1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�2.�Small Office Networking</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part�I.�Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter�1.�No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter�3.�Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�2.�Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a>�</td><th width="60%" align="center">Part�I.�Example Network Configurations</th><td width="20%" align="right">�<a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter�2.�Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id321229">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id321247">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id321293">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id321342">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id321528">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id321546">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id323199">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id323822">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id323841">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id323907">Questions and Answers</a></span></dt></dl></div><p> 2 <a href="simple.html" title="Chapter�1.�No-Frills Samba Servers">???</a> focused on the basics of simple yet effective 3 network solutions. Network administrators who take pride in their work 4 (that's most of us, right?) take care to deliver what our users want, 5 but not too much more. If we make things too complex, we confound our users 6 and increase costs of network ownership. A professional network manager 7 avoids the temptation to put too much pizazz into the way that the network 8 operates. Some creativity is helpful, but keep it under control 9 good advice that the following two scenarios illustrate. 10 </p><p> 11 <a class="indexterm" name="id321194"></a> 12 In one case the network administrator of a mid-sized company spent three 13 months building a new network to replace an old Netware server. What he 14 delivered had all the bells and whistles he could muster. There were a 15 few teething problems during the changeover, nothing serious but a little 16 disruptive all the same. Users were exposed to many changes at once. The 17 network administrator was asked to resign two months after implementing 18 the new system because so many staff complained they had lost time and 19 were not happy with the new network. Everything was automated, and he 20 delivered more features than any advanced user could think of. He was 21 just too smart for his own good. 22 </p><p> 23 In the case of the other company, a new network manager was appointed 24 to oversee the replacement of a LanTastic network with an MS Windows 25 NT 4.0 network. He had the replacement installed and operational within 26 two weeks. Before installation and changeover, he called a meeting to 27 explain to all users what was going to happen, how it would affect them, 28 and that he would be available 24 hours a day to help them transition. 29 One week after conversion, he held another meeting asking for cooperation 30 in the introduction of a few new features that would help to make life 31 easier. Network users were thrilled with the help he provided. The network 32 he implemented was nowhere near as complex as in the first example, had fewer 33 features, and yet he had happy users. Months later he was still adding 34 new innovations. He always asked the users if a 35 particular feature was what they wanted. He asked his boss for a raise 36 and got it. He often told me, “<span class="quote">Always keep a few new tricks up your 37 sleeves for when you need them.</span>” Was he smart? You decide. Let's 38 get on with our next exercise. 39 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id321229"></a>Introduction</h2></div></div></div><p> 40 Abmas Accounting has grown. Mr. Meany likes you and says he knew you 41 were the right person for the job. That's why he asked you to install the 42 new server. The past few months have been hard work. You advised Mr. Meany 43 that it is time for a change. Abmas now has 52 users, having acquired an 44 investment consulting business recently. The new users were added to the 45 network without any problems. 46 </p><p> 47 Some of the Windows clients are nearly past their use-by date. 48 You found damaged and unusable software on some of the workstations 49 that came with the acquired business and found some machines 50 in need of both hardware and software maintenance. 