7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
27 >winbindd -- Name Service Switch daemon for resolving names
30 CLASS="REFSYNOPSISDIV"
40 > [-i] [-d <debug level>] [-s <smb config file>]</P
50 >This program is part of the <A
59 > is a daemon that provides
60 a service for the Name Service Switch capability that is present
61 in most modern C libraries. The Name Service Switch allows user
62 and system information to be obtained from different databases
63 services such as NIS or DNS. The exact behaviour can be configured
66 >/etc/nsswitch.conf</TT
68 Users and groups are allocated as they are resolved to a range
69 of user and group ids specified by the administrator of the
72 >The service provided by <B
75 > is called `winbind' and
76 can be used to resolve user and group information from a
77 Windows NT server. The service can also provide authentication
78 services via an associated PAM module. </P
83 > module in the 2.2.2 release only
95 module-types. The latter is simply
96 performs a getpwnam() to verify that the system can obtain a uid for the
100 > library has been correctly
101 installed, this should always suceed.
104 >The following nsswitch databases are implemented by
105 the winbindd service: </P
115 >User information traditionally stored in
123 > functions. Names are
124 resolved through the WINS server or by broadcast.
131 >User information traditionally stored in
145 >Group information traditionally stored in
158 >For example, the following simple configuration in the
161 >/etc/nsswitch.conf</TT
162 > file can be used to initially
163 resolve user and group information from <TT
171 Windows NT server. </P
180 CLASS="PROGRAMLISTING"
181 >passwd: files winbind
189 >The following simple configuration in the
192 >/etc/nsswitch.conf</TT
193 > file can be used to initially
194 resolve hostnames from <TT
216 >Sets the debuglevel to an integer between
217 0 and 100. 0 is for no debugging and 100 is for reams and
218 reams. To submit a bug report to the Samba Team, use debug
219 level 100 (see BUGS.txt). </P
229 become a daemon and detach from the current terminal. This
230 option is used by developers when interactive debugging
245 >NAME AND ID RESOLUTION</H2
247 >Users and groups on a Windows NT server are assigned
248 a relative id (rid) which is unique for the domain when the
249 user or group is created. To convert the Windows NT user or group
250 into a unix user or group, a mapping between rids and unix user
251 and group ids is required. This is one of the jobs that <B
256 >As winbindd users and groups are resolved from a server, user
257 and group ids are allocated from a specified range. This
258 is done on a first come, first served basis, although all existing
259 users and groups will be mapped as soon as a client performs a user
260 or group enumeration command. The allocated unix ids are stored
261 in a database file under the Samba lock directory and will be
264 >WARNING: The rid to unix id database is the only location
265 where the user and group mappings are stored by winbindd. If this
266 file is deleted or corrupted, there is no way for winbindd to
267 determine which user and group ids correspond to Windows NT user
278 >Configuration of the <B
282 is done through configuration parameters in the <TT
286 > file. All parameters should be specified in the
287 [global] section of smb.conf. </P
294 >winbind separator</DT
297 >The winbind separator option allows you
298 to specify how NT domain names and user names are combined
299 into unix user names when presented to users. By default,
303 > will use the traditional '\'
304 separator so that the unix user names look like
305 DOMAIN\username. In some cases this separator character may
306 cause problems as the '\' character has special meaning in
307 unix shells. In that case you can use the winbind separator
308 option to specify an alternative separator character. Good
309 alternatives may be '/' (although that conflicts
310 with the unix directory separator) or a '+ 'character.
311 The '+' character appears to be the best choice for 100%
312 compatibility with existing unix utilities, but may be an
313 aesthetically bad choice depending on your taste. </P
317 >winbind separator = \ </B
323 >winbind separator = + </B
330 >The winbind uid parameter specifies the
331 range of user ids that are allocated by the winbindd daemon.
332 This range of ids should have no existing local or NIS users
333 within it as strange conflicts can occur otherwise. </P
337 >winbind uid = <empty string>
343 >winbind uid = 10000-20000</B
350 >The winbind gid parameter specifies the
351 range of group ids that are allocated by the winbindd daemon.
352 This range of group ids should have no existing local or NIS
353 groups within it as strange conflicts can occur otherwise.</P
357 >winbind gid = <empty string>
363 >winbind gid = 10000-20000
368 >winbind cache time</DT
371 >This parameter specifies the number of
372 seconds the winbindd daemon will cache user and group information
373 before querying a Windows NT server again. When a item in the
374 cache is older than this time winbindd will ask the domain
375 controller for the sequence number of the server's account database.
376 If the sequence number has not changed then the cached item is
377 marked as valid for a further <TT
383 > seconds. Otherwise the item is fetched from the
384 server. This means that as long as the account database is not
385 actively changing winbindd will only have to send one sequence
386 number query packet every <TT
396 >winbind cache time = 15</B
401 >winbind enum users</DT
404 >On large installations it may be necessary
405 to suppress the enumeration of users through the <B
415 > group of system calls. If
419 >winbind enum users</I
421 > parameter is false,
425 > system call will not
430 > Turning off user enumeration
431 may cause some programs to behave oddly. For example, the <B
435 program relies on having access to the full user list when
436 searching for matching usernames. </P
440 >winbind enum users = yes </B
444 >winbind enum groups</DT
447 >On large installations it may be necessary
448 to suppress the enumeration of groups through the <B
458 > group of system calls. If
462 >winbind enum groups</I
465 false, calls to the <B
469 call will not return any data. </P
474 enumeration may cause some programs to behave oddly.
