest</em></span> . You probably need
+to change it to <span class="emphasis"><em>Disabled</em></span> or <span class="emphasis"><em>Users can
+only Point and Print to these servers</em></span> in order to make
+driver downloads from Samba possible.</p></dd><dt><span class="term">I can't set and save default print options for all
+users on Win2K/XP</span></dt><dd><p>How are you doing it? I bet the wrong way (it is not
+very easy to find out, though). There are 3 different ways to bring
+you to a dialog that <span class="emphasis"><em>seems</em></span> to set everything. All
+three dialogs <span class="emphasis"><em>look</em></span> the same. Only one of them
+<span class="emphasis"><em>does</em></span> what you intend. You need to be
+Administrator or Print Administrator to do this for all users. Here
+is how I do in on XP:
+</p><div class="orderedlist"><ol type="A"><li xmlns:ns65=""><ns65:p>The first "wrong" way:
+
+</ns65:p><div class="orderedlist"><ol type="1"><li><p>Open the <span class="emphasis"><em>Printers</em></span>
+folder.</p></li><li><p>Right-click on the printer
+(<span class="emphasis"><em>remoteprinter on cupshost</em></span>) and
+select in context menu <span class="emphasis"><em>Printing
+Preferences...</em></span></p></li><li><p>Look at this dialog closely and remember what it looks
+like.</p></li></ol></div><ns65:p>
+</ns65:p></li><li xmlns:ns66=""><ns66:p>The second "wrong" way:
+
+</ns66:p><div class="orderedlist"><ol type="1"><li><p>Open the <span class="emphasis"><em>Printers</em></span>
+folder.</p></li><li><p>Right-click on the printer (<span class="emphasis"><em>remoteprinter on
+cupshost</em></span>) and select in the context menu
+<span class="emphasis"><em>Properties</em></span></p></li><li><p>Click on the <span class="emphasis"><em>General</em></span>
+tab</p></li><li><p>Click on the button <span class="emphasis"><em>Printing
+Preferences...</em></span></p></li><li><p>A new dialog opens. Keep this dialog open and go back
+to the parent dialog.</p></li></ol></div><ns66:p>
+</ns66:p></li><li xmlns:ns67=""><ns67:p>The third, the "correct" way: (should you do
+this from the beginning, just carry out steps 1. and 2. from second
+"way" above)
+
+</ns67:p><div class="orderedlist"><ol type="1"><li><p>Click on the <span class="emphasis"><em>Advanced</em></span>
+tab. (Hmmm... if everything is "Grayed Out", then you are not logged
+in as a user with enough privileges).</p></li><li><p>Click on the <span class="emphasis"><em>Printing
+Defaults...</em></span> button.</p></li><li><p>On any of the two new tabs, click on the
+<span class="emphasis"><em>Advanced...</em></span>
+button.</p></li><li><p>A new dialog opens. Compare this one to the other,
+identical looking one from "B.5" or A.3".</p></li></ol></div><ns67:p>
+</ns67:p></li></ol></div><p>
+Do you see any difference? I don't either... However, only the last
+one, which you arrived at with steps "C.1.-6." will save any settings
+permanently and be the defaults for new users. If you want all clients
+to get the same defaults, you need to conduct these steps <span class="emphasis"><em>as
+Administrator</em></span> (<i class="parameter"><tt>printer admin</tt></i> in
+<tt class="filename">smb.conf</tt>) <span class="emphasis"><em>before</em></span> a client
+downloads the driver (the clients can later set their own
+<span class="emphasis"><em>per-user defaults</em></span> by following the
+procedures <span class="emphasis"><em>A.</em></span> or <span class="emphasis"><em>B.</em></span>
+above).</p></dd><dt><span class="term">What are the most common blunders in driver
+settings on Windows clients?</span></dt><dd><p>Don't use <span class="emphasis"><em>Optimize for
+Speed</em></span>: use <span class="emphasis"><em>Optimize for
+Portability</em></span> instead (Adobe PS Driver) Don't use
+<span class="emphasis"><em>Page Independence: No</em></span>: always
+settle with <span class="emphasis"><em>Page Independence:
+Yes</em></span> (Microsoft PS Driver and CUPS PS Driver for
+WinNT/2K/XP) If there are problems with fonts: use
+<span class="emphasis"><em>Download as Softfont into
+printer</em></span> (Adobe PS Driver). For
+<span class="emphasis"><em>TrueType Download Options</em></span>
+choose <span class="emphasis"><em>Outline</em></span>. Use PostScript
+Level 2, if you are having trouble with a non-PS printer, and if
+there is a choice.</p></dd><dt><span class="term">I can't make <b class="command">cupsaddsmb</b> work
+with newly installed printer</span></dt><dd><p>Symptom: the last command of
+<b class="command">cupsaddsmb</b> doesn't complete successfully:
+<b class="command">cmd = setdriver printername printername</b> result was
+NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet
+"recognized" by Samba. Did it show up in <span class="emphasis"><em>Network
+Neighbourhood</em></span>? Did it show up in <b class="command">rpcclient
+hostname -c 'enumprinters'</b>? Restart smbd (or send a
+<b class="command">kill -HUP</b> to all processes listed by
+<b class="command">smbstatus</b> and try
+again.</p></dd><dt><span class="term">My permissions on
+<tt class="filename">/var/spool/samba/</tt> get reset after each
+reboot</span></dt><dd><p>Have you by accident set the CUPS spool directory to
+the same location? (<i class="parameter"><tt>RequestRoot
+/var/spool/samba/</tt></i> in <tt class="filename">cupsd.conf</tt> or
+the other way round: <tt class="filename">/var/spool/cups/</tt> is set as
+<i class="parameter"><tt>path</tt></i> in the <i class="parameter"><tt>[printers]</tt></i>
+section). These <span class="emphasis"><em>must</em></span> be different. Set
+<i class="parameter"><tt>RequestRoot /var/spool/cups/</tt></i> in
+<tt class="filename">cupsd.conf</tt> and <i class="parameter"><tt>path =
+/var/spool/samba</tt></i> in the <i class="parameter"><tt>[printers]</tt></i>
+section of <tt class="filename">smb.conf</tt>. Otherwise cupsd will
+sanitize permissions to its spool directory with each restart, and
+printing will not work reliably.</p></dd><dt><span class="term">My printers work fine: just the printer named "lp"
+intermittently swallows jobs and spits out completely different
+ones</span></dt><dd><p>It is a very bad idea to name any printer "lp". This
+is the traditional Unix name for the default printer. CUPS may be set
+up to do an automatic creation of "Implicit Classes". This means, to
+group all printers with the same name to a pool of devices, and
+loadbalancing the jobs across them in a round-robin fashion. Chances
+are high that someone else has an "lp" named printer too. You may
+receive his jobs and send your own to his device unwittingly. To have
+tight control over the printer names, set <i class="parameter"><tt>BrowseShortNames
+No</tt></i>. It will present any printer as "printername@cupshost"
+then, giving you a better control over what may happen in a large
+networked environment.</p></dd><dt><span class="term">How do I "watch" my Samba server?</span></dt><dd><p>You can use <b class="command">tail -f
+/var/log/samba/log.smbd</b> (you may need a different path) to
+see a live scrolling of all log messages. <b class="command">smbcontrol smbd
+debuglevel</b> tells you which verbosity goes into the
+logs. <b class="command">smbcontrol smbd debug 3</b> sets the verbosity to
+a quite high level (you can choose from 0 to 10 or 100). This works
+"on the fly", without the need to restart the smbd daemon. Don't use
+more than 3 initially; or you'll drown in an ocean of
+messages.</p></dd><dt><span class="term">I can't use Samba from my WinXP Home box, while
+access from WinXP Prof works flawlessly</span></dt><dd><p>You have our condolences! WinXP home has been
+completely neutered by Microsoft as compared to WinXP Prof: you can
+not log into a WinNT domain. It cannot join a Win NT domain as a
+member server. While it is possible to access domain resources, users
+don't have "single sign-on". They need to supply username and password
+each time they connect to a resource. Logon scripts and roaming
+profiles are not supported. It can serve file and print shares; but
+only in "share-mode security" level. It can not use "user-mode
+security" (what Windows 95/98/ME still can
+do).</p></dd><dt><span class="term">Where do I find the Adobe PostScript driver files
+I need for "cupsaddsmb"?</span></dt><dd><p>Use <b class="command">smbclient</b> to connect to any
+Windows box with a shared PostScript printer: <b class="command">smbclient
+//windowsbox/print\$ -U guest</b>. You can navigate to the
+<tt class="filename">W32X86/2</tt> subdir to <b class="command">mget ADOBE*</b>
+and other files or to <tt class="filename">WIN40/0</tt> to do the same. --
+Another option is to download the <tt class="filename">*.exe</tt> packaged
+files from the Adobe website.</p></dd></dl></div></div><div xmlns:ns68="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2956815"></a>An Overview of the CUPS Printing Processes</h3></div></div><div></div></div><ns68:p>
+</ns68:p><div class="figure"><a name="id2956826"></a><p class="title"><b>Figure 19.15. CUPS Printing Overview</b></p><div class="mediaobject"><img src="projdoc/imagefiles/a_small.png" alt="CUPS Printing Overview"></div></div><ns68:p>
+</ns68:p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="VFS"></a>Chapter 20. Stackable VFS modules</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Alexander</span> <span class="surname">Bokovoy</span></h3></div></div><div><div class="author"><h3 class="author"><span class="firstname">Tim</span> <span class="surname">Potter</span></h3></div></div><div><div class="author"><h3 class="author"><span class="firstname">Simo</span> <span class="surname">Sorce</span></h3></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2958218">Features and Benefits</a></dt><dt><a href="#id2958235">Discussion</a></dt><dt><a href="#id2958286">Included modules</a></dt><dd><dl><dt><a href="#id2956883">audit</a></dt><dt><a href="#id2956922">extd_audit</a></dt><dt><a href="#id2957044">fake_perms</a></dt><dt><a href="#id2957063">recycle</a></dt><dt><a href="#id2957202">netatalk</a></dt></dl></dd><dt><a href="#id2957247">VFS modules available elsewhere</a></dt><dd><dl><dt><a href="#id2957269">DatabaseFS</a></dt><dt><a href="#id2957323">vscan</a></dt></dl></dd><dt><a href="#id2957352">Common Errors</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2958218"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Since Samba-3, there is support for stackable VFS(Virtual File System) modules.
+Samba passes each request to access the unix file system thru the loaded VFS modules.
+This chapter covers all the modules that come with the samba source and references to
+some external modules.
+</p></div><div xmlns:ns69="" class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2958235"></a>Discussion</h2></div></div><div></div></div><p>
+If not supplied with your platform distribution binary Samba package you may have problems
+to compile these modules, as shared libraries are compiled and linked in different ways
+on different systems. They currently have been tested against GNU/Linux and IRIX.
+</p><ns69:p>
+To use the VFS modules, create a share similar to the one below. The
+important parameter is the <i class="parameter"><tt>vfs object</tt></i> parameter which must point to
+the exact pathname of the shared library objects. For example, to log all access
+to files and use a recycle bin:
+
+</ns69:p><pre class="programlisting">
+[audit]
+ comment = Audited /data directory
+ path = /data
+ vfs object = /path/to/audit.so /path/to/recycle.so
+ writeable = yes
+ browseable = yes
+</pre><ns69:p>
+</ns69:p><p>
+The modules are used in the order they are specified.
+</p><p>
+Further documentation on writing VFS modules for Samba can be found in
+the Samba Developers Guide.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2958286"></a>Included modules</h2></div></div><div></div></div><div xmlns:ns70="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2956883"></a>audit</h3></div></div><div></div></div><ns70:p>
+ A simple module to audit file access to the syslog
+ facility. The following operations are logged:
+ </ns70:p><table class="simplelist" border="0" summary="Simple list"><tr><td>share</td></tr><tr><td>connect/disconnect</td></tr><tr><td>directory opens/create/remove</td></tr><tr><td>file open/close/rename/unlink/chmod</td></tr></table><ns70:p>
+ </ns70:p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2956922"></a>extd_audit</h3></div></div><div></div></div><p>
+ This module is identical with the <span class="emphasis"><em>audit</em></span> module above except
+ that it sends audit logs to both syslog as well as the smbd log file/s. The
+ loglevel for this module is set in the smb.conf file.
+ </p><p>
+ The logging information that will be written to the smbd log file is controlled by
+ the <i class="parameter"><tt>log level</tt></i> parameter in <tt class="filename">smb.conf</tt>. The
+ following information will be recorded:
+ </p><div class="table"><a name="id2956961"></a><p class="title"><b>Table 20.1. Extended Auditing Log Information</b></p><table summary="Extended Auditing Log Information" border="1"><colgroup><col><col></colgroup><thead><tr><th align="center">Log Level</th><th align="center">Log Details - File and Directory Operations</th></tr></thead><tbody><tr><td align="center">0</td><td align="left">Creation / Deletion</td></tr><tr><td align="center">1</td><td align="left">Create / Delete / Rename / Permission Changes</td></tr><tr><td align="center">2</td><td align="left">Create / Delete / Rename / Perm Change / Open / Close</td></tr></tbody></table></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957044"></a>fake_perms</h3></div></div><div></div></div><p>
+ This module was created to allow Roaming Profile files and directories to be set (on the Samba server
+ under Unix) as read only. This module will if installed on the Profiles share will report to the client
+ that the Profile files and directories are writable. This satisfies the client even though the files
+ will never be overwritten as the client logs out or shuts down.
+ </p></div><div xmlns:ns71="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957063"></a>recycle</h3></div></div><div></div></div><p>
+ A recycle-bin like module. When used any unlink call
+ will be intercepted and files moved to the recycle
+ directory instead of being deleted.
+ </p><ns71:p>Supported options:
+ </ns71:p><div class="variablelist"><dl><dt><span class="term">vfs_recycle_bin:repository</span></dt><dd><p>FIXME</p></dd><dt><span class="term">vfs_recycle_bin:keeptree</span></dt><dd><p>FIXME</p></dd><dt><span class="term">vfs_recycle_bin:versions</span></dt><dd><p>FIXME</p></dd><dt><span class="term">vfs_recycle_bin:touch</span></dt><dd><p>FIXME</p></dd><dt><span class="term">vfs_recycle_bin:maxsize</span></dt><dd><p>FIXME</p></dd><dt><span class="term">vfs_recycle_bin:exclude</span></dt><dd><p>FIXME</p></dd><dt><span class="term">vfs_recycle_bin:exclude_dir</span></dt><dd><p>FIXME</p></dd><dt><span class="term">vfs_recycle_bin:noversions</span></dt><dd><p>FIXME</p></dd></dl></div><ns71:p>
+ </ns71:p></div><div xmlns:ns72="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957202"></a>netatalk</h3></div></div><div></div></div><p>
+ A netatalk module, that will ease co-existence of samba and
+ netatalk file sharing services.
+ </p><ns72:p>Advantages compared to the old netatalk module:
+ </ns72:p><table class="simplelist" border="0" summary="Simple list"><tr><td>it doesn't care about creating of .AppleDouble forks, just keeps them in sync</td></tr><tr><td>if a share in <tt class="filename">smb.conf</tt> doesn't contain .AppleDouble item in hide or veto list, it will be added automatically</td></tr></table><ns72:p>
+ </ns72:p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2957247"></a>VFS modules available elsewhere</h2></div></div><div></div></div><p>
+This section contains a listing of various other VFS modules that
+have been posted but don't currently reside in the Samba CVS
+tree for one reason or another (e.g. it is easy for the maintainer
+to have his or her own CVS tree).
+</p><p>
+No statements about the stability or functionality of any module
+should be implied due to its presence here.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957269"></a>DatabaseFS</h3></div></div><div></div></div><p>
+ URL: <a href="http://www.css.tayloru.edu/~elorimer/databasefs/index.php" target="_top">http://www.css.tayloru.edu/~elorimer/databasefs/index.php</a>
+ </p><p>By <a href="mailto:elorimer@css.tayloru.edu" target="_top">Eric Lorimer</a>.</p><p>
+ I have created a VFS module which implements a fairly complete read-only
+ filesystem. It presents information from a database as a filesystem in
+ a modular and generic way to allow different databases to be used
+ (originally designed for organizing MP3s under directories such as
+ "Artists," "Song Keywords," etc... I have since applied it to a student
+ roster database very easily). The directory structure is stored in the
+ database itself and the module makes no assumptions about the database
+ structure beyond the table it requires to run.
+ </p><p>
+ Any feedback would be appreciated: comments, suggestions, patches,
+ etc... If nothing else, hopefully it might prove useful for someone
+ else who wishes to create a virtual filesystem.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957323"></a>vscan</h3></div></div><div></div></div><p>URL: <a href="http://www.openantivirus.org/" target="_top">http://www.openantivirus.org/</a></p><p>
+ samba-vscan is a proof-of-concept module for Samba, which
+ uses the VFS (virtual file system) features of Samba 2.2.x/3.0
+ alphaX. Of couse, Samba has to be compiled with VFS support.
+ samba-vscan supports various virus scanners and is maintained
+ by Rainer Link.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2957352"></a>Common Errors</h2></div></div><div></div></div><p>
+There must be some gotchas we should record here! Jelmer???
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="winbind"></a>Chapter 21. Integrated Logon Support using Winbind</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">Tim</span> <span class="surname">Potter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:tpot@linuxcare.com.au">tpot@linuxcare.com.au</a>></tt></p></div></div></div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:tridge@samba.org">tridge@samba.org</a>></tt></p></div></div></div><div class="author"><h3 class="author"><span class="firstname">Naag</span> <span class="surname">Mummaneni</span></h3><div class="affiliation"><div class="address"><p><tt class="email"><<a href="mailto:getnag@rediffmail.com">getnag@rediffmail.com</a>></tt></p></div></div></div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div><p class="pubdate">27 June 2002</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2957847">Features and Benefits</a></dt><dt><a href="#id2957875">Introduction</a></dt><dt><a href="#id2959857">What Winbind Provides</a></dt><dd><dl><dt><a href="#id2959916">Target Uses</a></dt></dl></dd><dt><a href="#id2959947">How Winbind Works</a></dt><dd><dl><dt><a href="#id2959975">Microsoft Remote Procedure Calls</a></dt><dt><a href="#id2960008">Microsoft Active Directory Services</a></dt><dt><a href="#id2960031">Name Service Switch</a></dt><dt><a href="#id2957393">Pluggable Authentication Modules</a></dt><dt><a href="#id2957465">User and Group ID Allocation</a></dt><dt><a href="#id2957499">Result Caching</a></dt></dl></dd><dt><a href="#id2957528">Installation and Configuration</a></dt><dd><dl><dt><a href="#id2957555">Introduction</a></dt><dt><a href="#id2957630">Requirements</a></dt><dt><a href="#id2958907">Testing Things Out</a></dt></dl></dd><dt><a href="#id2963255">Conclusion</a></dt><dt><a href="#id2963274">Common Errors</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2957847"></a>Features and Benefits</h2></div></div><div></div></div><p>Integration of UNIX and Microsoft Windows NT through
+ a unified logon has been considered a "holy grail" in heterogeneous
+ computing environments for a long time. We present
+ <span class="emphasis"><em>winbind</em></span>, a component of the Samba suite
+ of programs as a solution to the unified logon problem. Winbind
+ uses a UNIX implementation
+ of Microsoft RPC calls, Pluggable Authentication Modules, and the Name
+ Service Switch to allow Windows NT domain users to appear and operate
+ as UNIX users on a UNIX machine. This paper describes the winbind
+ system, explaining the functionality it provides, how it is configured,
+ and how it works internally.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2957875"></a>Introduction</h2></div></div><div></div></div><p>It is well known that UNIX and Microsoft Windows NT have
+ different models for representing user and group information and
+ use different technologies for implementing them. This fact has
+ made it difficult to integrate the two systems in a satisfactory
+ manner.</p><p>One common solution in use today has been to create
+ identically named user accounts on both the UNIX and Windows systems
+ and use the Samba suite of programs to provide file and print services
+ between the two. This solution is far from perfect however, as
+ adding and deleting users on both sets of machines becomes a chore
+ and two sets of passwords are required both of which
+ can lead to synchronization problems between the UNIX and Windows
+ systems and confusion for users.</p><p>We divide the unified logon problem for UNIX machines into
+ three smaller problems:</p><div class="itemizedlist"><ul type="disc"><li><p>Obtaining Windows NT user and group information
+ </p></li><li><p>Authenticating Windows NT users
+ </p></li><li><p>Password changing for Windows NT users
+ </p></li></ul></div><p>Ideally, a prospective solution to the unified logon problem
+ would satisfy all the above components without duplication of
+ information on the UNIX machines and without creating additional
+ tasks for the system administrator when maintaining users and
+ groups on either system. The winbind system provides a simple
+ and elegant solution to all three components of the unified logon
+ problem.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2959857"></a>What Winbind Provides</h2></div></div><div></div></div><p>Winbind unifies UNIX and Windows NT account management by
+ allowing a UNIX box to become a full member of a NT domain. Once
+ this is done the UNIX box will see NT users and groups as if
+ they were native UNIX users and groups, allowing the NT domain
+ to be used in much the same manner that NIS+ is used within
+ UNIX-only environments.</p><p>The end result is that whenever any
+ program on the UNIX machine asks the operating system to lookup
+ a user or group name, the query will be resolved by asking the
+ NT domain controller for the specified domain to do the lookup.
+ Because Winbind hooks into the operating system at a low level
+ (via the NSS name resolution modules in the C library) this
+ redirection to the NT domain controller is completely
+ transparent.</p><p>Users on the UNIX machine can then use NT user and group
+ names as they would use "native" UNIX names. They can chown files
+ so that they are owned by NT domain users or even login to the
+ UNIX machine and run a UNIX X-Window session as a domain user.</p><p>The only obvious indication that Winbind is being used is
+ that user and group names take the form DOMAIN\user and
+ DOMAIN\group. This is necessary as it allows Winbind to determine
+ that redirection to a domain controller is wanted for a particular
+ lookup and which trusted domain is being referenced.</p><p>Additionally, Winbind provides an authentication service
+ that hooks into the Pluggable Authentication Modules (PAM) system
+ to provide authentication via a NT domain to any PAM enabled
+ applications. This capability solves the problem of synchronizing
+ passwords between systems since all passwords are stored in a single
+ location (on the domain controller).</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2959916"></a>Target Uses</h3></div></div><div></div></div><p>Winbind is targeted at organizations that have an
+ existing NT based domain infrastructure into which they wish
+ to put UNIX workstations or servers. Winbind will allow these
+ organizations to deploy UNIX workstations without having to
+ maintain a separate account infrastructure. This greatly
+ simplifies the administrative overhead of deploying UNIX
+ workstations into a NT based organization.</p><p>Another interesting way in which we expect Winbind to
+ be used is as a central part of UNIX based appliances. Appliances
+ that provide file and print services to Microsoft based networks
+ will be able to use Winbind to provide seamless integration of
+ the appliance into the domain.</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2959947"></a>How Winbind Works</h2></div></div><div></div></div><p>The winbind system is designed around a client/server
+ architecture. A long running <b class="command">winbindd</b> daemon
+ listens on a UNIX domain socket waiting for requests
+ to arrive. These requests are generated by the NSS and PAM
+ clients and processed sequentially.</p><p>The technologies used to implement winbind are described
+ in detail below.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2959975"></a>Microsoft Remote Procedure Calls</h3></div></div><div></div></div><p>Over the last few years, efforts have been underway
+ by various Samba Team members to decode various aspects of
+ the Microsoft Remote Procedure Call (MSRPC) system. This
+ system is used for most network related operations between
+ Windows NT machines including remote management, user authentication
+ and print spooling. Although initially this work was done
+ to aid the implementation of Primary Domain Controller (PDC)
+ functionality in Samba, it has also yielded a body of code which
+ can be used for other purposes.</p><p>Winbind uses various MSRPC calls to enumerate domain users
+ and groups and to obtain detailed information about individual
+ users or groups. Other MSRPC calls can be used to authenticate
+ NT domain users and to change user passwords. By directly querying
+ a Windows PDC for user and group information, winbind maps the
+ NT account information onto UNIX user and group names.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2960008"></a>Microsoft Active Directory Services</h3></div></div><div></div></div><p>
+ Since late 2001, Samba has gained the ability to
+ interact with Microsoft Windows 2000 using its 'Native
+ Mode' protocols, rather than the NT4 RPC services.
+ Using LDAP and Kerberos, a domain member running
+ winbind can enumerate users and groups in exactly the
+ same way as a Win2k client would, and in so doing
+ provide a much more efficient and
+ effective winbind implementation.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2960031"></a>Name Service Switch</h3></div></div><div></div></div><p>The Name Service Switch, or NSS, is a feature that is
+ present in many UNIX operating systems. It allows system
+ information such as hostnames, mail aliases and user information
+ to be resolved from different sources. For example, a standalone
+ UNIX workstation may resolve system information from a series of
+ flat files stored on the local filesystem. A networked workstation
+ may first attempt to resolve system information from local files,
+ and then consult a NIS database for user information or a DNS server
+ for hostname information.</p><p>The NSS application programming interface allows winbind
+ to present itself as a source of system information when
+ resolving UNIX usernames and groups. Winbind uses this interface,
+ and information obtained from a Windows NT server using MSRPC
+ calls to provide a new source of account enumeration. Using standard
+ UNIX library calls, one can enumerate the users and groups on
+ a UNIX machine running winbind and see all users and groups in
+ a NT domain plus any trusted domain as though they were local
+ users and groups.</p><p>The primary control file for NSS is
+ <tt class="filename">/etc/nsswitch.conf</tt>.
+ When a UNIX application makes a request to do a lookup
+ the C library looks in <tt class="filename">/etc/nsswitch.conf</tt>
+ for a line which matches the service type being requested, for
+ example the "passwd" service type is used when user or group names
+ are looked up. This config line species which implementations
+ of that service should be tried and in what order. If the passwd
+ config line is:</p><pre class="programlisting">
+passwd: files example
+ </pre><p>then the C library will first load a module called
+ <tt class="filename">/lib/libnss_files.so</tt> followed by
+ the module <tt class="filename">/lib/libnss_example.so</tt>. The
+ C library will dynamically load each of these modules in turn
+ and call resolver functions within the modules to try to resolve
+ the request. Once the request is resolved the C library returns the
+ result to the application.</p><p>This NSS interface provides a very easy way for Winbind
+ to hook into the operating system. All that needs to be done
+ is to put <tt class="filename">libnss_winbind.so</tt> in <tt class="filename">/lib/</tt>
+ then add "winbind" into <tt class="filename">/etc/nsswitch.conf</tt> at
+ the appropriate place. The C library will then call Winbind to
+ resolve user and group names.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957393"></a>Pluggable Authentication Modules</h3></div></div><div></div></div><p>Pluggable Authentication Modules, also known as PAM,
+ is a system for abstracting authentication and authorization
+ technologies. With a PAM module it is possible to specify different
+ authentication methods for different system applications without
+ having to recompile these applications. PAM is also useful
+ for implementing a particular policy for authorization. For example,
+ a system administrator may only allow console logins from users
+ stored in the local password file but only allow users resolved from
+ a NIS database to log in over the network.</p><p>Winbind uses the authentication management and password
+ management PAM interface to integrate Windows NT users into a
+ UNIX system. This allows Windows NT users to log in to a UNIX
+ machine and be authenticated against a suitable Primary Domain
+ Controller. These users can also change their passwords and have
+ this change take effect directly on the Primary Domain Controller.
+ </p><p>PAM is configured by providing control files in the directory
+ <tt class="filename">/etc/pam.d/</tt> for each of the services that
+ require authentication. When an authentication request is made
+ by an application the PAM code in the C library looks up this
+ control file to determine what modules to load to do the
+ authentication check and in what order. This interface makes adding
+ a new authentication service for Winbind very easy, all that needs
+ to be done is that the <tt class="filename">pam_winbind.so</tt> module
+ is copied to <tt class="filename">/lib/security/</tt> and the PAM
+ control files for relevant services are updated to allow
+ authentication via winbind. See the PAM documentation
+ for more details.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957465"></a>User and Group ID Allocation</h3></div></div><div></div></div><p>When a user or group is created under Windows NT
+ is it allocated a numerical relative identifier (RID). This is
+ slightly different to UNIX which has a range of numbers that are
+ used to identify users, and the same range in which to identify
+ groups. It is winbind's job to convert RIDs to UNIX id numbers and
+ vice versa. When winbind is configured it is given part of the UNIX
+ user id space and a part of the UNIX group id space in which to
+ store Windows NT users and groups. If a Windows NT user is
+ resolved for the first time, it is allocated the next UNIX id from
+ the range. The same process applies for Windows NT groups. Over
+ time, winbind will have mapped all Windows NT users and groups
+ to UNIX user ids and group ids.</p><p>The results of this mapping are stored persistently in
+ an ID mapping database held in a tdb database). This ensures that
+ RIDs are mapped to UNIX IDs in a consistent way.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957499"></a>Result Caching</h3></div></div><div></div></div><p>An active system can generate a lot of user and group
+ name lookups. To reduce the network cost of these lookups winbind
+ uses a caching scheme based on the SAM sequence number supplied
+ by NT domain controllers. User or group information returned
+ by a PDC is cached by winbind along with a sequence number also
+ returned by the PDC. This sequence number is incremented by
+ Windows NT whenever any user or group information is modified. If
+ a cached entry has expired, the sequence number is requested from
+ the PDC and compared against the sequence number of the cached entry.
+ If the sequence numbers do not match, then the cached information
+ is discarded and up to date information is requested directly
+ from the PDC.</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2957528"></a>Installation and Configuration</h2></div></div><div></div></div><p>
+Many thanks to John Trostel <a href="mailto:jtrostel@snapserver.com" target="_top">jtrostel@snapserver.com</a>
+for providing the HOWTO for this section.
+</p><p>
+This HOWTO describes how to get winbind services up and running
+to control access and authenticate users on your Linux box using
+the winbind services which come with SAMBA 3.0.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957555"></a>Introduction</h3></div></div><div></div></div><p>
+This section describes the procedures used to get winbind up and
+running on a RedHat 7.1 system. Winbind is capable of providing access
+and authentication control for Windows Domain users through an NT
+or Win2K PDC for 'regular' services, such as telnet a nd ftp, as
+well for SAMBA services.
+</p><p>
+This HOWTO has been written from a 'RedHat-centric' perspective, so if
+you are using another distribution, you may have to modify the instructions
+somewhat to fit the way your distribution works.
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ <span class="emphasis"><em>Why should I to this?</em></span>
+ </p><p>This allows the SAMBA administrator to rely on the
+ authentication mechanisms on the NT/Win2K PDC for the authentication
+ of domain members. NT/Win2K users no longer need to have separate
+ accounts on the SAMBA server.
+ </p></li><li><p>
+ <span class="emphasis"><em>Who should be reading this document?</em></span>
+ </p><p>
+ This HOWTO is designed for system administrators. If you are
+ implementing SAMBA on a file server and wish to (fairly easily)
+ integrate existing NT/Win2K users from your PDC onto the
+ SAMBA server, this HOWTO is for you. That said, I am no NT or PAM
+ expert, so you may find a better or easier way to accomplish
+ these tasks.
+ </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2957630"></a>Requirements</h3></div></div><div></div></div><p>
+If you have a samba configuration file that you are currently
+using... <span class="emphasis"><em>BACK IT UP!</em></span> If your system already uses PAM,
+<span class="emphasis"><em>back up the <tt class="filename">/etc/pam.d</tt> directory
+contents!</em></span> If you haven't already made a boot disk,
+<span class="emphasis"><em>MAKE ONE NOW!</em></span>
+</p><p>
+Messing with the pam configuration files can make it nearly impossible
+to log in to yourmachine. That's why you want to be able to boot back
+into your machine in single user mode and restore your
+<tt class="filename">/etc/pam.d</tt> back to the original state they were in if
+you get frustrated with the way things are going. ;-)
+</p><p>
+The latest version of SAMBA (version 3.0 as of this writing), now
+includes a functioning winbindd daemon. Please refer to the
+<a href="http://samba.org/" target="_top">main SAMBA web page</a> or,
+better yet, your closest SAMBA mirror site for instructions on
+downloading the source code.
+</p><p>
+To allow Domain users the ability to access SAMBA shares and
+files, as well as potentially other services provided by your
+SAMBA machine, PAM (pluggable authentication modules) must
+be setup properly on your machine. In order to compile the
+winbind modules, you should have at least the pam libraries resident
+on your system. For recent RedHat systems (7.1, for instance), that
+means <tt class="filename">pam-0.74-22</tt>. For best results, it is helpful to also
+install the development packages in <tt class="filename">pam-devel-0.74-22</tt>.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2958907"></a>Testing Things Out</h3></div></div><div></div></div><p>
+Before starting, it is probably best to kill off all the SAMBA
+related daemons running on your server. Kill off all <span class="application">smbd</span>,
+<span class="application">nmbd</span>, and <span class="application">winbindd</span> processes that may
+be running. To use PAM, you will want to make sure that you have the
+standard PAM package (for RedHat) which supplies the <tt class="filename">/etc/pam.d</tt>
+directory structure, including the pam modules are used by pam-aware
+services, several pam libraries, and the <tt class="filename">/usr/doc</tt>
+and <tt class="filename">/usr/man</tt> entries for pam. Winbind built better
+in SAMBA if the pam-devel package was also installed. This package includes
+the header files needed to compile pam-aware applications.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2958968"></a>Configure and compile SAMBA</h4></div></div><div></div></div><p>
+The configuration and compilation of SAMBA is pretty straightforward.
+The first three steps may not be necessary depending upon
+whether or not you have previously built the Samba binaries.
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="command">autoconf</b>
+<tt class="prompt">root# </tt><b class="command">make clean</b>
+<tt class="prompt">root# </tt><b class="command">rm config.cache</b>
+<tt class="prompt">root# </tt><b class="command">./configure</b>
+<tt class="prompt">root# </tt><b class="command">make</b>
+<tt class="prompt">root# </tt><b class="command">make install</b>
+</pre><p>
+This will, by default, install SAMBA in <tt class="filename">/usr/local/samba</tt>.
+See the main SAMBA documentation if you want to install SAMBA somewhere else.
+It will also build the winbindd executable and libraries.
+</p></div><div xmlns:ns73="" class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2959080"></a>Configure <tt class="filename">nsswitch.conf</tt> and the
+winbind libraries on Linux and Solaris</h4></div></div><div></div></div><p>
+The libraries needed to run the <span class="application">winbindd</span> daemon
+through nsswitch need to be copied to their proper locations, so
+</p><ns73:p>
+</ns73:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>cp ../samba/source/nsswitch/libnss_winbind.so /lib</tt></b>
+</pre><ns73:p>
+</ns73:p><p>
+I also found it necessary to make the following symbolic link:
+</p><p>
+<tt class="prompt">root# </tt> <b class="userinput"><tt>ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2</tt></b>
+</p><p>And, in the case of Sun solaris:</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1</tt></b>
+<tt class="prompt">root# </tt><b class="userinput"><tt>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1</tt></b>
+<tt class="prompt">root# </tt><b class="userinput"><tt>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2</tt></b>
+</pre><p>
+Now, as root you need to edit <tt class="filename">/etc/nsswitch.conf</tt> to
+allow user and group entries to be visible from the <span class="application">winbindd</span>
+daemon. My <tt class="filename">/etc/nsswitch.conf</tt> file look like
+this after editing:
+</p><pre class="programlisting">
+ passwd: files winbind
+ shadow: files
+ group: files winbind
+</pre><p>
+The libraries needed by the winbind daemon will be automatically
+entered into the <b class="command">ldconfig</b> cache the next time
+your system reboots, but it
+is faster (and you don't need to reboot) if you do it manually:
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>/sbin/ldconfig -v | grep winbind</tt></b>
+</p><p>
+This makes <tt class="filename">libnss_winbind</tt> available to winbindd
+and echos back a check to you.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2959288"></a>NSS Winbind on AIX</h4></div></div><div></div></div><p>(This section is only for those running AIX)</p><p>
+The winbind AIX identification module gets built as libnss_winbind.so in the
+nsswitch directory of the samba source. This file can be copied to
+/usr/lib/security, and the AIX naming convention would indicate that it
+should be named WINBIND. A stanza like the following:
+</p><pre class="programlisting">
+WINBIND:
+ program = /usr/lib/security/WINBIND
+ options = authonly
+</pre><p>can then be added to
+<tt class="filename">/usr/lib/security/methods.cfg</tt>. This module only
+supports identification, but there have been success reports using the
+standard winbind pam module for authentication. Use caution configuring
+loadable authentication modules as it is possible to make it impossible
+to logon to the system. More information about the AIX authentication
+module API can be found at "Kernel Extensions and Device Support
+Programming Concepts for AIX": <a href="http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixprggd/kernextc/sec_load_mod.htm" target="_top">
+Chapter 18. Loadable Authentication Module Programming Interface</a>
+and more information on administering the modules at <a href="http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixbman/baseadmn/iandaadmin.htm" target="_top">
+"System Management Guide: Operating System and Devices"</a>.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2959359"></a>Configure smb.conf</h4></div></div><div></div></div><p>
+Several parameters are needed in the smb.conf file to control
+the behavior of <span class="application">winbindd</span>. Configure
+<tt class="filename">smb.conf</tt> These are described in more detail in
+the <a href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> man page. My
+<tt class="filename">smb.conf</tt> file was modified to
+include the following entries in the [global] section:
+</p><pre class="programlisting">
+[global]
+ <...>
+ # separate domain and username with '+', like DOMAIN+username
+ <a href="winbindd.8.html#WINBINDSEPARATOR" target="_top">winbind separator</a> = +
+ # use uids from 10000 to 20000 for domain users
+ <a href="winbindd.8.html#WINBINDUID" target="_top">winbind uid</a> = 10000-20000
+ # use gids from 10000 to 20000 for domain groups
+ <a href="winbindd.8.html#WINBINDGID" target="_top">winbind gid</a> = 10000-20000
+ # allow enumeration of winbind users and groups
+ <a href="winbindd.8.html#WINBINDENUMUSERS" target="_top">winbind enum users</a> = yes
+ <a href="winbindd.8.html#WINBINDENUMGROUP" target="_top">winbind enum groups</a> = yes
+ # give winbind users a real shell (only needed if they have telnet access)
+ <a href="winbindd.8.html#TEMPLATEHOMEDIR" target="_top">template homedir</a> = /home/winnt/%D/%U
+ <a href="winbindd.8.html#TEMPLATESHELL" target="_top">template shell</a> = /bin/bash
+</pre></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2959473"></a>Join the SAMBA server to the PDC domain</h4></div></div><div></div></div><p>
+Enter the following command to make the SAMBA server join the
+PDC domain, where <i class="replaceable"><tt>DOMAIN</tt></i> is the name of
+your Windows domain and <i class="replaceable"><tt>Administrator</tt></i> is
+a domain user who has administrative privileges in the domain.
