1<!doctype linuxdoc system> <!-- -*- SGML -*- --> 2<!-- 3 v 0.1 23 Aug 1997 Dan Shearer 4 Original Samba-meta-FAQ.sgml from Paul's sambafaq.sgml 5 v 0.2 25 Aug 1997 Dan 6 v 0.3 7 Oct 1997 Paul 7 Changed samba.canberra refs to samba.anu.../samba/ 8--> 9 10<article> 11 12<title> Samba meta FAQ 13 14<author>Dan Shearer & Paul Blackman, <tt>ictinus@samba.org</tt> 15 16<date>v 0.3, 7 Oct '97 17 18<abstract> This is the meta-Frequently Asked Questions (FAQ) document 19for Samba, the free and very popular SMB and CIFS server product. It 20contains overview information for the Samba suite of programs, a 21quick-start guide, and pointers to all other Samba documentation. Other 22FAQs exist for specific client and server issues, and HOWTO documents 23for more extended topics to do with Samba software. Current to version 24Samba 1.9.17. Please send any corrections to the author. 25</abstract> 26 27<toc> 28 29<sect> Quick Reference Guides to Samba Documentation<p><label id=quickref> 30 31We are endeavouring to provide links here to every major class of 32information about Samba or things related to Samba. We cannot list every 33document, but we are aiming for all documents to be at most two 34referrals from those listed here. This needs constant maintaining, so 35please send the author your feedback. 36 37<sect1> Samba for the Impatient<p><label id="impatient"> 38 39You know you should read the documentation but can't wait to start? What 40you need to do then is follow the instructions in the following 41documents in the order given. This should be enough to get a fairly 42simple site going quickly. If you have any problems, refer back to this 43meta-FAQ and follow the links to find more reading material. 44 45<descrip> 46 47<label id="ImpGet"><tag/Getting Samba:/ The fastest way to get Samba 48going is and install it is to have an operating system for which the 49Samba team has put together an installation package. To see if your OS 50is included have a look at the directory 51/pub/samba/Binary_Packages/"OS_Vendor" on your nearest <url 52url="../MIRRORS" name="mirror site">. If it is included follow the 53installation instructions in the README file there and then do some <ref id="ImpTest" 54name="basic testing">. If you are not so fortunate, follow the normal <ref 55id="WhereFrom" name="download instructions"> and then continue with <ref 56id="ImpInst" name="building and installing Samba">. 57 58<label id="ImpInst"><tag/Building and Installing Samba:/ At the moment 59there are two kinds of Samba server installs besides the prepackaged 60binaries mentioned in the previous step. You need to decide if you have a <url url="../UNIX_INSTALL.txt" 61name="Unix or close relative"> or <url 62url="Samba-Server-FAQ.html#PortInfo" name="other supported operating system">. 63 64<label id="ImpTest"><tag/Basic Testing:/ Try to connect using the 65supplied smbclient command-line program. You need to know the IP 66hostname of your server. A service name must be defined in smb.conf, as 67given in the examples (under many operating systems if there is a 68[homes] service you can just use a valid username.) Then type 69<tt> 70 smbclient \\hostname\servicename 71</tt> 72Under most Unixes you will need to put the parameters within quotation 73marks. If this works, try connecting from one of the SMB clients you 74were planning to use with Samba. 75 76<label id="ImpDebug"><tag/Debug sequence:/ If you think you have completed the 77previous step and things aren't working properly work through 78<url url="../DIAGNOSIS.txt" name="the diagnosis recipe."> 79 80<label id="ImpExp"><tag/Exporting files to SMB clients:/ You should read the manual pages 81for smb.conf, but here is a <url url="Samba-Server-FAQ.html#Exporting" 82name="quick answer guide."> 83 84<label id="ImpControl"><tag/Controlling user access:/ the quickest and dirtiest way of sharing 85resources is to use <ref id="ShareModeSecurity" name="share level 86security."> If you want to spend more time and have a proper username 87and password database you must read the paragraph on <ref 88id="DomainModeSecurity" name="domain mode security."> If you want 89encryption (eg you are using Windows NT clients) follow the <url 90url="Samba-Server-FAQ.html#SMBEncryptionSteps" name="SMB encryption 91instructions."