51 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id321247"></a>Assignment Tasks</h3></div></div></div><p> 52 <a class="indexterm" name="id321255"></a> 53 Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure 54 that the business is running efficiently. Many of the new staff want notebook 55 computers. They visit customer business premises and need to use local network 56 facilities; these users are technically competent. The company uses a 57 business application that requires Windows XP Professional. In short, a complete 58 client upgrade is about to happen. Mr. Meany told you that he is working 59 on another business acquisition and that by the time he retires there will be 60 80 to 100 users. 61 </p><p> 62 Mr. Meany is not concerned about security. He wants to make it easier for 63 staff to do their work. He has hired you to help him appoint a full-time 64 network manager before he retires. Above all, he says he is investing in 65 the ability to grow. He is determined to live his lifelong dream and 66 hand the business over to a bright and capable executive who can make 67 things happen. This means your network design must cope well with 68 growth. 69 </p><p> 70 In a few months, Abmas will require an Internet connection for email and so 71 that staff can easily obtain software updates. Mr. Meany is warming up to 72 the installation of antivirus software but is not yet ready to approve 73 this expense. He told you to spend the money a virus scanner costs 74 on better quality notebook computers for mobile users. 75 </p><p> 76 One of Mr. Meany's golfing partners convinced him to buy new laser 77 printers, one black only, the other a color laser printer. Staff support 78 the need for a color printer so they can present more attractive proposals 79 and reports. 80 </p><p> 81 Mr. Meany also asked if it would be possible for one of the staff to manage 82 user accounts from the Windows desktop. That person will be responsible for 83 basic operations. 84 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id321293"></a>Dissection and Discussion</h2></div></div></div><p> 85 What are the key requirements in this business example? A quick review indicates 86 a need for 87 </p><div class="itemizedlist"><ul type="disc"><li><p> 88 Scalability, from 52 to over 100 users in 12 months 89 </p></li><li><p> 90 Mobile computing capability 91 <a class="indexterm" name="id321314"></a> 92 </p></li><li><p> 93 Improved reliability and usability 94 </p></li><li><p> 95 Easier administration 96 </p></li></ul></div><p> 97 In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server 98 (as in <a href="simple.html#AccountingOffice" title="Accounting Office">???</a>). 99 100 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id321342"></a>Technical Issues</h3></div></div></div><p> 101 <a class="indexterm" name="id321350"></a> 102 <a class="indexterm" name="id321357"></a> 103 <a class="indexterm" name="id321364"></a> 104 <a class="indexterm" name="id321370"></a> 105 <a class="indexterm" name="id321377"></a> 106 It is time to implement a domain security environment. You will use the <code class="constant"> 107 smbpasswd</code> (default) backend. You should implement a DHCP server. There is no need to 108 run DNS at this time, but the system will use WINS. The domain name will be <code class="constant"> 109 BILLMORE</code>. This time, the name of the server will be <code class="constant">SLEETH</code>. 110 </p><p> 111 All printers will be configured as DHCP clients. The DHCP server will assign 112 the printer a fixed IP address by way of its Ethernet interface (MAC) address. 113 See <a href="small.html#dhcp01" title="Example�2.2.�Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">???</a>. 114 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 115 The <code class="filename">smb.conf</code> file you are creating in this exercise can be used with equal effectiveness 116 with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is 117 possible to start with the installation that you have created here, migrate it 118 to a Samba-3 configuration, and then secure the system further. Configurations following 119 this one utilize features that may not be supported in Samba-2.2.x releases. 120 However, you should note that the examples in each chapter start with the assumption 121 that a fresh new installation is being effected. 122 </p></div><p> 123 Later on, when the Internet connection is implemented, you will add DNS as well as 124 other enhancements. It is important that you plan accordingly. 125 </p><p> 126 <a class="indexterm" name="id321431"></a> 127 You have split the network into two separate areas. Each has its own Ethernet switch. 128 There are 20 users on the accounting network and 32 users on the financial services 129 network. The server has two network interfaces, one serving each network. The 130 network printers will be located in a central area. You plan to install the new 131 printers and keep the old printer in use also. 132 </p><p> 133 You will provide separate file storage areas for each business entity. The old system 134 will go away, accounting files will be handled under a single directory, and files will 135 be stored under customer name, not under a personal work area. Staff will be made 136 responsible for file location, so the old share point must be maintained. 