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/local/samba/bin/net join -S PDC -U Administrator</tt></b>
+</p><p>
+The proper response to the command should be: "Joined the domain
+<i class="replaceable"><tt>DOMAIN</tt></i>" where <i class="replaceable"><tt>DOMAIN</tt></i>
+is your DOMAIN name.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2962315"></a>Start up the winbindd daemon and test it!</h4></div></div><div></div></div><p>
+Eventually, you will want to modify your smb startup script to
+automatically invoke the winbindd daemon when the other parts of
+SAMBA start, but it is possible to test out just the winbind
+portion first. To start up winbind services, enter the following
+command as root:
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/local/samba/bin/winbindd</tt></b>
+</p><p>
+Winbindd can now also run in 'dual daemon mode'. This will make it
+run as 2 processes. The first will answer all requests from the cache,
+thus making responses to clients faster. The other will
+update the cache for the query that the first has just responded.
+Advantage of this is that responses stay accurate and are faster.
+You can enable dual daemon mode by adding <tt class="option">-B</tt> to the commandline:
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/local/samba/bin/winbindd -B</tt></b>
+</p><p>
+I'm always paranoid and like to make sure the daemon
+is really running...
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>ps -ae | grep winbindd</tt></b>
+</p><p>
+This command should produce output like this, if the daemon is running
+</p><pre class="screen">
+3025 ? 00:00:00 winbindd
+</pre><p>
+Now... for the real test, try to get some information about the
+users on your PDC
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/local/samba/bin/wbinfo -u</tt></b>
+</p><p>
+This should echo back a list of users on your Windows users on
+your PDC. For example, I get the following response:
+</p><pre class="screen">
+ CEO+Administrator
+ CEO+burdell
+ CEO+Guest
+ CEO+jt-ad
+ CEO+krbtgt
+ CEO+TsInternetUser
+</pre><p>
+Obviously, I have named my domain 'CEO' and my <i class="parameter"><tt>winbind
+separator</tt></i> is '+'.
+</p><p>
+You can do the same sort of thing to get group information from
+the PDC:
+</p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/local/samba/bin/wbinfo -g</tt></b>
+ CEO+Domain Admins
+ CEO+Domain Users
+ CEO+Domain Guests
+ CEO+Domain Computers
+ CEO+Domain Controllers
+ CEO+Cert Publishers
+ CEO+Schema Admins
+ CEO+Enterprise Admins
+ CEO+Group Policy Creator Owners
+</pre><p>
+The function 'getent' can now be used to get unified
+lists of both local and PDC users and groups.
+Try the following command:
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>getent passwd</tt></b>
+</p><p>
+You should get a list that looks like your <tt class="filename">/etc/passwd</tt>
+list followed by the domain users with their new uids, gids, home
+directories and default shells.
+</p><p>
+The same thing can be done for groups with the command
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>getent group</tt></b>
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2962555"></a>Fix the init.d startup scripts</h4></div></div><div></div></div><div xmlns:ns74="" class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2962563"></a>Linux</h5></div></div><div></div></div><p>
+The <span class="application">winbindd</span> daemon needs to start up after the
+<span class="application">smbd</span> and <span class="application">nmbd</span> daemons are running.
+To accomplish this task, you need to modify the startup scripts of your system.
+They are located at <tt class="filename">/etc/init.d/smb</tt> in RedHat and
+<tt class="filename">/etc/init.d/samba</tt> in Debian.
+script to add commands to invoke this daemon in the proper sequence. My
+startup script starts up <span class="application">smbd</span>, <span class="application">nmbd</span>, and <span class="application">winbindd</span> from the
+<tt class="filename">/usr/local/samba/bin</tt> directory directly. The 'start'
+function in the script looks like this:
+</p><pre class="programlisting">
+start() {
+ KIND="SMB"
+ echo -n $"Starting $KIND services: "
+ daemon /usr/local/samba/bin/smbd $SMBDOPTIONS
+ RETVAL=$?
+ echo
+ KIND="NMB"
+ echo -n $"Starting $KIND services: "
+ daemon /usr/local/samba/bin/nmbd $NMBDOPTIONS
+ RETVAL2=$?
+ echo
+ KIND="Winbind"
+ echo -n $"Starting $KIND services: "
+ daemon /usr/local/samba/bin/winbindd
+ RETVAL3=$?
+ echo
+ [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && \
+ touch /var/lock/subsys/smb || RETVAL=1
+ return $RETVAL
+}
+</pre><ns74:p>If you would like to run winbindd in dual daemon mode, replace
+the line
+</ns74:p><pre class="programlisting">
+ daemon /usr/local/samba/bin/winbindd
+</pre><ns74:p>
+
+in the example above with:
+
+</ns74:p><pre class="programlisting">
+ daemon /usr/local/samba/bin/winbindd -B
+</pre><ns74:p>.
+</ns74:p><p>
+The 'stop' function has a corresponding entry to shut down the
+services and looks like this:
+</p><pre class="programlisting">
+stop() {
+ KIND="SMB"
+ echo -n $"Shutting down $KIND services: "
+ killproc smbd
+ RETVAL=$?
+ echo
+ KIND="NMB"
+ echo -n $"Shutting down $KIND services: "
+ killproc nmbd
+ RETVAL2=$?
+ echo
+ KIND="Winbind"
+ echo -n $"Shutting down $KIND services: "
+ killproc winbindd
+ RETVAL3=$?
+ [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && \
+ rm -f /var/lock/subsys/smb
+ echo ""
+ return $RETVAL
+}
+</pre></div><div xmlns:ns75="" class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2962708"></a>Solaris</h5></div></div><div></div></div><p>Winbind doesn't work on solaris 9, see the <a href="#winbind-solaris9" title="Winbind on Solaris 9">Portability</a> chapter for details.</p><p>On solaris, you need to modify the
+<tt class="filename">/etc/init.d/samba.server</tt> startup script. It usually
+only starts smbd and nmbd but should now start winbindd too. If you
+have samba installed in <tt class="filename">/usr/local/samba/bin</tt>,
+the file could contains something like this:
+</p><pre class="programlisting">
+ ##
+ ## samba.server
+ ##
+
+ if [ ! -d /usr/bin ]
+ then # /usr not mounted
+ exit
+ fi
+
+ killproc() { # kill the named process(es)
+ pid=`/usr/bin/ps -e |
+ /usr/bin/grep -w $1 |
+ /usr/bin/sed -e 's/^ *//' -e 's/ .*//'`
+ [ "$pid" != "" ] && kill $pid
+ }
+
+ # Start/stop processes required for samba server
+
+ case "$1" in
+
+ 'start')
+ #
+ # Edit these lines to suit your installation (paths, workgroup, host)
+ #
+ echo Starting SMBD
+ /usr/local/samba/bin/smbd -D -s \
+ /usr/local/samba/smb.conf
+
+ echo Starting NMBD
+ /usr/local/samba/bin/nmbd -D -l \
+ /usr/local/samba/var/log -s /usr/local/samba/smb.conf
+
+ echo Starting Winbind Daemon
+ /usr/local/samba/bin/winbindd
+ ;;
+
+ 'stop')
+ killproc nmbd
+ killproc smbd
+ killproc winbindd
+ ;;
+
+ *)
+ echo "Usage: /etc/init.d/samba.server { start | stop }"
+ ;;
+ esac
+</pre><ns75:p>
+Again, if you would like to run samba in dual daemon mode, replace
+</ns75:p><pre class="programlisting">
+ /usr/local/samba/bin/winbindd
+</pre><ns75:p>
+
+in the script above with:
+
+</ns75:p><pre class="programlisting">
+ /usr/local/samba/bin/winbindd -B
+</pre><ns75:p>
+</ns75:p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2962797"></a>Restarting</h5></div></div><div></div></div><p>
+If you restart the <span class="application">smbd</span>, <span class="application">nmbd</span>, and <span class="application">winbindd</span> daemons at this point, you
+should be able to connect to the samba server as a domain member just as
+if you were a local user.
+</p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2962833"></a>Configure Winbind and PAM</h4></div></div><div></div></div><p>
+If you have made it this far, you know that winbindd and samba are working
+together. If you want to use winbind to provide authentication for other
+services, keep reading. The pam configuration files need to be altered in
+this step. (Did you remember to make backups of your original
+<tt class="filename">/etc/pam.d</tt> files? If not, do it now.)
+</p><p>
+You will need a pam module to use winbindd with these other services. This
+module will be compiled in the <tt class="filename">../source/nsswitch</tt> directory
+by invoking the command
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>make nsswitch/pam_winbind.so</tt></b>
+</p><p>
+from the <tt class="filename">../source</tt> directory. The
+<tt class="filename">pam_winbind.so</tt> file should be copied to the location of
+your other pam security modules. On my RedHat system, this was the
+<tt class="filename">/lib/security</tt> directory. On Solaris, the pam security
+modules reside in <tt class="filename">/usr/lib/security</tt>.
+</p><p>
+<tt class="prompt">root# </tt><b class="userinput"><tt>cp ../samba/source/nsswitch/pam_winbind.so /lib/security</tt></b>
+</p><div xmlns:ns76="" class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2962940"></a>Linux/FreeBSD-specific PAM configuration</h5></div></div><div></div></div><p>
+The <tt class="filename">/etc/pam.d/samba</tt> file does not need to be changed. I
+just left this fileas it was:
+</p><pre class="programlisting">
+ auth required /lib/security/pam_stack.so service=system-auth
+ account required /lib/security/pam_stack.so service=system-auth
+</pre><p>
+The other services that I modified to allow the use of winbind
+as an authentication service were the normal login on the console (or a terminal
+session), telnet logins, and ftp service. In order to enable these
+services, you may first need to change the entries in
+<tt class="filename">/etc/xinetd.d</tt> (or <tt class="filename">/etc/inetd.conf</tt>).
+RedHat 7.1 uses the new xinetd.d structure, in this case you need
+to change the lines in <tt class="filename">/etc/xinetd.d/telnet</tt>
+and <tt class="filename">/etc/xinetd.d/wu-ftp</tt> from
+</p><pre class="programlisting">
+ enable = no
+</pre><p>
+to
+</p><pre class="programlisting">
+ enable = yes
+</pre><p>
+For ftp services to work properly, you will also need to either
+have individual directories for the domain users already present on
+the server, or change the home directory template to a general
+directory for all domain users. These can be easily set using
+the <tt class="filename">smb.conf</tt> global entry
+<i class="parameter"><tt>template homedir</tt></i>.
+</p><p>
+The <tt class="filename">/etc/pam.d/ftp</tt> file can be changed
+to allow winbind ftp access in a manner similar to the
+samba file. My <tt class="filename">/etc/pam.d/ftp</tt> file was
+changed to look like this:
+</p><pre class="programlisting">
+ auth required /lib/security/pam_listfile.so item=user sense=deny \
+ file=/etc/ftpusers onerr=succeed
+ auth sufficient /lib/security/pam_winbind.so
+ auth required /lib/security/pam_stack.so service=system-auth
+ auth required /lib/security/pam_shells.so
+ account sufficient /lib/security/pam_winbind.so
+ account required /lib/security/pam_stack.so service=system-auth
+ session required /lib/security/pam_stack.so service=system-auth
+</pre><p>
+The <tt class="filename">/etc/pam.d/login</tt> file can be changed nearly the
+same way. It now looks like this:
+</p><pre class="programlisting">
+ auth required /lib/security/pam_securetty.so
+ auth sufficient /lib/security/pam_winbind.so
+ auth sufficient /lib/security/pam_unix.so use_first_pass
+ auth required /lib/security/pam_stack.so service=system-auth
+ auth required /lib/security/pam_nologin.so
+ account sufficient /lib/security/pam_winbind.so
+ account required /lib/security/pam_stack.so service=system-auth
+ password required /lib/security/pam_stack.so service=system-auth
+ session required /lib/security/pam_stack.so service=system-auth
+ session optional /lib/security/pam_console.so
+</pre><ns76:p>
+In this case, I added the </ns76:p><pre class="programlisting">auth sufficient /lib/security/pam_winbind.so</pre><ns76:p>
+lines as before, but also added the </ns76:p><pre class="programlisting">required pam_securetty.so</pre><ns76:p>
+above it, to disallow root logins over the network. I also added a
+<b class="command">sufficient /lib/security/pam_unix.so use_first_pass</b>
+line after the <b class="command">winbind.so</b> line to get rid of annoying
+double prompts for passwords.
+</ns76:p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2963163"></a>Solaris-specific configuration</h5></div></div><div></div></div><p>
+The /etc/pam.conf needs to be changed. I changed this file so that my Domain
+users can logon both locally as well as telnet.The following are the changes
+that I made.You can customize the pam.conf file as per your requirements,but
+be sure of those changes because in the worst case it will leave your system
+nearly impossible to boot.
+</p><pre class="programlisting">
+ #
+ #ident "@(#)pam.conf 1.14 99/09/16 SMI"
+ #
+ # Copyright (c) 1996-1999, Sun Microsystems, Inc.
+ # All Rights Reserved.
+ #
+ # PAM configuration
+ #
+ # Authentication management
+ #
+ login auth required /usr/lib/security/pam_winbind.so
+ login auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
+ login auth required /usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass
+ #
+ rlogin auth sufficient /usr/lib/security/pam_winbind.so
+ rlogin auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
+ rlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
+ #
+ dtlogin auth sufficient /usr/lib/security/pam_winbind.so
+ dtlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
+ #
+ rsh auth required /usr/lib/security/$ISA/pam_rhosts_auth.so.1
+ other auth sufficient /usr/lib/security/pam_winbind.so
+ other auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
+ #
+ # Account management
+ #
+ login account sufficient /usr/lib/security/pam_winbind.so
+ login account requisite /usr/lib/security/$ISA/pam_roles.so.1
+ login account required /usr/lib/security/$ISA/pam_unix.so.1
+ #
+ dtlogin account sufficient /usr/lib/security/pam_winbind.so
+ dtlogin account requisite /usr/lib/security/$ISA/pam_roles.so.1
+ dtlogin account required /usr/lib/security/$ISA/pam_unix.so.1
+ #
+ other account sufficient /usr/lib/security/pam_winbind.so
+ other account requisite /usr/lib/security/$ISA/pam_roles.so.1
+ other account required /usr/lib/security/$ISA/pam_unix.so.1
+ #
+ # Session management
+ #
+ other session required /usr/lib/security/$ISA/pam_unix.so.1
+ #
+ # Password management
+ #
+ #other password sufficient /usr/lib/security/pam_winbind.so
+ other password required /usr/lib/security/$ISA/pam_unix.so.1
+ dtsession auth required /usr/lib/security/$ISA/pam_unix.so.1
+ #
+ # Support for Kerberos V5 authentication (uncomment to use Kerberos)
+ #
+ #rlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+ #login auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+ #dtlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+ #other auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+ #dtlogin account optional /usr/lib/security/$ISA/pam_krb5.so.1
+ #other account optional /usr/lib/security/$ISA/pam_krb5.so.1
+ #other session optional /usr/lib/security/$ISA/pam_krb5.so.1
+ #other password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+</pre><p>
+I also added a try_first_pass line after the winbind.so line to get rid of
+annoying double prompts for passwords.
+</p><p>
+Now restart your Samba and try connecting through your application that you
+configured in the pam.conf.
+</p></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2963255"></a>Conclusion</h2></div></div><div></div></div><p>The winbind system, through the use of the Name Service
+ Switch, Pluggable Authentication Modules, and appropriate
+ Microsoft RPC calls have allowed us to provide seamless
+ integration of Microsoft Windows NT domain users on a
+ UNIX system. The result is a great reduction in the administrative
+ cost of running a mixed UNIX and NT network.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2963274"></a>Common Errors</h2></div></div><div></div></div><p>Winbind has a number of limitations in its current
+ released version that we hope to overcome in future
+ releases:</p><div class="itemizedlist"><ul type="disc"><li><p>Winbind is currently only available for
+ the Linux, Solaris and IRIX operating systems, although ports to other operating
+ systems are certainly possible. For such ports to be feasible,
+ we require the C library of the target operating system to
+ support the Name Service Switch and Pluggable Authentication
+ Modules systems. This is becoming more common as NSS and
+ PAM gain support among UNIX vendors.</p></li><li><p>The mappings of Windows NT RIDs to UNIX ids
+ is not made algorithmically and depends on the order in which
+ unmapped users or groups are seen by winbind. It may be difficult
+ to recover the mappings of rid to UNIX id mapping if the file
+ containing this information is corrupted or destroyed.</p></li><li><p>Currently the winbind PAM module does not take
+ into account possible workstation and logon time restrictions
+ that may be been set for Windows NT users, this is
+ instead up to the PDC to enforce.</p></li></ul></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="AdvancedNetworkManagement"></a>Chapter 22. Advanced Network Manangement</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2964647">Features and Benefits</a></dt><dt><a href="#id2964678">Remote Server Administration</a></dt><dt><a href="#id2963360">Remote Desktop Management</a></dt><dd><dl><dt><a href="#id2963377">Remote Management from NoMachines.Com</a></dt></dl></dd><dt><a href="#id2963579">Network Logon Script Magic</a></dt><dd><dl><dt><a href="#id2963774">Adding printers without user intervention</a></dt></dl></dd><dt><a href="#id2963806">Common Errors</a></dt></dl></div><p>
+This section documents peripheral issues that are of great importance to network
+administrators who want to improve network resource access control, to automate the user
+environment, and to make their lives a little easier.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2964647"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Often the difference between a working network environment and a well appreciated one can
+best be measured by the <span class="emphasis"><em>little things</em></span> that makes everything work more
+harmoniously. A key part of every network environment solution is the ability to remotely
+manage MS Windows workstations, to remotely access the Samba server, to provide customised
+logon scripts, as well as other house keeping activities that help to sustain more reliable
+network operations.
+</p><p>
+This chapter presents information on each of these area. They are placed here, and not in
+other chapters, for ease of reference.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2964678"></a>Remote Server Administration</h2></div></div><div></div></div><p>
+<span class="emphasis"><em>How do I get 'User Manager' and 'Server Manager'?</em></span>
+</p><p>
+ Since I don't need to buy an <span class="application">NT4 Server</span>, how do I get the 'User Manager for Domains',
+the 'Server Manager'?
+</p><p>
+Microsoft distributes a version of these tools called nexus for installation
+on <span class="application">Windows 9x / Me</span> systems. The tools set includes:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Server Manager</td></tr><tr><td>User Manager for Domains</td></tr><tr><td>Event Viewer</td></tr></table><p>
+Click here to download the archived file <a href="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE" target="_top">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</a>
+</p><p>
+The <span class="application">Windows NT 4.0</span> version of the 'User Manager for
+Domains' and 'Server Manager' are available from Microsoft via ftp
+from <a href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</a>
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2963360"></a>Remote Desktop Management</h2></div></div><div></div></div><p>
+There are a number of possible remote desktop management solutions that range from free
+through costly. Do not let that put you off. Sometimes the most costly solutions is the
+most cost effective. In any case, you will need to draw your own conclusions as to which
+is the best tool in your network environment.
+</p><div xmlns:ns77="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2963377"></a>Remote Management from NoMachines.Com</h3></div></div><div></div></div><p>
+ The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003.
+ It is presented in slightly edited form (with author details omitted for privacy reasons).
+ The entire answer is reproduced below with some comments removed.
+ </p><ns77:p>
+</ns77:p><pre class="screen">
+> I have a wounderfull linux/samba server running as pdc for a network.
+> Now I would like to add remote desktop capabilites so that
+> users outside could login to the system and get their desktop up from
+> home or another country..
+>
+> Is there a way to acomplish this? Do I need a windows terminal server?
+> Do I need to configure it so that it is a member of the domain or a
+> BDC,PDC? Are there any hacks for MS Windows XP to enable remote login
+> even if the computer is in a domain?
+>
+> Any ideas/experience would be appreciated :)
+</pre><ns77:p>
+</ns77:p><p>
+ Answer provided: Check out the new offer from NoMachine, "NX" software:
+ <a href="http://www.nomachine.com/" target="_top">http://www.nomachine.com/</a>.
+ </p><p>
+ It implements a very easy-to-use interface to the remote X protocol as
+ well as incorporating VNC/RFB and rdesktop/RDP into it, but at a speed
+ performance much better than anything you may have ever seen...
+ </p><p>
+ Remote X is not new at all -- but what they did achieve successfully is
+ a new way of compression and caching technologies which makes the thing
+ fast enough to run even over slow modem/ISDN connections.
+ </p><p>
+ I could testdrive their (public) RedHat machine in Italy, over a loaded
+ internet connection, with enabled thumbnail previews in KDE konqueror
+ which popped up immediately on "mouse-over". From inside that (remote X)
+ session I started a rdesktop session on another, a Windows XP machine.
+ To test the performance, I played Pinball. I am proud to announce here
+ that my score was 631750 points at first try...
+ </p><p>
+ NX performs better on my local LAN than any of the other "pure"
+ connection methods I am using from time to time: TightVNC, rdesktop or
+ remote X. It is even faster than a direct crosslink connection between
+ two nodes.
+ </p><p>
+ I even got sound playing from the remote X app to my local boxes, and
+ had a working "copy'n'paste" from an NX window (running a KDE session
+ in Italy) to my Mozilla mailing agent... These guys are certainly doing
+ something right!
+ </p><p>
+ I recommend to testdrive NX to anybody with a only a remote interest
+ in remote computing
+ <a href="http://www.nomachine.com/testdrive.php" target="_top">http://www.nomachine.com/testdrive.php</a>.
+ </p><p>
+ Just download the free of charge client software (available for RedHat,
+ SuSE, Debian and Windows) and be up and running within 5 minutes (they
+ need to send you your account data, though, because you are assigned
+ a real Unix account on their testdrive.nomachine.com box...
+ </p><p>
+ They plan to get to the point were you can have NX application servers
+ running as a cluster of nodes, and users simply start an NX session locally,
+ and can select applications to run transparently (apps may even run on
+ another NX node, but pretend to be on the same as used for initial login,
+ because it displays in the same window.... well, you also can run it
+ fullscreen, and after a short time you forget that it is a remote session
+ at all).
+ </p><p>
+ Now the best thing at the end: all the core compression and caching
+ technologies are released under the GPL and available as source code
+ to anybody who wants to build on it! These technolgies are working,
+ albeit started from the command line only (and very inconvenient to
+ use in order to get a fully running remote X session up and running....)
+ </p><p>
+ To answer your questions:
+ </p><div class="itemizedlist"><ul type="disc"><li><p>
+ You don't need to install a terminal server; XP has RDP support built in.
+ </p></li><li><p>
+ NX is much cheaper than Citrix -- and comparable in performance, probably faster
+ </p></li><li><p>
+ You don't need to hack XP -- it just works
+ </p></li><li><p>
+ You log into the XP box from remote transparently (and I think there is no
+ need to change anything to get a connection, even if authentication is against a domain)
+ </p></li><li><p>
+ The NX core technologies are all Open Source and released under the GPL --
+ you can today use a (very inconvenient) commandline to use it at no cost,
+ but you can buy a comfortable (proprietary) NX GUI frontend for money
+ </p></li><li><p>
+ NoMachine are encouraging and offering help to OSS/Free Software implementations
+ for such a frontend too, even if it means competition to them (they have written
+ to this effect even to the LTSP, KDE and GNOME developer mailing lists)
+ </p></li></ul></div></div></div><div xmlns:ns78="" class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2963579"></a>Network Logon Script Magic</h2></div></div><div></div></div><p>
+This section needs work. Volunteer contributions most welcome. Please send your patches or updates
+to <a href="mailto:jht@samba.org" target="_top">John Terpstra</a>.
+</p><p>
+There are several opportunities for creating a custom network startup configuration environment.
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>No Logon Script</td></tr><tr><td>Simple universal Logon Script that applies to all users</td></tr><tr><td>Use of a conditional Logon Script that applies per user or per group attirbutes</td></tr><tr><td>Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create
+ a custom Logon Script and then execute it.</td></tr><tr><td>User of a tool such as KixStart</td></tr></table><p>
+The Samba source code tree includes two logon script generation/execution tools.
+See <tt class="filename">examples</tt> directory <tt class="filename">genlogon</tt> and
+<tt class="filename">ntlogon</tt> subdirectories.
+</p><p>
+The following listings are from the genlogon directory.
+</p><ns78:p>
+This is the <tt class="filename">genlogon.pl</tt> file:
+
+</ns78:p><pre class="programlisting">
+ #!/usr/bin/perl
+ #
+ # genlogon.pl
+ #
+ # Perl script to generate user logon scripts on the fly, when users
+ # connect from a Windows client. This script should be called from smb.conf
+ # with the %U, %G and %L parameters. I.e:
+ #
+ # root preexec = genlogon.pl %U %G %L
+ #
+ # The script generated will perform
+ # the following:
+ #
+ # 1. Log the user connection to /var/log/samba/netlogon.log
+ # 2. Set the PC's time to the Linux server time (which is maintained
+ # daily to the National Institute of Standard's Atomic clock on the
+ # internet.
+ # 3. Connect the user's home drive to H: (H for Home).
+ # 4. Connect common drives that everyone uses.
+ # 5. Connect group-specific drives for certain user groups.
+ # 6. Connect user-specific drives for certain users.
+ # 7. Connect network printers.
+
+ # Log client connection
+ #($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
+ ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
+ open LOG, ">>/var/log/samba/netlogon.log";
+ print LOG "$mon/$mday/$year $hour:$min:$sec - User $ARGV[0] logged into $ARGV[1]\n";
+ close LOG;
+
+ # Start generating logon script
+ open LOGON, ">/shared/netlogon/$ARGV[0].bat";
+ print LOGON "\@ECHO OFF\r\n";
+
+ # Connect shares just use by Software Development group
+ if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev")
+ {
+ print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n";
+ }
+
+ # Connect shares just use by Technical Support staff
+ if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support")
+ {
+ print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n";
+ }
+
+ # Connect shares just used by Administration staff
+ If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin")
+ {
+ print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n";
+ print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n";
+ }
+
+ # Now connect Printers. We handle just two or three users a little
+ # differently, because they are the exceptions that have desktop
+ # printers on LPT1: - all other user's go to the LaserJet on the
+ # server.
+ if ($ARGV[0] eq 'jim'
+ || $ARGV[0] eq 'yvonne')
+ {
+ print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n";
+ print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
+ }
+ else
+ {
+ print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n";
+ print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
+ }
+
+ # All done! Close the output file.
+ close LOGON;
+</pre><ns78:p>
+</ns78:p><p>
+Those wishing to use more elaborate or capable logon processing system should check out the following sites:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a href="http://www.craigelachie.org/rhacer/ntlogon" target="_top">http://www.craigelachie.org/rhacer/ntlogon</a></td></tr><tr><td><a href="http://www.kixtart.org" target="_top">http://www.kixtart.org</a></td></tr><tr><td><a href="http://support.microsoft.com/default.asp?scid=kb;en-us;189105" target="_top">http://support.microsoft.com/default.asp?scid=kb;en-us;189105</a></td></tr></table><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2963774"></a>Adding printers without user intervention</h3></div></div><div></div></div><ns78:p>
+Printers may be added automatically during logon script processing through the use of:
+
+</ns78:p><pre class="programlisting">
+ rundll32 printui.dll,PrintUIEntry /?
+</pre><ns78:p>
+
+See the documentation in the <a href="http://support.microsoft.com/default.asp?scid=kb;en-us;189105" target="_top">Microsoft knowledgebase article no: 189105</a>.
+</ns78:p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2963806"></a>Common Errors</h2></div></div><div></div></div><p>
+The information provided in this chapter has been reproduced from postings on the samba@samba.org
+mailing list. No implied endorsement or recommendation is offered. Administrators should conduct
+their own evaluation of alternatives and are encouraged to draw their own conclusions.
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="PolicyMgmt"></a>Chapter 23. System and Account Policies</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2964204">Features and Benefits</a></dt><dt><a href="#id2964256">Creating and Managing System Policies</a></dt><dd><dl><dt><a href="#id2964367">Windows 9x/Me Policies</a></dt><dt><a href="#id2963915">Windows NT4 Style Policy Files</a></dt><dt><a href="#id2964048">MS Windows 200x / XP Professional Policies</a></dt></dl></dd><dt><a href="#id2965490">Managing Account/User Policies</a></dt><dd><dl><dt><a href="#id2965591">Samba Editreg Toolset</a></dt><dt><a href="#id2965611">Windows NT4/200x</a></dt><dt><a href="#id2965631">Samba PDC</a></dt></dl></dd><dt><a href="#id2965676">System Startup and Logon Processing Overview</a></dt><dt><a href="#id2965823">Common Errors</a></dt><dd><dl><dt><a href="#id2965837">Policy Does Not Work</a></dt></dl></dd></dl></div><p>
+This chapter summarises the current state of knowledge derived from personal
+practice and knowledge from samba mailing list subscribers. Before reproduction
+of posted information effort has been made to validate the information provided.
+Where additional information was uncovered through this validation it is provided
+also.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2964204"></a>Features and Benefits</h2></div></div><div></div></div><p>
+When MS Windows NT3.5 was introduced the hot new topic was the ability to implmement
+Group Policies for users and group. Then along came MS Windows NT4 and a few sites
+started to adopt this capability. How do we know that? By way of the number of "booboos"
+(or mistakes) administrators made and then requested help to resolve.
+</p><p>
+By the time that MS Windows 2000 and Active Directory was released, administrators
+got the message: Group Policies are a good thing! They can help reduce administrative
+costs and actually can help to create happier users. But adoption of the true
+potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users
+and machines were picked up on rather slowly. This was very obvious from the samba
+mailing list as in 2000 and 2001 there were very few postings regarding GPOs and
+how to replicate them in a Samba environment.
+</p><p>
+Judging by the traffic volume since mid 2002, GPOs have become a standard part of
+the deployment in many sites. This chapter reviews techniques and methods that can
+be used to exploit opportunities for automation of control over user desktops and
+network client workstations.
+</p><p>
+A tool new to Samba-3 may become an important part of the future Samba Administrators'
+arsenal. The <b class="command">editreg</b> tool is described in this document.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2964256"></a>Creating and Managing System Policies</h2></div></div><div></div></div><p>
+Under MS Windows platforms, particularly those following the release of MS Windows
+NT4 and MS Windows 95) it is possible to create a type of file that would be placed
+in the NETLOGON share of a domain controller. As the client logs onto the network
+this file is read and the contents initiate changes to the registry of the client
+machine. This file allows changes to be made to those parts of the registry that
+affect users, groups of users, or machines.
+</p><p>
+For MS Windows 9x/Me this file must be called <tt class="filename">Config.POL</tt> and may
+be generated using a tool called <tt class="filename">poledit.exe</tt>, better known as the
+Policy Editor. The policy editor was provided on the Windows 98 installation CD, but
+dissappeared again with the introduction of MS Windows Me (Millenium Edition). From
+comments from MS Windows network administrators it would appear that this tool became
+a part of the MS Windows Me Resource Kit.
+</p><p>
+MS Windows NT4 Server products include the <span class="emphasis"><em>System Policy Editor</em></span>
+under the <tt class="filename">Start -> Programs -> Administrative Tools</tt> menu item.
+For MS Windows NT4 and later clients this file must be called <tt class="filename">NTConfig.POL</tt>.
+</p><p>
+New with the introduction of MS Windows 2000 was the Microsoft Management Console
+or MMC. This tool is the new wave in the ever changing landscape of Microsoft
+methods for management of network access and security. Every new Microsoft product
+or technology seems to obsolete the old rules and to introduce newer and more
+complex tools and methods. To Microsoft's credit though, the MMC does appear to
+be a step forward, but improved functionality comes at a great price.
+</p><p>
+Before embarking on the configuration of network and system policies it is highly
+advisable to read the documentation available from Microsoft's web site regarding
+<a href="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp" target="_top">
+Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp</a> available from Microsoft.
+There are a large number of documents in addition to this old one that should also
+be read and understood. Try searching on the Microsoft web site for "Group Policies".
+</p><p>
+What follows is a very brief discussion with some helpful notes. The information provided
+here is incomplete - you are warned.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2964367"></a>Windows 9x/Me Policies</h3></div></div><div></div></div><p>
+ You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me.
+ It can be found on the Original full product Win98 installation CD under
+ <tt class="filename">tools/reskit/netadmin/poledit</tt>. Install this using the
+ Add/Remove Programs facility and then click on the 'Have Disk' tab.
+ </p><p>
+ Use the Group Policy Editor to create a policy file that specifies the location of
+ user profiles and/or the <tt class="filename">My Documents</tt> etc. Then save these
+ settings in a file called <tt class="filename">Config.POL</tt> that needs to be placed in the
+ root of the <i class="parameter"><tt>[NETLOGON]</tt></i> share. If Win98 is configured to log onto
+ the Samba Domain, it will automatically read this file and update the Win9x/Me registry
+ of the machine as it logs on.
+ </p><p>
+ Further details are covered in the Win98 Resource Kit documentation.
+ </p><p>
+ If you do not take the right steps, then every so often Win9x/Me will check the
+ integrity of the registry and will restore it's settings from the back-up
+ copy of the registry it stores on each Win9x/Me machine. Hence, you will
+ occasionally notice things changing back to the original settings.
+ </p><p>
+ Install the group policy handler for Win9x to pick up group policies. Look on the
+ Win98 CD in <tt class="filename">\tools\reskit\netadmin\poledit</tt>.
+ Install group policies on a Win9x client by double-clicking
+ <tt class="filename">grouppol.inf</tt>. Log off and on again a couple of times and see
+ if Win98 picks up group policies. Unfortunately this needs to be done on every
+ Win9x/Me machine that uses group policies.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2963915"></a>Windows NT4 Style Policy Files</h3></div></div><div></div></div><p>
+ To create or edit <tt class="filename">ntconfig.pol</tt> you must use the NT Server
+ Policy Editor, <b class="command">poledit.exe</b> which is included with NT4 Server
+ but <span class="emphasis"><em>not NT Workstation</em></span>. There is a Policy Editor on a NT4
+ Workstation but it is not suitable for creating <span class="emphasis"><em>Domain Policies</em></span>.
+ Further, although the Windows 95 Policy Editor can be installed on an NT4
+ Workstation/Server, it will not work with NT clients. However, the files from
+ the NT Server will run happily enough on an NT4 Workstation.
+ </p><p>
+ You need <tt class="filename">poledit.exe</tt>, <tt class="filename">common.adm</tt> and <tt class="filename">winnt.adm</tt>.
+ It is convenient to put the two *.adm files in the <tt class="filename">c:\winnt\inf</tt>
+ directory which is where the binary will look for them unless told otherwise. Note also that that
+ directory is normally 'hidden'.
+ </p><p>
+ The Windows NT policy editor is also included with the Service Pack 3 (and
+ later) for Windows NT 4.0. Extract the files using <b class="command">servicepackname /x</b>,
+ i.e. that's <b class="command">Nt4sp6ai.exe /x</b> for service pack 6a. The policy editor,
+ <b class="command">poledit.exe</b> and the associated template files (*.adm) should
+ be extracted as well. It is also possible to downloaded the policy template
+ files for Office97 and get a copy of the policy editor. Another possible
+ location is with the Zero Administration Kit available for download from Microsoft.
+ </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2964024"></a>Registry Spoiling</h4></div></div><div></div></div><p>
+ With NT4 style registry based policy changes, a large number of settings are not
+ automatically reversed as the user logs off. Since the settings that were in the
+ NTConfig.POL file were applied to the client machine registry and that apply to the
+ hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known
+ as tattooing. It can have serious consequences down-stream and the administrator must
+ be extremely careful not to lock out the ability to manage the machine at a later date.
+ </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2964048"></a>MS Windows 200x / XP Professional Policies</h3></div></div><div></div></div><p>
+ Windows NT4 System policies allows setting of registry parameters specific to
+ users, groups and computers (client workstations) that are members of the NT4
+ style domain. Such policy file will work with MS Windows 2000 / XP clients also.
+ </p><p>
+ New to MS Windows 2000 Microsoft introduced a new style of group policy that confers
+ a superset of capabilities compared with NT4 style policies. Obviously, the tool used
+ to create them is different, and the mechanism for implementing them is much changed.
+ </p><p>
+ The older NT4 style registry based policies are known as <span class="emphasis"><em>Administrative Templates</em></span>
+ in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security
+ configurations, enforce Internet Explorer browser settings, change and redirect aspects of the
+ users' desktop (including: the location of <tt class="filename">My Documents</tt> files (directory), as
+ well as intrinsics of where menu items will appear in the Start menu). An additional new
+ feature is the ability to make available particular software Windows applications to particular
+ users and/or groups.
+ </p><p>
+ Remember: NT4 policy files are named <tt class="filename">NTConfig.POL</tt> and are stored in the root
+ of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password
+ and selects the domain name to which the logon will attempt to take place. During the logon
+ process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating
+ server, modifies the local registry values according to the settings in this file.
+ </p><p>
+ Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of
+ a Windows 200x policy file is stored in the Active Directory itself and the other part is stored
+ in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active
+ Directory domain controllers. The part that is stored in the Active Directory itself is called the
+ group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is
+ known as the group policy template (GPT).
+ </p><p>
+ With NT4 clients the policy file is read and executed upon only as each user logs onto the network.
+ MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine
+ startup (machine specific part) and when the user logs onto the network the user specific part
+ is applied. In MS Windows 200x style policy management each machine and/or user may be subject
+ to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows
+ the administrator to also set filters over the policy settings. No such equivalent capability
+ exists with NT4 style policy files.