> 92 93<label id="ImpBrowse"><tag/Browsing:/ if you are happy to type in "\\samba-server\sharename" 94at the client end then do not read any further. Otherwise you need to 95understand the <ref id="BrowsingDefinitions" name="browsing terminology"> 96and read <url url="Samba-Server-FAQ.html#NameBrowsing">. 97 98<label id="ImpPrint"><tag/Printing:/ See the <url url="Samba-Server-FAQ.html#Printing" 99name="printing quick answer guide."> 100 101</descrip> 102 103If you have got everything working to this point, you can expect Samba 104to be stable and secure: these are its greatest strengths. However Samba 105has a great deal to offer and to go further you must do some more 106reading. Speed and security optimisations, printer accounting, network 107logons, roving profiles, browsing across multiple subnets and so on are 108all covered either in this document or in those it refers to. 109 110<sect1> All Samba Documentation<p><label id=AllDocs> 111 112<itemize> 113 114<item> Meta-FAQ. This is the mother of all documents, and is the one you 115are reading now. The latest version is always at <url 116url="http://samba.org/[.....]"> but there is probably a much 117nearer <url url="../MIRRORS" name="mirror site"> which you should use 118instead. 119 120<item> <url url="Samba-Server-FAQ.html"> is the best starting point for 121information about server-side issues. Includes configuration tips and 122pointers for Samba on particular operating systems (with 40 to choose 123from...) 124 125<item> <url url="Samba-Client-FAQ.html"> is the best starting point for 126information about client-side issues, includes a list of all clients 127that are known to work with Samba. 128 129<item> <url url="samba-man-index.html" name="manual pages"> contains 130descriptions of and links to all the Samba manual pages, in Unix man and 131postscript format. 132 133<item> <url url="samba-txt-index.html"> has descriptions of and links to 134a large number of text files have been contributed to samba covering 135many topics. These are gradually being absorbed into the FAQs and HOWTOs 136but in the meantime you might find helpful answers here. 137 138<item> 139 140</itemize> 141 142<sect> General Information<p><label id="general_info"> 143 144All about Samba - what it is, how to get it, related sources of 145information, how to understand the numbering scheme, pizza 146details. 147 148<sect1> What is Samba?<p><label id="introduction"> 149 150Samba is a suite of programs which work together to allow clients to 151access to a server's filespace and printers via the SMB (Server Message 152Block) and CIFS (Common Internet Filesystem) protocols. Initially 153written for Unix, Samba now also runs on Netware, OS/2, VMS, StratOS and 154Amigas. Ports to BeOS and other operating systems are underway. Samba 155gives the capability for these operating systems to behave much like a 156LAN Server, Windows NT Server or Pathworks machine, only with added 157functionality and flexibility designed to make life easier for 158administrators. 159 160This means that using Samba you can share a server's disks and printers 161to many sorts of network clients, including Lan Manager, Windows for 162Workgroups, Windows NT, Linux, OS/2, and AIX. There is also a generic 163client program supplied as part of the Samba suite which gives a user on 164the server an ftp-like interface to access filespace and printers on any 165other SMB/CIFS servers. 166 167SMB has been implemented over many protocols, including XNS, NBT, IPX, 168NetBEUI and TCP/IP. Samba only uses TCP/IP. This is not likely to change 169although there have been some requests for NetBEUI support. 170 171Many users report that compared to other SMB implementations Samba is 172more stable, faster, and compatible with more clients. Administrators of 173some large installations say that Samba is the only SMB server available 174which will scale to many tens of thousands of users without crashing. 175The easy way to test these claims is to download it and try it for 176yourself! 177 178The suite is supplied with full source code under the <url 179url="../COPYING" name="GNU Public License">. The GPL means that you can 180use Samba for whatever purpose you wish (including changing the source 181or selling it for money) but under all circumstances the source code 182must be made freely available. A copy of the GPL must always be included 183in any copy of the package. 