137 </p><p> 138 Given that DNS will not be used, you will configure WINS name resolution for UNIX 139 hostname name resolution. 140 </p><p> 141 <a class="indexterm" name="id321455"></a> 142 <a class="indexterm" name="id321464"></a> 143 It is necessary to map Windows Domain Groups to UNIX groups. It is 144 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two 145 key staff groups in the firm are accounting staff and financial services staff. 146 For these, it is necessary to create UNIX groups as well as Windows Domain Groups. 147 </p><p> 148 In the sample <code class="filename">smb.conf</code> file, you have configured Samba to call the UNIX 149 <code class="literal">groupadd</code> to add group entries. This utility does not permit 150 the addition of group names that contain uppercase characters or spaces. This 151 is considered a bug. The <code class="literal">groupadd</code> is part of the 152 <code class="literal">shadow-utils</code> open source software package. A later release 153 of this package may have been patched to resolve this bug. If your operating 154 platform has this bug, it means that attempts to add a Windows Domain Group that 155 has either a space or uppercase characters in it will fail. See 156 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 11, Section 11.3.1, Example 11.1, for 157 more information. 158 </p><p> 159 <a class="indexterm" name="id321515"></a> 160 Vendor-supplied printer drivers will be installed on each client. The CUPS print 161 spooler on the UNIX host will be operated in <code class="constant">raw</code> mode. 162 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id321528"></a>Political Issues</h3></div></div></div><p> 163 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance. 164 He is willing to spend money on things he believes are of value. You need more 165 time to convince him of real priorities. 166 </p><p> 167 Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be 168 supplied with antivirus software? Above all, demonstrate good purchase value and remember 169 to make your users happy. 170 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id321546"></a>Implementation</h2></div></div></div><p> 171 <a class="indexterm" name="id321554"></a> 172 In this example, the assumption is made that this server is being configured from a clean start. 173 The alternate approach could be to demonstrate the migration of the system that is documented 174 in <a href="simple.html#AcctgNet" title="Implementation">???</a> to meet the new requirements. The decision to treat this case, as with 175 future examples, as a new installation is based on the premise that you can determine 176 the migration steps from the information provided in <a href="ntmigration.html" title="Chapter�9.�Migrating NT4 Domain to Samba-3">???</a>. 177 Additionally, a fresh installation makes the example easier to follow. 178 </p><p> 179 <a class="indexterm" name="id321581"></a> 180 Each user will be given a home directory on the UNIX system, which will be available as a private 181 share. Two additional shares will be created, one for the accounting department and the other for 182 the financial services department. Network users will be given access to these shares by way 183 of group membership. 184 </p><p> 185 <a class="indexterm" name="id321593"></a> 186 UNIX group membership is the primary mechanism by which Windows Domain users will be granted 187 rights and privileges within the Windows environment. 188 </p><p> 189 <a class="indexterm" name="id321607"></a> 190 The user <code class="literal">alanm</code> will be made the owner of all files. This will be preserved 191 by setting the sticky bit (set UID/GID) on the top-level directories. 192 </p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure�2.1.�Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><br class="figure-break"><div class="procedure"><a name="id321665"></a><p class="title"><b>Procedure�2.1.�Server Installation Steps</b></p><ol type="1"><li><p> 193 Using UNIX/Linux system tools, name the server <code class="constant">sleeth</code>. 194 </p></li><li><p> 195 <a class="indexterm" name="id321687"></a> 196 Place an entry for the machine <code class="constant">sleeth</code> in the <code class="filename">/etc/hosts</code>. 