+ </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2964149"></a>Administration of Win2K / XP Policies</h4></div></div><div></div></div><p>
+ Instead of using the tool called <span class="application">The System Policy Editor</span>, commonly called Poledit (from the
+ executable name <b class="command">poledit.exe</b>), <span class="acronym">GPOs</span> are created and managed using a
+ <span class="application">Microsoft Management Console</span> <span class="acronym">(MMC)</span> snap-in as follows:</p><div class="procedure"><ol type="1"><li><p>
+ Go to the Windows 200x / XP menu <span class="guimenu">Start->Programs->Administrative Tools</span>
+ and select the MMC snap-in called <span class="guimenuitem">Active Directory Users and Computers</span>
+ </p></li><li><p>
+ Select the domain or organizational unit (OU) that you wish to manage, then right click
+ to open the context menu for that object, select the properties item.
+ </p></li><li><p>
+ Now left click on the <span class="guilabel">Group Policy</span> tab, then left click on the New tab. Type a name
+ for the new policy you will create.
+ </p></li><li><p>
+ Now left click on the <span class="guilabel">Edit</span> tab to commence the steps needed to create the GPO.
+ </p></li></ol></div><p>
+ All policy configuration options are controlled through the use of policy administrative
+ templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP.
+ Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x.
+ The later introduces many new features as well as extended definition capabilities. It is
+ well beyond the scope of this documentation to explain how to program .adm files, for that
+ the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular
+ version of MS Windows.
+ </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+ The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used
+ to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you
+ use this powerful tool. Please refer to the resource kit manuals for specific usage information.
+ </p></div></div></div></div><div xmlns:ns79="" class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2965490"></a>Managing Account/User Policies</h2></div></div><div></div></div><p>
+Policies can define a specific user's settings or the settings for a group of users. The resulting
+policy file contains the registry settings for all users, groups, and computers that will be using
+the policy file. Separate policy files for each user, group, or computer are not not necessary.
+</p><p>
+If you create a policy that will be automatically downloaded from validating domain controllers,
+you should name the file NTconfig.POL. As system administrator, you have the option of renaming the
+policy file and, by modifying the Windows NT-based workstation, directing the computer to update
+the policy from a manual path. You can do this by either manually changing the registry or by using
+the System Policy Editor. This path can even be a local path such that each machine has its own policy file,
+but if a change is necessary to all machines, this change must be made individually to each workstation.
+</p><p>
+When a Windows NT4/200x/XP machine logs onto the network the NETLOGON share on the authenticating domain
+controller for the presence of the NTConfig.POL file. If one exists it is downloaded, parsed and then
+applied to the user's part of the registry.
+</p><p>
+MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally,
+acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory
+itself. The key benefit of using AS GPOs is that they impose no registry <span class="emphasis"><em>spoiling</em></span> effect.
+This has considerable advanage compared with the use of NTConfig.POL (NT4) style policy updates.
+</p><p>
+In addition to user access controls that may be imposed or applied via system and/or group policies
+in a manner that works in conjunction with user profiles, the user management environment under
+MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied.
+Common restrictions that are frequently used includes:
+</p><ns79:p>
+</ns79:p><table class="simplelist" border="0" summary="Simple list"><tr><td>Logon Hours</td></tr><tr><td>Password Aging</td></tr><tr><td>Permitted Logon from certain machines only</td></tr><tr><td>Account type (Local or Global)</td></tr><tr><td>User Rights</td></tr></table><ns79:p>
+</ns79:p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965591"></a>Samba Editreg Toolset</h3></div></div><div></div></div><p>
+ Describe in detail the benefits of <b class="command">editreg</b> and how to use it.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965611"></a>Windows NT4/200x</h3></div></div><div></div></div><p>
+ The tools that may be used to configure these types of controls from the MS Windows environment are:
+ The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe).
+ Under MS Windows 200x/XP this is done using the Microsoft Managment Console (MMC) with approapriate
+ "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965631"></a>Samba PDC</h3></div></div><div></div></div><p>
+ With a Samba Domain Controller, the new tools for managing of user account and policy information includes:
+ <b class="command">smbpasswd</b>, <b class="command">pdbedit</b>, <b class="command">net</b>, <b class="command">rpcclient</b>.
+ The administrator should read the
+ man pages for these tools and become familiar with their use.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2965676"></a>System Startup and Logon Processing Overview</h2></div></div><div></div></div><p>
+The following attempts to document the order of processing of system and user policies following a system
+reboot and as part of the user logon:
+</p><div class="orderedlist"><ol type="1"><li><p>
+ Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming
+ Convention Provider (MUP) start
+ </p></li><li xmlns:ns80=""><ns80:p>
+ Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded
+ and applied. The list may include GPOs that:
+</ns80:p><table class="simplelist" border="0" summary="Simple list"><tr><td>Apply to the location of machines in a Directory</td></tr><tr><td>Apply only when settings have changed</td></tr><tr><td>Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.</td></tr></table><ns80:p>
+ No desktop user interface is presented until the above have been processed.
+ </ns80:p></li><li><p>
+ Execution of start-up scripts (hidden and synchronous by defaut).
+ </p></li><li><p>
+ A keyboard action to affect start of logon (Ctrl-Alt-Del).
+ </p></li><li><p>
+ User credentials are validated, User profile is loaded (depends on policy settings).
+ </p></li><li xmlns:ns81=""><ns81:p>
+ An ordered list of User GPOs is obtained. The list contents depends on what is configured in respsect of:
+
+</ns81:p><table class="simplelist" border="0" summary="Simple list"><tr><td>Is user a domain member, thus subject to particular policies</td></tr><tr><td>Loopback enablement, and the state of the loopback policy (Merge or Replace)</td></tr><tr><td>Location of the Active Directory itself</td></tr><tr><td>Has the list of GPOs changed. No processing is needed if not changed.</td></tr></table><ns81:p>
+ </ns81:p></li><li><p>
+ User Policies are applied from Active Directory. Note: There are several types.
+ </p></li><li><p>
+ Logon scripts are run. New to Win2K and Active Directory, logon scripts may be obtained based on Group
+ Policy objects (hidden and executed synchronously). NT4 style logon scripts are then run in a normal
+ window.
+ </p></li><li><p>
+ The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4
+ Domain) machine (system) policies are applied at start-up, User policies are applied at logon.
+ </p></li></ol></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2965823"></a>Common Errors</h2></div></div><div></div></div><p>
+Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following
+collection demonstrates only basic issues.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2965837"></a>Policy Does Not Work</h3></div></div><div></div></div><p>
+Question: We have created the <tt class="filename">config.pol</tt> file and put it in the <span class="emphasis"><em>NETLOGON</em></span> share.
+It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not
+work any longer since we upgraded to Win XP Pro. Any hints?
+</p><p>
+<span class="emphasis"><em>ANSWER:</em></span> Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based
+platforms. You need to use the NT4 Group Policy Editor to create a file called <tt class="filename">NTConfig.POL</tt> so that
+it is in the correct format for your MS Windows XP Pro clients.
+</p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ProfileMgmt"></a>Chapter 24. Desktop Profile Management</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2965940">Features and Benefits</a></dt><dt><a href="#id2965973">Roaming Profiles</a></dt><dd><dl><dt><a href="#id2966014">Samba Configuration for Profile Handling</a></dt><dt><a href="#id2971377">Windows Client Profile Configuration Information</a></dt><dt><a href="#id2972314">Sharing Profiles between W9x/Me and NT4/200x/XP workstations</a></dt><dt><a href="#id2972378">Profile Migration from Windows NT4/200x Server to Samba</a></dt></dl></dd><dt><a href="#id2972638">Mandatory profiles</a></dt><dt><a href="#id2972696">Creating/Managing Group Profiles</a></dt><dt><a href="#id2972742">Default Profile for Windows Users</a></dt><dd><dl><dt><a href="#id2972762">MS Windows 9x/Me</a></dt><dt><a href="#id2972910">MS Windows NT4 Workstation</a></dt><dt><a href="#id2973464">MS Windows 200x/XP</a></dt></dl></dd><dt><a href="#id2973968">Common Errors</a></dt><dd><dl><dt><a href="#id2973980">How does one set up roaming profiles for just one (or a few) user/s or group/s?</a></dt><dt><a href="#id2974043">Can NOT use Roaming Profiles</a></dt><dt><a href="#id2974262">Changing the default profile</a></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2965940"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for
+some administrators.
+</p><p>
+Roaming Profiles allow an administrator to make available a consistent user desktop
+as the user moves from one machine to another. This chapter provides much information
+regarding how to configure and manage Roaming Profiles.
+</p><p>
+While Roaming Profiles might sound like nirvana to some, they are a real and tangible
+problem to others. In particular, users of mobile computing tools, where often there may not
+be a sustained network connection, are often better served by purely Local Profiles.
+This chapter provides information to help the Samba administrator to deal with those
+situations also.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2965973"></a>Roaming Profiles</h2></div></div><div></div></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+Roaming profiles support is different for Win9x / Me and Windows NT4/200x.
+</p></div><p>
+Before discussing how to configure roaming profiles, it is useful to see how
+Windows 9x / Me and Windows NT4/200x clients implement these features.
+</p><p>
+Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's
+profiles location. However, the response does not have room for a separate
+profiles location field, only the user's home share. This means that Win9X/Me
+profiles are restricted to being stored in the user's home directory.
+</p><p>
+Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields,
+including a separate field for the location of the user's profiles.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2966014"></a>Samba Configuration for Profile Handling</h3></div></div><div></div></div><p>
+This section documents how to configure Samba for MS Windows client profile support.
+</p><div xmlns:ns82="" class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2966027"></a>NT4/200x User Profiles</h4></div></div><div></div></div><p>
+To support Windowns NT4/200x clients, in the [global] section of smb.conf set the
+following (for example):
+</p><ns82:p>
+</ns82:p><pre class="programlisting">
+ logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
+</pre><ns82:p>
+
+ This is typically implemented like:
+
+</ns82:p><pre class="programlisting">
+ logon path = \\%L\Profiles\%u
+</pre><ns82:p>
+where %L translates to the name of the Samba server and %u translates to the user name
+</ns82:p><p>
+The default for this option is <tt class="filename">\\%N\%U\profile</tt>,
+namely <tt class="filename">\\sambaserver\username\profile</tt>.
+The <tt class="filename">\\N%\%U</tt> service is created automatically by the [homes] service. If you are using
+a samba server for the profiles, you _must_ make the share specified in the logon path
+browseable. Please refer to the man page for <tt class="filename">smb.conf</tt> in respect of the different
+symantics of %L and %N, as well as %U and %u.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+MS Windows NT/2K clients at times do not disconnect a connection to a server
+between logons. It is recommended to NOT use the <i class="parameter"><tt>homes</tt></i>
+meta-service name as part of the profile share path.
+</p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2966116"></a>Windows 9x / Me User Profiles</h4></div></div><div></div></div><p>
+ To support Windows 9x / Me clients, you must use the <i class="parameter"><tt>logon home</tt></i> parameter. Samba has
+now been fixed so that <b class="userinput"><tt>net use /home</tt></b> now works as well, and it, too, relies
+on the <b class="command">logon home</b> parameter.
+</p><p>
+By using the logon home parameter, you are restricted to putting Win9x / Me
+profiles in the user's home directory. But wait! There is a trick you
+can use. If you set the following in the <i class="parameter"><tt>[global]</tt></i> section of your <tt class="filename">smb.conf</tt> file:
+</p><pre class="programlisting">
+ logon home = \\%L\%U\.profiles
+</pre><p>
+then your Windows 9x / Me clients will dutifully put their clients in a subdirectory
+of your home directory called <tt class="filename">.profiles</tt> (thus making them hidden).
+</p><p>
+Not only that, but <b class="userinput"><tt>net use /home</tt></b> will also work, because of a feature in
+Windows 9x / Me. It removes any directory stuff off the end of the home directory area
+and only uses the server and share portion. That is, it looks like you
+specified <tt class="filename">\\%L\%U</tt> for <i class="parameter"><tt>logon home</tt></i>.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2971192"></a>Mixed Windows 9x / Me and Windows NT4/200x User Profiles</h4></div></div><div></div></div><p>
+You can support profiles for both Win9X and WinNT clients by setting both the
+<i class="parameter"><tt>logon home</tt></i> and <i class="parameter"><tt>logon path</tt></i> parameters. For example:
+</p><pre class="programlisting">
+ logon home = \\%L\%u\.profiles
+ logon path = \\%L\profiles\%u
+</pre></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2971228"></a>Disabling Roaming Profile Support</h4></div></div><div></div></div><p>
+ A question often asked is “<span class="quote">How may I enforce use of local profiles?</span>” or
+ “<span class="quote">How do I disable Roaming Profiles?</span>”
+</p><p>
+There are three ways of doing this:
+</p><div class="variablelist"><dl><dt><span class="term">In <tt class="filename">smb.conf</tt></span></dt><dd xmlns:ns83=""><ns83:p>
+ Affect the following settings and ALL clients
+ will be forced to use a local profile:
+ </ns83:p><pre class="programlisting">
+ logon home =
+ logon path =
+ </pre><ns83:p>
+ </ns83:p></dd><dt><span class="term">MS Windows Registry:</span></dt><dd xmlns:ns84=""><ns84:p>
+ By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is:
+
+ </ns84:p><pre class="programlisting">
+ Local Computer Policy\
+ Computer Configuration\
+ Administrative Templates\
+ System\
+ User Profiles\
+
+ Disable: Only Allow Local User Profiles
+ Disable: Prevent Roaming Profile Change from Propogating to the Server
+ </pre><ns84:p>
+ </ns84:p></dd><dt><span class="term">Change of Profile Type:</span></dt><dd><p>
+ From the start menu right click on the
+ My Computer icon, select <span class="guimenuitem">Properties</span>, click on the <span class="guilabel">User Profiles</span>
+ tab, select the profile you wish to change from Roaming type to Local, click <span class="guibutton">Change Type</span>.
+ </p></dd></dl></div><p>
+Consult the MS Windows registry guide for your particular MS Windows version for more
+information about which registry keys to change to enforce use of only local user
+profiles.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The specifics of how to convert a local profile to a roaming profile, or a roaming profile
+to a local one vary according to the version of MS Windows you are running. Consult the
+Microsoft MS Windows Resource Kit for your version of Windows for specific information.
+</p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2971377"></a>Windows Client Profile Configuration Information</h3></div></div><div></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2971385"></a>Windows 9x / Me Profile Setup</h4></div></div><div></div></div><p>
+When a user first logs in on Windows 9X, the file user.DAT is created,
+as are folders <tt class="filename">Start Menu</tt>, <tt class="filename">Desktop</tt>,
+<tt class="filename">Programs</tt> and <tt class="filename">Nethood</tt>.
+These directories and their contents will be merged with the local
+versions stored in <tt class="filename">c:\windows\profiles\username</tt> on subsequent logins,
+taking the most recent from each. You will need to use the <i class="parameter"><tt>[global]</tt></i>
+options <i class="parameter"><tt>preserve case = yes</tt></i>, <i class="parameter"><tt>short preserve case = yes</tt></i> and
+<i class="parameter"><tt>case sensitive = no</tt></i> in order to maintain capital letters in shortcuts
+in any of the profile folders.
+</p><p>
+The user.DAT file contains all the user's preferences. If you wish to
+enforce a set of preferences, rename their user.DAT file to user.MAN,
+and deny them write access to this file.
+</p><div class="orderedlist"><ol type="1"><li><p>
+ On the Windows 9x / Me machine, go to <span class="guimenu">Control Panel</span> -> <span class="guimenuitem">Passwords</span> and
+ select the <span class="guilabel">User Profiles</span> tab. Select the required level of
+ roaming preferences. Press <span class="guibutton">OK</span>, but do _not_ allow the computer
+ to reboot.
+ </p></li><li><p>
+ On the Windows 9x / Me machine, go to <span class="guimenu">Control Panel</span> -> <span class="guimenuitem">Network</span> ->
+ <span class="guimenuitem">Client for Microsoft Networks</span> -> <span class="guilabel">Preferences</span>. Select <span class="guilabel">Log on to
+ NT Domain</span>. Then, ensure that the Primary Logon is <span class="guilabel">Client for
+ Microsoft Networks</span>. Press <span class="guibutton">OK</span>, and this time allow the computer
+ to reboot.
+ </p></li></ol></div><p>
+Under Windows 9x / Me Profiles are downloaded from the Primary Logon.
+If you have the Primary Logon as 'Client for Novell Networks', then
+the profiles and logon script will be downloaded from your Novell
+Server. If you have the Primary Logon as 'Windows Logon', then the
+profiles will be loaded from the local machine - a bit against the
+concept of roaming profiles, it would seem!
+</p><p>
+You will now find that the Microsoft Networks Login box contains
+[user, password, domain] instead of just [user, password]. Type in
+the samba server's domain name (or any other domain known to exist,
+but bear in mind that the user will be authenticated against this
+domain and profiles downloaded from it, if that domain logon server
+supports it), user name and user's password.
+</p><p>
+Once the user has been successfully validated, the Windows 9x / Me machine
+will inform you that <tt class="computeroutput">The user has not logged on before' and asks you
+ if you wish to save the user's preferences?</tt> Select <span class="guibutton">yes</span>.
+</p><p>
+Once the Windows 9x / Me client comes up with the desktop, you should be able
+to examine the contents of the directory specified in the <i class="parameter"><tt>logon path</tt></i>
+on the samba server and verify that the <tt class="filename">Desktop</tt>, <tt class="filename">Start Menu</tt>,
+<tt class="filename">Programs</tt> and <tt class="filename">Nethood</tt> folders have been created.
+</p><p>
+These folders will be cached locally on the client, and updated when
+the user logs off (if you haven't made them read-only by then).
+You will find that if the user creates further folders or short-cuts,
+that the client will merge the profile contents downloaded with the
+contents of the profile directory already on the local client, taking
+the newest folders and short-cuts from each set.
+</p><p>
+If you have made the folders / files read-only on the samba server,
+then you will get errors from the Windows 9x / Me machine on logon and logout, as
+it attempts to merge the local and the remote profile. Basically, if
+you have any errors reported by the Windows 9x / Me machine, check the Unix file
+permissions and ownership rights on the profile directory contents,
+on the samba server.
+</p><p>
+If you have problems creating user profiles, you can reset the user's
+local desktop cache, as shown below. When this user then next logs in,
+they will be told that they are logging in "for the first time".
+</p><div class="orderedlist"><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+ Before deleting the contents of the
+ directory listed in the ProfilePath (this is likely to be
+ <tt class="filename">c:\windows\profiles\username)</tt>, ask them if they
+ have any important files stored on their desktop or in their start menu.
+ Delete the contents of the directory ProfilePath (making a backup if any
+ of the files are needed).
+ </p><p>
+ This will have the effect of removing the local (read-only hidden
+ system file) user.DAT in their profile directory, as well as the
+ local "desktop", "nethood", "start menu" and "programs" folders.
+ </p></div><ol type="1"><li><p>
+ instead of logging in under the [user, password, domain] dialog,
+ press <span class="guibutton">escape</span>.
+ </p></li><li><p>
+ run the <b class="command">regedit.exe</b> program, and look in:
+ </p><p>
+ <tt class="filename">HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList</tt>
+ </p><p>
+ you will find an entry, for each user, of ProfilePath. Note the
+ contents of this key (likely to be <tt class="filename">c:\windows\profiles\username</tt>),
+ then delete the key ProfilePath for the required user.
+ </p><p>[Exit the registry editor].</p></li><li><p>
+ search for the user's .PWL password-caching file in the <tt class="filename">c:\windows</tt>
+ directory, and delete it.
+ </p></li><li><p>
+ log off the windows 9x / Me client.
+ </p></li><li><p>
+ check the contents of the profile path (see <i class="parameter"><tt>logon path</tt></i> described
+ above), and delete the <tt class="filename">user.DAT</tt> or <tt class="filename">user.MAN</tt> file for the user,
+ making a backup if required.
+ </p></li></ol></div><p>
+If all else fails, increase samba's debug log levels to between 3 and 10,
+and / or run a packet trace program such as ethereal or <b class="command">netmon.exe</b>, and
+look for error messages.
+</p><p>
+If you have access to an Windows NT4/200x server, then first set up roaming profiles
+and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine
+the example packet traces provided with Windows NT4/200x server, and see what the
+differences are with the equivalent samba trace.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2967586"></a>Windows NT4 Workstation</h4></div></div><div></div></div><p>
+When a user first logs in to a Windows NT Workstation, the profile
+NTuser.DAT is created. The profile location can be now specified
+through the <i class="parameter"><tt>logon path</tt></i> parameter.
+</p><p>
+There is a parameter that is now available for use with NT Profiles:
+<i class="parameter"><tt>logon drive</tt></i>. This should be set to <tt class="filename">H:</tt> or any other drive, and
+should be used in conjunction with the new "logon home" parameter.
+</p><p>
+The entry for the NT4 profile is a _directory_ not a file. The NT
+help on profiles mentions that a directory is also created with a .PDS
+extension. The user, while logging in, must have write permission to
+create the full profile path (and the folder with the .PDS extension
+for those situations where it might be created.)
+</p><p>
+In the profile directory, Windows NT4 creates more folders than Windows 9x / Me.
+It creates <tt class="filename">Application Data</tt> and others, as well as <tt class="filename">Desktop</tt>, <tt class="filename">Nethood</tt>,
+<tt class="filename">Start Menu</tt> and <tt class="filename">Programs</tt>. The profile itself is stored in a file
+<tt class="filename">NTuser.DAT</tt>. Nothing appears to be stored in the .PDS directory, and
+its purpose is currently unknown.
+</p><p>
+You can use the <span class="application">System Control Panel</span> to copy a local profile onto
+a samba server (see NT Help on profiles: it is also capable of firing
+up the correct location in the <span class="application">System Control Panel</span> for you). The
+NT Help file also mentions that renaming <tt class="filename">NTuser.DAT</tt> to <tt class="filename">NTuser.MAN</tt>
+turns a profile into a mandatory one.
+</p><p>
+The case of the profile is significant. The file must be called
+<tt class="filename">NTuser.DAT</tt> or, for a mandatory profile, <tt class="filename">NTuser.MAN</tt>.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2967744"></a>Windows 2000/XP Professional</h4></div></div><div></div></div><p>
+You must first convert the profile from a local profile to a domain
+profile on the MS Windows workstation as follows:
+</p><div class="procedure"><ol type="1"><li><p>
+ Log on as the <span class="emphasis"><em>LOCAL</em></span> workstation administrator.
+ </p></li><li><p>
+ Right click on the <span class="guiicon">My Computer</span> Icon, select <span class="guimenuitem">Properties</span>
+ </p></li><li><p>
+ Click on the <span class="guilabel">User Profiles</span> tab
+ </p></li><li><p>
+ Select the profile you wish to convert (click on it once)
+ </p></li><li><p>
+ Click on the button <span class="guibutton">Copy To</span>
+ </p></li><li><p>
+ In the <span class="guilabel">Permitted to use</span> box, click on the <span class="guibutton">Change</span> button.
+ </p></li><li><p>
+ Click on the 'Look in" area that lists the machine name, when you click
+ here it will open up a selection box. Click on the domain to which the
+ profile must be accessible.
+ </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>You will need to log on if a logon box opens up. Eg: In the connect
+ as: <i class="replaceable"><tt>MIDEARTH</tt></i>\root, password: <i class="replaceable"><tt>mypassword</tt></i>.</p></div></li><li><p>
+ To make the profile capable of being used by anyone select 'Everyone'
+ </p></li><li><p>
+ Click <span class="guibutton">OK</span>. The Selection box will close.
+ </p></li><li><p>
+ Now click on the <span class="guibutton">Ok</span> button to create the profile in the path you
+ nominated.
+ </p></li></ol></div><p>
+Done. You now have a profile that can be editted using the samba-3.0.0
+<b class="command">profiles</b> tool.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Under NT/2K the use of mandotory profiles forces the use of MS Exchange
+storage of mail data. That keeps desktop profiles usable.
+</p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><div class="procedure"><ol type="1"><li><p>
+This is a security check new to Windows XP (or maybe only
+Windows XP service pack 1). It can be disabled via a group policy in
+Active Directory. The policy is:</p><p><tt class="filename">Computer Configuration\Administrative Templates\System\User
+Profiles\Do not check for user ownership of Roaming Profile Folders</tt></p><p>...and it should be set to <tt class="constant">Enabled</tt>.
+Does the new version of samba have an Active Directory analogue? If so,
+then you may be able to set the policy through this.
+</p><p>
+If you cannot set group policies in samba, then you may be able to set
+the policy locally on each machine. If you want to try this, then do
+the following (N.B. I don't know for sure that this will work in the
+same way as a domain group policy):
+</p></li><li><p>
+On the XP workstation log in with an Administrator account.
+</p></li><li><p>Click: <span class="guimenu">Start</span>, <span class="guimenuitem">Run</span></p></li><li><p>Type: <b class="userinput"><tt>mmc</tt></b></p></li><li><p>Click: <span class="guibutton">OK</span></p></li><li><p>A Microsoft Management Console should appear.</p></li><li><p>Click: <span class="guimenu">File</span>, <span class="guimenuitem">Add/Remove Snap-in...</span>, <span class="guimenuitem">Add</span></p></li><li><p>Double-Click: <span class="guiicon">Group Policy</span></p></li><li><p>Click: <span class="guibutton">Finish</span>, <span class="guibutton">Close</span></p></li><li><p>Click: <span class="guibutton">OK</span></p></li><li><p>In the "Console Root" window:</p></li><li><p>Expand: <span class="guiicon">Local Computer Policy</span>, <span class="guiicon">Computer Configuration</span>,
+ <span class="guiicon">Administrative Templates</span>, <span class="guiicon">System</span>, <span class="guiicon">User Profiles</span></p></li><li><p>Double-Click: <span class="guilabel">Do not check for user ownership of Roaming Profile Folders</span></p></li><li><p>Select: <span class="guilabel">Enabled</span></p></li><li><p>Click: <span class="guibutton">OK</span></p></li><li><p>Close the whole console. You do not need to save the settings (this
+ refers to the console settings rather than the policies you have
+ changed).</p></li><li><p>Reboot</p></li></ol></div></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972314"></a>Sharing Profiles between W9x/Me and NT4/200x/XP workstations</h3></div></div><div></div></div><p>
+Sharing of desktop profiles between Windows versions is NOT recommended.
+Desktop profiles are an evolving phenomenon and profiles for later versions
+of MS Windows clients add features that may interfere with earlier versions
+of MS Windows clients. Probably the more salient reason to NOT mix profiles
+is that when logging off an earlier version of MS Windows the older format
+of profile contents may overwrite information that belongs to the newer
+version resulting in loss of profile information content when that user logs
+on again with the newer version of MS Windows.
+</p><p>
+If you then want to share the same Start Menu / Desktop with W9x/Me, you will
+need to specify a common location for the profiles. The smb.conf parameters
+that need to be common are <i class="parameter"><tt>logon path</tt></i> and
+<i class="parameter"><tt>logon home</tt></i>.
+</p><p>
+If you have this set up correctly, you will find separate <tt class="filename">user.DAT</tt> and
+<tt class="filename">NTuser.DAT</tt> files in the same profile directory.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972378"></a>Profile Migration from Windows NT4/200x Server to Samba</h3></div></div><div></div></div><p>
+There is nothing to stop you specifying any path that you like for the
+location of users' profiles. Therefore, you could specify that the
+profile be stored on a samba server, or any other SMB server, as long as
+that SMB server supports encrypted passwords.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2972395"></a>Windows NT4 Profile Management Tools</h4></div></div><div></div></div><p>
+Unfortunately, the Resource Kit information is specific to the version of MS Windows
+NT4/200x. The correct resource kit is required for each platform.
+</p><p>
+Here is a quick guide:
+</p><div class="procedure"><ol type="1"><li><p>
+On your NT4 Domain Controller, right click on <span class="guiicon">My Computer</span>, then
+select the tab labelled <span class="guilabel">User Profiles</span>.
+</p></li><li><p>
+Select a user profile you want to migrate and click on it.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>I am using the term "migrate" lossely. You can copy a profile to
+create a group profile. You can give the user 'Everyone' rights to the
+profile you copy this to. That is what you need to do, since your samba
+domain is not a member of a trust relationship with your NT4 PDC.</p></div></li><li><p>Click the <span class="guibutton">Copy To</span> button.</p></li><li><p>In the box labelled <span class="guilabel">Copy Profile to</span> add your new path, eg:
+ <tt class="filename">c:\temp\foobar</tt></p></li><li><p>Click on the button <span class="guibutton">Change</span> in the <span class="guilabel">Permitted to use</span> box.</p></li><li><p>Click on the group 'Everyone' and then click <span class="guibutton">OK</span>. This closes the
+ 'choose user' box.</p></li><li><p>Now click <span class="guibutton">OK</span>.</p></li></ol></div><p>
+Follow the above for every profile you need to migrate.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2972559"></a>Side bar Notes</h4></div></div><div></div></div><p>
+You should obtain the SID of your NT4 domain. You can use smbpasswd to do
+this. Read the man page.</p><p>
+With Samba-3.0.0 alpha code you can import all you NT4 domain accounts
+using the net samsync method. This way you can retain your profile
+settings as well as all your users.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2972580"></a>moveuser.exe</h4></div></div><div></div></div><p>
+The W2K professional resource kit has moveuser.exe. moveuser.exe changes
+the security of a profile from one user to another. This allows the account
+domain to change, and/or the user name to change.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2972597"></a>Get SID</h4></div></div><div></div></div><p>
+You can identify the SID by using GetSID.exe from the Windows NT Server 4.0
+Resource Kit.
+</p><p>
+Windows NT 4.0 stores the local profile information in the registry under
+the following key:
+<tt class="filename">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList</tt>
+</p><p>
+Under the ProfileList key, there will be subkeys named with the SIDs of the
+users who have logged on to this computer. (To find the profile information
+for the user whose locally cached profile you want to move, find the SID for
+the user with the GetSID.exe utility.) Inside of the appropriate user's
+subkey, you will see a string value named ProfileImagePath.
+</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2972638"></a>Mandatory profiles</h2></div></div><div></div></div><p>
+A Mandatory Profile is a profile that the user does NOT have the ability to overwrite.
+During the user's session it may be possible to change the desktop environment, but
+as the user logs out all changes made will be lost. If it is desired to NOT allow the
+user any ability to change the desktop environment then this must be done through
+policy settings. See previous chapter.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Under NO circumstances should the profile directory (or it's contents) be made read-only
+as this may render the profile un-usable.
+</p></div><p>
+For MS Windows NT4/200x/XP the above method can be used to create mandatory profiles
+also. To convert a group profile into a mandatory profile simply locate the NTUser.DAT
+file in the copied profile and rename it to NTUser.MAN.
+</p><p>
+For MS Windows 9x / Me it is the <tt class="filename">User.DAT</tt> file that must be renamed to <tt class="filename">User.MAN</tt> to
+affect a mandatory profile.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2972696"></a>Creating/Managing Group Profiles</h2></div></div><div></div></div><p>
+Most organisations are arranged into departments. There is a nice benenfit in
+this fact since usually most users in a department will require the same desktop
+applications and the same desktop layout. MS Windows NT4/200x/XP will allow the
+use of Group Profiles. A Group Profile is a profile that is created firstly using
+a template (example) user. Then using the profile migration tool (see above) the
+profile is assigned access rights for the user group that needs to be given access
+to the group profile.
+</p><p>
+The next step is rather important. <span class="emphasis"><em>Please note:</em></span> Instead of assigning a group profile
+to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned
+the now modified profile.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+ Be careful with group profiles, if the user who is a member of a group also
+ has a personal profile, then the result will be a fusion (merge) of the two.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2972742"></a>Default Profile for Windows Users</h2></div></div><div></div></div><p>
+MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom
+a profile does not already exist. Armed with a knowledge of where the default profile
+is located on the Windows workstation, and knowing which registry keys affect the path
+from which the default profile is created, it is possible to modify the default profile
+to one that has been optimised for the site. This has significant administrative
+advantages.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972762"></a>MS Windows 9x/Me</h3></div></div><div></div></div><p>
+To enable default per use profiles in Windows 9x / Me you can either use the <span class="application">Windows 98 System
+Policy Editor</span> or change the registry directly.
+</p><p>
+To enable default per user profiles in Windows 9x / Me, launch the <span class="application">System Policy Editor</span>, then
+select <span class="guimenu">File</span> -> <span class="guimenuitem">Open Registry</span>, then click on the
+<span class="guiicon">Local Computer</span> icon, click on <span class="guilabel">Windows 98 System</span>,
+select <span class="guilabel">User Profiles</span>, click on the enable box. Do not forget to save the registry changes.
+</p><p>
+To modify the registry directly, launch the <span class="application">Registry Editor</span> (<b class="command">regedit.exe</b>), select the hive
+<tt class="filename">HKEY_LOCAL_MACHINE\Network\Logon</tt>. Now add a DWORD type key with the name
+"User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2972859"></a>How User Profiles Are Handled in Windows 9x / Me?</h4></div></div><div></div></div><p>
+When a user logs on to a Windows 9x / Me machine, the local profile path,
+<tt class="filename">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList</tt>, is checked
+for an existing entry for that user:
+</p><p>
+If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached
+version of the user profile. Windows 9x / Me also checks the user's home directory (or other
+specified directory if the location has been modified) on the server for the User Profile.
+If a profile exists in both locations, the newer of the two is used. If the User Profile exists
+on the server, but does not exist on the local machine, the profile on the server is downloaded
+and used. If the User Profile only exists on the local machine, that copy is used.
+</p><p>
+If a User Profile is not found in either location, the Default User Profile from the Windows 9x / Me
+machine is used and is copied to a newly created folder for the logged on user. At log off, any
+changes that the user made are written to the user's local profile. If the user has a roaming
+profile, the changes are written to the user's profile on the server.
+</p></div></div><div xmlns:ns85="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2972910"></a>MS Windows NT4 Workstation</h3></div></div><div></div></div><p>
+On MS Windows NT4 the default user profile is obtained from the location
+<tt class="filename">%SystemRoot%\Profiles</tt> which in a default installation will translate to
+<tt class="filename">C:\WinNT\Profiles</tt>. Under this directory on a clean install there will be
+three (3) directories: <tt class="filename">Administrator</tt>, <tt class="filename">All Users</tt>, <tt class="filename">Default User</tt>.
+</p><p>
+The <tt class="filename">All Users</tt> directory contains menu settings that are common across all
+system users. The <tt class="filename">Default User</tt> directory contains menu entries that are
+customisable per user depending on the profile settings chosen/created.
+</p><p>
+When a new user first logs onto an MS Windows NT4 machine a new profile is created from:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>All Users settings</td></tr><tr><td>Default User settings (contains the default NTUser.DAT file)</td></tr></table><p>
+When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain
+the following steps are followed in respect of profile handling:
+</p><div class="procedure"><ol type="1"><li><p>
+ The users' account information which is obtained during the logon process contains
+ the location of the users' desktop profile. The profile path may be local to the
+ machine or it may be located on a network share. If there exists a profile at the location
+ of the path from the user account, then this profile is copied to the location
+ <tt class="filename">%SystemRoot%\Profiles\%USERNAME%</tt>. This profile then inherits the
+ settings in the <tt class="filename">All Users</tt> profile in the <tt class="filename">%SystemRoot%\Profiles</tt>
+ location.
+ </p></li><li><p>
+ If the user account has a profile path, but at it's location a profile does not exist,
+ then a new profile is created in the <tt class="filename">%SystemRoot%\Profiles\%USERNAME%</tt>
+ directory from reading the <tt class="filename">Default User</tt> profile.
+ </p></li><li><p>
+ If the NETLOGON share on the authenticating server (logon server) contains a policy file
+ (<tt class="filename">NTConfig.POL</tt>) then it's contents are applied to the <tt class="filename">NTUser.DAT</tt>
+ which is applied to the <tt class="filename">HKEY_CURRENT_USER</tt> part of the registry.
+ </p></li><li><p>
+ When the user logs out, if the profile is set to be a roaming profile it will be written
+ out to the location of the profile. The <tt class="filename">NTuser.DAT</tt> file is then
+ re-created from the contents of the <tt class="filename">HKEY_CURRENT_USER</tt> contents.
+ Thus, should there not exist in the NETLOGON share an <tt class="filename">NTConfig.POL</tt> at the
+ next logon, the effect of the provious <tt class="filename">NTConfig.POL</tt> will still be held
+ in the profile. The effect of this is known as <span class="emphasis"><em>tatooing</em></span>.
+ </p></li></ol></div><p>
+MS Windows NT4 profiles may be <span class="emphasis"><em>Local</em></span> or <span class="emphasis"><em>Roaming</em></span>. A Local profile
+will stored in the <tt class="filename">%SystemRoot%\Profiles\%USERNAME%</tt> location. A roaming profile will
+also remain stored in the same way, unless the following registry key is created:
+</p><ns85:p>
+</ns85:p><pre class="programlisting">
+ HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
+ "DeleteRoamingCache"=dword:00000001
+</pre><ns85:p>
+
+In which case, the local copy (in <tt class="filename">%SystemRoot%\Profiles\%USERNAME%</tt>) will be
+deleted on logout.
+</ns85:p><p>
+Under MS Windows NT4 default locations for common resources (like <tt class="filename">My Documents</tt>
+may be redirected to a network share by modifying the following registry keys. These changes may be affected
+via use of the System Policy Editor (to do so may require that you create your owns template extension
+for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first
+creating a default user profile, then while logged in as that user, run regedt32 to edit the key settings.