184 185The primary creator of the Samba suite is Andrew Tridgell. Later 186versions incorporate much effort by many net.helpers. The man pages 187and this FAQ were originally written by Karl Auer. 188 189<sect1> What is the current version of Samba?<p><label id="current_version"> 190 191At time of writing, the current version was 1.9.17. If you want to be 192sure check the bottom of the change-log file. <url url="ftp://samba.org/pub/samba/alpha/change-log"> 193 194For more information see <ref id="version_nums" name="What do the version numbers mean?"> 195 196<sect1> Where can I get it? <p><label id="WhereFrom"> 197 198The Samba suite is available via anonymous ftp from samba.org and 199many <url url="../MIRRORS" name="mirror"> sites. You will get much 200faster performance if you use a mirror site. The latest and greatest 201versions of the suite are in the directory: 202 203/pub/samba/ 204 205Development (read "alpha") versions, which are NOT necessarily stable 206and which do NOT necessarily have accurate documentation, are available 207in the directory: 208 209/pub/samba/alpha 210 211Note that binaries are NOT included in any of the above. Samba is 212distributed ONLY in source form, though binaries may be available from 213other sites. Most Linux distributions, for example, do contain Samba 214binaries for that platform. The VMS, OS/2, Netware and Amiga and other 215ports typically have binaries made available. 216 217A special case is vendor-provided binary packages. Samba binaries and 218default configuration files are put into packages for a specific 219operating system. RedHat Linux and Sun Solaris (Sparc and x86) is 220already included, and others such as OS/2 may follow. All packages are 221in the directory: 222 223/pub/samba/Binary_Packages/"OS_Vendor" 224 225<sect1>What do the version numbers mean?<p><label id="version_nums"> 226 227It is not recommended that you run a version of Samba with the word 228"alpha" in its name unless you know what you are doing and are willing 229to do some debugging. Many, many people just get the latest 230recommended stable release version and are happy. If you are brave, by 231all means take the plunge and help with the testing and development - 232but don't install it on your departmental server. Samba is typically 233very stable and safe, and this is mostly due to the policy of many 234public releases. 235 236How the scheme works: 237 238<enum> 239 240<item>When major changes are made the version number is increased. For 241example, the transition from 1.9.16 to 1.9.17. However, this version 242number will not appear immediately and people should continue to use 2431.9.15 for production systems (see next point.) 244 245<item>Just after major changes are made the software is considered 246unstable, and a series of alpha releases are distributed, for example 2471.9.16alpha1. These are for testing by those who know what they are 248doing. The "alpha" in the filename will hopefully scare off those who 249are just looking for the latest version to install. 250 251<item>When Andrew thinks that the alphas have stabilised to the point 252where he would recommend new users install it, he renames it to the 253same version number without the alpha, for example 1.9.17. 254 255<item>Inevitably bugs are found in the "stable" releases and minor patch 256levels are released which give us the pXX series, for example 1.9.17p2. 257 258</enum> 259 260So the progression goes: 261 262<verb> 263 1.9.16p10 (production) 264 1.9.16p11 (production) 265 1.9.17alpha1 (test sites only) 266 : 267 1.9.17alpha20 (test sites only) 268 1.9.17 (production) 269 1.9.17p1 (production) 270</verb> 271 272The above system means that whenever someone looks at the samba ftp 273site they will be able to grab the highest numbered release without an 274alpha in the name and be sure of getting the current recommended 275version. 276 277<sect1> Where can I go for further information?<p><label id="more"> 278 279There are a number of places to look for more information on Samba, 280including: 281 282<itemize> 283 284<item>Two mailing lists devoted to discussion of Samba-related matters. 285See below for subscription information. 286 287<item>The newsgroup comp.protocols.smb, which has a great deal of 288discussion about Samba. 