479 >winbind enum groups = no </B
484 >template homedir</DT
487 >When filling out the user information
488 for a Windows NT user, the <B
492 uses this parameter to fill in the home directory for that user.
499 substituted with the user's Windows NT domain name. If the
505 > is present it is substituted
506 with the user's Windows NT user name. </P
510 >template homedir = /home/%D/%U </B
518 >When filling out the user information for
519 a Windows NT user, the <B
523 uses this parameter to fill in the shell for that user.
528 >template shell = /bin/false </B
533 >winbind use default domain</DT
536 >This parameter specifies whether the <B
540 daemon should operate on users without domain component in their username.
541 Users without a domain component are treated as is part of the winbindd server's
542 own domain. While this does not benifit Windows users, it makes SSH, FTP and e-mail
543 function in a way much closer to the way they would in a native unix system.</P
547 >winbind use default domain = <falseg>
553 >winbind use default domain = true</B
567 >To setup winbindd for user and group lookups plus
568 authentication from a domain controller use something like the
569 following setup. This was tested on a RedHat 6.2 Linux box. </P
573 >/etc/nsswitch.conf</TT
584 CLASS="PROGRAMLISTING"
585 >passwd: files winbind
602 > lines with something like this: </P
611 CLASS="PROGRAMLISTING"
612 >auth required /lib/security/pam_securetty.so
613 auth required /lib/security/pam_nologin.so
614 auth sufficient /lib/security/pam_winbind.so
615 auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok
622 >Note in particular the use of the <TT
635 >Now replace the account lines with this: </P
639 >account required /lib/security/pam_winbind.so
643 >The next step is to join the domain. To do that use the
647 > program like this: </P
651 >smbpasswd -j DOMAIN -r PDC -U
655 >The username after the <TT
661 Domain user that has administrator privileges on the machine.
662 Substitute your domain name for "DOMAIN" and the name of your PDC
667 >libnss_winbind.so</TT
679 >. A symbolic link needs to be
682 >/lib/libnss_winbind.so</TT
686 >/lib/libnss_winbind.so.2</TT
687 >. If you are using an
688 older version of glibc then the target of the link should be
691 >/lib/libnss_winbind.so.1</TT
694 >Finally, setup a <TT
697 > containing directives like the
707 CLASS="PROGRAMLISTING"
709 winbind separator = +
710 winbind cache time = 10
711 template shell = /bin/bash
712 template homedir = /home/%D/%U
713 winbind uid = 10000-20000
714 winbind gid = 10000-20000
724 >Now start winbindd and you should find that your user and
725 group database is expanded to include your NT users and groups,
726 and that you can login to your unix box as a domain user, using
727 the DOMAIN+user syntax for the username. You may wish to use the
735 > to confirm the correct operation of winbindd.</P
745 >The following notes are useful when configuring and
754 > must be running on the local machine
762 queries the list of trusted domains for the Windows NT server
763 on startup and when a SIGHUP is received. Thus, for a running <B
766 > to become aware of new trust relationships between
767 servers, it must be sent a SIGHUP signal. </P
769 >Client processes resolving names through the <B
773 nsswitch module read an environment variable named <TT
775 > $WINBINDD_DOMAIN</TT
776 >. If this variable contains a comma separated
777 list of Windows NT domain names, then winbindd will only resolve users
778 and groups within those Windows NT domains. </P
780 >PAM is really easy to misconfigure. Make sure you know what
781 you are doing when modifying PAM configuration files. It is possible
782 to set up PAM such that you can no longer log into your system. </P
784 >If more than one UNIX machine is running <B
788 then in general the user and groups ids allocated by winbindd will not
789 be the same. The user and group ids will only be valid for the local
792 >If the the Windows NT RID to UNIX user and group id mapping
793 file is damaged or destroyed then the mappings will be lost. </P
803 >The following signals can be used to manipulate the
821 file and apply any parameter changes to the running
822 version of winbindd. This signal also clears any cached
823 user and group information. The list of other domains trusted
824 by winbindd is also reloaded. </P
830 >The SIGUSR1 signal will cause <B
833 > to write status information to the winbind
834 log file including information about the number of user and
835 group ids allocated by <B
840 >Log files are stored in the filename specified by the
841 log file parameter.</P
861 >/etc/nsswitch.conf(5)</TT
865 >Name service switch configuration file.</P
868 >/tmp/.winbindd/pipe</DT
871 >The UNIX pipe over which clients communicate with
875 > program. For security reasons, the
876 winbind client will only attempt to connect to the winbindd daemon
883 >/tmp/.winbindd/pipe</TT
888 >/lib/libnss_winbind.so.X</DT
891 >Implementation of name service switch library.
895 >$LOCKDIR/winbindd_idmap.tdb</DT
898 >Storage for the Windows NT rid to UNIX user/group
899 id mapping. The lock directory is specified when Samba is initially
900 compiled using the <TT
906 This directory is by default <TT
908 >/usr/local/samba/var/locks
913 >$LOCKDIR/winbindd_cache.tdb</DT
916 >Storage for cached user and group information.
930 >This man page is correct for version 2.2 of
943 >nsswitch.conf(5)</TT
956 HREF="smb.conf.5.html"
969 >The original Samba software and related utilities
970 were created by Andrew Tridgell. Samba is now developed
971 by the Samba Team as an Open Source project similar
972 to the way the Linux kernel is developed.</P
981 were written by Tim Potter.</P
983 >The conversion to DocBook for Samba 2.2 was done