+</p><p>
+The Registry Hive key that affects the behaviour of folders that are part of the default user profile
+are controlled by entries on Windows NT4 is:
+</p><p>
+<tt class="filename">HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\</tt>
+</p><p>
+The above hive key contains a list of automatically managed folders. The default entries are:
+</p><ns85:p>
+</ns85:p><div class="table"><a name="id2973257"></a><p class="title"><b>Table 24.1. User Shell Folder registry keys default values</b></p><table summary="User Shell Folder registry keys default values" border="1"><colgroup><col><col></colgroup><thead><tr><th>Name</th><th>Default Value</th></tr></thead><tbody><tr><td>AppData</td><td>%USERPROFILE%\Application Data</td></tr><tr><td>Desktop</td><td>%USERPROFILE%\Desktop</td></tr><tr><td>Favorites</td><td>%USERPROFILE%\Favorites</td></tr><tr><td>NetHood</td><td>%USERPROFILE%\NetHood</td></tr><tr><td>PrintHood</td><td>%USERPROFILE%\PrintHood</td></tr><tr><td>Programs</td><td>%USERPROFILE%\Start Menu\Programs</td></tr><tr><td>Recent</td><td>%USERPROFILE%\Recent</td></tr><tr><td>SendTo</td><td>%USERPROFILE%\SendTo</td></tr><tr><td>Start Menu </td><td>%USERPROFILE%\Start Menu</td></tr><tr><td>Startup</td><td>%USERPROFILE%\Start Menu\Programs\Startup</td></tr></tbody></table></div><ns85:p>
+</ns85:p><p>
+The registry key that contains the location of the default profile settings is:
+</p><p>
+<tt class="filename">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</tt>
+</p><ns85:p>
+The default entries are:
+
+</ns85:p><div class="table"><a name="id2973402"></a><p class="title"><b>Table 24.2. Defaults of profile settings registry keys</b></p><table summary="Defaults of profile settings registry keys" border="1"><colgroup><col><col></colgroup><tbody><tr><td>Common Desktop</td><td>%SystemRoot%\Profiles\All Users\Desktop</td></tr><tr><td>Common Programs</td><td>%SystemRoot%\Profiles\All Users\Programs</td></tr><tr><td>Common Start Menu</td><td>%SystemRoot%\Profiles\All Users\Start Menu</td></tr><tr><td>Common Startup</td><td>%SystemRoot%\Profiles\All Users\Start Menu\Progams\Startup</td></tr></tbody></table></div><ns85:p>
+</ns85:p></div><div xmlns:ns86="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2973464"></a>MS Windows 200x/XP</h3></div></div><div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+ MS Windows XP Home Edition does use default per user profiles, but can not participate
+ in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile
+ only from itself. While there are benefits in doing this the beauty of those MS Windows
+ clients that CAN participate in domain logon processes allows the administrator to create
+ a global default profile and to enforce it through the use of Group Policy Objects (GPOs).
+ </p></div><p>
+When a new user first logs onto MS Windows 200x/XP machine the default profile is obtained from
+<tt class="filename">C:\Documents and Settings\Default User</tt>. The administrator can modify (or change
+the contents of this location and MS Windows 200x/XP will gladly use it. This is far from the optimum
+arrangement since it will involve copying a new default profile to every MS Windows 200x/XP client
+workstation.
+</p><p>
+When MS Windows 200x/XP participate in a domain security context, and if the default user
+profile is not found, then the client will search for a default profile in the NETLOGON share
+of the authenticating server. ie: In MS Windows parlance:
+<tt class="filename">%LOGONSERVER%\NETLOGON\Default User</tt> and if one exits there it will copy this
+to the workstation to the <tt class="filename">C:\Documents and Settings\</tt> under the Windows
+login name of the user.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+ This path translates, in Samba parlance, to the <tt class="filename">smb.conf</tt> <i class="parameter"><tt>[NETLOGON]</tt></i> share. The directory
+ should be created at the root of this share and must be called <tt class="filename">Default Profile</tt>.
+ </p></div><p>
+If a default profile does not exist in this location then MS Windows 200x/XP will use the local
+default profile.
+</p><p>
+On loging out, the users' desktop profile will be stored to the location specified in the registry
+settings that pertain to the user. If no specific policies have been created, or passed to the client
+during the login process (as Samba does automatically), then the user's profile will be written to
+the local machine only under the path <tt class="filename">C:\Documents and Settings\%USERNAME%</tt>.
+</p><p>
+Those wishing to modify the default behaviour can do so through three methods:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Modify the registry keys on the local machine manually and place the new default profile in the
+ NETLOGON share root - NOT recommended as it is maintenance intensive.
+ </p></li><li><p>
+ Create an NT4 style NTConfig.POL file that specified this behaviour and locate this file
+ in the root of the NETLOGON share along with the new default profile.
+ </p></li><li><p>
+ Create a GPO that enforces this through Active Directory, and place the new default profile
+ in the NETLOGON share.
+ </p></li></ul></div><p>
+The Registry Hive key that affects the behaviour of folders that are part of the default user profile
+are controlled by entries on Windows 200x/XP is:
+</p><p>
+<tt class="filename">HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\</tt>
+</p><p>
+The above hive key contains a list of automatically managed folders. The default entries are:
+</p><ns86:p>
+</ns86:p><div class="table"><a name="id2973656"></a><p class="title"><b>Table 24.3. Defaults of default user profile paths registry keys</b></p><table summary="Defaults of default user profile paths registry keys" border="1"><colgroup><col><col></colgroup><thead><tr><th>Name</th><th>Default Value</th></tr></thead><tbody><tr><td>AppData</td><td>%USERPROFILE%\Application Data</td></tr><tr><td>Cache</td><td>%USERPROFILE%\Local Settings\Temporary Internet Files</td></tr><tr><td>Cookies</td><td>%USERPROFILE%\Cookies</td></tr><tr><td>Desktop</td><td>%USERPROFILE%\Desktop</td></tr><tr><td>Favorites</td><td>%USERPROFILE%\Favorites</td></tr><tr><td>History</td><td>%USERPROFILE%\Local Settings\History</td></tr><tr><td>Local AppData</td><td>%USERPROFILE%\Local Settings\Application Data</td></tr><tr><td>Local Settings</td><td>%USERPROFILE%\Local Settings</td></tr><tr><td>My Pictures</td><td>%USERPROFILE%\My Documents\My Pictures</td></tr><tr><td>NetHood</td><td>%USERPROFILE%\NetHood</td></tr><tr><td>Personal</td><td>%USERPROFILE%\My Documents</td></tr><tr><td>PrintHood</td><td>%USERPROFILE%\PrintHood</td></tr><tr><td>Programs</td><td>%USERPROFILE%\Start Menu\Programs</td></tr><tr><td>Recent</td><td>%USERPROFILE%\Recent</td></tr><tr><td>SendTo</td><td>%USERPROFILE%\SendTo</td></tr><tr><td>Start Menu</td><td>%USERPROFILE%\Start Menu</td></tr><tr><td>Startup</td><td>%USERPROFILE%\Start Menu\Programs\Startup</td></tr><tr><td>Templates</td><td>%USERPROFILE%\Templates</td></tr></tbody></table></div><ns86:p>
+</ns86:p><p>
+There is also an entry called "Default" that has no value set. The default entry is of type <tt class="constant">REG_SZ</tt>, all
+the others are of type <tt class="constant">REG_EXPAND_SZ</tt>.
+</p><p>
+It makes a huge difference to the speed of handling roaming user profiles if all the folders are
+stored on a dedicated location on a network server. This means that it will NOT be necessary to
+write the Outlook PST file over the network for every login and logout.
+</p><p>
+To set this to a network location you could use the following examples:
+</p><p><tt class="filename">%LOGONSERVER%\%USERNAME%\Default Folders</tt></p><p>
+This would store the folders in the user's home directory under a directory called <tt class="filename">Default Folders</tt>
+You could also use:
+</p><p><tt class="filename">\\<i class="replaceable"><tt>SambaServer</tt></i>\<i class="replaceable"><tt>FolderShare</tt></i>\%USERNAME%</tt></p><p>
+ in which case the default folders will be stored in the server named <i class="replaceable"><tt>SambaServer</tt></i>
+in the share called <i class="replaceable"><tt>FolderShare</tt></i> under a directory that has the name of the MS Windows
+user as seen by the Linux/Unix file system.
+</p><p>
+Please note that once you have created a default profile share, you MUST migrate a user's profile
+(default or custom) to it.
+</p><p>
+MS Windows 200x/XP profiles may be <span class="emphasis"><em>Local</em></span> or <span class="emphasis"><em>Roaming</em></span>.
+A roaming profile will be cached locally unless the following registry key is created:
+</p><p><tt class="filename">HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\"DeleteRoamingCache"=dword:00000001</tt></p><p>
+In which case, the local cache copy will be deleted on logout.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2973968"></a>Common Errors</h2></div></div><div></div></div><p>
+THe following are some typical errors/problems/questions that have been asked.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2973980"></a>How does one set up roaming profiles for just one (or a few) user/s or group/s?</h3></div></div><div></div></div><p>
+With samba-2.2.x the choice you have is to enable or disable roaming
+profiles support. It is a global only setting. The default is to have
+roaming profiles and the default path will locate them in the user's home
+directory.
+</p><p>
+If disabled globally then no-one will have roaming profile ability.
+If enabled and you want it to apply only to certain machines, then on
+those machines on which roaming profile support is NOT wanted it is then
+necessary to disable roaming profile handling in the registry of each such
+machine.
+</p><p>
+With samba-3.0.0 (soon to be released) you can have a global profile
+setting in smb.conf _AND_ you can over-ride this by per-user settings
+using the Domain User Manager (as with MS Windows NT4/ Win 2Kx).
+</p><p>
+In any case, you can configure only one profile per user. That profile can
+be either:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>A profile unique to that user</td></tr><tr><td>A mandatory profile (one the user can not change)</td></tr><tr><td>A group profile (really should be mandatory ie:unchangable)</td></tr></table></div><div xmlns:ns88="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2974043"></a>Can NOT use Roaming Profiles</h3></div></div><div></div></div><p>
+“<span class="quote">
+ I dont want Roaming profile to be implemented, I just want to give users
+ local profiles only.
+...
+ Please help me I am totally lost with this error from past two days I tried
+ everything and googled around quite a bit but of no help. Please help me.
+</span>”</p><ns88:p>
+Your choices are:
+
+
+</ns88:p><div class="variablelist"><dl><dt><span class="term">Local profiles</span></dt><dd><p>
+ I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out
+ </p></dd><dt><span class="term">Roaming profiles</span></dt><dd xmlns:ns87=""><ns87:p>
+ </ns87:p><table class="simplelist" border="0" summary="Simple list"><tr><td>can use auto-delete on logout option</td></tr><tr><td>requires a registry key change on workstation</td></tr></table><ns87:p>
+
+ Your choices are:
+
+ </ns87:p><div class="variablelist"><dl><dt><span class="term">Personal Roaming profiles</span></dt><dd><p>
+ - should be preserved on a central server
+ - workstations 'cache' (store) a local copy
+ - used in case the profile can not be downloaded
+ at next logon
+ </p></dd><dt><span class="term">Group profiles</span></dt><dd><p>- loaded from a cetral place</p></dd><dt><span class="term">Mandatory profiles</span></dt><dd><p>
+ - can be personal or group
+ - can NOT be changed (except by an administrator
+ </p></dd></dl></div><ns87:p>
+ </ns87:p></dd></dl></div><ns88:p>
+
+</ns88:p><p>
+A WinNT4/2K/XP profile can vary in size from 130KB to off the scale.
+Outlook PST files are most often part of the profile and can be many GB in
+size. On average (in a well controlled environment) roaming profie size of
+2MB is a good rule of thumb to use for planning purposes. In an
+undisciplined environment I have seen up to 2GB profiles. Users tend to
+complain when it take an hour to log onto a workstation but they harvest
+the fuits of folly (and ignorance).
+</p><p>
+The point of all the above is to show that roaming profiles and good
+controls of how they can be changed as well as good discipline make up for
+a problem free site.
+</p><p>
+Microsoft's answer to the PST problem is to store all email in an MS
+Exchange Server back-end. But this is another story ...!
+</p><ns88:p>
+So, having LOCAL profiles means:
+
+</ns88:p><table class="simplelist" border="0" summary="Simple list"><tr><td>If lots of users user each machine - lot's of local disk storage needed for local profiles</td></tr><tr><td>Every workstation the user logs into has it's own profile - can be very different from machine to machine</td></tr></table><ns88:p>
+
+On the other hand, having roaming profiles means:
+</ns88:p><table class="simplelist" border="0" summary="Simple list"><tr><td>The network administrator can control EVERY aspect of user profiles</td></tr><tr><td>With the use of mandatory profiles - a drastic reduction in network management overheads</td></tr><tr><td>User unhappiness about not being able to change their profiles soon fades as they get used to being able to work reliably</td></tr></table><ns88:p>
+
+</ns88:p><p>
+I have managed and installed MANY NT/2K networks and have NEVER found one
+where users who move from machine to machine are happy with local
+profiles. In the long run local profiles bite them.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2974262"></a>Changing the default profile</h3></div></div><div></div></div><p>“<span class="quote">
+When the client tries to logon to the PDC it looks for a profile to download
+where do I put this default profile.
+</span>”</p><p>
+Firstly, your samba server need to be configured as a domain controller.
+</p><pre class="programlisting">
+ server = user
+ os level = 32 (or more)
+ domain logons = Yes
+</pre><p>
+Plus you need to have a <i class="parameter"><tt>[netlogon]</tt></i> share that is world readable.
+It is a good idea to add a logon script to pre-set printer and
+drive connections. There is also a facility for automatically
+synchronizing the workstation time clock with that of the logon
+server (another good thing to do).
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+To invoke auto-deletion of roaming profile from the local
+workstation cache (disk storage) you need to use the <span class="application">Group Policy Editor</span>
+to create a file called <tt class="filename">NTConfig.POL</tt> with the appropriate entries. This
+file needs to be located in the <i class="parameter"><tt>netlogon</tt></i> share root directory.</p></div><p>
+Oh, of course the windows clients need to be members of the domain.
+Workgroup machines do NOT do network logons - so they never see domain
+profiles.
+</p><p>
+Secondly, for roaming profiles you need:
+
+ logon path = \\%N\profiles\%U (with some such path)
+ logon drive = H: (Z: is the default)
+
+ Plus you need a PROFILES share that is world writable.
+</p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="pam"></a>Chapter 25. PAM based Distributed Authentication</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Stephen</span> <span class="surname">Langasek</span></h3><div class="affiliation"><div class="address"><p><tt class="email"><<a href="mailto:vorlon@netexpress.net">vorlon@netexpress.net</a>></tt></p></div></div></div></div><div><p class="pubdate">May 31, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2975719">Features and Benefits</a></dt><dt><a href="#id2974574">Technical Discussion</a></dt><dd><dl><dt><a href="#id2974590">PAM Configuration Syntax</a></dt><dt><a href="#id2975256">Example System Configurations</a></dt><dt><a href="#id2977688">smb.conf PAM Configuration</a></dt><dt><a href="#id2977745">Remote CIFS Authentication using winbindd.so</a></dt><dt><a href="#id2977829">Password Synchronization using pam_smbpass.so</a></dt></dl></dd><dt><a href="#id2978196">Common Errors</a></dt><dd><dl><dt><a href="#id2978209">pam_winbind problem</a></dt></dl></dd></dl></div><p>
+This chapter you should help you to deploy winbind based authentication on any PAM enabled
+Unix/Linux system. Winbind can be used to enable user level application access authentication
+from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba
+based domain environment. It will also help you to configure PAM based local host access
+controls that are appropriate to your Samba configuration.
+</p><p>
+In addition to knowing how to configure winbind into PAM, you will learn generic PAM managment
+possibilities and in particular how to deploy tools like pam_smbpass.so to your adavantage.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+The use of Winbind require more than PAM configuration alone. Please refer to <a href="#winbind" title="Chapter 21. Integrated Logon Support using Winbind">the Winbind chapter</a>.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2975719"></a>Features and Benefits</h2></div></div><div></div></div><p>
+A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux,
+now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication,
+authorization and resource control services. Prior to the introduction of PAM, a decision
+to use an alternative to the system password database (<tt class="filename">/etc/passwd</tt>)
+would require the provision of alternatives for all programs that provide security services.
+Such a choice would involve provision of alternatives to such programs as: <b class="command">login</b>,
+<b class="command">passwd</b>, <b class="command">chown</b>, etc.
+</p><p>
+PAM provides a mechanism that disconnects these security programs from the underlying
+authentication/authorization infrastructure. PAM is configured either through one file
+<tt class="filename">/etc/pam.conf</tt> (Solaris), or by editing individual files that are
+located in <tt class="filename">/etc/pam.d</tt>.
+</p><p>
+On PAM enabled Unix/Linux systems it is an easy matter to configure the system to use any
+authentication backend, so long as the appropriate dynamically loadable library modules
+are available for it. The backend may be local to the system, or may be centralised on a
+remote server.
+</p><p>
+PAM support modules are available for:
+</p><div class="variablelist"><dl><dt><span class="term"><tt class="filename">/etc/passwd</tt></span></dt><dd><p>-</p><p>
+ There are several PAM modules that interact with this standard Unix user
+ database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so
+ and pam_userdb.so.
+ </p></dd><dt><span class="term">Kerberos</span></dt><dd><p>-</p><p>
+ The pam_krb5.so module allows the use of any Kerberos compliant server.
+ This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially
+ Microsoft Active Directory (if enabled).
+ </p></dd><dt><span class="term">LDAP</span></dt><dd><p>-</p><p>
+ The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend
+ server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1,
+ Sun ONE iDentity server, Novell eDirectory server, Microsoft Active Directory.
+ </p></dd><dt><span class="term">NetWare Bindery</span></dt><dd><p>-</p><p>
+ The pam_ncp_auth.so module allows authentication off any bindery enabled
+ NetWare Core Protocol based server.
+ </p></dd><dt><span class="term">SMB Password</span></dt><dd><p>-</p><p>
+ This module, called pam_smbpass.so, will allow user authentication off
+ the passdb backend that is configured in the Samba <tt class="filename">smb.conf</tt> file.
+ </p></dd><dt><span class="term">SMB Server</span></dt><dd><p>-</p><p>
+ The pam_smb_auth.so module is the original MS Windows networking authentication
+ tool. This module has been somewhat outdated by the Winbind module.
+ </p></dd><dt><span class="term">Winbind</span></dt><dd><p>-</p><p>
+ The pam_winbind.so module allows Samba to obtain authentication from any
+ MS Windows Domain Controller. It can just as easily be used to authenticate
+ users for access to any PAM enabled application.
+ </p></dd><dt><span class="term">RADIUS</span></dt><dd><p>-</p><p>
+ There is a PAM RADIUS (Remote Access Dial-In User Service) authentication
+ module. In most cases the administrator will need to locate the source code
+ for this tool and compile and install it themselves. RADIUS protocols are
+ used by many routers and terminal servers.
+ </p></dd></dl></div><p>
+Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone.
+</p><p>
+Once configured, these permit a remarkable level of flexibility in the location and use
+of distributed samba domain controllers that can provide wide are network bandwidth
+efficient authentication services for PAM capable systems. In effect, this allows the
+deployment of centrally managed and maintained distributed authentication from a single
+user account database.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2974574"></a>Technical Discussion</h2></div></div><div></div></div><p>
+PAM is designed to provide the system administrator with a great deal of flexibility in
+configuration of the privilege granting applications of their system. The local
+configuration of system security controlled by PAM is contained in one of two places:
+either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory.
+</p><div xmlns:ns89="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2974590"></a>PAM Configuration Syntax</h3></div></div><div></div></div><p>
+In this section we discuss the correct syntax of and generic options respected by entries to these files.
+PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case
+sensitive since they indicate a file's name and reflect the case dependence of typical file-systems.
+The case-sensitivity of the arguments to any given module is defined for each module in turn.
+</p><p>
+In addition to the lines described below, there are two special characters provided for the convenience
+of the system administrator: comments are preceded by a `#' and extend to the next end-of-line; also,
+module specification lines may be extended with a `\' escaped newline.
+</p><p>
+If the PAM authentication module (loadable link library file) is located in the
+default location then it is not necessary to specify the path. In the case of
+Linux, the default location is <tt class="filename">/lib/security</tt>. If the module
+is located outside the default then the path must be specified as:
+</p><ns89:p>
+</ns89:p><pre class="screen">
+auth required /other_path/pam_strange_module.so
+</pre><ns89:p>
+</ns89:p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2974646"></a>Anatomy of <tt class="filename">/etc/pam.d</tt> Entries</h4></div></div><div></div></div><p>
+The remaining information in this subsection was taken from the documentation of the Linux-PAM
+project. For more information on PAM, see
+<a href="http://ftp.kernel.org/pub/linux/libs/pam/" target="_top">
+http://ftp.kernel.org/pub/linux/libs/pam</a> The Official Linux-PAM home page.
+</p><p>
+A general configuration line of the /etc/pam.conf file has the following form:
+</p><ns89:p>
+</ns89:p><pre class="screen">
+service-name module-type control-flag module-path args
+</pre><ns89:p>
+</ns89:p><p>
+Below, we explain the meaning of each of these tokens. The second (and more recently adopted)
+way of configuring Linux-PAM is via the contents of the <tt class="filename">/etc/pam.d/</tt> directory.
+Once we have explained the meaning of the above tokens, we will describe this method.
+</p><div class="variablelist"><dl><dt><span class="term">service-name</span></dt><dd><p>-</p><p>
+ The name of the service associated with this entry. Frequently the service name is the conventional
+ name of the given application. For example, `ftpd', `rlogind' and `su', etc. .
+ </p><p>
+ There is a special service-name, reserved for defining a default authentication mechanism. It has
+ the name `OTHER' and may be specified in either lower or upper case characters. Note, when there
+ is a module specified for a named service, the `OTHER' entries are ignored.
+ </p></dd><dt><span class="term">module-type</span></dt><dd><p>-</p><p>
+ One of (currently) four types of module. The four types are as follows:
+ </p><div class="itemizedlist"><ul type="disc"><li><p>
+ <span class="emphasis"><em>auth:</em></span> this module type provides two aspects of authenticating the user.
+ Firstly, it establishes that the user is who they claim to be, by instructing the application
+ to prompt the user for a password or other means of identification. Secondly, the module can
+ grant group membership (independently of the <tt class="filename">/etc/groups</tt> file discussed
+ above) or other privileges through its credential granting properties.
+ </p></li><li><p>
+ <span class="emphasis"><em>account:</em></span> this module performs non-authentication based account management.
+ It is typically used to restrict/permit access to a service based on the time of day, currently
+ available system resources (maximum number of users) or perhaps the location of the applicant
+ user `root' login only on the console.
+ </p></li><li><p>
+ <span class="emphasis"><em>session:</em></span> primarily, this module is associated with doing things that need
+ to be done for the user before/after they can be given service. Such things include the loggin
+ of information concerning the opening/closing of some data exchange with a user, mountin
+ directories, etc.
+ </p></li><li><p>
+ <span class="emphasis"><em>password:</em></span> this last module type is required for updating the authentication
+ token associated with the user. Typically, there is one module for each `challenge/response'
+ based authentication (auth) module-type.
+ </p></li></ul></div></dd><dt><span class="term">control-flag</span></dt><dd><p>-</p><p>
+ The control-flag is used to indicate how the PAM library will react to the success or failure of the
+ module it is associated with. Since modules can be stacked (modules of the same type execute in series,
+ one after another), the control-flags determine the relative importance of each module. The application
+ is not made aware of the individual success or failure of modules listed in the
+ <tt class="filename">/etc/pam.conf</tt> file. Instead, it receives a summary success or fail response from
+ the Linux-PAM library. The order of execution of these modules is that of the entries in the
+ <tt class="filename">/etc/pam.conf</tt> file; earlier entries are executed before later ones.
+ As of Linux-PAM v0.60, this control-flag can be defined with one of two syntaxes.
+ </p><p>
+ The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the
+ severity of concern associated with the success or failure of a specific module. There are four such
+ <span class="emphasis"><em>keywords: required, requisite, sufficient and optional</em></span>.
+ </p><p>
+ The Linux-PAM library interprets these keywords in the following manner:
+ </p><div class="itemizedlist"><ul type="disc"><li><p>
+ <span class="emphasis"><em>required:</em></span> this indicates that the success of the module is required for the
+ module-type facility to succeed. Failure of this module will not be apparent to the user until all
+ of the remaining modules (of the same module-type) have been executed.
+ </p></li><li><p>
+ <span class="emphasis"><em>requisite:</em></span> like required, however, in the case that such a module returns a
+ failure, control is directly returned to the application. The return value is that associated with
+ the first required or requisite module to fail. Note, this flag can be used to protect against the
+ possibility of a user getting the opportunity to enter a password over an unsafe medium. It is
+ conceivable that such behavior might inform an attacker of valid accounts on a system. This
+ possibility should be weighed against the not insignificant concerns of exposing a sensitive
+ password in a hostile environment.
+ </p></li><li><p>
+ <span class="emphasis"><em>sufficient:</em></span> the success of this module is deemed `sufficient' to satisfy
+ the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no
+ previous required module has failed, no more `stacked' modules of this type are invoked. (Note,
+ in this case subsequent required modules are not invoked.). A failure of this module is not deemed
+ as fatal to satisfying the application that this module-type has succeeded.
+ </p></li><li><p>
+ <span class="emphasis"><em>optional:</em></span> as its name suggests, this control-flag marks the module as not
+ being critical to the success or failure of the user's application for service. In general,
+ Linux-PAM ignores such a module when determining if the module stack will succeed or fail.
+ However, in the absence of any definite successes or failures of previous or subsequent stacked
+ modules this module will determine the nature of the response to the application. One example of
+ this latter case, is when the other modules return something like PAM_IGNORE.
+ </p></li></ul></div><p>
+ The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control
+ over how the user is authenticated. This form of the control flag is delimeted with square brackets and
+ consists of a series of value=action tokens:
+ </p><pre class="screen">
+ [value1=action1 value2=action2 ...]
+ </pre><p>
+ Here, valueI is one of the following return values: success; open_err; symbol_err; service_err;
+ system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries;
+ new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err;
+ authtok_err; authtok_recover_err; authtok_lock_busy; authtok_disable_aging; try_again; ignore; abort;
+ authtok_expired; module_unknown; bad_item; and default. The last of these (default) can be used to set
+ the action for those return values that are not explicitly defined.
+ </p><p>
+ The actionI can be a positive integer or one of the following tokens: ignore; ok; done; bad; die; and reset.
+ A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the
+ current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated
+ stack of modules with a number of different paths of execution. Which path is taken can be determined by the
+ reactions of individual modules.
+ </p><div class="itemizedlist"><ul type="disc"><li><p>
+ <span class="emphasis"><em>ignore:</em></span> when used with a stack of modules, the module's return status will not
+ contribute to the return code the application obtains.
+ </p></li><li><p>
+ <span class="emphasis"><em>bad:</em></span> this action indicates that the return code should be thought of as indicative
+ of the module failing. If this module is the first in the stack to fail, its status value will be used
+ for that of the whole stack.
+ </p></li><li><p>
+ <span class="emphasis"><em>die:</em></span> equivalent to bad with the side effect of terminating the module stack and
+ PAM immediately returning to the application.
+ </p></li><li><p>
+ <span class="emphasis"><em>ok:</em></span> this tells PAM that the administrator thinks this return code should
+ contribute directly to the return code of the full stack of modules. In other words, if the former
+ state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override
+ this value. Note, if the former state of the stack holds some value that is indicative of a modules
+ failure, this 'ok' value will not be used to override that value.
+ </p></li><li><p>
+ <span class="emphasis"><em>done:</em></span> equivalent to ok with the side effect of terminating the module stack and
+ PAM immediately returning to the application.
+ </p></li><li><p>
+ <span class="emphasis"><em>reset:</em></span> clear all memory of the state of the module stack and start again with
+ the next stacked module.
+ </p></li></ul></div><p>
+ Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in
+ terms of the [...] syntax. They are as follows:
+ </p><ns89:p>
+ </ns89:p><div class="itemizedlist"><ul type="disc"><li><p>
+ required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad]
+ </p></li><li><p>
+ requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die]
+ </p></li><li><p>
+ sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore]
+ </p></li><li><p>
+ optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore]
+ </p></li></ul></div><ns89:p>
+ </ns89:p><p>
+ Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63,
+ the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support
+ machine-machine authentication using the transport protocol inherent to the client/server application. With the
+ <span class="emphasis"><em>[ ... value=action ... ]</em></span> control syntax, it is possible for an application to be configured
+ to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication
+ mode for older, legacy, applications.
+ </p></dd><dt><span class="term">module-path</span></dt><dd><p>-</p><p>
+ The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the
+ module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended
+ to the default module path: <tt class="filename">/lib/security</tt> (but see the notes above).
+ </p><p>
+ The args are a list of tokens that are passed to the module when it is invoked. Much like arguments to a typical
+ Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments
+ are ignored by a module, however, when encountering an invalid argument, the module is required to write an error
+ to syslog(3). For a list of generic options see the next section.
+ </p><p>
+ Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example:
+ </p><pre class="screen">
+squid auth required pam_mysql.so user=passwd_query passwd=mada \
+ db=eminence [query=select user_name from internet_service where \
+ user_name='%u' and password=PASSWORD('%p') and \
+ service='web_proxy']
+</pre><p>
+ Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]'
+ character inside the string that will survive the argument parsing, you should use `\['. In other words:
+ </p><pre class="screen">
+[..[..\]..] --> ..[..]..
+</pre><p>
+ Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the
+ side of caution) to make the authentication process fail. A corresponding error is written to the system log files
+ with a call to syslog(3).
+ </p></dd></dl></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2975256"></a>Example System Configurations</h3></div></div><div></div></div><p>
+The following is an example <tt class="filename">/etc/pam.d/login</tt> configuration file.
+This example had all options been uncommented is probably not usable
+as it stacks many conditions before allowing successful completion
+of the login process. Essentially all conditions can be disabled
+by commenting them out except the calls to <tt class="filename">pam_pwdb.so</tt>.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2975286"></a>PAM: original login config</h4></div></div><div></div></div><pre class="screen">
+#%PAM-1.0
+# The PAM configuration file for the `login' service
+#
+auth required pam_securetty.so
+auth required pam_nologin.so
+# auth required pam_dialup.so
+# auth optional pam_mail.so
+auth required pam_pwdb.so shadow md5
+# account requisite pam_time.so
+account required pam_pwdb.so
+session required pam_pwdb.so
+# session optional pam_lastlog.so
+# password required pam_cracklib.so retry=3
+password required pam_pwdb.so shadow md5
+</pre></div><div xmlns:ns90="" class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2975313"></a>PAM: login using pam_smbpass</h4></div></div><div></div></div><p>
+PAM allows use of replacable modules. Those available on a sample system include:
+</p><ns90:p><tt class="prompt">$</tt><b class="userinput"><tt>/bin/ls /lib/security</tt></b>
+</ns90:p><pre class="screen">
+pam_access.so pam_ftp.so pam_limits.so
+pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so
+pam_cracklib.so pam_group.so pam_listfile.so
+pam_nologin.so pam_rootok.so pam_tally.so
+pam_deny.so pam_issue.so pam_mail.so
+pam_permit.so pam_securetty.so pam_time.so
+pam_dialup.so pam_lastlog.so pam_mkhomedir.so
+pam_pwdb.so pam_shells.so pam_unix.so
+pam_env.so pam_ldap.so pam_motd.so
+pam_radius.so pam_smbpass.so pam_unix_acct.so
+pam_wheel.so pam_unix_auth.so pam_unix_passwd.so
+pam_userdb.so pam_warn.so pam_unix_session.so
+</pre><p>
+The following example for the login program replaces the use of
+the <tt class="filename">pam_pwdb.so</tt> module which uses the system
+password database (<tt class="filename">/etc/passwd</tt>,
+<tt class="filename">/etc/shadow</tt>, <tt class="filename">/etc/group</tt>) with
+the module <tt class="filename">pam_smbpass.so</tt> which uses the Samba
+database which contains the Microsoft MD4 encrypted password
+hashes. This database is stored in either
+<tt class="filename">/usr/local/samba/private/smbpasswd</tt>,
+<tt class="filename">/etc/samba/smbpasswd</tt>, or in
+<tt class="filename">/etc/samba.d/smbpasswd</tt>, depending on the
+Samba implementation for your Unix/Linux system. The
+<tt class="filename">pam_smbpass.so</tt> module is provided by
+Samba version 2.2.1 or later. It can be compiled by specifying the
+<tt class="option">--with-pam_smbpass</tt> options when running Samba's
+<b class="command">configure</b> script. For more information
+on the <tt class="filename">pam_smbpass</tt> module, see the documentation
+in the <tt class="filename">source/pam_smbpass</tt> directory of the Samba
+source distribution.
+</p><pre class="screen">
+#%PAM-1.0
+# The PAM configuration file for the `login' service
+#
+auth required pam_smbpass.so nodelay
+account required pam_smbpass.so nodelay
+session required pam_smbpass.so nodelay
+password required pam_smbpass.so nodelay
+</pre><p>
+The following is the PAM configuration file for a particular
+Linux system. The default condition uses <tt class="filename">pam_pwdb.so</tt>.
+</p><pre class="screen">
+#%PAM-1.0
+# The PAM configuration file for the `samba' service
+#
+auth required pam_pwdb.so nullok nodelay shadow audit
+account required pam_pwdb.so audit nodelay
+session required pam_pwdb.so nodelay
+password required pam_pwdb.so shadow md5
+</pre><p>
+In the following example the decision has been made to use the
+smbpasswd database even for basic samba authentication. Such a
+decision could also be made for the passwd program and would
+thus allow the smbpasswd passwords to be changed using the passwd
+program.
+</p><pre class="screen">
+#%PAM-1.0
+# The PAM configuration file for the `samba' service
+#
+auth required pam_smbpass.so nodelay
+account required pam_pwdb.so audit nodelay
+session required pam_pwdb.so nodelay
+password required pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf
+</pre><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>PAM allows stacking of authentication mechanisms. It is
+also possible to pass information obtained within one PAM module through
+to the next module in the PAM stack. Please refer to the documentation for
+your particular system implementation for details regarding the specific
+capabilities of PAM in this environment. Some Linux implmentations also
+provide the <tt class="filename">pam_stack.so</tt> module that allows all
+authentication to be configured in a single central file. The
+<tt class="filename">pam_stack.so</tt> method has some very devoted followers
+on the basis that it allows for easier administration. As with all issues in
+life though, every decision makes trade-offs, so you may want examine the
+PAM documentation for further helpful information.
+</p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2977688"></a>smb.conf PAM Configuration</h3></div></div><div></div></div><p>
+There is an option in smb.conf called <a href="smb.conf.5.html#OBEYPAMRESTRICTIONS" target="_top">obey pam restrictions</a>.
+The following is from the on-line help for this option in SWAT;
+</p><p>
+When Samba-3 is configured to enable PAM support (i.e.
+<tt class="option">--with-pam</tt>), this parameter will
+control whether or not Samba should obey PAM's account
+and session management directives. The default behavior
+is to use PAM for clear text authentication only and to
+ignore any account or session management. Note that Samba always
+ignores PAM for authentication in the case of
+<a href="smb.conf.5.html#ENCRYPTPASSWORDS" target="_top">encrypt passwords = yes</a>.
+The reason is that PAM modules cannot support the challenge/response
+authentication mechanism needed in the presence of SMB
+password encryption.
+</p><p>Default: <i class="parameter"><tt>obey pam restrictions = no</tt></i></p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2977745"></a>Remote CIFS Authentication using winbindd.so</h3></div></div><div></div></div><p>
+All operating systems depend on the provision of users credentials accecptable to the platform.
+Unix requires the provision of a user identifier (UID) as well as a group identifier (GID).
+These are both simple integer type numbers that are obtained from a password backend such
+as <tt class="filename">/etc/passwd</tt>.
+</p><p>
+Users and groups on a Windows NT server are assigned a relative id (rid) which is unique for
+the domain when the user or group is created. To convert the Windows NT user or group into
+a unix user or group, a mapping between rids and unix user and group ids is required. This
+is one of the jobs that winbind performs.
+</p><p>
+As winbind users and groups are resolved from a server, user and group ids are allocated
+from a specified range. This is done on a first come, first served basis, although all
+existing users and groups will be mapped as soon as a client performs a user or group
+enumeration command. The allocated unix ids are stored in a database file under the Samba
+lock directory and will be remembered.
+</p><p>
+The astute administrator will realize from this that the combination of <tt class="filename">pam_smbpass.so</tt>,
+<b class="command">winbindd</b>, and a distributed passdb backend, such as ldap, will allow the establishment of a
+centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware
+programs and applications. This arrangement can have particularly potent advantages compared with the use of
+Microsoft Active Directory Service (ADS) in so far as reduction of wide area network authentication traffic.
+</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+The rid to unix id database is the only location where the user and group mappings are
+stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd
+to determine which user and group ids correspond to Windows NT user and group rids.
+</p></div></div><div xmlns:ns91="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2977829"></a>Password Synchronization using pam_smbpass.so</h3></div></div><div></div></div><p>
+pam_smbpass is a PAM module which can be used on conforming systems to
+keep the smbpasswd (Samba password) database in sync with the unix
+password file. PAM (Pluggable Authentication Modules) is an API supported
+under some Unices, such as Solaris, HPUX and Linux, that provides a
+generic interface to authentication mechanisms.
+</p><p>
+This module authenticates a local smbpasswd user database. If you require
+support for authenticating against a remote SMB server, or if you're
+concerned about the presence of suid root binaries on your system, it is
+recommended that you use pam_winbind instead.