289 290<item>The WWW site 'SAMBA Web Pages' at <url 291url="http://samba.org/samba/"> includes: 292 293 <itemize> 294 <item>Links to man pages and documentation, including this FAQ 295 <item>A comprehensive survey of Samba users 296 <item>A searchable hypertext archive of the Samba mailing list 297 <item>Links to Samba source code, binaries, and mirrors of both 298 <item>This FAQ and the rest in its family 299 </itemize> 300 301</itemize> 302 303<sect1>How do I subscribe to the Samba Mailing Lists?<p><label id="mailinglist"> 304 305Send email to <htmlurl url="mailto:listproc@samba.org" 306name="listproc@samba.org">. Make sure the subject line is blank, 307and include the following two lines in the body of the message: 308 309<tscreen><verb> 310subscribe samba Firstname Lastname 311subscribe samba-announce Firstname Lastname 312</verb></tscreen> 313 314Obviously you should substitute YOUR first name for "Firstname" and 315YOUR last name for "Lastname"! Try not to send any signature, it 316sometimes confuses the list processor. 317 318The samba list is a digest list - every eight hours or so it sends a 319single message containing all the messages that have been received by 320the list since the last time and sends a copy of this message to all 321subscribers. There are thousands of people on this list. 322 323If you stop being interested in Samba, please send another email to 324<htmlurl url="mailto:listproc@samba.org" name="listproc@samba.org">. Make sure the subject line is blank, and 325include the following two lines in the body of the message: 326 327<tscreen><verb> 328unsubscribe samba 329unsubscribe samba-announce 330</verb></tscreen> 331 332The <bf>From:</bf> line in your message <em>MUST</em> be the same 333address you used when you subscribed. 334 335<sect1> Something's gone wrong - what should I do?<p><label id="wrong"> 336 337<bf>[#] *** IMPORTANT! *** [#]</bf> 338<p> 339 340DO NOT post messages on mailing lists or in newsgroups until you have 341carried out the first three steps given here! 342 343<enum> <item> See if there are any likely looking entries in this FAQ! 344If you have just installed Samba, have you run through the checklist in 345<url url="ftp://samba.org/pub/samba/DIAGNOSIS.txt" 346name="DIAGNOSIS.txt">? It can save you a lot of time and effort. 347DIAGNOSIS.txt can also be found in the docs directory of the Samba 348distribution. 349 350<item> Read the man pages for smbd, nmbd and smb.conf, looking for 351topics that relate to what you are trying to do. 352 353<item> If there is no obvious solution to hand, try to get a look at 354the log files for smbd and/or nmbd for the period during which you 355were having problems. You may need to reconfigure the servers to 356provide more extensive debugging information - usually level 2 or 357level 3 provide ample debugging info. Inspect these logs closely, 358looking particularly for the string "Error:". 359 360<item> If you need urgent help and are willing to pay for it see 361<ref id="PaidSupport" name="Paid Support">. 362 363</enum> 364 365If you still haven't got anywhere, ask the mailing list or newsgroup. In 366general nobody minds answering questions provided you have followed the 367preceding steps. It might be a good idea to scan the archives of the 368mailing list, which are available through the Samba web site described 369in the previous section. When you post be sure to include a good 370description of your environment and your problem. 371 372If you successfully solve a problem, please mail the FAQ maintainer a 373succinct description of the symptom, the problem and the solution, so 374that an explanation can be incorporated into the next version. 375 376<sect1> How do I submit patches or bug reports?<p> 377 378If you make changes to the source code, <em>please</em> submit these patches 379so that everyone else gets the benefit of your work. This is one of 380the most important aspects to the maintainence of Samba. Send all 381patches to <htmlurl url="mailto:samba@samba.org" name="samba@samba.org">. Do not send patches to Andrew Tridgell or any 382other individual, they may be lost if you do. 383 384Patch format 385------------ 386 387If you are sending a patch to fix a problem then please don't just use 388standard diff format. As an example, samba received this patch from 389someone: 390 391382a 392#endif 393.. 