197 The printers are network attached, so there should be entries for the 198 network printers also. An example <code class="filename">/etc/hosts</code> file is shown here: 199</p><pre class="screen"> 200192.168.1.1 sleeth sleeth1 201192.168.2.1 sleeth2 202192.168.1.10 hplj6 203192.168.1.11 hplj4 204192.168.2.10 qms 205</pre><p> 206 </p></li><li><p> 207 Install the Samba-3 binary RPM from the Samba-Team FTP site. 208 </p></li><li><p> 209 Install the ISC DHCP server using the UNIX/Linux system tools available to you. 210 </p></li><li><p> 211 <a class="indexterm" name="id321738"></a> 212 <a class="indexterm" name="id321745"></a> 213 <a class="indexterm" name="id321752"></a> 214 <a class="indexterm" name="id321759"></a> 215 Because Samba will be operating over two network interfaces and clients on each side 216 may want to be able to reach clients on the other side, it is imperative that IP forwarding 217 is enabled. Use the system tool of your choice to enable IP forwarding. In the 218 absence of such a tool on the Linux system, add to the <code class="filename">/etc/rc.d/rc.local</code> 219 file an entry as follows: 220</p><pre class="screen"> 221echo 1 > /proc/sys/net/ipv4/ip_forward 222</pre><p> 223 This causes the Linux kernel to forward IP packets so that it acts as a router. 224 </p></li><li><p> 225 Install the <code class="filename">smb.conf</code> file as shown in <a href="small.html#acct2conf" title="Example�2.3.�Accounting Office Network smb.conf File [globals] Section">???</a> and 226 <a href="small.html#acct3conf" title="Example�2.4.�Accounting Office Network smb.conf File Services and Shares Section">???</a>. Combine these two examples to form a single 227 <code class="filename">/etc/samba/smb.conf</code> file. 228 </p></li><li><p> 229 <a class="indexterm" name="id321820"></a> 230 Add the user <code class="literal">root</code> to the Samba password backend: 231</p><pre class="screen"> 232<code class="prompt">root# </code> smbpasswd -a root 233New SMB password: XXXXXXX 234Retype new SMB password: XXXXXXX 235<code class="prompt">root# </code> 236</pre><p> 237 <a class="indexterm" name="id321851"></a> 238 This is the Windows Domain Administrator password. Never delete this account from 239 the password backend after Windows Domain Groups have been initialized. If you delete 240 this account, your system is crippled. You cannot restore this account, 241 and your Samba server can no longer be administered. 242 </p></li><li><p> 243 <a class="indexterm" name="id321867"></a> 244 Create the username map file to permit the <code class="constant">root</code> account to be called 245 <code class="constant">Administrator</code> from the Windows network environment. To do this, create 246 the file <code class="filename">/etc/samba/smbusers</code> with the following contents: 247</p><pre class="screen"> 248#### 249# User mapping file 250#### 251# File Format 252# ----------- 253# Unix_ID = Windows_ID 254# 255# Examples: 256# root = Administrator 257# janes = "Jane Smith" 258# jimbo = Jim Bones 259# 260# Note: If the name contains a space it must be double quoted. 261# In the example above the name 'jimbo' will be mapped to Windows 262# user names 'Jim' and 'Bones' because the space was not quoted. 263####################################################################### 264root = Administrator 265#### 266# End of File 267#### 268</pre><p> 269 </p></li><li><p> 270 <a class="indexterm" name="id321909"></a> 271 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in 272 <a href="small.html#initGrps" title="Example�2.1.�Script to Map Windows NT Groups to UNIX Groups">???</a>. Create a file containing this script. We called ours 273 <code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed, 274 and then execute the script. Sample output should be as follows: 275 276</p><div class="example"><a name="initGrps"></a><p class="title"><b>Example�2.1.�Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id321939"></a><pre class="screen"> 277#!/bin/bash 278# 279# initGrps.sh 280# 281 282# Create UNIX groups 283groupadd acctsdep 284groupadd finsrvcs 285 286# Map Windows Domain Groups to UNIX groups 287net groupmap add ntgroup="Domain Admins" unixgroup=root type=d 288net groupmap add ntgroup="Domain Users" unixgroup=users type=d 289net groupmap add ntgroup="Domain Guests" unixgroup=nobody type=d 290 291# Add Functional Domain Groups 292net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d 293net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d 294</pre></div></div><p><br class="example-break"> 295 296</p><pre class="screen"> 297<code class="prompt">root# </code> chmod 755 initGrps.sh 298<code class="prompt">root# </code> cd /etc/samba 299<code class="prompt">root# </code> ./initGrps.sh 300Updated mapping entry for Domain Admins 301Updated mapping entry for Domain Users 302Updated mapping entry for Domain Guests 303No rid or sid specified, choosing algorithmic mapping 304Successfully added group Accounts Dept to the mapping db 