+</p><ns91:p>
+Options recognized by this module are as follows:
+</ns91:p><div class="table"><a name="id2977860"></a><p class="title"><b>Table 25.1. Options recognized by pam_smbpass</b></p><table summary="Options recognized by pam_smbpass" border="1"><colgroup><col><col></colgroup><tbody><tr><td align="left">debug</td><td align="left">log more debugging info</td></tr><tr><td align="left">audit</td><td align="left">like debug, but also logs unknown usernames</td></tr><tr><td align="left">use_first_pass</td><td align="left">don't prompt the user for passwords; take them from PAM_ items instead</td></tr><tr><td align="left">try_first_pass</td><td align="left">try to get the password from a previous PAM module, fall back to prompting the user</td></tr><tr><td align="left">use_authtok</td><td align="left">like try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only)</td></tr><tr><td align="left">not_set_pass</td><td align="left">don't make passwords used by this module available to other modules.</td></tr><tr><td align="left">nodelay</td><td align="left">don't insert ~1 second delays on authentication failure.</td></tr><tr><td align="left">nullok</td><td align="left">null passwords are allowed.</td></tr><tr><td align="left">nonull</td><td align="left">null passwords are not allowed. Used to override the Samba configuration.</td></tr><tr><td align="left">migrate</td><td align="left">only meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication.</td></tr><tr><td align="left">smbconf=<i class="replaceable"><tt>file</tt></i></td><td align="left">specify an alternate path to the <tt class="filename">smb.conf</tt> file.</td></tr></tbody></table></div><ns91:p>
+</ns91:p><ns91:p>
+Thanks go to the following people:
+</ns91:p><table class="simplelist" border="0" summary="Simple list"><tr><td><a href="mailto:morgan@transmeta.com" target="_top">Andrew Morgan</a>, for providing the Linux-PAM
+ framework, without which none of this would have happened</td></tr><tr><td><a href="gafton@redhat.com" target="_top">Christian Gafton</a> and Andrew Morgan again, for the
+ pam_pwdb module upon which pam_smbpass was originally based</td></tr><tr><td><a href="lkcl@switchboard.net" target="_top">Luke Leighton</a> for being receptive to the idea,
+ and for the occasional good-natured complaint about the project's status
+ that keep me working on it :)</td></tr></table><ns91:p>.
+</ns91:p><p>
+The following are examples of the use of pam_smbpass.so in the format of Linux
+<tt class="filename">/etc/pam.d/</tt> files structure. Those wishing to implement this
+tool on other platforms will need to adapt this appropriately.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2978061"></a>Password Synchronisation Configuration</h4></div></div><div></div></div><p>
+A sample PAM configuration that shows the use of pam_smbpass to make
+sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow)
+is changed. Useful when an expired password might be changed by an
+application (such as ssh).
+</p><pre class="screen">
+#%PAM-1.0
+# password-sync
+#
+auth requisite pam_nologin.so
+auth required pam_unix.so
+account required pam_unix.so
+password requisite pam_cracklib.so retry=3
+password requisite pam_unix.so shadow md5 use_authtok try_first_pass
+password required pam_smbpass.so nullok use_authtok try_first_pass
+session required pam_unix.so
+</pre></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2978094"></a>Password Migration Configuration</h4></div></div><div></div></div><p>
+A sample PAM configuration that shows the use of pam_smbpass to migrate
+from plaintext to encrypted passwords for Samba. Unlike other methods,
+this can be used for users who have never connected to Samba shares:
+password migration takes place when users ftp in, login using ssh, pop
+their mail, etc.
+</p><pre class="screen">
+#%PAM-1.0
+# password-migration
+#
+auth requisite pam_nologin.so
+# pam_smbpass is called IF pam_unix succeeds.
+auth requisite pam_unix.so
+auth optional pam_smbpass.so migrate
+account required pam_unix.so
+password requisite pam_cracklib.so retry=3
+password requisite pam_unix.so shadow md5 use_authtok try_first_pass
+password optional pam_smbpass.so nullok use_authtok try_first_pass
+session required pam_unix.so
+</pre></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2978129"></a>Mature Password Configuration</h4></div></div><div></div></div><p>
+A sample PAM configuration for a 'mature' smbpasswd installation.
+private/smbpasswd is fully populated, and we consider it an error if
+the smbpasswd doesn't exist or doesn't match the Unix password.
+</p><pre class="screen">
+#%PAM-1.0
+# password-mature
+#
+auth requisite pam_nologin.so
+auth required pam_unix.so
+account required pam_unix.so
+password requisite pam_cracklib.so retry=3
+password requisite pam_unix.so shadow md5 use_authtok try_first_pass
+password required pam_smbpass.so use_authtok use_first_pass
+session required pam_unix.so
+</pre></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2978161"></a>Kerberos Password Integration Configuration</h4></div></div><div></div></div><p>
+A sample PAM configuration that shows pam_smbpass used together with
+pam_krb5. This could be useful on a Samba PDC that is also a member of
+a Kerberos realm.
+</p><pre class="screen">
+#%PAM-1.0
+# kdc-pdc
+#
+auth requisite pam_nologin.so
+auth requisite pam_krb5.so
+auth optional pam_smbpass.so migrate
+account required pam_krb5.so
+password requisite pam_cracklib.so retry=3
+password optional pam_smbpass.so nullok use_authtok try_first_pass
+password required pam_krb5.so use_authtok try_first_pass
+session required pam_krb5.so
+</pre></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2978196"></a>Common Errors</h2></div></div><div></div></div><p>
+PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from
+the Samba mailing list.
+</p><div xmlns:ns92="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978209"></a>pam_winbind problem</h3></div></div><div></div></div><p>
+ I have the following PAM configuration:
+ </p><ns92:p>
+</ns92:p><pre class="screen">
+auth required /lib/security/pam_securetty.so
+auth sufficient /lib/security/pam_winbind.so
+auth sufficient /lib/security/pam_unix.so use_first_pass nullok
+auth required /lib/security/pam_stack.so service=system-auth
+auth required /lib/security/pam_nologin.so
+account required /lib/security/pam_stack.so service=system-auth
+account required /lib/security/pam_winbind.so
+password required /lib/security/pam_stack.so service=system-auth
+</pre><ns92:p>
+</ns92:p><p>
+ When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie".
+ I've tried with user "scienceu+pitie" also.
+ </p><p>
+ Answer: The problem may lie with your inclusion of <i class="parameter"><tt>pam_stack.so
+ service=system-auth</tt></i>. That file often contains a lot of stuff that may
+ duplicate what you're already doing. Try commenting out the pam_stack lines
+ for auth and account and see if things work. If they do, look at
+ <tt class="filename">/etc/pam.d/system-auth</tt> and copy only what you need from it into your
+ <tt class="filename">/etc/pam.d/login</tt> file. Alternatively, if you want all services to use
+ winbind, you can put the winbind-specific stuff in <tt class="filename">/etc/pam.d/system-auth</tt>.
+ </p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="integrate-ms-networks"></a>Chapter 26. Integrating MS Windows networks with Samba</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate"> (Jan 01 2001) </p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2979952">Features and Benefits</a></dt><dt><a href="#id2979977">Background Information</a></dt><dt><a href="#id2980022">Name Resolution in a pure Unix/Linux world</a></dt><dd><dl><dt><a href="#id2980073">/etc/hosts</a></dt><dt><a href="#id2980198">/etc/resolv.conf</a></dt><dt><a href="#id2978348">/etc/host.conf</a></dt><dt><a href="#id2978390">/etc/nsswitch.conf</a></dt></dl></dd><dt><a href="#id2978479">Name resolution as used within MS Windows networking</a></dt><dd><dl><dt><a href="#id2978604">The NetBIOS Name Cache</a></dt><dt><a href="#id2978648">The LMHOSTS file</a></dt><dt><a href="#id2978762">HOSTS file</a></dt><dt><a href="#id2978795">DNS Lookup</a></dt><dt><a href="#id2978820">WINS Lookup</a></dt></dl></dd><dt><a href="#id2978890">Common Errors</a></dt><dd><dl><dt><a href="#id2978906">My Boomerang Won't Come Back</a></dt><dt><a href="#id2978938">Very Slow Network Connections</a></dt><dt><a href="#id2978989">Samba server name change problem</a></dt></dl></dd></dl></div><p>
+This section deals with NetBIOS over TCP/IP name to IP address resolution. If
+your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this
+section does not apply to your installation. If your installation involves use of
+NetBIOS over TCP/IP then this section may help you to resolve networking problems.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+ NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS
+ over Logical Link Control (LLC). On modern networks it is highly advised
+ to NOT run NetBEUI at all. Note also that there is NO such thing as
+ NetBEUI over TCP/IP - the existence of such a protocol is a complete
+ and utter mis-apprehension.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2979952"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Many MS Windows network administrators have never been exposed to basic TCP/IP
+networking as it is implemented in a Unix/Linux operating system. Likewise, many Unix and
+Linux adminsitrators have not been exposed to the intricacies of MS Windows TCP/IP based
+networking (and may have no desire to be either).
+</p><p>
+This chapter gives a short introduction to the basics of how a name can be resolved to
+it's IP address for each operating system environment.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2979977"></a>Background Information</h2></div></div><div></div></div><p>
+Since the introduction of MS Windows 2000 it is possible to run MS Windows networking
+without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS
+name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over
+TCP/IP is disabled on MS Windows 2000 and later clients then only TCP port 445 will be
+used and UDP port 137 and TCP port 139 will not.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+When using Windows 2000 or later clients, if NetBIOS over TCP/IP is NOT disabled, then
+the client will use UDP port 137 (NetBIOS Name Service, also known as the Windows Internet
+Name Service or WINS), TCP port 139 AND TCP port 445 (for actual file and print traffic).
+</p></div><p>
+When NetBIOS over TCP/IP is disabled the use of DNS is essential. Most installations that
+disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS requires
+Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR).
+Use of DHCP with ADS is recommended as a further means of maintaining central control
+over client workstation network configuration.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2980022"></a>Name Resolution in a pure Unix/Linux world</h2></div></div><div></div></div><p>
+The key configuration files covered in this section are:
+</p><div class="itemizedlist"><ul type="disc"><li><p><tt class="filename">/etc/hosts</tt></p></li><li><p><tt class="filename">/etc/resolv.conf</tt></p></li><li><p><tt class="filename">/etc/host.conf</tt></p></li><li><p><tt class="filename">/etc/nsswitch.conf</tt></p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2980073"></a><tt class="filename">/etc/hosts</tt></h3></div></div><div></div></div><p>
+Contains a static list of IP Addresses and names.
+eg:
+</p><pre class="screen">
+ 127.0.0.1 localhost localhost.localdomain
+ 192.168.1.1 bigbox.caldera.com bigbox alias4box
+</pre><p>
+The purpose of <tt class="filename">/etc/hosts</tt> is to provide a
+name resolution mechanism so that uses do not need to remember
+IP addresses.
+</p><p>
+Network packets that are sent over the physical network transport
+layer communicate not via IP addresses but rather using the Media
+Access Control address, or MAC address. IP Addresses are currently
+32 bits in length and are typically presented as four (4) decimal
+numbers that are separated by a dot (or period). eg: 168.192.1.1.
+</p><p>
+MAC Addresses use 48 bits (or 6 bytes) and are typically represented
+as two digit hexadecimal numbers separated by colons. eg:
+40:8e:0a:12:34:56
+</p><p>
+Every network interface must have an MAC address. Associated with
+a MAC address there may be one or more IP addresses. There is NO
+relationship between an IP address and a MAC address, all such assignments
+are arbitary or discretionary in nature. At the most basic level all
+network communications takes place using MAC addressing. Since MAC
+addresses must be globally unique, and generally remains fixed for
+any particular interface, the assignment of an IP address makes sense
+from a network management perspective. More than one IP address can
+be assigned per MAC address. One address must be the primary IP address,
+this is the address that will be returned in the ARP reply.
+</p><p>
+When a user or a process wants to communicate with another machine
+the protocol implementation ensures that the "machine name" or "host
+name" is resolved to an IP address in a manner that is controlled
+by the TCP/IP configuration control files. The file
+<tt class="filename">/etc/hosts</tt> is one such file.
+</p><p>
+When the IP address of the destination interface has been
+determined a protocol called ARP/RARP is used to identify
+the MAC address of the target interface. ARP stands for Address
+Resolution Protocol, and is a broadcast oriented method that
+uses UDP (User Datagram Protocol) to send a request to all
+interfaces on the local network segment using the all 1's MAC
+address. Network interfaces are programmed to respond to two
+MAC addresses only; their own unique address and the address
+ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will
+contain the MAC address and the primary IP address for each
+interface.
+</p><p>
+The <tt class="filename">/etc/hosts</tt> file is foundational to all
+Unix/Linux TCP/IP installations and as a minumum will contain
+the localhost and local network interface IP addresses and the
+primary names by which they are known within the local machine.
+This file helps to prime the pump so that a basic level of name
+resolution can exist before any other method of name resolution
+becomes available.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2980198"></a><tt class="filename">/etc/resolv.conf</tt></h3></div></div><div></div></div><p>
+This file tells the name resolution libraries:
+</p><div class="itemizedlist"><ul type="disc"><li><p>The name of the domain to which the machine
+ belongs
+ </p></li><li><p>The name(s) of any domains that should be
+ automatically searched when trying to resolve unqualified
+ host names to their IP address
+ </p></li><li><p>The name or IP address of available Domain
+ Name Servers that may be asked to perform name to address
+ translation lookups
+ </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978348"></a><tt class="filename">/etc/host.conf</tt></h3></div></div><div></div></div><p>
+<tt class="filename">/etc/host.conf</tt> is the primary means by
+which the setting in /etc/resolv.conf may be affected. It is a
+critical configuration file. This file controls the order by
+which name resolution may procede. The typical structure is:
+</p><pre class="screen">
+ order hosts,bind
+ multi on
+</pre><p>
+then both addresses should be returned. Please refer to the
+man page for host.conf for further details.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978390"></a><tt class="filename">/etc/nsswitch.conf</tt></h3></div></div><div></div></div><p>
+This file controls the actual name resolution targets. The
+file typically has resolver object specifications as follows:
+</p><pre class="screen">
+ # /etc/nsswitch.conf
+ #
+ # Name Service Switch configuration file.
+ #
+
+ passwd: compat
+ # Alternative entries for password authentication are:
+ # passwd: compat files nis ldap winbind
+ shadow: compat
+ group: compat
+
+ hosts: files nis dns
+ # Alternative entries for host name resolution are:
+ # hosts: files dns nis nis+ hesoid db compat ldap wins
+ networks: nis files dns
+
+ ethers: nis files
+ protocols: nis files
+ rpc: nis files
+ services: nis files
+</pre><p>
+Of course, each of these mechanisms requires that the appropriate
+facilities and/or services are correctly configured.
+</p><p>
+It should be noted that unless a network request/message must be
+sent, TCP/IP networks are silent. All TCP/IP communications assumes a
+principal of speaking only when necessary.
+</p><p>
+Starting with version 2.2.0 samba has Linux support for extensions to
+the name service switch infrastructure so that linux clients will
+be able to obtain resolution of MS Windows NetBIOS names to IP
+Addresses. To gain this functionality Samba needs to be compiled
+with appropriate arguments to the make command (ie: <b class="userinput"><tt>make
+nsswitch/libnss_wins.so</tt></b>). The resulting library should
+then be installed in the <tt class="filename">/lib</tt> directory and
+the "wins" parameter needs to be added to the "hosts:" line in
+the <tt class="filename">/etc/nsswitch.conf</tt> file. At this point it
+will be possible to ping any MS Windows machine by it's NetBIOS
+machine name, so long as that machine is within the workgroup to
+which both the samba machine and the MS Windows machine belong.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2978479"></a>Name resolution as used within MS Windows networking</h2></div></div><div></div></div><p>
+MS Windows networking is predicated about the name each machine
+is given. This name is known variously (and inconsistently) as
+the "computer name", "machine name", "networking name", "netbios name",
+"SMB name". All terms mean the same thing with the exception of
+"netbios name" which can apply also to the name of the workgroup or the
+domain name. The terms "workgroup" and "domain" are really just a
+simply name with which the machine is associated. All NetBIOS names
+are exactly 16 characters in length. The 16th character is reserved.
+It is used to store a one byte value that indicates service level
+information for the NetBIOS name that is registered. A NetBIOS machine
+name is therefore registered for each service type that is provided by
+the client/server.
+</p><p>
+The following are typical NetBIOS name/service type registrations:
+</p><pre class="screen">
+ Unique NetBIOS Names:
+ MACHINENAME<00> = Server Service is running on MACHINENAME
+ MACHINENAME<03> = Generic Machine Name (NetBIOS name)
+ MACHINENAME<20> = LanMan Server service is running on MACHINENAME
+ WORKGROUP<1b> = Domain Master Browser
+
+ Group Names:
+ WORKGROUP<03> = Generic Name registered by all members of WORKGROUP
+ WORKGROUP<1c> = Domain Controllers / Netlogon Servers
+ WORKGROUP<1d> = Local Master Browsers
+ WORKGROUP<1e> = Internet Name Resolvers
+</pre><p>
+It should be noted that all NetBIOS machines register their own
+names as per the above. This is in vast contrast to TCP/IP
+installations where traditionally the system administrator will
+determine in the /etc/hosts or in the DNS database what names
+are associated with each IP address.
+</p><p>
+One further point of clarification should be noted, the <tt class="filename">/etc/hosts</tt>
+file and the DNS records do not provide the NetBIOS name type information
+that MS Windows clients depend on to locate the type of service that may
+be needed. An example of this is what happens when an MS Windows client
+wants to locate a domain logon server. It finds this service and the IP
+address of a server that provides it by performing a lookup (via a
+NetBIOS broadcast) for enumeration of all machines that have
+registered the name type *<1c>. A logon request is then sent to each
+IP address that is returned in the enumerated list of IP addresses. Which
+ever machine first replies then ends up providing the logon services.
+</p><p>
+The name "workgroup" or "domain" really can be confusing since these
+have the added significance of indicating what is the security
+architecture of the MS Windows network. The term "workgroup" indicates
+that the primary nature of the network environment is that of a
+peer-to-peer design. In a WORKGROUP all machines are responsible for
+their own security, and generally such security is limited to use of
+just a password (known as SHARE MODE security). In most situations
+with peer-to-peer networking the users who control their own machines
+will simply opt to have no security at all. It is possible to have
+USER MODE security in a WORKGROUP environment, thus requiring use
+of a user name and a matching password.
+</p><p>
+MS Windows networking is thus predetermined to use machine names
+for all local and remote machine message passing. The protocol used is
+called Server Message Block (SMB) and this is implemented using
+the NetBIOS protocol (Network Basic Input Output System). NetBIOS can
+be encapsulated using LLC (Logical Link Control) protocol - in which case
+the resulting protocol is called NetBEUI (Network Basic Extended User
+Interface). NetBIOS can also be run over IPX (Internetworking Packet
+Exchange) protocol as used by Novell NetWare, and it can be run
+over TCP/IP protocols - in which case the resulting protocol is called
+NBT or NetBT, the NetBIOS over TCP/IP.
+</p><p>
+MS Windows machines use a complex array of name resolution mechanisms.
+Since we are primarily concerned with TCP/IP this demonstration is
+limited to this area.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978604"></a>The NetBIOS Name Cache</h3></div></div><div></div></div><p>
+All MS Windows machines employ an in memory buffer in which is
+stored the NetBIOS names and IP addresses for all external
+machines that that machine has communicated with over the
+past 10-15 minutes. It is more efficient to obtain an IP address
+for a machine from the local cache than it is to go through all the
+configured name resolution mechanisms.
+</p><p>
+If a machine whose name is in the local name cache has been shut
+down before the name had been expired and flushed from the cache, then
+an attempt to exchange a message with that machine will be subject
+to time-out delays. i.e.: Its name is in the cache, so a name resolution
+lookup will succeed, but the machine can not respond. This can be
+frustrating for users - but it is a characteristic of the protocol.
+</p><p>
+The MS Windows utility that allows examination of the NetBIOS
+name cache is called "nbtstat". The Samba equivalent of this
+is called <b class="command">nmblookup</b>.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978648"></a>The LMHOSTS file</h3></div></div><div></div></div><p>
+This file is usually located in MS Windows NT 4.0 or
+2000 in <tt class="filename">C:\WINNT\SYSTEM32\DRIVERS\ETC</tt> and contains
+the IP Address and the machine name in matched pairs. The
+<tt class="filename">LMHOSTS</tt> file performs NetBIOS name
+to IP address mapping.
+</p><p>
+It typically looks like:
+</p><pre class="screen">
+ # Copyright (c) 1998 Microsoft Corp.
+ #
+ # This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS
+ # over TCP/IP) stack for Windows98
+ #
+ # This file contains the mappings of IP addresses to NT computernames
+ # (NetBIOS) names. Each entry should be kept on an individual line.
+ # The IP address should be placed in the first column followed by the
+ # corresponding computername. The address and the comptername
+ # should be separated by at least one space or tab. The "#" character
+ # is generally used to denote the start of a comment (see the exceptions
+ # below).
+ #
+ # This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
+ # files and offers the following extensions:
+ #
+ # #PRE
+ # #DOM:<domain>
+ # #INCLUDE <filename>
+ # #BEGIN_ALTERNATE
+ # #END_ALTERNATE
+ # \0xnn (non-printing character support)
+ #
+ # Following any entry in the file with the characters "#PRE" will cause
+ # the entry to be preloaded into the name cache. By default, entries are
+ # not preloaded, but are parsed only after dynamic name resolution fails.
+ #
+ # Following an entry with the "#DOM:<domain>" tag will associate the
+ # entry with the domain specified by <domain>. This affects how the
+ # browser and logon services behave in TCP/IP environments. To preload
+ # the host name associated with #DOM entry, it is necessary to also add a
+ # #PRE to the line. The <domain> is always preloaded although it will not
+ # be shown when the name cache is viewed.
+ #
+ # Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
+ # software to seek the specified <filename> and parse it as if it were
+ # local. <filename> is generally a UNC-based name, allowing a
+ # centralized lmhosts file to be maintained on a server.
+ # It is ALWAYS necessary to provide a mapping for the IP address of the
+ # server prior to the #INCLUDE. This mapping must use the #PRE directive.
+ # In addtion the share "public" in the example below must be in the
+ # LanManServer list of "NullSessionShares" in order for client machines to
+ # be able to read the lmhosts file successfully. This key is under
+ # \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
+ # in the registry. Simply add "public" to the list found there.
+ #
+ # The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
+ # statements to be grouped together. Any single successful include
+ # will cause the group to succeed.
+ #
+ # Finally, non-printing characters can be embedded in mappings by
+ # first surrounding the NetBIOS name in quotations, then using the
+ # \0xnn notation to specify a hex value for a non-printing character.
+ #
+ # The following example illustrates all of these extensions:
+ #
+ # 102.54.94.97 rhino #PRE #DOM:networking #net group's DC
+ # 102.54.94.102 "appname \0x14" #special app server
+ # 102.54.94.123 popular #PRE #source server
+ # 102.54.94.117 localsrv #PRE #needed for the include
+ #
+ # #BEGIN_ALTERNATE
+ # #INCLUDE \\localsrv\public\lmhosts
+ # #INCLUDE \\rhino\public\lmhosts
+ # #END_ALTERNATE
+ #
+ # In the above example, the "appname" server contains a special
+ # character in its name, the "popular" and "localsrv" server names are
+ # preloaded, and the "rhino" server name is specified so it can be used
+ # to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
+ # system is unavailable.
+ #
+ # Note that the whole file is parsed including comments on each lookup,
+ # so keeping the number of comments to a minimum will improve performance.
+ # Therefore it is not advisable to simply add lmhosts file entries onto the
+ # end of this file.
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978762"></a>HOSTS file</h3></div></div><div></div></div><p>
+This file is usually located in MS Windows NT 4.0 or 2000 in
+<tt class="filename">C:\WINNT\SYSTEM32\DRIVERS\ETC</tt> and contains
+the IP Address and the IP hostname in matched pairs. It can be
+used by the name resolution infrastructure in MS Windows, depending
+on how the TCP/IP environment is configured. This file is in
+every way the equivalent of the Unix/Linux <tt class="filename">/etc/hosts</tt> file.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978795"></a>DNS Lookup</h3></div></div><div></div></div><p>
+This capability is configured in the TCP/IP setup area in the network
+configuration facility. If enabled an elaborate name resolution sequence
+is followed the precise nature of which is dependant on what the NetBIOS
+Node Type parameter is configured to. A Node Type of 0 means use
+NetBIOS broadcast (over UDP broadcast) is first used if the name
+that is the subject of a name lookup is not found in the NetBIOS name
+cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to
+Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the
+WINS Server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast
+lookup is used.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978820"></a>WINS Lookup</h3></div></div><div></div></div><p>
+A WINS (Windows Internet Name Server) service is the equivaent of the
+rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores
+the names and IP addresses that are registered by a Windows client
+if the TCP/IP setup has been given at least one WINS Server IP Address.
+</p><p>
+To configure Samba to be a WINS server the following parameter needs
+to be added to the <tt class="filename">smb.conf</tt> file:
+</p><pre class="screen">
+ wins support = Yes
+</pre><p>
+To configure Samba to use a WINS server the following parameters are
+needed in the <tt class="filename">smb.conf</tt> file:
+</p><pre class="screen">
+ wins support = No
+ wins server = xxx.xxx.xxx.xxx
+</pre><p>
+where <i class="replaceable"><tt>xxx.xxx.xxx.xxx</tt></i> is the IP address
+of the WINS server.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2978890"></a>Common Errors</h2></div></div><div></div></div><p>
+TCP/IP network configuration problems find every network administrator sooner or later.
+The cause can be anything from keybaord mishaps, forgetfulness, simple mistakes, and
+carelessness. Of course, noone is every deliberately careless!
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978906"></a>My Boomerang Won't Come Back</h3></div></div><div></div></div><p>
+ Well, the real complaint said, "I can ping my samba server from Windows, but I can
+ not ping my Windows machine from the samba server."
+ </p><p>
+ The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the
+ Samba server (Linux) was at IP Address 192.168.1.130 with netmast 255.255.255.128.
+ The machines were on a local network with no external connections.
+ </p><p>
+ Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while
+ the Samba server was on network 192.168.1.128/25 - logically a different network.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978938"></a>Very Slow Network Connections</h3></div></div><div></div></div><p>
+ A common causes of slow network response includes:
+ </p><div class="itemizedlist"><ul type="disc"><li><p>Client is configured to use DNS and DNS server is down</p></li><li><p>Client is configured to use remote DNS server, but remote connection is down</p></li><li><p>Client is configured to use a WINS server, but there is no WINS server</p></li><li><p>Client is NOT configured to use a WINS server, but there is a WINS server</p></li><li><p>Firewall is filtering our DNS or WINS traffic</p></li></ul></div></div><div xmlns:ns93="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2978989"></a>Samba server name change problem</h3></div></div><div></div></div><p>
+ The name of the samba server was changed, samba was restarted, samba server can not be
+ pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using
+ the old name. Why?
+ </p><p>
+ From this description three (3) things are rather obvious:
+ </p><div class="itemizedlist"><ul type="disc"><li><p>WINS is NOT in use, only broadcast based name resolution is used</p></li><li><p>The samba server was renamed and restarted within the last 10-15 minutes</p></li><li><p>The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation</p></li></ul></div><p>
+ To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine,
+ open a cmd shell, then:
+ </p><ns93:p>
+ </ns93:p><pre class="screen">
+ C:\temp\>nbtstat -n
+
+ NetBIOS Local Name Table
+
+ Name Type Status
+ ------------------------------------------------
+ SLACK <03> UNIQUE Registered
+ ADMININSTRATOR <03> UNIQUE Registered
+ SLACK <00> UNIQUE Registered
+ SARDON <00> GROUP Registered
+ SLACK <20> UNIQUE Registered
+ SLACK <1F> UNIQUE Registered
+
+
+ C:\Temp\>nbtstat -c
+
+ NetBIOS Remote Cache Name Table
+
+ Name Type Host Address Life [sec]
+ --------------------------------------------------------------
+ FRODO <20> UNIQUE 192.168.1.1 240
+
+ C:\Temp\>
+ </pre><ns93:p>
+ </ns93:p><p>
+ In the above example, FRODO is the Samba server and SLACK is the MS Windows NT4 Workstation.
+ The first listing shows the contents of the Local Name Table (ie: Identity information on
+ the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache.
+ The name cache contains the remote machines known to this workstation.
+ </p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="unicode"></a>Chapter 27. Unicode/Charsets</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">TAKAHASHI</span> <span class="surname">Motonobu</span></h3><div class="affiliation"><div class="address"><p><tt class="email"><<a href="mailto:monyo@home.monyo.com">monyo@home.monyo.com</a>></tt></p></div></div></div></div><div><p class="pubdate">25 March 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2979144">Features and Benefits</a></dt><dt><a href="#id2979186">What are charsets and unicode?</a></dt><dt><a href="#id2979255">Samba and charsets</a></dt><dt><a href="#id2979355">Conversion from old names</a></dt><dt><a href="#id2979401">Japanese charsets</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2979144"></a>Features and Benefits</h2></div></div><div></div></div><p>
+Every industry eventually matures. One of the great areas of maturation is in
+the focus that has been given over the past decade to make it possible for anyone
+anywhere to use a computer. It has not always been that way, in fact, not so long
+ago it was common for software to be written for exclusive use in the country of
+origin.
+</p><p>
+Of all the effort that has been brought to bear on providing native language support
+for all computer users, the efforts of the Openi18n organisation is deserving of
+special mention. For more information about Openi18n please refer to:
+<a href="#">http://www.openi18n.org/</a>.
+</p><p>
+Samba-2.x supported a single locale through a mechanism called
+<span class="emphasis"><em>codepages</em></span>. Samba-3 is destined to become a truely trans-global
+file and printer sharing platform.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2979186"></a>What are charsets and unicode?</h2></div></div><div></div></div><p>
+Computers communicate in numbers. In texts, each number will be
+translated to a corresponding letter. The meaning that will be assigned
+to a certain number depends on the <span class="emphasis"><em>character set(charset)
+</em></span> that is used.
+A charset can be seen as a table that is used to translate numbers to
+letters. Not all computers use the same charset (there are charsets
+with German umlauts, Japanese characters, etc). Usually a charset contains
+256 characters, which means that storing a character with it takes
+exactly one byte. </p><p>
+There are also charsets that support even more characters,
+but those need twice(or even more) as much storage space. These
+charsets can contain <b class="command">256 * 256 = 65536</b> characters, which
+is more then all possible characters one could think of. They are called
+multibyte charsets (because they use more then one byte to
+store one character).
+</p><p>
+A standardised multibyte charset is unicode, info is available at
+<a href="http://www.unicode.org/" target="_top">www.unicode.org</a>.
+A big advantage of using a multibyte charset is that you only need one; no
+need to make sure two computers use the same charset when they are
+communicating.
+</p><p>Old windows clients used to use single-byte charsets, named
+'codepages' by microsoft. However, there is no support for
+negotiating the charset to be used in the smb protocol. Thus, you
+have to make sure you are using the same charset when talking to an old client.
+Newer clients (Windows NT, 2K, XP) talk unicode over the wire.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2979255"></a>Samba and charsets</h2></div></div><div></div></div><p>
+As of samba 3.0, samba can (and will) talk unicode over the wire. Internally,
+samba knows of three kinds of character sets:
+</p><div class="variablelist"><dl><dt><span class="term"><i class="parameter"><tt>unix charset</tt></i></span></dt><dd><p>
+ This is the charset used internally by your operating system.
+ The default is <tt class="constant">ASCII</tt>, which is fine for most
+ systems.
+ </p></dd><dt><span class="term"><i class="parameter"><tt>display charset</tt></i></span></dt><dd><p>This is the charset samba will use to print messages
+ on your screen. It should generally be the same as the <b class="command">unix charset</b>.
+ </p></dd><dt><span class="term"><i class="parameter"><tt>dos charset</tt></i></span></dt><dd><p>This is the charset samba uses when communicating with
+ DOS and Windows 9x clients. It will talk unicode to all newer clients.
+ The default depends on the charsets you have installed on your system.
+ Run <b class="command">testparm -v | grep "dos charset"</b> to see
+ what the default is on your system.
+ </p></dd></dl></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2979355"></a>Conversion from old names</h2></div></div><div></div></div><p>Because previous samba versions did not do any charset conversion,
+characters in filenames are usually not correct in the unix charset but only
+for the local charset used by the DOS/Windows clients.</p><p>The following script from Steve Langasek converts all
+filenames from CP850 to the iso8859-15 charset.</p><p>
+<tt class="prompt">#</tt><b class="userinput"><tt>find <i class="replaceable"><tt>/path/to/share</tt></i> -type f -exec bash -c 'CP="{}"; ISO=`echo -n "$CP" | iconv -f cp850 \
+ -t iso8859-15`; if [ "$CP" != "$ISO" ]; then mv "$CP" "$ISO"; fi' \;
+</tt></b>
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2979401"></a>Japanese charsets</h2></div></div><div></div></div><p>Samba doesn't work correctly with Japanese charsets yet. Here are
+points of attention when setting it up:</p><div class="itemizedlist"><ul type="disc"><li><p>You should set <i class="parameter"><tt>mangling method =
+hash</tt></i></p></li><li><p>There are various iconv() implementations around and not
+all of them work equally well. glibc2's iconv() has a critical problem
+in CP932. libiconv-1.8 works with CP932 but still has some problems and
+does not work with EUC-JP.</p></li><li><p>You should set <i class="parameter"><tt>dos charset = CP932</tt></i>, not
+Shift_JIS, SJIS...</p></li><li><p>Currently only <i class="parameter"><tt>unix charset = CP932</tt></i>
+will work (but still has some problems...) because of iconv() issues.
+<i class="parameter"><tt>unix charset = EUC-JP</tt></i> doesn't work well because of
+iconv() issues.</p></li><li><p>Currently Samba 3.0 does not support <i class="parameter"><tt>unix charset
+= UTF8-MAC/CAP/HEX/JIS*</tt></i></p></li></ul></div><p>More information (in Japanese) is available at: <a href="http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html" target="_top">http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html</a>.</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Backup"></a>Chapter 28. Samba Backup Techniques</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2981995">Note</a></dt><dt><a href="#id2982016">Features and Benefits</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2981995"></a>Note</h2></div></div><div></div></div><p>
+This chapter did not make it into this release.
+It is planned for the published release of this document.
+If you have something to contribute for this section please email it to
+<a href="#">jht@samba.org</a>/
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2982016"></a>Features and Benefits</h2></div></div><div></div></div><p>
+We need feedback from people who are backing up samba servers.
+We would like to know what software tools you are using to backup
+your samba server/s.
+</p><p>
+In particular, if you have any success and / or failure stories you could
+share with other users this would be appreciated.
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="SambaHA"></a>Chapter 29. High Availability Options</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2981826">Note</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2981826"></a>Note</h2></div></div><div></div></div><p>
+This chapter did not make it into this release.
+It is planned for the published release of this document.
+</p></div></div></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="migration"></a>Migration and Updating</h1></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt>30. <a href="#upgrading-to-3.0">Upgrading from Samba-2.x to Samba-3.0.0</a></dt><dd><dl><dt><a href="#id2983161">Charsets</a></dt><dt><a href="#id2983184">Obsolete configuration options</a></dt><dt><a href="#id2983238">Password Backend</a></dt></dl></dd><dt>31. <a href="#NT4Migration">Migration from NT4 PDC to Samba-3 PDC</a></dt><dd><dl><dt><a href="#id2982481">Planning and Getting Started</a></dt><dd><dl><dt><a href="#id2982505">Objectives</a></dt><dt><a href="#id2981433">Steps In Migration Process</a></dt></dl></dd><dt><a href="#id2983650">Migration Options</a></dt><dd><dl><dt><a href="#id2983731">Planning for Success</a></dt><dt><a href="#id2983972">Samba Implementation Choices</a></dt></dl></dd></dl></dd><dt>32. <a href="#SWAT">SWAT - The Samba Web Administration Tool</a></dt><dd><dl><dt><a href="#id2984279">Features and Benefits</a></dt><dd><dl><dt><a href="#id2984129">Enabling SWAT for use</a></dt><dt><a href="#id2985018">Securing SWAT through SSL</a></dt><dt><a href="#id2985131">The SWAT Home Page</a></dt><dt><a href="#id2985194">Global Settings</a></dt><dt><a href="#id2985300">Share Settings</a></dt><dt><a href="#id2985365">Printers Settings</a></dt><dt><a href="#id2985429">The SWAT Wizard</a></dt><dt><a href="#id2985477">The Status Page</a></dt><dt><a href="#id2985529">The View Page</a></dt><dt><a href="#id2985552">The Password Change Page</a></dt></dl></dd></dl></dd></dl></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrading-to-3.0"></a>Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">25 October 2002</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2983161">Charsets</a></dt><dt><a href="#id2983184">Obsolete configuration options</a></dt><dt><a href="#id2983238">Password Backend</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2983161"></a>Charsets</h2></div></div><div></div></div><p>You might experience problems with special characters
+when communicating with old DOS clients. Codepage
+support has changed in samba 3.0. Read the chapter
+<a href="#unicode" title="Chapter 27. Unicode/Charsets">Unicode support</a> for details.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2983184"></a>Obsolete configuration options</h2></div></div><div></div></div><p>
+In 3.0, the following configuration options have been removed.
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>printer driver (replaced by new driver procedures) </td></tr><tr><td>printer driver file (replaced by new driver procedures)</td></tr><tr><td>printer driver location (replaced by new driver procedures)</td></tr><tr><td>use rhosts</td></tr><tr><td>postscript</td></tr><tr><td>client code page (replaced by dos charset)</td></tr><tr><td>vfs path</td></tr><tr><td>vfs options</td></tr></table></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2983238"></a>Password Backend</h2></div></div><div></div></div><p>
+Effective with the release of samba-3 it is now imperative that the password backend
+be correctly defined in smb.conf.
+</p><p>
+Those migrating from samba-2.x with plaintext password support need the following:
+<span class="emphasis"><em>passdb backend = guest</em></span>.
+</p><p>
+Those migrating from samba-2.x with encrypted password support should add to smb.conf
+<span class="emphasis"><em>passdb backend = smbpasswd, guest</em></span>.
+</p><p>
+LDAP using Samba-2.x systems can continue to operate with the following entry
+<span class="emphasis"><em>passdb backend = ldapsam_compat, guest</em></span>.
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NT4Migration"></a>Chapter 31. Migration from NT4 PDC to Samba-3 PDC</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2982481">Planning and Getting Started</a></dt><dd><dl><dt><a href="#id2982505">Objectives</a></dt><dt><a href="#id2981433">Steps In Migration Process</a></dt></dl></dd><dt><a href="#id2983650">Migration Options</a></dt><dd><dl><dt><a href="#id2983731">Planning for Success</a></dt><dt><a href="#id2983972">Samba Implementation Choices</a></dt></dl></dd></dl></div><p>
+This is a rough guide to assist those wishing to migrate from NT4 domain control to
+Samba-3 based domain control.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2982481"></a>Planning and Getting Started</h2></div></div><div></div></div><p>
+In the IT world there is often a saying that all problems are encountered because of
+poor planning. The corrollary to this saying is that not all problems can be anticpated
+and planned for. Then again, good planning will anticpate most show stopper type situations.