394381a 395#if !defined(NEWS61) 396 397How are we supposed to work out what this does and where it goes? These 398sort of patches only work if we both have identical files in the first 399place. The Samba sources are constantly changing at the hands of multiple 400developers, so it doesn't work. 401 402Please use either context diffs or (even better) unified diffs. You 403get these using "diff -c4" or "diff -u". If you don't have a diff that 404can generate these then please send manualy commented patches to I 405know what is being changed and where. Most patches are applied by hand so 406the info must be clear. 407 408This is a basic guideline that will assist us with assessing your problem 409more efficiently : 410 411Machine Arch: 412Machine OS: 413OS Version: 414Kernel: 415 416Compiler: 417Libc Version: 418 419Samba Version: 420 421Network Layout (description): 422 423What else is on machine (services, etc): 424 425Some extras : 426 427<itemize> 428 429<item> what you did and what happened 430 431<item> relevant parts of a debugging output file with debuglevel higher. 432 If you can't find the relevant parts, please ask before mailing 433 huge files. 434 435<item> anything else you think is useful to trace down the bug 436 437</itemize> 438 439<sect1> What if I have an URGENT message for the developers?<p> 440 441If you have spotted something very serious and believe that it is 442important to contact the developers quickly send a message to 443samba-urgent@samba.org. This will be processed more quickly than 444mail to samba. Please think carefully before using this address. An 445example of its use might be to report a security hole. 446 447Examples of things <em>not</em> to send to samba-urgent include problems 448getting Samba to work at all and bugs that cannot potentially cause damage. 449 450<sect1> What if I need paid-for support?<p><label id=PaidSupport> 451 452Samba has a large network of consultants who provide Samba support on a 453commercial basis. The list is included in the package in <url 454url="../Support.txt">, and the latest version will always be on the main 455samba ftp site. Any company in the world can request that the samba team 456include their details in Support.txt so we can give no guarantee of 457their services. 458 459<sect1> Pizza supply details<p><label id="pizza"> 460Those who have registered in the Samba survey as "Pizza Factory" will 461already know this, but the rest may need some help. Andrew doesn't ask 462for payment, but he does appreciate it when people give him 463pizza. This calls for a little organisation when the pizza donor is 464twenty thousand kilometres away, but it has been done. 465 466<enum> 467<item> Ring up your local branch of an international pizza chain 468and see if they honour their vouchers internationally. Pizza Hut do, 469which is how the entire Canberra Linux Users Group got to eat pizza 470one night, courtesy of someone in the US. 471 472<item>Ring up a local pizza shop in Canberra and quote a credit 473card number for a certain amount, and tell them that Andrew will be 474collecting it (don't forget to tell him.) One kind soul from Germany 475did this. 476 477<item>Purchase a pizza voucher from your local pizza shop that has 478no international affiliations and send it to Andrew. It is completely 479useless but he can hang it on the wall next to the one he already has 480from Germany :-) 481 482<item>Air freight him a pizza with your favourite regional 483flavours. It will probably get stuck in customs or torn apart by 484hungry sniffer dogs but it will have been a noble gesture. 485 486</enum> 487 488<sect>About the CIFS and SMB Protocols<p><label id="CifsSmb"> 489 490<sect1> What is the Server Message Block (SMB) Protocol?<p> 491SMB is a filesharing protocol that has had several maintainers and 492contributors over the years including Xerox, 3Com and most recently 493Microsoft. Names for this protocol include LAN Manager and Microsoft 494Networking. Parts of the specification has been made public at several 495versions including in an X/Open document, as listed at 496<url url="ftp://ftp.microsoft.com/developr/drg/CIFS/">. No specification 497releases were made between 1992 and 1996, and during that period 498Microsoft became the SMB implementor with the largest market share. 499Microsoft developed the specification further for its products but for 500various reasons connected with developer's workload rather than market 501strategy did not make the changes public. This culminated with the 502"Windows NT 0.12" version released with NT 3.5 in 1995 which had significant 503improvements and bugs. Because Microsoft client systems are so popular, 504it is fair to say that what Microsoft with Windows affects all suppliers 505of SMB server products. 506 507From 1994 Andrew Tridgell began doing some serious work on his 508Smbserver (now Samba) product and with some helpers started to 509implement more and more of these protocols. Samba began to take 510a significant share of the SMB server market. 511 512<sect1> What is the Common Internet Filesystem (CIFS)?<p> 513The initial pressure for Microsoft to document their current SMB 514implementation came from the Samba team, who kept coming across things 515on the wire that Microsoft either didn't know about or hadn't documented 516anywhere (even in the sourcecode to Windows NT.) Then Sun Microsystems 517came out with their WebNFS initiative, designed to replace FTP for file 518transfers on the Internet. There are many drawbacks to WebNFS (including 519its scope - it aims to replace HTTP as well!) but the concept was 520attractive. FTP is not very clever, and why should it be harder to get 521files from across the world than across the room? 522 523Some hasty revisions were made and an Internet Draft for the Common 524Internet Filesystem (CIFS) was released. Note that CIFS is not an 525Internet standard and is a very long way from becoming one, BUT the 526protocol specification is in the public domain and ongoing discussions 527concerning the spec take place on a public mailing list according to the 528rules of the Internet Engineering Task Force. For more information and 529pointers see <url url="http://samba.org/cifs/"> 530 531The following is taken from <url url="http://www.microsoft.com/intdev/cifs/"> 532 533<verb> 534 CIFS defines a standard remote file system access protocol for use 535 over the Internet, enabling groups of users to work together and 536 share documents across the Internet or within their corporate 537 intranets. CIFS is an open, cross-platform technology based on the 538 native file-sharing protocols built into Microsoft� Windows� and 539 other popular PC operating systems, and supported on dozens of 540 other platforms, including UNIX�. With CIFS, millions of computer 541 users can open and share remote files on the Internet without having 542 to install new software or change the way they work." 543</verb> 544 545If you consider CIFS as a backwardsly-compatible refinement of SMB that 546will work reasonably efficiently over the Internet you won't be too far 547wrong. 548 549The net effect is that Microsoft is now documenting large parts of their 550Windows NT fileserver protocols. The security concepts embodied in 551Windows NT are part of the specification, which is why Samba 552documentation often talks in terms of Windows NT. However there is no 553reason why a site shouldn't conduct all its file and printer sharing 554with CIFS and yet have no Microsoft products at all. 555 556<sect1> What is Browsing? <p> 557The term "Browsing" causes a lot of confusion. It is the part of the 558SMB/CIFS protocol which allows for resource discovery. For example, in 559the Windows NT Explorer it is possible to see a "Network Neighbourhood" 560of computers in the same SMB workgroup. Clicking on the name of one of 561these machines brings up a list of file and printer resources for 562connecting to. In this way you can cruise the network, seeing what 563things are available. How this scales to the Internet is a subject for 564debate. Look at the CIFS list archives to see what the experts think. 565 566<sect>Designing A SMB and CIFS Network<p> 567 568The big issues for installing any network of LAN or WAN file and print 569servers are 570 571<itemize> 572 573<item>How and where usernames, passwords and other security information 574is stored 575 576<item>What method can be used for locating the resources that users have 577permission to use 578 579<item>What protocols the clients can converse with 580 581</itemize> 582 583If you buy Netware, Windows NT or just about any other LAN fileserver 584product you are expected to lock yourself into the product's preferred 585answers to these questions. This tendancy is restrictive and often very 586expensive for a site where there is only one kind of client or server, 587and for sites with a mixture of operating systems it often makes it 588impossible to share resources between some sets of users. 