+</p><p>
+Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control
+environment would do well to develop a detailed migration plan. So here are a few pointers to
+help migration get under way.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2982505"></a>Objectives</h3></div></div><div></div></div><p>
+The key objective for most organisations will be to make the migration from MS Windows NT4
+to Samba-3 domain control as painless as possible. One of the challenges you may experience
+in your migration process may well be one of convincing management that the new environment
+should remain in place. Many who have introduced open source technologies have experienced
+pressure to return to a Microsoft based platform solution at the first sign of trouble.
+</p><p>
+It is strongly advised that before attempting a migration to a Samba-3 controlled network
+that every possible effort be made to gain all-round commitment to the change. Firstly, you
+should know precisely <span class="emphasis"><em>why</em></span> the change is important for the organisation.
+Possible motivations to make a change include:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Improve network manageability</td></tr><tr><td>Obtain better user level functionality</td></tr><tr><td>Reduce network operating costs</td></tr><tr><td>Reduce exposure caused by Microsoft withdrawal of NT4 support</td></tr><tr><td>Avoid MS License 6 implications</td></tr><tr><td>Reduce organisation's dependency on Microsoft</td></tr></table><p>
+It is vital that it be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers
+an alternative solution that is both different from MS Windows NT4 and that offers some
+advantages compared with it. It should also be recognised that Samba-3 lacks many of the
+features that Microsoft has promoted as core values in migration from MS Windows NT4 to
+MS Windows 2000 and beyond (with or without Active Directory services).
+</p><p>
+What are the features that Samba-3 can NOT provide?
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Active Directory Server</td></tr><tr><td>Group Policy Objects (in Active Direcrtory)</td></tr><tr><td>Machine Policy objects</td></tr><tr><td>Logon Scripts in Active Directorty</td></tr><tr><td>Software Application and Access Controls in Active Directory</td></tr></table><p>
+The features that Samba-3 DOES provide and that may be of compelling interest to your site
+includes:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Lower Cost of Ownership</td></tr><tr><td>Global availability of support with no strings attached</td></tr><tr><td>Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)</td></tr><tr><td>Creation of on-the-fly logon scripts</td></tr><tr><td>Creation of on-the-fly Policy Files</td></tr><tr><td>Greater Stability, Reliability, Performance and Availability</td></tr><tr><td>Manageability via an ssh connection</td></tr><tr><td>Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)</td></tr><tr><td>Ability to implement a full single-signon architecture</td></tr><tr><td>Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand</td></tr></table><p>
+Before migrating a network from MS Windows NT4 to Samba-3 it is vital that all necessary factors are
+considered. Users should be educated about changes they may experience so that the change will be a
+welcome one and not become an obstacle to the work they need to do. The following are some of the
+factors that will go into a successful migration:
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2981206"></a>Domain Layout</h4></div></div><div></div></div><p>
+Samba-3 can be configured as a domain controller, a back-up domain controller (probably best called
+a secondary controller), a domain member, or as a stand-alone server. The Windows network security
+domain context should be sized and scoped before implementation. Particular attention needs to be
+paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs).
+It should be noted that one way in which Samba-3 differs from Microsoft technology is that if one
+chooses to use an LDAP authentication backend then the same database can be used by several different
+domains. This means that in a complex organisation there can be a single LDAP database, that itself
+can be distributed, that can simultaneously serve multiple domains (that can also be widely distributed).
+</p><p>
+It is recommended that from a design perspective, the number of users per server, as well as the number
+of servers, per domain should be scaled according to needs and should also consider server capacity
+and network bandwidth.
+</p><p>
+A physical network segment may house several domains, each of which may span multiple network segments.
+Where domains span routed network segments it is most advisable to consider and test the performance
+implications of the design and layout of a network. A Centrally located domain controller that is being
+designed to serve mulitple routed network segments may result in severe performance problems if the
+response time (eg: ping timing) between the remote segment and the PDC is more than 100 ms. In situations
+where the delay is too long it is highly recommended to locate a backup controller (BDC) to serve as
+the local authentication and access control server.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2981260"></a>Server Share and Directory Layout</h4></div></div><div></div></div><p>
+There are few cardinal rules to effective network design that can be broken with impunity.
+The most important rule of effective network management is that simplicity is king in every
+well controlled network. Every part of the infrastructure must be managed, the more complex
+it is, the greater will be the demand of keeping systems secure and functional.
+</p><p>
+The nature of the data that must be stored needs to be born in mind when deciding how many
+shares must be created. The physical disk space layout should also be taken into account
+when designing where share points will be created. Keep in mind that all data needs to be
+backed up, thus the simpler the disk layout the easier it will be to keep track of what must
+be backed up to tape or other off-line storage medium. Always plan and implement for minimum
+maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance:
+Backup and test, validate every backup, create a disaster recovery plan and prove that it works.
+</p><p>
+Users should be grouped according to data access control needs. File and directory access
+is best controlled via group permissions and the use of the "sticky bit" on group controlled
+directories may substantially avoid file access complaints from samba share users.
+</p><p>
+Many network administrators who are new to the game will attempt to use elaborate techniques
+to set access controls, on files, directories, shares, as well as in share definitions.
+There is the ever present danger that that administrator's successor will not understand the
+complex mess that has been inherited. Remember, apparent job security through complex design
+and implementation may ultimately cause loss of operations and downtime to users as the new
+administrator learns to untangle your web. Keep access controls simple and effective and
+make sure that users will never be interrupted by the stupidity of complexity.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2981321"></a>Logon Scripts</h4></div></div><div></div></div><p>
+Please refer to the section of this document on Advanced Network Adminsitration for information
+regarding the network logon script options for Samba-3. Logon scripts can help to ensure that
+all users gain share and printer connections they need.
+</p><p>
+Logon scripts can be created on-the-fly so that all commands executed are specific to the
+rights and privilidges granted to the user. The preferred controls should be affected through
+group membership so that group information can be used to custom create a logong script using
+the <i class="parameter"><tt>root preexec</tt></i> parameters to the <tt class="filename">NETLOGON</tt> share.
+</p><p>
+Some sites prefer to use a tool such as <b class="command">kixstart</b> to establish a controlled
+user environment. In any case you may wish to do a google search for logon script process controls.
+In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that
+deals with how to add printers without user intervention via the logon script process.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2981379"></a>Profile Migration/Creation</h4></div></div><div></div></div><p>
+User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile
+Management.
+</p><p>
+Profiles may also be managed using the Samba-3 tool <b class="command">profiles</b>. This tool allows
+the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file
+to be changed to the SID of the Samba-3 domain.
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2981408"></a>User and Group Accounts</h4></div></div><div></div></div><p>
+It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before
+attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the
+groups that are present on the MS Windows NT4 domain <span class="emphasis"><em>AND</em></span> to connect these to
+suitable Unix/Linux groups. Following this simple advice will mean that all user and group attributes
+should migrate painlessly.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2981433"></a>Steps In Migration Process</h3></div></div><div></div></div><p>
+The approximate migration process is described below.
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated
+</p></li><li><p>
+Samba-3 set up as a DC with netlogon share, profile share, etc.
+</p></li></ul></div><div class="procedure"><p class="title"><b>Procedure 31.1. The Account Migration Process</b></p><ol type="1"><li><p>Create a BDC account for the samba server using NT Server Manager</p><ol type="a"><li><p>Samba must NOT be running</p></li></ol></li><li><p><b class="userinput"><tt>rpcclient <i class="replaceable"><tt>NT4PDC</tt></i> -U Administrator%<i class="replaceable"><tt>passwd</tt></i></tt></b></p><ol type="a"><li><p>lsaquery</p></li><li><p>Note the SID returned</p></li></ol></li><li><p><b class="userinput"><tt>net getsid -S <i class="replaceable"><tt>NT4PDC</tt></i> -w <i class="replaceable"><tt>DOMNAME</tt></i> -U Administrator%<i class="replaceable"><tt>passwd</tt></i></tt></b></p><ol type="a"><li><p>Note the SID</p></li></ol></li><li><p><b class="userinput"><tt>net getlocalsid</tt></b></p><ol type="a"><li><p>Note the SID, now check that all three SIDS reported are the same!</p></li></ol></li><li><p><b class="userinput"><tt>net rpc join -S <i class="replaceable"><tt>NT4PDC</tt></i> -w <i class="replaceable"><tt>DOMNAME</tt></i> -U Administrator%<i class="replaceable"><tt>passwd</tt></i></tt></b></p></li><li><p><b class="userinput"><tt>net rpc vampire -S <i class="replaceable"><tt>NT4PDC</tt></i> -U administrator%<i class="replaceable"><tt>passwd</tt></i></tt></b></p></li><li><p><b class="userinput"><tt>pdbedit -L</tt></b></p><ol type="a"><li><p>Note - did the users migrate?</p></li></ol></li><li><p><b class="userinput"><tt>initGrps.sh <i class="replaceable"><tt>DOMNAME</tt></i></tt></b></p></li><li><p><b class="userinput"><tt>net groupmap list</tt></b></p><ol type="a"><li><p>Now check that all groups are recognised</p></li></ol></li><li><p><b class="userinput"><tt>net rpc campire -S <i class="replaceable"><tt>NT4PDC</tt></i> -U administrator%<i class="replaceable"><tt>passwd</tt></i></tt></b></p></li><li><p><b class="userinput"><tt>pdbedit -Lv</tt></b></p><ol type="a"><li><p>Note - check that all group membership has been migrated</p></li></ol></li></ol></div><p>
+Now it is time to migrate all the profiles, then migrate all policy files.
+More later.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2983650"></a>Migration Options</h2></div></div><div></div></div><p>
+Based on feedback from many sites as well as from actual installation and maintenance
+experience sites that wish to migrate from MS Windows NT4 Domain Control to a Samba
+based solution fit into three basic categories.
+</p><div class="table"><a name="id2983665"></a><p class="title"><b>Table 31.1. The 3 Major Site Types</b></p><table summary="The 3 Major Site Types" border="1"><colgroup><col><col></colgroup><thead><tr><th>Number of Users</th><th>Description</th></tr></thead><tbody><tr><td>< 50</td><td><p>Want simple conversion with NO pain</p></td></tr><tr><td>50 - 250</td><td><p>Want new features, can manage some in-house complexity</p></td></tr><tr><td>> 250</td><td><p>Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas</p></td></tr></tbody></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2983731"></a>Planning for Success</h3></div></div><div></div></div><p>
+There are three basic choices for sites that intend to migrate from MS Windwows NT4
+to Samba-3.
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Simple Conversion (total replacement)
+ </p></li><li><p>
+ Upgraded Conversion (could be one of integration)
+ </p></li><li><p>
+ Complete Redesign (completely new solution)
+ </p></li></ul></div><p>
+No matter what choice you make, the following rules will minimise down-stream problems:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ Take sufficient time
+ </p></li><li><p>
+ Avoid Panic
+ </p></li><li><p>
+ Test ALL assumptions
+ </p></li><li><p>
+ Test full roll-out program, including workstation deployment
+ </p></li></ul></div><div class="table"><a name="id2983801"></a><p class="title"><b>Table 31.2. Nature of the Conversion Choices</b></p><table summary="Nature of the Conversion Choices" border="1"><colgroup><col><col><col></colgroup><thead><tr><th>Simple</th><th>Upgraded</th><th>Redesign</th></tr></thead><tbody><tr><td><p>Make use of minimal OS specific features</p></td><td><p>Translate NT4 features to new host OS features</p></td><td><p>Decide:</p></td></tr><tr><td><p>Suck all accounts from NT4 into Samba-3</p></td><td><p>Copy and improve:</p></td><td><p>Authentication Regime (database location and access)</p></td></tr><tr><td><p>Make least number of operational changes</p></td><td><p>Make progressive improvements</p></td><td><p>Desktop Management Methods</p></td></tr><tr><td><p>Take least amount of time to migrate</p></td><td><p>Minimise user impact</p></td><td><p>Better Control of Desktops / Users</p></td></tr><tr><td><p>Live versus Isolated Conversion</p></td><td><p>Maximise functionality</p></td><td><p>Identify Needs for: Manageability, Scalability, Security, Availability</p></td></tr><tr><td><p>Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)</p></td><td><p>Take advantage of lower maintenance opportunity</p></td><td><p></p></td></tr></tbody></table></div></div><div xmlns:ns94="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2983972"></a>Samba Implementation Choices</h3></div></div><div></div></div><pre class="programlisting">
+Authentication database back end
+ Winbind (external Samba or NT4/200x server)
+ Can use pam_mkhomedir.so to auto-create home dirs
+ External server could use Active Directory or NT4 Domain
+
+Database type
+ smbpasswd, tdbsam, ldapsam, MySQLsam
+
+Access Control Points
+ On the Share itself (Use NT4 Server Manager)
+ On the file system
+ Unix permissions on files and directories
+ Posix ACLs enablement in file system?
+ Through Samba share parameters
+ Not recommended - except as only resort
+
+Policies (migrate or create new ones)
+ Group Policy Editor (NT4)
+ Watch out for Tattoo effect
+
+User and Group Profiles
+ Platform specific so use platform tool to change from a Local
+ to a Roaming profile Can use new profiles tool to change SIDs
+ (NTUser.DAT)
+
+Logon Scripts (Know how they work)
+
+User and Group mapping to Unix/Linux
+ username map facility may be needed
+ Use 'net groupmap' to connect NT4 groups to Unix groups
+ Use pdbedit to set/change user configuration
+NOTE:
+If migrating to LDAP back end it may be easier to dump initial LDAP database
+to LDIF, then edit, then reload into LDAP
+
+ OS specific scripts / programs may be needed
+ Add / delete Users
+ Note OS limits on size of name (Linux 8 chars)
+ NT4 up to 254 chars
+ Add / delete machines
+ Applied only to domain members (note up to 16 chars)
+ Add / delete Groups
+ Note OS limits on size and nature
+ Linux limit is 16 char,
+ no spaces and no upper case chars (groupadd)
+
+Migration Tools
+ Domain Control (NT4 Style)
+ Profiles, Policies, Access Controls, Security
+
+Migration Tools
+ Samba: net, rpcclient, smbpasswd, pdbedit, profiles
+ Windows: NT4 Domain User Manager, Server Manager (NEXUS)
+
+Authentication
+ New SAM back end (smbpasswd, tdbsam, ldapsam, mysqlsam)
+</pre><ns94:p>
+</ns94:p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="SWAT"></a>Chapter 32. SWAT - The Samba Web Administration Tool</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">April 21, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2984279">Features and Benefits</a></dt><dd><dl><dt><a href="#id2984129">Enabling SWAT for use</a></dt><dt><a href="#id2985018">Securing SWAT through SSL</a></dt><dt><a href="#id2985131">The SWAT Home Page</a></dt><dt><a href="#id2985194">Global Settings</a></dt><dt><a href="#id2985300">Share Settings</a></dt><dt><a href="#id2985365">Printers Settings</a></dt><dt><a href="#id2985429">The SWAT Wizard</a></dt><dt><a href="#id2985477">The Status Page</a></dt><dt><a href="#id2985529">The View Page</a></dt><dt><a href="#id2985552">The Password Change Page</a></dt></dl></dd></dl></div><p>
+There are many and varied opinions regarding the usefulness or otherwise of SWAT.
+No matter how hard one tries to produce the perfect configuration tool it remains
+an object of personal taste. SWAT is a tool that will allow web based configuration
+of samba. It has a wizard that may help to get samba configured quickly, it has context
+sensitive help on each smb.conf parameter, it provides for monitoring of current state
+of connection information, and it allows network wide MS Windows network password
+management.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2984279"></a>Features and Benefits</h2></div></div><div></div></div><p>
+There are network administrators who believe that it is a good idea to write systems
+documentation inside configuration files, for them SWAT will aways be a nasty tool. SWAT
+does not store the configuration file in any intermediate form, rather, it stores only the
+parameter settings, so when SWAT writes the smb.conf file to disk it will write only
+those parameters that are at other than the default settings. The result is that all comments
+will be lost from the <tt class="filename">smb.conf</tt> file. Additionally, the parameters will be written back in
+internal ordering.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+So before using SWAT please be warned - SWAT will completely replace your smb.conf with
+a fully optimised file that has been stripped of all comments you might have placed there
+and only non-default settings will be written to the file.
+</p></div><div xmlns:ns95="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2984129"></a>Enabling SWAT for use</h3></div></div><div></div></div><p>
+SWAT should be installed to run via the network super daemon. Depending on which system
+your Unix/Linux system has you will have either an <b class="command">inetd</b> or
+<b class="command">xinetd</b> based system.
+</p><p>
+The nature and location of the network super-daemon varies with the operating system
+implementation. The control file (or files) can be located in the file
+<tt class="filename">/etc/inetd.conf</tt> or in the directory <tt class="filename">/etc/[x]inet.d</tt>
+or similar.
+</p><p>
+The control entry for the older style file might be:
+</p><pre class="programlisting">
+ # swat is the Samba Web Administration Tool
+ swat stream tcp nowait.400 root /usr/sbin/swat swat
+</pre><p>
+A control file for the newer style xinetd could be:
+</p><ns95:p>
+</ns95:p><pre class="programlisting">
+ # default: off
+ # description: SWAT is the Samba Web Admin Tool. Use swat \
+ # to configure your Samba server. To use SWAT, \
+ # connect to port 901 with your favorite web browser.
+ service swat
+ {
+ port = 901
+ socket_type = stream
+ wait = no
+ only_from = localhost
+ user = root
+ server = /usr/sbin/swat
+ log_on_failure += USERID
+ disable = yes
+ }
+</pre><ns95:p>
+
+</ns95:p><p>
+Both the above examples assume that the <b class="command">swat</b> binary has been
+located in the <tt class="filename">/usr/sbin</tt> directory. In addition to the above
+SWAT will use a directory access point from which it will load it's help files
+as well as other control information. The default location for this on most Linux
+systems is in the directory <tt class="filename">/usr/share/samba/swat</tt>. The default
+location using samba defaults will be <tt class="filename">/usr/local/samba/swat</tt>.
+</p><p>
+Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user
+the only permission allowed is to view certain aspects of configuration as well as
+access to the password change facility. The buttons that will be exposed to the non-root
+user are: <span class="guibutton">HOME</span>, <span class="guibutton">STATUS</span>, <span class="guibutton">VIEW</span>,
+<span class="guibutton">PASSWORD</span>. The only page that allows
+change capability in this case is <span class="guibutton">PASSWORD</span>.
+</p><p>
+So long as you log onto SWAT as the user <span class="emphasis"><em>root</em></span> you should obtain
+full change and commit ability. The buttons that will be exposed includes:
+<span class="guibutton">HOME</span>, <span class="guibutton">GLOBALS</span>, <span class="guibutton">SHARES</span>, <span class="guibutton">PRINTERS</span>,
+<span class="guibutton">WIZARD</span>, <span class="guibutton">STATUS</span>, <span class="guibutton">VIEW</span>, <span class="guibutton">PASSWORD</span>.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2985018"></a>Securing SWAT through SSL</h3></div></div><div></div></div><p>
+Lots of people have asked about how to setup SWAT with SSL to allow for secure remote
+administration of Samba. Here is a method that works, courtesy of Markus Krieger
+</p><p>
+Modifications to the swat setup are as following:
+</p><div class="procedure"><ol type="1"><li><p>
+ install OpenSSL
+ </p></li><li xmlns:ns96=""><ns96:p>
+ generate certificate and private key
+
+ </ns96:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>/usr/bin/openssl req -new -x509 -days 365 -nodes -config \
+ /usr/share/doc/packages/stunnel/stunnel.cnf \
+ -out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem</tt></b>
+ </pre></li><li><p>
+ remove swat-entry from [x]inetd
+ </p></li><li xmlns:ns97=""><ns97:p>
+ start stunnel
+
+ </ns97:p><pre class="screen">
+<tt class="prompt">root# </tt><b class="userinput"><tt>stunnel -p /etc/stunnel/stunnel.pem -d 901 \
+ -l /usr/local/samba/bin/swat swat </tt></b>
+ </pre></li></ol></div><p>
+afterwards simply contact to swat by using the URL <a href="https://myhost:901" target="_top">https://myhost:901</a>, accept the certificate
+and the SSL connection is up.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2985131"></a>The SWAT Home Page</h3></div></div><div></div></div><p>
+The SWAT title page provides access to the latest Samba documentation. The manual page for
+each samba component is accessible from this page as are the Samba-HOWTO-Collection (this
+document) as well as the O'Reilly book "Using Samba".
+</p><p>
+Administrators who wish to validate their samba configuration may obtain useful information
+from the man pages for the diganostic utilities. These are available from the SWAT home page
+also. One diagnostic tool that is NOT mentioned on this page, but that is particularly
+useful is <b class="command">ethereal</b>, available from <a href="http://www.ethereal.com" target="_top">
+http://www.ethereal.com</a>.
+</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
+SWAT can be configured to run in <span class="emphasis"><em>demo</em></span> mode. This is NOT recommended
+as it runs SWAT without authentication and with full administrative ability. ie: Allows
+changes to smb.conf as well as general operation with root privilidges. The option that
+creates this ability is the <tt class="option">-a</tt> flag to swat. <span class="emphasis"><em>Do not use this in any
+production environment.</em></span>
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2985194"></a>Global Settings</h3></div></div><div></div></div><p>
+The Globals button will expose a page that allows configuration of the global parameters
+in smb.conf. There are three levels of exposure of the parameters:
+</p><div class="itemizedlist"><ul type="disc"><li><p>
+ <span class="emphasis"><em>Basic</em></span> - exposes common configuration options.
+ </p></li><li><p>
+ <span class="emphasis"><em>Advanced</em></span> - exposes configuration options needed in more
+ complex environments.
+ </p></li><li><p>
+ <span class="emphasis"><em>Developer</em></span> - exposes configuration options that only the brave
+ will want to tamper with.
+ </p></li></ul></div><p>
+To switch to other than <span class="emphasis"><em>Basic</em></span> editing ability click on either the
+<span class="emphasis"><em>Advanced</em></span> or the <span class="emphasis"><em>Developer</em></span> dial, then click the
+<span class="guibutton">Commit Changes</span> button.
+</p><p>
+After making any changes to configuration parameters make sure that you click on the
+<span class="guibutton">Commit Changes</span> button before moving to another area otherwise
+your changes will be immediately lost.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+SWAT has context sensitive help. To find out what each parameter is for simply click the
+<span class="guibutton">Help</span> link to the left of the configurartion parameter.
+</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2985300"></a>Share Settings</h3></div></div><div></div></div><p>
+To affect a currenly configured share, simply click on the pull down button between the
+<span class="guibutton">Choose Share</span> and the <span class="guibutton">Delete Share</span> buttons,
+select the share you wish to operate on, then to edit the settings click on the
+<span class="guibutton">Choose Share</span> button, to delete the share simply press the
+<span class="guibutton">Delete Share</span> button.
+</p><p>
+To create a new share, next to the button labelled <span class="guibutton">Create Share</span> enter
+into the text field the name of the share to be created, then click on the
+<span class="guibutton">Create Share</span> button.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2985365"></a>Printers Settings</h3></div></div><div></div></div><p>
+To affect a currenly configured printer, simply click on the pull down button between the
+<span class="guibutton">Choose Printer</span> and the <span class="guibutton">Delete Printer</span> buttons,
+select the printer you wish to operate on, then to edit the settings click on the
+<span class="guibutton">Choose Printer</span> button, to delete the share simply press the
+<span class="guibutton">Delete Printer</span> button.
+</p><p>
+To create a new printer, next to the button labelled <span class="guibutton">Create Printer</span> enter
+into the text field the name of the share to be created, then click on the
+<span class="guibutton">Create Printer</span> button.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2985429"></a>The SWAT Wizard</h3></div></div><div></div></div><p>
+The purpose if the SWAT Wizard is to help the Microsoft knowledgable network administrator
+to configure Samba with a minimum of effort.
+</p><p>
+The Wizard page provides a tool for rewiting the smb.conf file in fully optimised format.
+This will also happen if you press the commit button. The two differ in the the rewrite button
+ignores any changes that may have been made, while the Commit button causes all changes to be
+affected.
+</p><p>
+The <span class="guibutton">Edit</span> button permits the editing (setting) of the minimal set of
+options that may be necessary to create a working samba server.
+</p><p>
+Finally, there are a limited set of options that will determine what type of server samba
+will be configured for, whether it will be a WINS server, participate as a WINS client, or
+operate with no WINS support. By clicking on one button you can elect to epose (or not) user
+home directories.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2985477"></a>The Status Page</h3></div></div><div></div></div><p>
+The status page serves a limited purpose. Firstly, it allows control of the samba daemons.
+The key daemons that create the samba server environment are: <span class="application">smbd</span>, <span class="application">nmbd</span>, <span class="application">winbindd</span>.
+</p><p>
+The daemons may be controlled individually or as a total group. Additionally, you may set
+an automatic screen refresh timing. As MS Windows clients interact with Samba new smbd processes
+will be continually spawned. The auto-refresh facility will allow you to track the changing
+conditions with minimal effort.
+</p><p>
+Lastly, the Status page may be used to terminate specific smbd client connections in order to
+free files that may be locked.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2985529"></a>The View Page</h3></div></div><div></div></div><p>
+This page allows the administrator to view the optimised <tt class="filename">smb.conf</tt> file and if you are
+particularly massochistic will permit you also to see all possible global configuration
+parameters and their settings.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2985552"></a>The Password Change Page</h3></div></div><div></div></div><p>
+The Password Change page is a popular tool. This tool allows the creation, deletion, deactivation
+and reactivation of MS Windows networking users on the local machine. Alternatively, you can use
+this tool to change a local password for a user account.
+</p><p>
+When logged in as a non-root account the user will have to provide the old password as well as
+the new password (twice). When logged in as <span class="emphasis"><em>root</em></span> only the new password is
+required.
+</p><p>
+One popular use for this tool is to change user passwords across a range of remote MS Windows
+servers.
+</p></div></div></div></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="troubleshooting"></a>Troubleshooting</h1></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt>33. <a href="#diagnosis">The samba checklist</a></dt><dd><dl><dt><a href="#id2985673">Introduction</a></dt><dt><a href="#id2985707">Assumptions</a></dt><dt><a href="#id2985879">The tests</a></dt><dt><a href="#id2989430">Still having troubles?</a></dt></dl></dd><dt>34. <a href="#problems">Analysing and solving samba problems</a></dt><dd><dl><dt><a href="#id2990823">Diagnostics tools</a></dt><dt><a href="#id2989549">Installing 'Network Monitor' on an NT Workstation or a Windows 9x box</a></dt><dt><a href="#id2989832">Useful URL's</a></dt><dt><a href="#id2989876">Getting help from the mailing lists</a></dt><dt><a href="#id2990029">How to get off the mailinglists</a></dt></dl></dd><dt>35. <a href="#bugreport">Reporting Bugs</a></dt><dd><dl><dt><a href="#id2992343">Introduction</a></dt><dt><a href="#id2992402">General info</a></dt><dt><a href="#id2992438">Debug levels</a></dt><dt><a href="#id2990534">Internal errors</a></dt><dt><a href="#id2990642">Attaching to a running process</a></dt><dt><a href="#id2990144">Patches</a></dt></dl></dd></dl></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="diagnosis"></a>Chapter 33. The samba checklist</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:tridge@samba.org">tridge@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">Wed Jan 15</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2985673">Introduction</a></dt><dt><a href="#id2985707">Assumptions</a></dt><dt><a href="#id2985879">The tests</a></dt><dt><a href="#id2989430">Still having troubles?</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2985673"></a>Introduction</h2></div></div><div></div></div><p>
+This file contains a list of tests you can perform to validate your
+Samba server. It also tells you what the likely cause of the problem
+is if it fails any one of these steps. If it passes all these tests
+then it is probably working fine.
+</p><p>
+You should do ALL the tests, in the order shown. We have tried to
+carefully choose them so later tests only use capabilities verified in
+the earlier tests. However, do not stop at the first error as there
+have been some instances when continuing with the tests has helped
+to solve a problem.
+</p><p>
+If you send one of the samba mailing lists an email saying "it doesn't work"
+and you have not followed this test procedure then you should not be surprised
+if your email is ignored.
+</p></div><div xmlns:ns98="" class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2985707"></a>Assumptions</h2></div></div><div></div></div><p>
+In all of the tests it is assumed you have a Samba server called
+BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.
+</p><p>
+The procedure is similar for other types of clients.
+</p><p>
+It is also assumed you know the name of an available share in your
+<tt class="filename">smb.conf</tt>. I will assume this share is called <i class="replaceable"><tt>tmp</tt></i>.
+You can add a <i class="replaceable"><tt>tmp</tt></i> share like this by adding the
+following to <tt class="filename">smb.conf</tt>:
+</p><pre class="programlisting">
+
+[tmp]
+ comment = temporary files
+ path = /tmp
+ read only = yes
+
+</pre><ns98:p>
+</ns98:p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+These tests assume version 3.0 or later of the samba suite.
+Some commands shown did not exist in earlier versions.
+</p></div><p>
+Please pay attention to the error messages you receive. If any error message
+reports that your server is being unfriendly you should first check that your
+IP name resolution is correctly set up. eg: Make sure your <tt class="filename">/etc/resolv.conf</tt>
+file points to name servers that really do exist.
+</p><p>
+Also, if you do not have DNS server access for name resolution please check
+that the settings for your <tt class="filename">smb.conf</tt> file results in <b class="command">dns proxy = no</b>. The
+best way to check this is with <b class="userinput"><tt>testparm smb.conf</tt></b>.
+</p><p>
+It is helpful to monitor the log files during testing by using the
+<b class="command">tail -F <i class="replaceable"><tt>log_file_name</tt></i></b> in a separate
+terminal console (use ctrl-alt-F1 through F6 or multiple terminals in X).
+Relevant log files can be found (for default installations) in
+<tt class="filename">/usr/local/samba/var</tt>. Also, connection logs from
+machines can be found here or possibly in <tt class="filename">/var/log/samba</tt>
+depending on how or if you specified logging in your <tt class="filename">smb.conf</tt> file.
+</p><p>
+If you make changes to your <tt class="filename">smb.conf</tt> file while going through these test,
+don't forget to restart <span class="application">smbd</span> and <span class="application">nmbd</span>.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2985879"></a>The tests</h2></div></div><div></div></div><div class="procedure"><p class="title"><b>Procedure 33.1. Diagnosing your samba server</b></p><ol type="1"><li><p>
+In the directory in which you store your <tt class="filename">smb.conf</tt> file, run the command
+<b class="userinput"><tt>testparm smb.conf</tt></b>. If it reports any errors then your <tt class="filename">smb.conf</tt>
+configuration file is faulty.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Your <tt class="filename">smb.conf</tt> file may be located in: <tt class="filename">/etc/samba</tt>
+Or in: <tt class="filename">/usr/local/samba/lib</tt>
+</p></div></li><li><p>
+Run the command <b class="userinput"><tt>ping BIGSERVER</tt></b> from the PC and
+<b class="userinput"><tt>ping ACLIENT</tt></b> from
+the unix box. If you don't get a valid response then your TCP/IP
+software is not correctly installed.
+</p><p>
+Note that you will need to start a "dos prompt" window on the PC to
+run ping.
+</p><p>
+If you get a message saying <span class="errorname">host not found</span> or similar then your DNS
+software or <tt class="filename">/etc/hosts</tt> file is not correctly setup.
+It is possible to
+run samba without DNS entries for the server and client, but I assume
+you do have correct entries for the remainder of these tests.
+</p><p>
+Another reason why ping might fail is if your host is running firewall
+software. You will need to relax the rules to let in the workstation
+in question, perhaps by allowing access from another subnet (on Linux
+this is done via the <span class="application">ipfwadm</span> program.)
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Modern Linux distributions install ipchains/iptables by default.
+This is a common problem that is often overlooked.
+</p></div></li><li><p>
+Run the command <b class="userinput"><tt>smbclient -L BIGSERVER</tt></b> on the unix box. You
+should get a list of available shares back.
+</p><p>
+If you get a error message containing the string "Bad password" then
+you probably have either an incorrect <b class="command">hosts allow</b>,
+<b class="command">hosts deny</b> or <b class="command">valid users</b> line in your
+<tt class="filename">smb.conf</tt>, or your guest account is not
+valid. Check what your guest account is using <span class="application">testparm</span> and
+temporarily remove any <b class="command">hosts allow</b>, <b class="command">hosts deny</b>, <b class="command">valid users</b> or <b class="command">invalid users</b> lines.
+</p><p>
+If you get a <span class="errorname">connection refused</span> response then the smbd server may
+not be running. If you installed it in inetd.conf then you probably edited
+that file incorrectly. If you installed it as a daemon then check that
+it is running, and check that the netbios-ssn port is in a LISTEN
+state using <b class="userinput"><tt>netstat -a</tt></b>.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+Some Unix / Linux systems use <b class="command">xinetd</b> in place of
+<b class="command">inetd</b>. Check your system documentation for the location
+of the control file/s for your particular system implementation of
+this network super daemon.
+</p></div><p>
+If you get a <span class="errorname">session request failed</span> then the server refused the
+connection. If it says "Your server software is being unfriendly" then
+its probably because you have invalid command line parameters to <span class="application">smbd</span>,
+or a similar fatal problem with the initial startup of <span class="application">smbd</span>. Also
+check your config file (<tt class="filename">smb.conf</tt>) for syntax errors with <span class="application">testparm</span>
+and that the various directories where samba keeps its log and lock
+files exist.
+</p><p>
+There are a number of reasons for which smbd may refuse or decline
+a session request. The most common of these involve one or more of
+the following <tt class="filename">smb.conf</tt> file entries:
+</p><pre class="programlisting">
+ hosts deny = ALL
+ hosts allow = xxx.xxx.xxx.xxx/yy
+ bind interfaces only = Yes
+</pre><p>
+In the above, no allowance has been made for any session requests that
+will automatically translate to the loopback adaptor address 127.0.0.1.
+To solve this problem change these lines to:
+</p><pre class="programlisting">
+ hosts deny = ALL
+ hosts allow = xxx.xxx.xxx.xxx/yy 127.
+</pre><p>
+Do <span class="emphasis"><em>not</em></span> use the <b class="command">bind interfaces only</b> parameter where you
+may wish to
+use the samba password change facility, or where <span class="application">smbclient</span> may need to
+access a local service for name resolution or for local resource
+connections. (Note: the <b class="command">bind interfaces only</b> parameter deficiency
+where it will not allow connections to the loopback address will be
+fixed soon).
+</p><p>
+Another common cause of these two errors is having something already running
+on port <tt class="constant">139</tt>, such as Samba
+(ie: <span class="application">smbd</span> is running from <span class="application">inetd</span> already) or
+something like Digital's Pathworks. Check your <tt class="filename">inetd.conf</tt> file before trying
+to start <span class="application">smbd</span> as a daemon, it can avoid a lot of frustration!
+</p><p>
+And yet another possible cause for failure of this test is when the subnet mask
+and / or broadcast address settings are incorrect. Please check that the
+network interface IP Address / Broadcast Address / Subnet Mask settings are
+correct and that Samba has correctly noted these in the <tt class="filename">log.nmb</tt> file.
+</p></li><li><p>
+Run the command <b class="userinput"><tt>nmblookup -B BIGSERVER __SAMBA__</tt></b>. You should get the
+IP address of your Samba server back.
+</p><p>
+If you don't then nmbd is incorrectly installed. Check your <tt class="filename">inetd.conf</tt>
+if you run it from there, or that the daemon is running and listening
+to udp port 137.
+</p><p>
+One common problem is that many inetd implementations can't take many
+parameters on the command line. If this is the case then create a
+one-line script that contains the right parameters and run that from
+inetd.
+</p></li><li><p>run the command <b class="userinput"><tt>nmblookup -B ACLIENT '*'</tt></b></p><p>
+You should get the PCs IP address back. If you don't then the client
+software on the PC isn't installed correctly, or isn't started, or you
+got the name of the PC wrong.
+</p><p>
+If ACLIENT doesn't resolve via DNS then use the IP address of the
+client in the above test.
+</p></li><li><p>
+Run the command <b class="userinput"><tt>nmblookup -d 2 '*'</tt></b>
+</p><p>
+This time we are trying the same as the previous test but are trying
+it via a broadcast to the default broadcast address. A number of
+Netbios/TCPIP hosts on the network should respond, although Samba may
+not catch all of the responses in the short time it listens. You
+should see <span class="errorname">got a positive name query response</span>
+messages from several hosts.
+</p><p>
+If this doesn't give a similar result to the previous test then
+nmblookup isn't correctly getting your broadcast address through its
+automatic mechanism. In this case you should experiment with the
+<b class="command">interfaces</b> option in <tt class="filename">smb.conf</tt> to manually configure your IP
+address, broadcast and netmask.
+</p><p>
+If your PC and server aren't on the same subnet then you will need to
+use the <i class="parameter"><tt>-B</tt></i> option to set the broadcast address to that of the PCs
+subnet.
+</p><p>
+This test will probably fail if your subnet mask and broadcast address are
+not correct. (Refer to TEST 3 notes above).
+</p></li><li><p>
+Run the command <b class="userinput"><tt>smbclient //BIGSERVER/TMP</tt></b>. You should
+then be prompted for a password. You should use the password of the account
+you are logged into the unix box with. If you want to test with
+another account then add the <i class="parameter"><tt>-U <i class="replaceable"><tt>accountname</tt></i></tt></i> option to the end of
+the command line. eg:
+<b class="userinput"><tt>smbclient //bigserver/tmp -Ujohndoe</tt></b>
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+It is possible to specify the password along with the username
+as follows:
+<b class="userinput"><tt>smbclient //bigserver/tmp -Ujohndoe%secret</tt></b>
+</p></div><p>
+Once you enter the password you should get the <tt class="prompt">smb></tt> prompt. If you
+don't then look at the error message. If it says <span class="errorname">invalid network
+name</span> then the service <span class="emphasis"><em>"tmp"</em></span> is not correctly setup in your <tt class="filename">smb.conf</tt>.