589 590The Samba philosophy is to make things as easy as possible for 591administators, which means allowing as many combinations of clients, 592servers, operating systems and protocols as possible. 593 594<sect1>Workgroups, Domains, Authentication and Browsing<p> 595 596From the point of view of networking implementation, Domains and 597Workgroups are <em>exactly</em> the same, except for the client logon 598sequence. Some kind of distributed authentication database is associated 599with a domain (there are quite a few choices) and this adds so much 600flexibility that many people think of a domain as a completely different 601entity to a workgroup. From Samba's point of view a client connecting to 602a service presents an authentication token, and it if it is valid they 603have access. Samba does not care what mechanism was used to generate 604that token in the first place. 605 606The SMB client logging on to a domain has an expectation that every other 607server in the domain should accept the same authentication information. 608However the network browsing functionality of domains and workgroups is 609identical and is explained in <url url="../BROWSING.txt">. 610 611There are some implementation differences: Windows 95 can be a member of 612both a workgroup and a domain, but Windows NT cannot. Windows 95 also 613has the concept of an "alternative workgroup". Samba can only be a 614member of a single workgroup or domain, although this is due to change 615with a future version when nmbd will be split into two daemons, one for 616WINS and the other for browsing (<url url="../NetBIOS.txt"> explains 617what WINS is.) 618 619<sect2> Defining the Terms<p><label id="BrowseAndDomainDefs"> 620 621<descrip> 622 623<tag/Workgroup/ means a collection of machines that maintain a common 624browsing database containing information about their shared resources. 625They do not necessarily have any security information in common (if they 626do, it gets called a Domain.) The browsing database is dynamic, modified 627as servers come and go on the network and as resources are added or 628deleted. The term "browsing" refers to a user accessing the database via 629whatever interface the client provides, eg the OS/2 Workplace Shell or 630Windows 95 Explorer. SMB servers agree between themselves as to which 631ones will maintain the browsing database. Workgroups can be anywhere on 632a connected TCP/IP network, including on different subnets or even on 633the Interet. This is a very tricky part of SMB to implement. 634 635<tag/Master Browsers/ are machines which holds the master browsing 636database for a workgroup or domain. There are two kinds of Master Browser: 637 638<itemize> 639 640<item> Domain Master Browser, which holds the master browsing 641information for an entire domain, which may well cross multiple TCP/IP 642subnets. 643 644<item> Local Master Browser, which holds the master browsing database 645for a particular subnet and communicates with the Domain Master Browser 646to get information on other subnets. 647 648</itemize> 649 650Subnets are differentiated because browsing is based on broadcasts, and 651broadcasts do not pass through routers. Subnets are not routed: while it 652is possible to have more than one subnet on a single network segment 653this is regarded as very bad practice. 654 655Master Browsers (both Domain and Local) are elected dynamically 656according to an algorithm which is supposed to take into account the 657machine's ability to sustain the browsing load. Samba can be configured 658to always act as a master browser, ie it always wins elections under all 659circumstances, even against systems such as a Windows NT Primary Domain 660Controller which themselves expect to win. 661 662There are also Backup Browsers which are promoted to Master Browsers in 663the event of a Master Browser disappearing from the network. 664 665Alternative terms include confusing variations such as "Browse Master", 666and "Master Browser" which we are trying to eliminate from the Samba 667documentation. 