+</p><p>
+If it says <span class="errorname">bad password</span> then the likely causes are:
+</p><div class="orderedlist"><ol type="1"><li><p>
+ you have shadow passords (or some other password system) but didn't
+ compile in support for them in <span class="application">smbd</span>
+ </p></li><li><p>
+ your <b class="command">valid users</b> configuration is incorrect
+ </p></li><li><p>
+ you have a mixed case password and you haven't enabled the <b class="command">password
+ level</b> option at a high enough level
+ </p></li><li><p>
+ the <b class="command">path =</b> line in <tt class="filename">smb.conf</tt> is incorrect. Check it with <span class="application">testparm</span>
+ </p></li><li><p>
+ you enabled password encryption but didn't map unix to samba users
+ </p></li></ol></div><p>
+Once connected you should be able to use the commands
+<b class="command">dir</b> <b class="command">get</b> <b class="command">put</b> etc.
+Type <b class="command">help <i class="replaceable"><tt>command</tt></i></b> for instructions. You should
+especially check that the amount of free disk space shown is correct
+when you type <b class="command">dir</b>.
+</p></li><li><p>
+On the PC, type the command <b class="userinput"><tt>net view \\BIGSERVER</tt></b>. You will
+need to do this from within a "dos prompt" window. You should get back a
+list of available shares on the server.
+</p><p>
+If you get a <span class="errorname">network name not found</span> or similar error then netbios
+name resolution is not working. This is usually caused by a problem in
+nmbd. To overcome it you could do one of the following (you only need
+to choose one of them):
+</p><div class="orderedlist"><ol type="1"><li><p>
+ fixup the <span class="application">nmbd</span> installation
+</p></li><li><p>
+ add the IP address of BIGSERVER to the <b class="command">wins server</b> box in the
+ advanced tcp/ip setup on the PC.
+</p></li><li><p>
+ enable windows name resolution via DNS in the advanced section of
+ the tcp/ip setup
+</p></li><li><p>
+ add BIGSERVER to your lmhosts file on the PC.
+</p></li></ol></div><p>
+If you get a <span class="errorname">invalid network name</span> or <span class="errorname">bad password error</span> then the
+same fixes apply as they did for the <b class="userinput"><tt>smbclient -L</tt></b> test above. In
+particular, make sure your <b class="command">hosts allow</b> line is correct (see the man
+pages)
+</p><p>
+Also, do not overlook that fact that when the workstation requests the
+connection to the samba server it will attempt to connect using the
+name with which you logged onto your Windows machine. You need to make
+sure that an account exists on your Samba server with that exact same
+name and password.
+</p><p>
+If you get <span class="errorname">specified computer is not receiving requests</span> or similar
+it probably means that the host is not contactable via tcp services.
+Check to see if the host is running tcp wrappers, and if so add an entry in
+the <tt class="filename">hosts.allow</tt> file for your client (or subnet, etc.)
+</p></li><li><p>
+Run the command <b class="userinput"><tt>net use x: \\BIGSERVER\TMP</tt></b>. You should
+be prompted for a password then you should get a <tt class="computeroutput">command completed
+successfully</tt> message. If not then your PC software is incorrectly
+installed or your smb.conf is incorrect. make sure your <b class="command">hosts allow</b>
+and other config lines in <tt class="filename">smb.conf</tt> are correct.
+</p><p>
+It's also possible that the server can't work out what user name to
+connect you as. To see if this is the problem add the line <i class="parameter"><tt>user =
+<i class="replaceable"><tt>username</tt></i></tt></i> to the <i class="parameter"><tt>[tmp]</tt></i> section of
+<tt class="filename">smb.conf</tt> where <i class="replaceable"><tt>username</tt></i> is the
+username corresponding to the password you typed. If you find this
+fixes things you may need the username mapping option.
+</p><p>
+It might also be the case that your client only sends encrypted passwords
+and you have <i class="parameter"><tt>encrypt passwords = no</tt></i> in <tt class="filename">smb.conf</tt>
+Turn it back on to fix.
+</p></li><li><p>
+Run the command <b class="userinput"><tt>nmblookup -M <i class="replaceable"><tt>testgroup</tt></i></tt></b> where
+<i class="replaceable"><tt>testgroup</tt></i> is the name of the workgroup that your Samba server and
+Windows PCs belong to. You should get back the IP address of the
+master browser for that workgroup.
+</p><p>
+If you don't then the election process has failed. Wait a minute to
+see if it is just being slow then try again. If it still fails after
+that then look at the browsing options you have set in <tt class="filename">smb.conf</tt>. Make
+sure you have <i class="parameter"><tt>preferred master = yes</tt></i> to ensure that
+an election is held at startup.
+</p></li><li><p>
+>From file manager try to browse the server. Your samba server should
+appear in the browse list of your local workgroup (or the one you
+specified in smb.conf). You should be able to double click on the name
+of the server and get a list of shares. If you get a "invalid
+password" error when you do then you are probably running WinNT and it
+is refusing to browse a server that has no encrypted password
+capability and is in user level security mode. In this case either set
+<i class="parameter"><tt>security = server</tt></i> AND
+<i class="parameter"><tt>password server = Windows_NT_Machine</tt></i> in your
+<tt class="filename">smb.conf</tt> file, or make sure <i class="parameter"><tt>encrypted passwords</tt></i> is
+set to "yes".
+</p></li></ol></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2989430"></a>Still having troubles?</h2></div></div><div></div></div><p>Read the chapter on
+<a href="#problems" title="Chapter 34. Analysing and solving samba problems">Analysing and Solving Problems</a>.
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="problems"></a>Chapter 34. Analysing and solving samba problems</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jerry@samba.org">jerry@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">David</span> <span class="surname">Bannon</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:dbannon@samba.org">dbannon@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">8 Apr 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2990823">Diagnostics tools</a></dt><dt><a href="#id2989549">Installing 'Network Monitor' on an NT Workstation or a Windows 9x box</a></dt><dt><a href="#id2989832">Useful URL's</a></dt><dt><a href="#id2989876">Getting help from the mailing lists</a></dt><dt><a href="#id2990029">How to get off the mailinglists</a></dt></dl></div><p>
+There are many sources of information available in the form
+of mailing lists, RFC's and documentation. The docs that come
+with the samba distribution contain very good explanations of
+general SMB topics such as browsing.</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2990823"></a>Diagnostics tools</h2></div></div><div></div></div><p>
+One of the best diagnostic tools for debugging problems is Samba itself.
+You can use the <tt class="option">-d option</tt> for both <span class="application">smbd</span> and <span class="application">nmbd</span> to specify what
+<i class="parameter"><tt>debug level</tt></i> at which to run. See the man pages on smbd, nmbd and
+smb.conf for more information on debugging options. The debug
+level can range from 1 (the default) to 10 (100 for debugging passwords).
+</p><p>
+Another helpful method of debugging is to compile samba using the
+<b class="userinput"><tt>gcc -g </tt></b> flag. This will include debug
+information in the binaries and allow you to attach gdb to the
+running smbd / nmbd process. In order to attach gdb to an smbd
+process for an NT workstation, first get the workstation to make the
+connection. Pressing ctrl-alt-delete and going down to the domain box
+is sufficient (at least, on the first time you join the domain) to
+generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation
+maintains an open connection, and therefore there will be an smbd
+process running (assuming that you haven't set a really short smbd
+idle timeout) So, in between pressing ctrl alt delete, and actually
+typing in your password, you can attach gdb and continue.
+</p><p>
+Some useful samba commands worth investigating:
+</p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>testparam | more</tt></b>
+ <tt class="prompt">$ </tt><b class="userinput"><tt>smbclient -L //{netbios name of server}</tt></b>
+</pre><p>
+An SMB enabled version of tcpdump is available from
+<a href="http://www.tcpdump.org/" target="_top">http://www.tcpdup.org/</a>.
+Ethereal, another good packet sniffer for Unix and Win32
+hosts, can be downloaded from <a href="http://www.ethereal.com/" target="_top">http://www.ethereal.com</a>.
+</p><p>
+For tracing things on the Microsoft Windows NT, Network Monitor
+(aka. netmon) is available on the Microsoft Developer Network CD's,
+the Windows NT Server install CD and the SMS CD's. The version of
+netmon that ships with SMS allows for dumping packets between any two
+computers (i.e. placing the network interface in promiscuous mode).
+The version on the NT Server install CD will only allow monitoring
+of network traffic directed to the local NT box and broadcasts on the
+local subnet. Be aware that Ethereal can read and write netmon
+formatted files.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2989549"></a>Installing 'Network Monitor' on an NT Workstation or a Windows 9x box</h2></div></div><div></div></div><p>
+Installing netmon on an NT workstation requires a couple
+of steps. The following are for installing Netmon V4.00.349, which comes
+with Microsoft Windows NT Server 4.0, on Microsoft Windows NT
+Workstation 4.0. The process should be similar for other versions of
+Windows NT / Netmon. You will need both the Microsoft Windows
+NT Server 4.0 Install CD and the Workstation 4.0 Install CD.
+</p><p>
+Initially you will need to install <span class="application">Network Monitor Tools and Agent</span>
+on the NT Server. To do this
+</p><div class="itemizedlist"><ul type="disc"><li><p>Goto <span class="guibutton">Start</span> - <span class="guibutton">Settings</span> - <span class="guibutton">Control Panel</span> -
+ <span class="guibutton">Network</span> - <span class="guibutton">Services</span> - <span class="guibutton">Add</span> </p></li><li><p>Select the <span class="guilabel">Network Monitor Tools and Agent</span> and
+ click on <span class="guibutton">OK</span>.</p></li><li><p>Click <span class="guibutton">OK</span> on the Network Control Panel.
+ </p></li><li><p>Insert the Windows NT Server 4.0 install CD
+ when prompted.</p></li></ul></div><p>
+At this point the Netmon files should exist in
+<tt class="filename">%SYSTEMROOT%\System32\netmon\*.*</tt>.
+Two subdirectories exist as well, <tt class="filename">parsers\</tt>
+which contains the necessary DLL's for parsing the netmon packet
+dump, and <tt class="filename">captures\</tt>.
+</p><p>
+In order to install the Netmon tools on an NT Workstation, you will
+first need to install the 'Network Monitor Agent' from the Workstation
+install CD.
+</p><div class="itemizedlist"><ul type="disc"><li><p>Goto <span class="guibutton">Start</span> - <span class="guibutton">Settings</span> - <span class="guibutton">Control Panel</span> -
+ <span class="guibutton">Network</span> - <span class="guibutton">Services</span> - <span class="guibutton">Add</span></p></li><li><p>Select the <span class="guilabel">Network Monitor Agent</span> and click
+ on <span class="guibutton">OK</span>.</p></li><li><p>Click <span class="guibutton">OK</span> on the Network Control Panel.
+ </p></li><li><p>Insert the Windows NT Workstation 4.0 install
+ CD when prompted.</p></li></ul></div><p>
+Now copy the files from the NT Server in <tt class="filename">%SYSTEMROOT%\System32\netmon\*.*</tt>
+to <tt class="filename">%SYSTEMROOT%\System32\netmon\*.*</tt> on the Workstation and set
+permissions as you deem appropriate for your site. You will need
+administrative rights on the NT box to run netmon.
+</p><p>
+To install Netmon on a Windows 9x box install the network monitor agent
+from the Windows 9x CD (<tt class="filename">\admin\nettools\netmon</tt>). There is a readme
+file located with the netmon driver files on the CD if you need
+information on how to do this. Copy the files from a working
+Netmon installation.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2989832"></a>Useful URL's</h2></div></div><div></div></div><div class="itemizedlist"><ul type="disc"><li><p>See how Scott Merrill simulates a BDC behavior at
+ <a href="http://www.skippy.net/linux/smb-howto.html" target="_top">
+ http://www.skippy.net/linux/smb-howto.html</a>. </p></li><li><p>FTP site for older SMB specs:
+ <a href="ftp://ftp.microsoft.com/developr/drg/CIFS/" target="_top">
+ ftp://ftp.microsoft.com/developr/drg/CIFS/</a></p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2989876"></a>Getting help from the mailing lists</h2></div></div><div></div></div><p>
+There are a number of Samba related mailing lists. Go to <a href="http://samba.org" target="_top">http://samba.org</a>, click on your nearest mirror
+and then click on <b class="command">Support</b> and then click on <b class="command">
+Samba related mailing lists</b>.
+</p><p>
+For questions relating to Samba TNG go to
+<a href="http://www.samba-tng.org/" target="_top">http://www.samba-tng.org/</a>
+It has been requested that you don't post questions about Samba-TNG to the
+main stream Samba lists.</p><p>
+If you post a message to one of the lists please observe the following guide lines :
+</p><div class="itemizedlist"><ul type="disc"><li><p> Always remember that the developers are volunteers, they are
+not paid and they never guarantee to produce a particular feature at
+a particular time. Any time lines are 'best guess' and nothing more.
+</p></li><li><p> Always mention what version of samba you are using and what
+operating system its running under. You should probably list the
+relevant sections of your <tt class="filename">smb.conf</tt> file, at least the options
+in [global] that affect PDC support.</p></li><li><p>In addition to the version, if you obtained Samba via
+CVS mention the date when you last checked it out.</p></li><li><p> Try and make your question clear and brief, lots of long,
+convoluted questions get deleted before they are completely read !
+Don't post html encoded messages (if you can select colour or font
+size its html).</p></li><li><p> If you run one of those nifty 'I'm on holidays' things when
+you are away, make sure its configured to not answer mailing lists.
+</p></li><li><p> Don't cross post. Work out which is the best list to post to
+and see what happens, i.e. don't post to both samba-ntdom and samba-technical.
+Many people active on the lists subscribe to more
+than one list and get annoyed to see the same message two or more times.
+Often someone will see a message and thinking it would be better dealt
+with on another, will forward it on for you.</p></li><li><p>You might include <span class="emphasis"><em>partial</em></span>
+log files written at a debug level set to as much as 20.
+Please don't send the entire log but enough to give the context of the
+error messages.</p></li><li><p>(Possibly) If you have a complete netmon trace ( from the opening of
+the pipe to the error ) you can send the *.CAP file as well.</p></li><li><p>Please think carefully before attaching a document to an email.
+Consider pasting the relevant parts into the body of the message. The samba
+mailing lists go to a huge number of people, do they all need a copy of your
+smb.conf in their attach directory?</p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2990029"></a>How to get off the mailinglists</h2></div></div><div></div></div><p>To have your name removed from a samba mailing list, go to the
+same place you went to to get on it. Go to <a href="http://lists.samba.org/" target="_top">http://lists.samba.org</a>,
+click on your nearest mirror and then click on <b class="command">Support</b> and
+then click on <b class="command"> Samba related mailing lists</b>. Or perhaps see
+<a href="http://lists.samba.org/mailman/roster/samba-ntdom" target="_top">here</a>
+</p><p>
+Please don't post messages to the list asking to be removed, you will just
+be referred to the above address (unless that process failed in some way...)
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="bugreport"></a>Chapter 35. Reporting Bugs</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="surname">Someone; Tridge or Karl Auer perhaps?</span></h3></div></div><div><p class="pubdate"> 27 June 1997 </p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2992343">Introduction</a></dt><dt><a href="#id2992402">General info</a></dt><dt><a href="#id2992438">Debug levels</a></dt><dt><a href="#id2990534">Internal errors</a></dt><dt><a href="#id2990642">Attaching to a running process</a></dt><dt><a href="#id2990144">Patches</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2992343"></a>Introduction</h2></div></div><div></div></div><p>Please report bugs using
+ <a href="https://bugzilla.samba.org/" target="_top">bugzilla</a>.</p><p>
+Please take the time to read this file before you submit a bug
+report. Also, please see if it has changed between releases, as we
+may be changing the bug reporting mechanism at some time.
+</p><p>
+Please also do as much as you can yourself to help track down the
+bug. Samba is maintained by a dedicated group of people who volunteer
+their time, skills and efforts. We receive far more mail about it than
+we can possibly answer, so you have a much higher chance of an answer
+and a fix if you send us a "developer friendly" bug report that lets
+us fix it fast.
+</p><p>
+Do not assume that if you post the bug to the comp.protocols.smb
+newsgroup or the mailing list that we will read it. If you suspect that your
+problem is not a bug but a configuration problem then it is better to send
+it to the Samba mailing list, as there are (at last count) 5000 other users on
+that list that may be able to help you.
+</p><p>
+You may also like to look though the recent mailing list archives,
+which are conveniently accessible on the Samba web pages
+at <a href="http://samba.org/samba/" target="_top">http://samba.org/samba/</a>.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2992402"></a>General info</h2></div></div><div></div></div><p>
+Before submitting a bug report check your config for silly
+errors. Look in your log files for obvious messages that tell you that
+you've misconfigured something and run testparm to test your config
+file for correct syntax.
+</p><p>
+Have you run through the <a href="#diagnosis" title="Chapter 33. The samba checklist">diagnosis</a>?
+This is very important.
+</p><p>
+If you include part of a log file with your bug report then be sure to
+annotate it with exactly what you were doing on the client at the
+time, and exactly what the results were.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2992438"></a>Debug levels</h2></div></div><div></div></div><p>
+If the bug has anything to do with Samba behaving incorrectly as a
+server (like refusing to open a file) then the log files will probably
+be very useful. Depending on the problem a log level of between 3 and
+10 showing the problem may be appropriate. A higher level givesmore
+detail, but may use too much disk space.
+</p><p>
+To set the debug level use the <i class="parameter"><tt>log level</tt></i> in your
+<tt class="filename">smb.conf</tt>. You may also find it useful to set the log
+level higher for just one machine and keep separate logs for each machine.
+To do this use:
+</p><pre class="programlisting">
+log level = 10
+log file = /usr/local/samba/lib/log.%m
+include = /usr/local/samba/lib/smb.conf.%m
+</pre><p>
+then create a file
+<tt class="filename">/usr/local/samba/lib/smb.conf.<i class="replaceable"><tt>machine</tt></i></tt> where
+<i class="replaceable"><tt>machine</tt></i> is the name of the client you wish to debug. In that file
+put any <tt class="filename">smb.conf</tt> commands you want, for example
+<i class="parameter"><tt>log level</tt></i> may be useful. This also allows you to
+experiment with different security systems, protocol levels etc on just
+one machine.
+</p><p>
+The <tt class="filename">smb.conf</tt> entry <i class="parameter"><tt>log level</tt></i>
+is synonymous with the parameter <i class="parameter"><tt>debuglevel</tt></i> that has
+been used in older versions of Samba and is being retained for backwards
+compatibility of <tt class="filename">smb.conf</tt> files.
+</p><p>
+As the <i class="parameter"><tt>log level</tt></i> value is increased you will record
+a significantly increasing level of debugging information. For most
+debugging operations you may not need a setting higher than
+<tt class="constant">3</tt>. Nearly
+all bugs can be tracked at a setting of <tt class="constant">10</tt>, but be
+prepared for a VERY large volume of log data.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2990534"></a>Internal errors</h2></div></div><div></div></div><p>
+If you get a <span class="errorname">INTERNAL ERROR</span> message in your log files
+it means that Samba got an unexpected signal while running. It is probably a
+segmentation fault and almost certainly means a bug in Samba (unless
+you have faulty hardware or system software).
+</p><p>
+If the message came from smbd then it will probably be accompanied by
+a message which details the last SMB message received by smbd. This
+info is often very useful in tracking down the problem so please
+include it in your bug report.
+</p><p>
+You should also detail how to reproduce the problem, if
+possible. Please make this reasonably detailed.
+</p><p>
+You may also find that a core file appeared in a <tt class="filename">corefiles</tt>
+subdirectory of the directory where you keep your samba log
+files. This file is the most useful tool for tracking down the bug. To
+use it you do this:
+</p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>gdb smbd core</tt></b>
+</pre><p>
+adding appropriate paths to smbd and core so gdb can find them. If you
+don't have gdb then try <b class="userinput"><tt>dbx</tt></b>. Then within the debugger
+use the command <b class="command">where</b> to give a stack trace of where the
+problem occurred. Include this in your report.
+</p><p>
+If you know any assembly language then do a
+<b class="command">disass</b> of the routine
+where the problem occurred (if its in a library routine then
+disassemble the routine that called it) and try to work out exactly
+where the problem is by looking at the surrounding code. Even if you
+don't know assembly then incuding this info in the bug report can be
+useful.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2990642"></a>Attaching to a running process</h2></div></div><div></div></div><p>
+Unfortunately some unixes (in particular some recent linux kernels)
+refuse to dump a core file if the task has changed uid (which smbd
+does often). To debug with this sort of system you could try to attach
+to the running process using
+<b class="userinput"><tt>gdb smbd <i class="replaceable"><tt>PID</tt></i></tt></b> where you get
+<i class="replaceable"><tt>PID</tt></i> from <span class="application">smbstatus</span>.
+Then use <b class="command">c</b> to continue and try to cause the core dump
+using the client. The debugger should catch the fault and tell you
+where it occurred.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2990144"></a>Patches</h2></div></div><div></div></div><p>
+The best sort of bug report is one that includes a fix! If you send us
+patches please use <b class="userinput"><tt>diff -u</tt></b> format if your version of
+diff supports it, otherwise use <b class="userinput"><tt>diff -c4</tt></b>. Make sure
+you do the diff against a clean version of the source and let me know
+exactly what version you used.
+</p></div></div></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="Appendixes"></a>Appendixes</h1></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt>36. <a href="#compiling">How to compile SAMBA</a></dt><dd><dl><dt><a href="#id2990261">Access Samba source code via CVS</a></dt><dd><dl><dt><a href="#id2990268">Introduction</a></dt><dt><a href="#id2990297">CVS Access to samba.org</a></dt></dl></dd><dt><a href="#id2991766">Accessing the samba sources via rsync and ftp</a></dt><dt><a href="#id2991814">Verifying Samba's PGP signature</a></dt><dt><a href="#id2991949">Building the Binaries</a></dt><dd><dl><dt><a href="#id2992086">Compiling samba with Active Directory support</a></dt></dl></dd><dt><a href="#id2992982">Starting the smbd and nmbd</a></dt><dd><dl><dt><a href="#id2993073">Starting from inetd.conf</a></dt><dt><a href="#id2993277">Alternative: starting it as a daemon</a></dt></dl></dd><dt><a href="#id2993372">Common Errors</a></dt></dl></dd><dt>37. <a href="#Portability">Portability</a></dt><dd><dl><dt><a href="#id2994651">HPUX</a></dt><dt><a href="#id2994736">SCO Unix</a></dt><dt><a href="#id2994764">DNIX</a></dt><dt><a href="#id2994934">RedHat Linux Rembrandt-II</a></dt><dt><a href="#id2994978">AIX</a></dt><dd><dl><dt><a href="#id2994984">Sequential Read Ahead</a></dt></dl></dd><dt><a href="#id2995010">Solaris</a></dt><dd><dl><dt><a href="#id2995017">Locking improvements</a></dt><dt><a href="#winbind-solaris9">Winbind on Solaris 9</a></dt></dl></dd></dl></dd><dt>38. <a href="#Other-Clients">Samba and other CIFS clients</a></dt><dd><dl><dt><a href="#id2995794">Macintosh clients?</a></dt><dt><a href="#id2995866">OS2 Client</a></dt><dd><dl><dt><a href="#id2995873">How can I configure OS/2 Warp Connect or
+ OS/2 Warp 4 as a client for Samba?</a></dt><dt><a href="#id2995488">How can I configure OS/2 Warp 3 (not Connect),
+ OS/2 1.2, 1.3 or 2.x for Samba?</a></dt><dt><a href="#id2995548">How do I get printer driver download working
+ for OS/2 clients?</a></dt></dl></dd><dt><a href="#id2995645">Windows for Workgroups</a></dt><dd><dl><dt><a href="#id2995107">Use latest TCP/IP stack from Microsoft</a></dt><dt><a href="#id2995197">Delete .pwl files after password change</a></dt><dt><a href="#id2995227">Configure WfW password handling</a></dt><dt><a href="#id2995273">Case handling of passwords</a></dt><dt><a href="#id2995303">Use TCP/IP as default protocol</a></dt><dt><a href="#id2995320">Speed improvement</a></dt></dl></dd><dt><a href="#id2995367">Windows '95/'98</a></dt><dd><dl><dt><a href="#id2996396">Speed improvement</a></dt></dl></dd><dt><a href="#id2996420">Windows 2000 Service Pack 2</a></dt><dt><a href="#id2996531">Windows NT 3.1</a></dt></dl></dd><dt>39. <a href="#speed">Samba Performance Tuning</a></dt><dd><dl><dt><a href="#id2996649">Comparisons</a></dt><dt><a href="#id2996693">Socket options</a></dt><dt><a href="#id2996767">Read size</a></dt><dt><a href="#id2996811">Max xmit</a></dt><dt><a href="#id2996864">Log level</a></dt><dt><a href="#id2996886">Read raw</a></dt><dt><a href="#id2997829">Write raw</a></dt><dt><a href="#id2997871">Slow Logins</a></dt><dt><a href="#id2997892">LDAP</a></dt><dt><a href="#id2997917">Client tuning</a></dt><dt><a href="#id2997940">Samba performance problem due changing kernel</a></dt><dt><a href="#id2997973">Corrupt tdb Files</a></dt></dl></dd><dt>40. <a href="#DNSDHCP">DNS and DHCP Configuration Guide</a></dt><dd><dl><dt><a href="#id2998691">Note</a></dt></dl></dd><dt>41. <a href="#Further-Resources">Further Resources</a></dt><dd><dl><dt><a href="#id2998110">Websites</a></dt><dt><a href="#id2998494">Related updates from microsoft</a></dt><dt><a href="#id2998561">Books</a></dt></dl></dd></dl></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="compiling"></a>Chapter 36. How to compile SAMBA</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="surname">Someone; Jerry perhaps?</span></h3></div></div><div><p class="pubdate"> 22 May 2001 </p></div><div><p class="pubdate"> 18 March 2003 </p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2990261">Access Samba source code via CVS</a></dt><dd><dl><dt><a href="#id2990268">Introduction</a></dt><dt><a href="#id2990297">CVS Access to samba.org</a></dt></dl></dd><dt><a href="#id2991766">Accessing the samba sources via rsync and ftp</a></dt><dt><a href="#id2991814">Verifying Samba's PGP signature</a></dt><dt><a href="#id2991949">Building the Binaries</a></dt><dd><dl><dt><a href="#id2992086">Compiling samba with Active Directory support</a></dt></dl></dd><dt><a href="#id2992982">Starting the smbd and nmbd</a></dt><dd><dl><dt><a href="#id2993073">Starting from inetd.conf</a></dt><dt><a href="#id2993277">Alternative: starting it as a daemon</a></dt></dl></dd><dt><a href="#id2993372">Common Errors</a></dt></dl></div><p>
+You can obtain the samba source from the
+<a href="http://samba.org/" target="_top">samba website</a>. To obtain a development version,
+you can download samba from CVS or using rsync.
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2990261"></a>Access Samba source code via CVS</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2990268"></a>Introduction</h3></div></div><div></div></div><p>
+Samba is developed in an open environment. Developers use CVS
+(Concurrent Versioning System) to "checkin" (also known as
+"commit") new source code. Samba's various CVS branches can
+be accessed via anonymous CVS using the instructions
+detailed in this chapter.
+</p><p>
+This chapter is a modified version of the instructions found at
+<a href="http://samba.org/samba/cvs.html" target="_top">http://samba.org/samba/cvs.html</a>
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2990297"></a>CVS Access to samba.org</h3></div></div><div></div></div><p>
+The machine samba.org runs a publicly accessible CVS
+repository for access to the source code of several packages,
+including samba, rsync, distcc, ccache and jitterbug. There are two main ways
+of accessing the CVS server on this host.
+</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2990313"></a>Access via CVSweb</h4></div></div><div></div></div><p>
+You can access the source code via your
+favourite WWW browser. This allows you to access the contents of
+individual files in the repository and also to look at the revision
+history and commit logs of individual files. You can also ask for a diff
+listing between any two versions on the repository.
+</p><p>
+Use the URL : <a href="http://samba.org/cgi-bin/cvsweb" target="_top">http://samba.org/cgi-bin/cvsweb</a>
+</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2990343"></a>Access via cvs</h4></div></div><div></div></div><p>
+You can also access the source code via a
+normal cvs client. This gives you much more control over what you can
+do with the repository and allows you to checkout whole source trees
+and keep them up to date via normal cvs commands. This is the
+preferred method of access if you are a developer and not
+just a casual browser.
+</p><p>
+To download the latest cvs source code, point your
+browser at the URL :
+<a href="http://www.cyclic.com/" target="_top">http://www.cyclic.com/</a>.
+and click on the 'How to get cvs' link. CVS is free software under
+the GNU GPL (as is Samba). Note that there are several graphical CVS clients
+which provide a graphical interface to the sometimes mundane CVS commands.
+Links to theses clients are also available from the Cyclic website.
+</p><p>
+To gain access via anonymous cvs use the following steps.
+For this example it is assumed that you want a copy of the
+samba source code. For the other source code repositories
+on this system just substitute the correct package name
+</p><div class="procedure"><p class="title"><b>Procedure 36.1. Retrieving samba using CVS</b></p><ol type="1"><li><p>
+ Install a recent copy of cvs. All you really need is a
+ copy of the cvs client binary.
+ </p></li><li><p>
+ Run the command
+ </p><p>
+ <b class="userinput"><tt>cvs -d :pserver:cvs@samba.org:/cvsroot login</tt></b>
+ </p></li><li><p>
+ When it asks you for a password type <b class="userinput"><tt>cvs</tt></b>.
+ </p></li><li><p>
+ Run the command
+ </p><p>
+ <b class="userinput"><tt>cvs -d :pserver:cvs@samba.org:/cvsroot co samba</tt></b>
+ </p><p>
+ This will create a directory called samba containing the
+ latest samba source code (i.e. the HEAD tagged cvs branch). This
+ currently corresponds to the 3.0 development tree.
+ </p><p>
+ CVS branches other then HEAD can be obtained by using the
+ <tt class="option">-r</tt> and defining a tag name. A list of branch tag names
+ can be found on the "Development" page of the samba web site. A common
+ request is to obtain the latest 3.0 release code. This could be done by
+ using the following userinput.
+ </p><p>
+ <b class="userinput"><tt>cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_3_0 samba</tt></b>
+ </p></li><li><p>
+ Whenever you want to merge in the latest code changes use
+ the following command from within the samba directory:
+ </p><p>
+ <b class="userinput"><tt>cvs update -d -P</tt></b>
+ </p></li></ol></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2991766"></a>Accessing the samba sources via rsync and ftp</h2></div></div><div></div></div><p>
+ pserver.samba.org also exports unpacked copies of most parts of the CVS
+ tree at <a href="ftp://pserver.samba.org/pub/unpacked" target="_top">ftp://pserver.samba.org/pub/unpacked</a> and also via anonymous rsync at
+ <a href="rsync://pserver.samba.org/ftp/unpacked/" target="_top">rsync://pserver.samba.org/ftp/unpacked/</a>. I recommend using rsync rather than ftp.
+ See <a href="http://rsync.samba.org/" target="_top">the rsync homepage</a> for more info on rsync.
+ </p><p>
+ The disadvantage of the unpacked trees is that they do not support automatic
+ merging of local changes like CVS does. rsync access is most convenient
+ for an initial install.
+ </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2991814"></a>Verifying Samba's PGP signature</h2></div></div><div></div></div><p>
+In these days of insecurity, it's strongly recommended that you verify the PGP
+signature for any source file before installing it. Even if you're not
+downloading from a mirror site, verifying PGP signatures should be a
+standard reflex.
+</p><p>
+With that said, go ahead and download the following files:
+</p><pre class="screen">
+<tt class="prompt">$ </tt><b class="userinput"><tt> wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc</tt></b>
+<tt class="prompt">$ </tt><b class="userinput"><tt> wget http://us1.samba.org/samba/ftp/samba-pubkey.asc</tt></b>
+</pre><p>
+The first file is the PGP signature for the Samba source file; the other is the Samba public
+PGP key itself. Import the public PGP key with:
+</p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>gpg --import samba-pubkey.asc</tt></b>
+</pre><p>
+And verify the Samba source code integrity with:
+</p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>gzip -d samba-2.2.8a.tar.gz</tt></b>
+ <tt class="prompt">$ </tt><b class="userinput"><tt>gpg --verify samba-2.2.8a.tar.asc</tt></b>
+</pre><p>
+If you receive a message like, "Good signature from Samba Distribution
+Verification Key..."
+then all is well. The warnings about trust relationships can be ignored. An
+example of what you would not want to see would be:
+</p><tt class="computeroutput">
+ gpg: BAD signature from "Samba Distribution Verification Key"
+</tt></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2991949"></a>Building the Binaries</h2></div></div><div></div></div><p>To do this, first run the program <b class="userinput"><tt>./configure
+ </tt></b> in the source directory. This should automatically
+ configure Samba for your operating system. If you have unusual
+ needs then you may wish to run</p><p><tt class="prompt">root# </tt><b class="userinput"><tt>./configure --help
+ </tt></b></p><p>first to see what special options you can enable.
+ Then executing</p><p><tt class="prompt">root# </tt><b class="userinput"><tt>make</tt></b></p><p>will create the binaries. Once it's successfully
+ compiled you can use </p><p><tt class="prompt">root# </tt><b class="userinput"><tt>make install</tt></b></p><p>to install the binaries and manual pages. You can
+ separately install the binaries and/or man pages using</p><p><tt class="prompt">root# </tt><b class="userinput"><tt>make installbin
+ </tt></b></p><p>and</p><p><tt class="prompt">root# </tt><b class="userinput"><tt>make installman
+ </tt></b></p><p>Note that if you are upgrading for a previous version
+ of Samba you might like to know that the old versions of
+ the binaries will be renamed with a ".old" extension. You
+ can go back to the previous version with</p><p><tt class="prompt">root# </tt><b class="userinput"><tt>make revert
+ </tt></b></p><p>if you find this version a disaster!</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2992086"></a>Compiling samba with Active Directory support</h3></div></div><div></div></div><p>In order to compile samba with ADS support, you need to have installed
+ on your system:</p><div class="itemizedlist"><ul type="disc"><li><p>the MIT kerberos development libraries
+ (either install from the sources or use a package). The
+ heimdal libraries will not work.</p></li><li><p>the OpenLDAP development libraries.</p></li></ul></div><p>If your kerberos libraries are in a non-standard location then
+ remember to add the configure option
+ <tt class="option">--with-krb5=<i class="replaceable"><tt>DIR</tt></i></tt>.</p><p>After you run configure make sure that
+ <tt class="filename">include/config.h</tt> it generates contains lines like
+ this:</p><pre class="programlisting">
+#define HAVE_KRB5 1
+#define HAVE_LDAP 1
+</pre><p>If it doesn't then configure did not find your krb5 libraries or
+ your ldap libraries. Look in <tt class="filename">config.log</tt> to figure
+ out why and fix it.</p><div xmlns:ns99="" class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2992896"></a>Installing the required packages for Debian</h4></div></div><div></div></div><p>On Debian you need to install the following packages:</p><ns99:p>
+ </ns99:p><table class="simplelist" border="0" summary="Simple list"><tr><td>libkrb5-dev</td></tr><tr><td>krb5-user</td></tr></table><ns99:p>
+ </ns99:p></div><div xmlns:ns100="" class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2992929"></a>Installing the required packages for RedHat</h4></div></div><div></div></div><p>On RedHat this means you should have at least: </p><ns100:p>
+ </ns100:p><table class="simplelist" border="0" summary="Simple list"><tr><td>krb5-workstation (for kinit)</td></tr><tr><td>krb5-libs (for linking with)</td></tr><tr><td>krb5-devel (because you are compiling from source)</td></tr></table><ns100:p>
+ </ns100:p><p>in addition to the standard development environment.</p><p>Note that these are not standard on a RedHat install, and you may need
+ to get them off CD2.</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2992982"></a>Starting the <span class="application">smbd</span> and <span class="application">nmbd</span></h2></div></div><div></div></div><p>You must choose to start <span class="application">smbd</span> and <span class="application">nmbd</span> either
+ as daemons or from <span class="application">inetd</span>Don't try
+ to do both! Either you can put them in <tt class="filename">
+ inetd.conf</tt> and have them started on demand
+ by <span class="application">inetd</span>, or you can start them as
+ daemons either from the command line or in <tt class="filename">
+ /etc/rc.local</tt>. See the man pages for details
+ on the command line options. Take particular care to read
+ the bit about what user you need to be in order to start
+ Samba. In many cases you must be root.</p><p>The main advantage of starting <span class="application">smbd</span>
+ and <span class="application">nmbd</span> using the recommended daemon method
+ is that they will respond slightly more quickly to an initial connection
+ request.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2993073"></a>Starting from inetd.conf</h3></div></div><div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>The following will be different if
+ you use NIS, NIS+ or LDAP to distribute services maps.</p></div><p>Look at your <tt class="filename">/etc/services</tt>.
+ What is defined at port 139/tcp. If nothing is defined
+ then add a line like this:</p><pre class="programlisting">netbios-ssn 139/tcp</pre><p>similarly for 137/udp you should have an entry like:</p><pre class="programlisting">netbios-ns 137/udp</pre><p>Next edit your <tt class="filename">/etc/inetd.conf</tt>
+ and add two lines something like this:</p><pre class="programlisting">
+ netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd
+ netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd
+ </pre><p>The exact syntax of <tt class="filename">/etc/inetd.conf</tt>
+ varies between unixes. Look at the other entries in inetd.conf
+ for a guide.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Some unixes already have entries like netbios_ns
+ (note the underscore) in <tt class="filename">/etc/services</tt>.
+ You must either edit <tt class="filename">/etc/services</tt> or
+ <tt class="filename">/etc/inetd.conf</tt> to make them consistent.
+ </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>On many systems you may need to use the
+ <i class="parameter"><tt>interfaces</tt></i> option in <tt class="filename">smb.conf</tt> to specify the IP
+ address and netmask of your interfaces. Run
+ <span class="application">ifconfig</span>
+ as root if you don't know what the broadcast is for your
+ net. <span class="application">nmbd</span> tries to determine it at run
+ time, but fails on some unixes.