668 669<tag/Domain Controller/ is a term which comes from the Microsoft and IBM 670etc implementation of the LAN Manager protocols. It is tied to 671authentication. There are other ways of doing domain authentication, but 672the Windows NT method has a large market share. The general issues are 673discussed in <url url="../DOMAIN.txt"> and a Windows NT-specific 674discussion is in <url url="../DOMAIN_CONTROL.txt">. 675 676</descrip> 677 678<sect2>Sharelevel (Workgroup) Security Services<p><label id="ShareModeSecurity"> 679 680With the Samba setting "security = SHARE", all shared resources 681information about what password is associated with them but only hints 682as to what usernames might be valid (the hint can be 'all users', in 683which case any username will work. This is usually a bad idea, but 684reflects both the initial implementations of SMB in the mid-80s and 685its reincarnation with Windows for Workgroups in 1992. The idea behind 686workgroup security was that small independant groups of people could 687share information on an ad-hoc basis without there being an 688authentication infrastructure present or requiring them to do more than 689fill in a dialogue box. 690 691<sect2>Authentication Domain Mode Services<p><label id="DomainModeSecurity"> 692 693With the Samba settings "security = USER" or "security = SERVER" 694accesses to all resources are checked for username/password pair matches 695in a more rigorous manner. To the client, this has the effect of 696emulating a Microsoft Domain. The client is not concerned whether or not 697Samba looks up a Windows NT SAM or does it in some other way. 698 699<sect1>Authentication Schemes<p> 700 701In the simple case authentication information is stored on a single 702server and the user types a password on connecting for the first time. 703However client operating systems often require a password before they 704can be used at all, and in addition users usually want access to more 705than one server. Asking users to remember many different passwords in 706different contexts just does not work. Some kind of distributed 707authentication database is needed. It must cope with password changes 708and provide for assigning groups of users the same level of access 709permissions. This is why Samba installations often choose to implement a 710Domain model straight away. 711 712Authentication decisions are some of the biggest in designing a network. 713Are you going to use a scheme native to the client operating system, 714native to the server operating system, or newly installed on both? A 715list of options relevant to Samba (ie that make sense in the context of 716the SMB protocol) follows. Any experiences with other setups would be 717appreciated. [refer to server FAQ for "passwd chat" passwd program 718password server etc etc...] 719 720<sect2>NIS<p> 721 722For Windows 95, Windows for Workgroups and most other clients Samba can 723be a domain controller and share the password database via NIS 724transparently. Windows NT is different. 725<url url="http://www.dcs.qmw.ac.uk/~williams" name="Free NIS NT client"> 726 727<sect2>Kerberos<p> 728 729Kerberos for US users only: 730<url url="http://www.cygnus.com/product/unifying-security.html" 731name="Kerberos overview"> 732<url url="http://www.cygnus.com/product/kerbnet-download.html" 733name="Download Kerberos"> 734 735<sect2>FTP<p> 736 737Other NT w/s logon hack via NT 738 739<sect2>Default Server Method<p> 740 741<sect2>Client-side Database Only<p> 742 743<sect1>Post-Authentication: Netlogon, Logon Scripts, Profiles<p> 744 745See <url url="../DOMAIN.txt"> 746 747<sect>Cross-Protocol File Sharing<p> 748 749Samba is an important tool for... 750 751It is possible to... 752 753File protocol gateways... 754 755"Setting up a Linux File Server" http://vetrec.mit.edu/people/narf/linux.html 756 757Two free implementations of Appletalk for Unix are Netatalk, <url 758url="http://www.umich.edu/~rsug/netatalk/">, and CAP, <url 759url="http://www.cs.mu.oz.au/appletalk/atalk.html">. What Samba offers MS 760Windows users, these packages offer to Macs. For more info on these 761packages, Samba, and Linux (and other UNIX-based systems) see <url 762url="http://www.eats.com/linux_mac_win.html"> 3.5) Sniffing your nework 763 764 765<sect>Miscellaneous<p><label id="miscellaneous"> 766<sect1>Is Samba Year 2000 compliant?<p><label id="Year2000Compliant"> 767The CIFS protocol that Samba implements 768negotiates times in various formats, all of which 769are able to cope with dates beyond 2000. 770 771</article> 772