+ </p></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>Many unixes only accept around 5
+ parameters on the command line in <tt class="filename">inetd.conf</tt>.
+ This means you shouldn't use spaces between the options and
+ arguments, or you should use a script, and start the script
+ from <b class="command">inetd</b>.</p></div><p>Restart <span class="application">inetd</span>, perhaps just send
+ it a HUP. If you have installed an earlier version of <span class="application">nmbd</span> then
+ you may need to kill <span class="application">nmbd</span> as well.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2993277"></a>Alternative: starting it as a daemon</h3></div></div><div></div></div><p>To start the server as a daemon you should create
+ a script something like this one, perhaps calling
+ it <tt class="filename">startsmb</tt>.</p><pre class="programlisting">
+ #!/bin/sh
+ /usr/local/samba/bin/smbd -D
+ /usr/local/samba/bin/nmbd -D
+ </pre><p>then make it executable with <b class="command">chmod
+ +x startsmb</b></p><p>You can then run <b class="command">startsmb</b> by
+ hand or execute it from <tt class="filename">/etc/rc.local</tt>
+ </p><p>To kill it send a kill signal to the processes
+ <span class="application">nmbd</span> and <span class="application">smbd</span>.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>If you use the SVR4 style init system then
+ you may like to look at the <tt class="filename">examples/svr4-startup</tt>
+ script to make Samba fit into that system.</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2993372"></a>Common Errors</h2></div></div><div></div></div><p>“<span class="quote">
+I'm using gcc 3 and I've compiled Samba-3 from the CVS and the
+binaries are very large files (40 Mb and 20 Mb). I've the same result with
+<tt class="option">--enable-shared</tt> ?
+</span>”
+</p><p>
+The dwarf format used by GCC 3 for storing debugging symbols is very inefficient.
+Strip the binaries, don't compile with -g or compile with -gstabs.
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Portability"></a>Chapter 37. Portability</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2994651">HPUX</a></dt><dt><a href="#id2994736">SCO Unix</a></dt><dt><a href="#id2994764">DNIX</a></dt><dt><a href="#id2994934">RedHat Linux Rembrandt-II</a></dt><dt><a href="#id2994978">AIX</a></dt><dd><dl><dt><a href="#id2994984">Sequential Read Ahead</a></dt></dl></dd><dt><a href="#id2995010">Solaris</a></dt><dd><dl><dt><a href="#id2995017">Locking improvements</a></dt><dt><a href="#winbind-solaris9">Winbind on Solaris 9</a></dt></dl></dd></dl></div><p>Samba works on a wide range of platforms but the interface all the
+platforms provide is not always compatible. This chapter contains
+platform-specific information about compiling and using samba.</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2994651"></a>HPUX</h2></div></div><div></div></div><p>
+HP's implementation of supplementary groups is, er, non-standard (for
+hysterical reasons). There are two group files, <tt class="filename">/etc/group</tt> and
+<tt class="filename">/etc/logingroup</tt>; the system maps UIDs to numbers using the former, but
+initgroups() reads the latter. Most system admins who know the ropes
+symlink <tt class="filename">/etc/group</tt> to <tt class="filename">/etc/logingroup</tt>
+(hard link doesn't work for reasons too stupid to go into here). initgroups() will complain if one of the
+groups you're in in <tt class="filename">/etc/logingroup</tt> has what it considers to be an invalid
+ID, which means outside the range <tt class="constant">[0..UID_MAX]</tt>, where <tt class="constant">UID_MAX</tt> is (I think)
+60000 currently on HP-UX. This precludes -2 and 65534, the usual <tt class="constant">nobody</tt>
+GIDs.
+</p><p>
+If you encounter this problem, make sure that the programs that are failing
+to initgroups() be run as users not in any groups with GIDs outside the
+allowed range.
+</p><p>This is documented in the HP manual pages under setgroups(2) and passwd(4).
+</p><p>
+On HPUX you must use gcc or the HP Ansi compiler. The free compiler
+that comes with HP-UX is not Ansi compliant and cannot compile
+Samba.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2994736"></a>SCO Unix</h2></div></div><div></div></div><p>
+If you run an old version of SCO Unix then you may need to get important
+TCP/IP patches for Samba to work correctly. Without the patch, you may
+encounter corrupt data transfers using samba.
+</p><p>
+The patch you need is UOD385 Connection Drivers SLS. It is available from
+SCO (<a href="ftp://ftp.sco.com/" target="_top">ftp.sco.com</a>, directory SLS,
+files uod385a.Z and uod385a.ltr.Z).
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2994764"></a>DNIX</h2></div></div><div></div></div><p>
+DNIX has a problem with seteuid() and setegid(). These routines are
+needed for Samba to work correctly, but they were left out of the DNIX
+C library for some reason.
+</p><p>
+For this reason Samba by default defines the macro NO_EID in the DNIX
+section of includes.h. This works around the problem in a limited way,
+but it is far from ideal, some things still won't work right.
+</p><p>
+To fix the problem properly you need to assemble the following two
+functions and then either add them to your C library or link them into
+Samba.
+</p><p>
+put this in the file <tt class="filename">setegid.s</tt>:
+</p><pre class="programlisting">
+ .globl _setegid
+_setegid:
+ moveq #47,d0
+ movl #100,a0
+ moveq #1,d1
+ movl 4(sp),a1
+ trap #9
+ bccs 1$
+ jmp cerror
+1$:
+ clrl d0
+ rts
+</pre><p>
+put this in the file <tt class="filename">seteuid.s</tt>:
+</p><pre class="programlisting">
+ .globl _seteuid
+_seteuid:
+ moveq #47,d0
+ movl #100,a0
+ moveq #0,d1
+ movl 4(sp),a1
+ trap #9
+ bccs 1$
+ jmp cerror
+1$:
+ clrl d0
+ rts
+</pre><p>
+after creating the above files you then assemble them using
+</p><pre class="screen">
+ <tt class="prompt">$ </tt><b class="userinput"><tt>as seteuid.s</tt></b>
+ <tt class="prompt">$ </tt><b class="userinput"><tt>as setegid.s</tt></b>
+</pre><p>
+that should produce the files <tt class="filename">seteuid.o</tt> and
+<tt class="filename">setegid.o</tt>
+</p><p>
+then you need to add these to the LIBSM line in the DNIX section of
+the Samba Makefile. Your LIBSM line will then look something like this:
+</p><pre class="programlisting">
+LIBSM = setegid.o seteuid.o -ln
+</pre><p>
+You should then remove the line:
+</p><pre class="programlisting">
+#define NO_EID
+</pre><p>from the DNIX section of <tt class="filename">includes.h</tt></p></div><div xmlns:ns101="" class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2994934"></a>RedHat Linux Rembrandt-II</h2></div></div><div></div></div><ns101:p>
+By default RedHat Rembrandt-II during installation adds an
+entry to <tt class="filename">/etc/hosts</tt> as follows:
+</ns101:p><pre class="programlisting">
+ 127.0.0.1 loopback "hostname"."domainname"
+</pre><ns101:p>
+</ns101:p><p>
+This causes Samba to loop back onto the loopback interface.
+The result is that Samba fails to communicate correctly with
+the world and therefor may fail to correctly negotiate who
+is the master browse list holder and who is the master browser.
+</p><p>
+Corrective Action: Delete the entry after the word loopback
+ in the line starting 127.0.0.1
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2994978"></a>AIX</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2994984"></a>Sequential Read Ahead</h3></div></div><div></div></div><p>
+Disabling Sequential Read Ahead using <b class="userinput"><tt>vmtune -r 0</tt></b> improves
+samba performance significally.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2995010"></a>Solaris</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2995017"></a>Locking improvements</h3></div></div><div></div></div><p>Some people have been experiencing problems with F_SETLKW64/fcntl
+when running samba on solaris. The built in file locking mechanism was
+not scalable. Performance would degrade to the point where processes would
+get into loops of trying to lock a file. It woul try a lock, then fail,
+then try again. The lock attempt was failing before the grant was
+occurring. So the visible manifestation of this would be a handful of
+processes stealing all of the CPU, and when they were trussed they would
+be stuck if F_SETLKW64 loops.
+</p><p>
+Sun released patches for Solaris 2.6, 8, and 9. The patch for Solaris 7
+has not been released yet.
+</p><p>
+The patch revision for 2.6 is 105181-34
+for 8 is 108528-19 and for 9 is 112233-04
+</p><p>
+After the install of these patches it is recommended to reconfigure
+and rebuild samba.
+</p><p>Thanks to Joe Meslovich for reporting</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="winbind-solaris9"></a>Winbind on Solaris 9</h3></div></div><div></div></div><p>
+Nsswitch on Solaris 9 refuses to use the winbind nss module. This behavior
+is fixed by Sun in patch 113476-05 which as of March 2003 is not in any
+roll-up packages.
+</p></div></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Other-Clients"></a>Chapter 38. Samba and other CIFS clients</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jim</span> <span class="surname">McDonough</span></h3><div class="affiliation"><span class="orgname">IBM<br></span><div class="address"><p><tt class="email"><<a href="mailto:jmcd@us.ibm.com">jmcd@us.ibm.com</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">5 Mar 2001</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2995794">Macintosh clients?</a></dt><dt><a href="#id2995866">OS2 Client</a></dt><dd><dl><dt><a href="#id2995873">How can I configure OS/2 Warp Connect or
+ OS/2 Warp 4 as a client for Samba?</a></dt><dt><a href="#id2995488">How can I configure OS/2 Warp 3 (not Connect),
+ OS/2 1.2, 1.3 or 2.x for Samba?</a></dt><dt><a href="#id2995548">How do I get printer driver download working
+ for OS/2 clients?</a></dt></dl></dd><dt><a href="#id2995645">Windows for Workgroups</a></dt><dd><dl><dt><a href="#id2995107">Use latest TCP/IP stack from Microsoft</a></dt><dt><a href="#id2995197">Delete .pwl files after password change</a></dt><dt><a href="#id2995227">Configure WfW password handling</a></dt><dt><a href="#id2995273">Case handling of passwords</a></dt><dt><a href="#id2995303">Use TCP/IP as default protocol</a></dt><dt><a href="#id2995320">Speed improvement</a></dt></dl></dd><dt><a href="#id2995367">Windows '95/'98</a></dt><dd><dl><dt><a href="#id2996396">Speed improvement</a></dt></dl></dd><dt><a href="#id2996420">Windows 2000 Service Pack 2</a></dt><dt><a href="#id2996531">Windows NT 3.1</a></dt></dl></div><p>This chapter contains client-specific information.</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2995794"></a>Macintosh clients?</h2></div></div><div></div></div><p>
+Yes. <a href="http://www.thursby.com/" target="_top">Thursby</a> now have a CIFS Client / Server called <a href="http://www.thursby.com/products/dave.html" target="_top">DAVE</a>
+</p><p>
+They test it against Windows 95, Windows NT and samba for
+compatibility issues. At the time of writing, DAVE was at version
+1.0.1. The 1.0.0 to 1.0.1 update is available as a free download from
+the Thursby web site (the speed of finder copies has been greatly
+enhanced, and there are bug-fixes included).
+</p><p>
+Alternatives - There are two free implementations of AppleTalk for
+several kinds of UNIX machnes, and several more commercial ones.
+These products allow you to run file services and print services
+natively to Macintosh users, with no additional support required on
+the Macintosh. The two free omplementations are
+<a href="http://www.umich.edu/~rsug/netatalk/" target="_top">Netatalk</a>, and
+<a href="http://www.cs.mu.oz.au/appletalk/atalk.html" target="_top">CAP</a>.
+What Samba offers MS
+Windows users, these packages offer to Macs. For more info on these
+packages, Samba, and Linux (and other UNIX-based systems) see
+<a href="http://www.eats.com/linux_mac_win.html" target="_top">http://www.eats.com/linux_mac_win.html</a>
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2995866"></a>OS2 Client</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2995873"></a>How can I configure OS/2 Warp Connect or
+ OS/2 Warp 4 as a client for Samba?</h3></div></div><div></div></div><p>A more complete answer to this question can be
+ found on <a href="http://carol.wins.uva.nl/~leeuw/samba/warp.html" target="_top">
+ http://carol.wins.uva.nl/~leeuw/samba/warp.html</a>.</p><p>Basically, you need three components:</p><table class="simplelist" border="0" summary="Simple list"><tr><td>The File and Print Client ('IBM Peer')</td></tr><tr><td>TCP/IP ('Internet support') </td></tr><tr><td>The "NetBIOS over TCP/IP" driver ('TCPBEUI')</td></tr></table><p>Installing the first two together with the base operating
+ system on a blank system is explained in the Warp manual. If Warp
+ has already been installed, but you now want to install the
+ networking support, use the "Selective Install for Networking"
+ object in the "System Setup" folder.</p><p>Adding the "NetBIOS over TCP/IP" driver is not described
+ in the manual and just barely in the online documentation. Start
+ MPTS.EXE, click on OK, click on "Configure LAPS" and click
+ on "IBM OS/2 NETBIOS OVER TCP/IP" in 'Protocols'. This line
+ is then moved to 'Current Configuration'. Select that line,
+ click on "Change number" and increase it from 0 to 1. Save this
+ configuration.</p><p>If the Samba server(s) is not on your local subnet, you
+ can optionally add IP names and addresses of these servers
+ to the "Names List", or specify a WINS server ('NetBIOS
+ Nameserver' in IBM and RFC terminology). For Warp Connect you
+ may need to download an update for 'IBM Peer' to bring it on
+ the same level as Warp 4. See the webpage mentioned above.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2995488"></a>How can I configure OS/2 Warp 3 (not Connect),
+ OS/2 1.2, 1.3 or 2.x for Samba?</h3></div></div><div></div></div><p>You can use the free Microsoft LAN Manager 2.2c Client
+ for OS/2 from
+ <a href="ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/" target="_top">
+ ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/</a>.
+ See <a href="http://carol.wins.uva.nl/~leeuw/lanman.html" target="_top">
+ http://carol.wins.uva.nl/~leeuw/lanman.html</a> for
+ more information on how to install and use this client. In
+ a nutshell, edit the file \OS2VER in the root directory of
+ the OS/2 boot partition and add the lines:</p><pre class="programlisting">
+ 20=setup.exe
+ 20=netwksta.sys
+ 20=netvdd.sys
+ </pre><p>before you install the client. Also, don't use the
+ included NE2000 driver because it is buggy. Try the NE2000
+ or NS2000 driver from
+ <a href="ftp://ftp.cdrom.com/pub/os2/network/ndis/" target="_top">
+ ftp://ftp.cdrom.com/pub/os2/network/ndis/</a> instead.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2995548"></a>How do I get printer driver download working
+ for OS/2 clients?</h3></div></div><div></div></div><p>First, create a share called <i class="parameter"><tt>[PRINTDRV]</tt></i> that is
+ world-readable. Copy your OS/2 driver files there. Note
+ that the .EA_ files must still be separate, so you will need
+ to use the original install files, and not copy an installed
+ driver from an OS/2 system.</p><p>Install the NT driver first for that printer. Then,
+ add to your <tt class="filename">smb.conf</tt> a parameter, <i class="parameter"><tt>os2 driver map =
+ <i class="replaceable"><tt>filename</tt></i></tt></i>. Then, in the file
+ specified by <i class="replaceable"><tt>filename</tt></i>, map the
+ name of the NT driver name to the OS/2 driver name as
+ follows:</p><p><i class="parameter"><tt><i class="replaceable"><tt>nt driver name</tt></i> = <i class="replaceable"><tt>os2 driver name</tt></i>.<i class="replaceable"><tt>device name</tt></i></tt></i>, e.g.:</p><p><i class="parameter"><tt>
+ HP LaserJet 5L = LASERJET.HP LaserJet 5L</tt></i></p><p>You can have multiple drivers mapped in this file.</p><p>If you only specify the OS/2 driver name, and not the
+ device name, the first attempt to download the driver will
+ actually download the files, but the OS/2 client will tell
+ you the driver is not available. On the second attempt, it
+ will work. This is fixed simply by adding the device name
+ to the mapping, after which it will work on the first attempt.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2995645"></a>Windows for Workgroups</h2></div></div><div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2995107"></a>Use latest TCP/IP stack from Microsoft</h3></div></div><div></div></div><p>Use the latest TCP/IP stack from microsoft if you use Windows
+for workgroups.
+</p><p>The early TCP/IP stacks had lots of bugs.</p><p>
+Microsoft has released an incremental upgrade to their TCP/IP 32-Bit
+VxD drivers. The latest release can be found on their ftp site at
+ftp.microsoft.com, located in <tt class="filename">/peropsys/windows/public/tcpip/wfwt32.exe</tt>.
+There is an update.txt file there that describes the problems that were
+fixed. New files include <tt class="filename">WINSOCK.DLL</tt>,
+<tt class="filename">TELNET.EXE</tt>,
+<tt class="filename">WSOCK.386</tt>,
+<tt class="filename">VNBT.386</tt>,
+<tt class="filename">WSTCP.386</tt>,
+<tt class="filename">TRACERT.EXE</tt>,
+<tt class="filename">NETSTAT.EXE</tt>, and
+<tt class="filename">NBTSTAT.EXE</tt>.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2995197"></a>Delete .pwl files after password change</h3></div></div><div></div></div><p>
+WfWg does a lousy job with passwords. I find that if I change my
+password on either the unix box or the PC the safest thing to do is to
+delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password.
+</p><p>
+If you don't do this you may find that WfWg remembers and uses the old
+password, even if you told it a new one.
+</p><p>
+Often WfWg will totally ignore a password you give it in a dialog box.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2995227"></a>Configure WfW password handling</h3></div></div><div></div></div><p>
+There is a program call admincfg.exe
+on the last disk (disk 8) of the WFW 3.11 disk set. To install it
+type <b class="userinput"><tt>EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE</tt></b>.
+Then add an icon
+for it via the <span class="application">Program Manager</span> <span class="guimenu">New</span> Menu.
+This program allows you to control how WFW handles passwords. ie disable Password Caching etc
+for use with <i class="parameter"><tt>security = user</tt></i>
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2995273"></a>Case handling of passwords</h3></div></div><div></div></div><p>Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the <a href="smb.conf.5.html" target="_top">smb.conf(5)</a> information on <i class="parameter"><tt>password level</tt></i> to specify what characters samba should try to uppercase when checking.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2995303"></a>Use TCP/IP as default protocol</h3></div></div><div></div></div><p>To support print queue reporting you may find
+that you have to use TCP/IP as the default protocol under
+WfWg. For some reason if you leave Netbeui as the default
+it may break the print queue reporting on some systems.
+It is presumably a WfWg bug.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2995320"></a>Speed improvement</h3></div></div><div></div></div><p>
+Note that some people have found that setting <i class="parameter"><tt>DefaultRcvWindow</tt></i> in
+the <i class="parameter"><tt>[MSTCP]</tt></i> section of the
+<tt class="filename">SYSTEM.INI</tt> file under WfWg to 3072 gives a
+big improvement. I don't know why.
+</p><p>
+My own experience wth DefaultRcvWindow is that I get much better
+performance with a large value (16384 or larger). Other people have
+reported that anything over 3072 slows things down enourmously. One
+person even reported a speed drop of a factor of 30 when he went from
+3072 to 8192. I don't know why.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2995367"></a>Windows '95/'98</h2></div></div><div></div></div><p>
+When using Windows 95 OEM SR2 the following updates are recommended where Samba
+is being used. Please NOTE that the above change will affect you once these
+updates have been installed.
+</p><p>
+There are more updates than the ones mentioned here. You are referred to the
+Microsoft Web site for all currently available updates to your specific version
+of Windows 95.
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Kernel Update: KRNLUPD.EXE</td></tr><tr><td>Ping Fix: PINGUPD.EXE</td></tr><tr><td>RPC Update: RPCRTUPD.EXE</td></tr><tr><td>TCP/IP Update: VIPUPD.EXE</td></tr><tr><td>Redirector Update: VRDRUPD.EXE</td></tr></table><p>
+Also, if using <span class="application">MS OutLook</span> it is desirable to
+install the <b class="command">OLEUPD.EXE</b> fix. This
+fix may stop your machine from hanging for an extended period when exiting
+OutLook and you may also notice a significant speedup when accessing network
+neighborhood services.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2996396"></a>Speed improvement</h3></div></div><div></div></div><p>
+Configure the win95 TCPIP registry settings to give better
+performance. I use a program called <b class="command">MTUSPEED.exe</b> which I got off the
+net. There are various other utilities of this type freely available.
+</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2996420"></a>Windows 2000 Service Pack 2</h2></div></div><div></div></div><p>
+There are several annoyances with Windows 2000 SP2. One of which
+only appears when using a Samba server to host user profiles
+to Windows 2000 SP2 clients in a Windows domain. This assumes
+that Samba is a member of the domain, but the problem will
+likely occur if it is not.
+</p><p>
+In order to serve profiles successfully to Windows 2000 SP2
+clients (when not operating as a PDC), Samba must have
+<i class="parameter"><tt>nt acl support = no</tt></i>
+added to the file share which houses the roaming profiles.
+If this is not done, then the Windows 2000 SP2 client will
+complain about not being able to access the profile (Access
+Denied) and create multiple copies of it on disk (DOMAIN.user.001,
+DOMAIN.user.002, etc...). See the
+<a href="smb.conf.5.html" target="_top">smb.conf(5)</a> man page
+for more details on this option. Also note that the
+<i class="parameter"><tt>nt acl support</tt></i> parameter was formally a global parameter in
+releases prior to Samba 2.2.2.
+</p><p>
+The following is a minimal profile share:
+</p><pre class="programlisting">
+ [profile]
+ path = /export/profile
+ create mask = 0600
+ directory mask = 0700
+ nt acl support = no
+ read only = no
+</pre><p>
+The reason for this bug is that the Win2k SP2 client copies
+the security descriptor for the profile which contains
+the Samba server's SID, and not the domain SID. The client
+compares the SID for SAMBA\user and realizes it is
+different that the one assigned to DOMAIN\user. Hence the reason
+for the <span class="errorname">access denied</span> message.
+</p><p>
+By disabling the <i class="parameter"><tt>nt acl support</tt></i> parameter, Samba will send
+the Win2k client a response to the QuerySecurityDescriptor
+trans2 call which causes the client to set a default ACL
+for the profile. This default ACL includes
+</p><p><span class="emphasis"><em>DOMAIN\user "Full Control"</em></span>></p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>This bug does not occur when using winbind to
+create accounts on the Samba host for Domain users.</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2996531"></a>Windows NT 3.1</h2></div></div><div></div></div><p>If you have problems communicating across routers with Windows
+NT 3.1 workstations, read <a href="http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;Q103765" target="_top">this Microsoft Knowledge Base article</a>.
+
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="speed"></a>Chapter 39. Samba Performance Tuning</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Paul</span> <span class="surname">Cochrane</span></h3><div class="affiliation"><span class="orgname">Dundee Limb Fitting Centre<br></span><div class="address"><p><tt class="email"><<a href="mailto:paulc@dth.scot.nhs.uk">paulc@dth.scot.nhs.uk</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2996649">Comparisons</a></dt><dt><a href="#id2996693">Socket options</a></dt><dt><a href="#id2996767">Read size</a></dt><dt><a href="#id2996811">Max xmit</a></dt><dt><a href="#id2996864">Log level</a></dt><dt><a href="#id2996886">Read raw</a></dt><dt><a href="#id2997829">Write raw</a></dt><dt><a href="#id2997871">Slow Logins</a></dt><dt><a href="#id2997892">LDAP</a></dt><dt><a href="#id2997917">Client tuning</a></dt><dt><a href="#id2997940">Samba performance problem due changing kernel</a></dt><dt><a href="#id2997973">Corrupt tdb Files</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2996649"></a>Comparisons</h2></div></div><div></div></div><p>
+The Samba server uses TCP to talk to the client. Thus if you are
+trying to see if it performs well you should really compare it to
+programs that use the same protocol. The most readily available
+programs for file transfer that use TCP are ftp or another TCP based
+SMB server.
+</p><p>
+If you want to test against something like a NT or WfWg server then
+you will have to disable all but TCP on either the client or
+server. Otherwise you may well be using a totally different protocol
+(such as Netbeui) and comparisons may not be valid.
+</p><p>
+Generally you should find that Samba performs similarly to ftp at raw
+transfer speed. It should perform quite a bit faster than NFS,
+although this very much depends on your system.
+</p><p>
+Several people have done comparisons between Samba and Novell, NFS or
+WinNT. In some cases Samba performed the best, in others the worst. I
+suspect the biggest factor is not Samba vs some other system but the
+hardware and drivers used on the various systems. Given similar
+hardware Samba should certainly be competitive in speed with other
+systems.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2996693"></a>Socket options</h2></div></div><div></div></div><p>
+There are a number of socket options that can greatly affect the
+performance of a TCP based server like Samba.
+</p><p>
+The socket options that Samba uses are settable both on the command
+line with the <tt class="option">-O</tt> option, or in the <tt class="filename">smb.conf</tt> file.
+</p><p>
+The <i class="parameter"><tt>socket options</tt></i> section of the <tt class="filename">smb.conf</tt> manual page describes how
+to set these and gives recommendations.
+</p><p>
+Getting the socket options right can make a big difference to your
+performance, but getting them wrong can degrade it by just as
+much. The correct settings are very dependent on your local network.
+</p><p>
+The socket option TCP_NODELAY is the one that seems to make the
+biggest single difference for most networks. Many people report that
+adding <i class="parameter"><tt>socket options = TCP_NODELAY</tt></i> doubles the read
+performance of a Samba drive. The best explanation I have seen for this is
+that the Microsoft TCP/IP stack is slow in sending tcp ACKs.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2996767"></a>Read size</h2></div></div><div></div></div><p>
+The option <i class="parameter"><tt>read size</tt></i> affects the overlap of disk
+reads/writes with network reads/writes. If the amount of data being
+transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and
+SMBreadbraw) is larger than this value then the server begins writing
+the data before it has received the whole packet from the network, or
+in the case of SMBreadbraw, it begins writing to the network before
+all the data has been read from disk.
+</p><p>
+This overlapping works best when the speeds of disk and network access
+are similar, having very little effect when the speed of one is much
+greater than the other.
+</p><p>
+The default value is 16384, but very little experimentation has been
+done yet to determine the optimal value, and it is likely that the best
+value will vary greatly between systems anyway. A value over 65536 is
+pointless and will cause you to allocate memory unnecessarily.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2996811"></a>Max xmit</h2></div></div><div></div></div><p>
+At startup the client and server negotiate a <i class="parameter"><tt>maximum transmit</tt></i> size,
+which limits the size of nearly all SMB commands. You can set the
+maximum size that Samba will negotiate using the <i class="parameter"><tt>max xmit = </tt></i> option
+in <tt class="filename">smb.conf</tt>. Note that this is the maximum size of SMB requests that
+Samba will accept, but not the maximum size that the *client* will accept.
+The client maximum receive size is sent to Samba by the client and Samba
+honours this limit.
+</p><p>
+It defaults to 65536 bytes (the maximum), but it is possible that some
+clients may perform better with a smaller transmit unit. Trying values
+of less than 2048 is likely to cause severe problems.
+</p><p>
+In most cases the default is the best option.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2996864"></a>Log level</h2></div></div><div></div></div><p>
+If you set the log level (also known as <i class="parameter"><tt>debug level</tt></i>) higher than 2
+then you may suffer a large drop in performance. This is because the
+server flushes the log file after each operation, which can be very
+expensive.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2996886"></a>Read raw</h2></div></div><div></div></div><p>
+The <i class="parameter"><tt>read raw</tt></i> operation is designed to be an optimised, low-latency
+file read operation. A server may choose to not support it,
+however. and Samba makes support for <i class="parameter"><tt>read raw</tt></i> optional, with it
+being enabled by default.
+</p><p>
+In some cases clients don't handle <i class="parameter"><tt>read raw</tt></i> very well and actually
+get lower performance using it than they get using the conventional
+read operations.
+</p><p>
+So you might like to try <i class="parameter"><tt>read raw = no</tt></i> and see what happens on your
+network. It might lower, raise or not affect your performance. Only
+testing can really tell.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2997829"></a>Write raw</h2></div></div><div></div></div><p>
+The <i class="parameter"><tt>write raw</tt></i> operation is designed to be an optimised, low-latency
+file write operation. A server may choose to not support it,
+however. and Samba makes support for <i class="parameter"><tt>write raw</tt></i> optional, with it
+being enabled by default.
+</p><p>
+Some machines may find <i class="parameter"><tt>write raw</tt></i> slower than normal write, in which
+case you may wish to change this option.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2997871"></a>Slow Logins</h2></div></div><div></div></div><p>
+Slow logins are almost always due to the password checking time. Using
+the lowest practical <i class="parameter"><tt>password level</tt></i> will improve things.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2997892"></a>LDAP</h2></div></div><div></div></div><p>
+LDAP can be vastly improved by using the
+<a href="smb.conf.5.html#LDAPTRUSTIDS" target="_top"><i class="parameter"><tt>ldap trust ids</tt></i></a> parameter.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2997917"></a>Client tuning</h2></div></div><div></div></div><p>
+Often a speed problem can be traced to the client. The client (for
+example Windows for Workgroups) can often be tuned for better TCP
+performance. Check the sections on the various clients in
+<a href="#Other-Clients" title="Chapter 38. Samba and other CIFS clients">Samba and Other Clients</a>.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2997940"></a>Samba performance problem due changing kernel</h2></div></div><div></div></div><p>
+Hi everyone. I am running Gentoo on my server and samba 2.2.8a. Recently
+I changed kernel version from linux-2.4.19-gentoo-r10 to
+linux-2.4.20-wolk4.0s. And now I have performance issue with samba. Ok
+many of you will probably say that move to vanilla sources...well I ried
+it too and it didn't work. I have 100mb LAN and two computers (linux +
+Windows2000). Linux server shares directory with DivX files, client
+(windows2000) plays them via LAN. Before when I was running 2.4.19 kernel
+everything was fine, but now movies freezes and stops...I tried moving
+files between server and Windows and it's trerribly slow.
+</p><p>
+Grab mii-tool and check the duplex settings on the NIC.
+My guess is that it is a link layer issue, not an application
+layer problem. Also run ifconfig and verify that the framing
+error, collisions, etc... look normal for ethernet.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2997973"></a>Corrupt tdb Files</h2></div></div><div></div></div><p>
+Well today it happend, our first major problem using samba.
+Our samba PDC server has been hosting 3 TB of data to our 500+ users
+[Windows NT/XP] for the last 3 years using samba, no problem.
+But today all shares went SLOW; very slow. Also the main smbd kept
+spawning new processes so we had 1600+ running smbd's (normally we avg. 250).
+It crashed the SUN E3500 cluster twice. After alot of searching I
+decided to <b class="command">rm /var/locks/*.tbl</b>. Happy again.
+</p><p>
+Q1) Is there any method of keeping the *.tbl files in top condition or
+how to early detect corruption?
+</p><p>
+A1) Yes, run <b class="command">tdbbackup</b> each time after stoping nmbd and before starting nmbd.
+</p><p>
+Q2) What I also would like to mention is that the service latency seems
+alot lower then before the locks cleanup, any ideas on keeping it top notch?
+</p><p>
+A2) Yes! Samba answer as for Q1!
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DNSDHCP"></a>Chapter 40. DNS and DHCP Configuration Guide</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2998691">Note</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2998691"></a>Note</h2></div></div><div></div></div><p>
+This chapter did not make it into this release.
+It is planned for the published release of this document.
+</p></div></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Further-Resources"></a>Chapter 41. Further Resources</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">David</span> <span class="surname">Lechnyr</span></h3><div class="affiliation"><span class="orgname">Unofficial HOWTO<br></span><div class="address"><p><tt class="email"><<a href="mailto:david@lechnyr.com">david@lechnyr.com</a>></tt></p></div></div></div></div><div><p class="pubdate">May 1, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="#id2998110">Websites</a></dt><dt><a href="#id2998494">Related updates from microsoft</a></dt><dt><a href="#id2998561">Books</a></dt></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2998110"></a>Websites</h2></div></div><div></div></div><div class="itemizedlist"><ul type="disc"><li><p>
+ <a href="http://hr.uoregon.edu/davidrl/cifs.txt" target="_top">
+ <span class="emphasis"><em>CIFS: Common Insecurities Fail Scrutiny</em></span> by "Hobbit"</a>
+ </p></li><li><p>
+ <a href="http://afr.com/it/2002/10/01/FFXDF43AP6D.html" target="_top">
+ <span class="emphasis"><em>Doing the Samba on Windows</em></span> by Financial Review
+ </a>
+ </p></li><li><p>
+ <a href="http://ubiqx.org/cifs/" target="_top">
+ <span class="emphasis"><em>Implementing CIFS</em></span> by Christopher R. Hertel
+ </a>
+ </p></li><li><p>
+ <a href="http://samba.anu.edu.au/cifs/docs/what-is-smb.html" target="_top">
+ <span class="emphasis"><em>Just What Is SMB?</em></span> by Richard Sharpe
+ </a>
+ </p></li><li><p>
+ <a href="http://www.linux-mag.com/1999-05/samba_01.html" target="_top">
+ <span class="emphasis"><em>Opening Windows Everywhere</em></span> by Mike Warfield
+ </a>
+ </p></li><li><p>
+ <a href="http://www.tldp.org/HOWTO/SMB-HOWTO.html" target="_top">
+ <span class="emphasis"><em>SMB HOWTO</em></span> by David Wood
+ </a>
+ </p></li><li><p>
+ <a href="http://www.phrack.org/phrack/60/p60-0x0b.txt" target="_top">
+ <span class="emphasis"><em>SMB/CIFS by The Root</em></span> by "ledin"
+ </a>
+ </p></li><li><p>
+ <a href="http://www.linux-mag.com/1999-09/samba_01.html" target="_top">
+ <span class="emphasis"><em>The Story of Samba</em></span> by Christopher R. Hertel
+ </a>
+ </p></li><li><p>
+ <a href="http://hr.uoregon.edu/davidrl/samba/" target="_top">
+ <span class="emphasis"><em>The Unofficial Samba HOWTO</em></span> by David Lechnyr
+ </a>
+ </p></li><li><p>
+ <a href="http://www.linux-mag.com/2001-05/smb_01.html" target="_top">
+ <span class="emphasis"><em>Understanding the Network Neighborhood</em></span> by Christopher R. Hertel
+ </a>
+ </p></li><li><p>
+ <a href="http://www.linux-mag.com/2002-02/samba_01.html" target="_top">
+ <span class="emphasis"><em>Using Samba as a PDC</em></span> by Andrew Bartlett
+ </a>
+ </p></li><li><p>
+ <a href="http://ru.samba.org/samba/ftp/docs/Samba24Hc13.pdf" target="_top">
+ <span class="emphasis"><em>PDF version of the Troubleshooting Techniques chapter</em></span>
+ from the second edition of Sam's Teach Yourself Samba in 24 Hours
+ (publishing date of Dec. 12, 2001)</a>
+ </p></li><li><p>
+ <a href="http://ru.samba.org/samba/ftp/slides/" target="_top">
+ <span class="emphasis"><em>Slide presentations</em></span> by Samba Team members
+ </a>
+ </p></li><li><p>
+ <a href="http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html" target="_top">
+ <span class="emphasis"><em>Introduction to Samba 3.0</em></span> by Motonobu Takahashi
+ (written in Japanese). </a>
+ </p></li><li><p>
+ <a href="http://www.linux-mag.com/2001-05/smb_01.html" target="_top">
+ <span class="emphasis"><em>Understanding the Network Neighborhood</em></span>, by team member
+ Chris Hertel. This article appeared in the May 2001 issue of
+ Linux Magazine.
+ </a>
+ </p></li><li><p>
+ <a href="ftp://ftp.stratus.com/pub/vos/customers/samba/" target="_top">
+ <span class="emphasis"><em>Samba 2.0.x Troubleshooting guide</em></span> from Paul Green
+ </a>
+ </p></li><li><p>
+ <a href="http://samba.org/samba/docs/10years.html" target="_top">
+ <span class="emphasis"><em>Ten Years of Samba</em></span>
+ </a>
+ </p></li><li><p>
+ <a href="http://tldp.org/HOWTO/Samba-Authenticated-Gateway-HOWTO.html" target="_top">
+ <span class="emphasis"><em>Samba Authenticated Gateway HOWTO</em></span>
+ </a>
+ </p></li><li><p>
+ <a href="http://samba.org/samba/docs/SambaIntro.html" target="_top">
+ <span class="emphasis"><em>An Introduction to Samba</em></span>
+ </a>
+ </p></li><li><p>
+ <a href="http://www.samba.org/cifs/" target="_top">
+ <span class="emphasis"><em>What is CIFS?</em></span>
+ </a>
+ </p></li><li><p>
+ <a href="http://support.microsoft.com/support/kb/articles/q92/5/88.asp" target="_top">
+ <span class="emphasis"><em>WFWG: Password Caching and How It Affects LAN Manager
+ Security</em></span> at Microsoft Knowledge Base
+ </a>
+ </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2998494"></a>Related updates from microsoft</h2></div></div><div></div></div><div class="itemizedlist"><ul type="disc"><li><p>
+ <a href="http://support.microsoft.com/support/kb/articles/q92/5/88.asp" target="_top">
+ <span class="emphasis"><em>Enhanced Encryption for Windows 95 Password Cache</em></span>
+ </a>
+ </p></li><li><p>
+ <a href="http://support.microsoft.com/support/kb/articles/q136/4/18.asp" target="_top">
+ <span class="emphasis"><em>Windows '95 File Sharing Updates</em></span>
+ </a>
+ </p></li><li><p>
+ <a href="http://support.microsoft.com/support/kb/articles/q136/4/18.asp" target="_top">
+ <span class="emphasis"><em>Windows for Workgroups Sharing Updates</em></span>
+ </a>
+ </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2998561"></a>Books</h2></div></div><div></div></div></div></div></div><div class="index"><div class="titlepage"><div><div><h2 class="title"><a name="id2998572"></a>Index</h2></div></div><div></div></div><div class="index"></div></div></div></body></html>
git.samba.org / kai / samba-autobuild / .git / commitdiff