305No rid or sid specified, choosing algorithmic mapping 306Successfully added group Domain Guests to the mapping db 307 308<code class="prompt">root# </code> cd /etc/samba 309<code class="prompt">root# </code> net groupmap list | sort 310Account Operators (S-1-5-32-548) -> -1 311Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep 312Administrators (S-1-5-32-544) -> -1 313Backup Operators (S-1-5-32-551) -> -1 314Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root 315Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody 316Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users 317Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs 318Guests (S-1-5-32-546) -> -1 319Power Users (S-1-5-32-547) -> -1 320Print Operators (S-1-5-32-550) -> -1 321Replicators (S-1-5-32-552) -> -1 322System Operators (S-1-5-32-549) -> -1 323Users (S-1-5-32-545) -> -1 324</pre><p> 325 </p></li><li><p> 326 <a class="indexterm" name="id322008"></a> 327 <a class="indexterm" name="id322015"></a> 328 <a class="indexterm" name="id322024"></a> 329 For each user who needs to be given a Windows Domain account, make an entry in the 330 <code class="filename">/etc/passwd</code> file as well as in the Samba password backend. 331 Use the system tool of your choice to create the UNIX system accounts, and use the Samba 332 <code class="literal">smbpasswd</code> program to create the Domain user accounts. 333 </p><p> 334 <a class="indexterm" name="id322048"></a> 335 <a class="indexterm" name="id322055"></a> 336 <a class="indexterm" name="id322062"></a> 337 There are a number of tools for user management under UNIX, such as 338 <code class="literal">useradd</code> and <code class="literal">adduser</code>, as well as a plethora of custom 339 tools. With the tool of your choice, create a home directory for each user. 340 </p></li><li><p> 341 Using the preferred tool for your UNIX system, add each user to the UNIX groups created 342 previously, as necessary. File system access control will be based on UNIX group membership. 343 </p></li><li><p> 344 Create the directory mount point for the disk subsystem that is mounted to provide 345 data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code> 346 file is <code class="filename">/data</code>. Format the file system as required, mount the formatted 347 file system partition using <code class="literal">mount</code>, 348 and make the appropriate changes in <code class="filename">/etc/fstab</code>. 349 </p></li><li><p> 350 Create the top-level file storage directories are follows: 351</p><pre class="screen"> 352<code class="prompt">root# </code> mkdir -p /data/{accounts,finsvcs} 353<code class="prompt">root# </code> chown -R root:root /data 354<code class="prompt">root# </code> chown -R alanm:accounts /data/accounts 355<code class="prompt">root# </code> chown -R alanm:finsvcs /data/finsvcs 356<code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /data 357</pre><p> 358 Each department is responsible for creating its own directory structure within its 359 share. The directory root of the <code class="literal">accounts</code> share is <code class="filename">/data/accounts</code>. 360 The directory root of the <code class="literal">finsvcs</code> share is <code class="filename">/data/finsvcs</code>. 361 </p></li><li><p> 362 Configure the printers with the IP addresses as shown in <a href="small.html#acct2net" title="Figure�2.1.�Abmas Accounting 52-User Network Topology">???</a>. 363 Follow the instructions in the manufacturers' manuals to permit printing to port 9100. 364 This allows the CUPS spooler to print using raw mode protocols. 365 <a class="indexterm" name="id322209"></a> 366 <a class="indexterm" name="id322216"></a> 367 </p></li><li><p> 368 <a class="indexterm" name="id322229"></a> 369 <a class="indexterm" name="id322238"></a> 370 Configure the CUPS Print Queues as follows: 371</p><pre class="screen"> 372<code class="prompt">root# </code> lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E 373<code class="prompt">root# </code> lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E 374<code class="prompt">root# </code> lpadmin -p qms -v socket://192.168.2.10:9100 -E 375</pre><p> 376 <a class="indexterm" name="id322270"></a> 377 This creates the necessary print queues with no assigned print filter. 378 </p></li><li><p> 379 <a class="indexterm" name="id322284"></a> 380 <a class="indexterm" name="id322291"></a> 381 <a class="indexterm" name="id322298"></a> 382 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 383</p><pre class="screen"> 384application/octet-stream application/vnd.cups-raw 0 - 385</pre><p> 386 </p></li><li><p> 387 <a class="indexterm" name="id322324"></a> 388 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 389</p><pre class="screen"> 390application/octet-stream 391</pre><p> 392 </p></li><li><p> 393 <a class="indexterm" name="id322349"></a> 394 Using your favorite system editor, create an <code class="filename">/etc/dhcpd.conf</code> with the 395 contents as shown in <a href="small.html#dhcp01" title="Example�2.2.�Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">???</a>. 396</p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example�2.2.�Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id322384"></a><pre class="screen"> 397default-lease-time 86400; 398max-lease-time 172800; 399default-lease-time 86400; 400 401option ntp-servers 192.168.1.1; 402option domain-name "abmas.biz"; 403option domain-name-servers 192.168.1.1, 192.168.2.1; 404option netbios-name-servers 192.168.1.1, 192.168.2.1; 405option netbios-node-type 8; 406### NOTE ### 407# netbios-node-type=8 means set clients to Hybrid Mode 408# so they will use Unicast communication with the WINS 409# server and thus reduce the level of UDP broadcast 410# traffic by up to 90%. 411############ 412 413subnet 192.168.1.0 netmask 255.255.255.0 { 414 range dynamic-bootp 192.168.1.128 192.168.1.254; 415 option subnet-mask 255.255.255.0; 416 option routers 192.168.1.1; 417 allow unknown-clients; 418 host hplj4 { 419 hardware ethernet 08:00:46:7a:35:e4; 420 fixed-address 192.168.1.10; 421 } 422 host hplj6 { 423 hardware ethernet 00:03:47:cb:81:e0; 424 fixed-address 192.168.1.11; 425 } 426 } 427subnet 192.168.2.0 netmask 255.255.255.0 { 428 range dynamic-bootp 192.168.2.128 192.168.2.254; 429 option subnet-mask 255.255.255.0; 430 option routers 192.168.2.1; 431 allow unknown-clients; 432 host qms { 433 hardware ethernet 01:04:31:db:e1:c0; 434 fixed-address 192.168.1.10; 435 } 436 } 437subnet 127.0.0.0 netmask 255.0.0.0 { 438 } 439</pre></div></div><p><br class="example-break"> 440 </p></li><li><p> 441 Use the standard system tool to start Samba and CUPS and configure them to start 442 automatically at every system reboot. For example, 443 </p><p> 444 <a class="indexterm" name="id322419"></a> 445 <a class="indexterm" name="id322426"></a> 446 <a class="indexterm" name="id322432"></a> 447 <a class="indexterm" name="id322439"></a> 448 <a class="indexterm" name="id322446"></a> 449</p><pre class="screen"> 450<code class="prompt">root# </code> chkconfig dhcp on 451<code class="prompt">root# </code> chkconfig smb on 452<code class="prompt">root# </code> chkconfig cups on 453<code class="prompt">root# </code> /etc/rc.d/init.d/dhcp restart 454<code class="prompt">root# </code> /etc/rc.d/init.d/smb restart 455<code class="prompt">root# </code> /etc/rc.d/init.d/cups restart 456</pre><p> 457 </p></li><li><p> 458 <a class="indexterm" name="id322501"></a> 459 <a class="indexterm" name="id322508"></a> 460 <a class="indexterm" name="id322517"></a> 461 <a class="indexterm" name="id322523"></a> 462 <a class="indexterm" name="id322530"></a> 463 <a class="indexterm" name="id322537"></a> 464 Configure the name service switch (NSS) to handle WINS-based name resolution. 465 Since this system does not use a DNS server, it is safe to remove this option from 466 the NSS configuration. Edit the <code class="filename">/etc/nsswitch.conf</code> file so that 467 the <code class="constant">hosts:</code> entry looks like this: 468</p><pre class="screen"> 469hosts: files wins 470</pre><p> 471 </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example�2.3.�Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id322599"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id322611"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id322624"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id322637"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id322650"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id322662"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id322675"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id322688"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id322700"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id322713"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id322726"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id322739"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id322752"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id322765"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id322778"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id322790"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id322803"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322815"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322828"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322840"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example�2.4.�Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id322886"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id322898"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id322911"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id322924"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id322945"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id322958"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id322970"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322983"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322995"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323008"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id323029"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id323042"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id323054"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id323067"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id323088"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id323101"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id323114"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id323126"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id323148"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id323160"></a><em class="parameter"><code>path = /data/finsvcs</code></em></td></tr><tr><td><a class="indexterm" name="id323173"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id323185"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id323199"></a>Validation</h3></div></div></div><p> 472 Does everything function as it ought? That is the key question at this point. 473 Here are some simple steps to validate your Samba server configuration. 474 </p><div class="procedure"><a name="id323209"></a><p class="title"><b>Procedure�2.2.�Validation Steps</b></p><ol type="1"><li><p> 475 <a class="indexterm" name="id323220"></a> 476 If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba 477 to refuse to start. The first step should always be to validate the contents 478 of this file by running: 479</p><pre class="screen"> 480<code class="prompt">root# </code> testparm -s 481Load smb config files from smb.conf 482Processing section "[homes]" 483Processing section "[printers]" 484Processing section "[netlogon]" 485Processing section "[accounts]" 486Processing section "[service]" 487Loaded services file OK. 488# Global parameters 489[global] 490 workgroup = BILLMORE 491 passwd chat = *New*Password* \ 492 %n\n *Re-enter*new*password* %n\n *Password*changed* 493 username map = /etc/samba/smbusers 494 syslog = 0 495 name resolve order = wins bcast hosts 496 printcap name = CUPS 497 show add printer wizard = No 498 add user script = /usr/sbin/useradd -m '%u' 499 delete user script = /usr/sbin/userdel -r '%u' 500 add group script = /usr/sbin/groupadd '%g' 501 delete group script = /usr/sbin/groupdel '%g' 502 add user to group script = /usr/sbin/usermod -G '%g' '%u' 503 add machine script = /usr/sbin/useradd 504 -s /bin/false -d /var/lib/nobody '%u' 505 logon script = scripts\logon.bat 506 logon path = 507 logon drive = X: 508 domain logons = Yes 509 preferred master = Yes 510 wins support = Yes 511... 512### Remainder cut to save space ### 513</pre><p> 514 The inclusion of an invalid parameter (say one called dogbert) would generate an 515 error as follows: 516</p><pre class="screen"> 517Unknown parameter encountered: "dogbert" 518Ignoring unknown parameter "dogbert" 519</pre><p> 520 Clear away all errors before proceeding, and start or restart samba as necessary. 521 </p></li><li><p> 522 <a class="indexterm" name="id323270"></a> 523 <a class="indexterm" name="id323277"></a> 524 <a class="indexterm" name="id323284"></a> 525 <a class="indexterm" name="id323291"></a> 526 Check that the Samba server is running: 527</p><pre class="screen"> 528<code class="prompt">root# </code> ps ax | grep mbd 52914244 ? S 0:00 /usr/sbin/nmbd -D 53014245 ? S 0:00 /usr/sbin/nmbd -D 53114290 ? S 0:00 /usr/sbin/smbd -D 532 533$rootprompt; ps ax | grep winbind 53414293 ? S 0:00 /usr/sbin/winbindd -B 53514295 ? S 0:00 /usr/sbin/winbindd -B 536</pre><p> 537 The <code class="literal">winbindd</code> daemon is running in split mode (normal), so there are also 538 two instances of it. For more information regarding <code class="literal">winbindd</code>, see 539 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 23, Section 23.3. The single instance of 540 <code class="literal">smbd</code> is normal. 541 </p></li><li><p> 542 <a class="indexterm" name="id323342"></a> 543 Check that an anonymous connection can be made to the Samba server: 544</p><pre class="screen"> 545<code class="prompt">root# </code> smbclient -L localhost -U% 546 547 Sharename Type Comment 548 --------- ---- ------- 549 netlogon Disk Network Logon Service 550 accounts Disk Accounting Files 551 finsvcs Disk Financial Service Files 552 IPC$ IPC IPC Service (Samba3) 553 ADMIN$ IPC IPC Service (Samba3) 554 hplj4 Printer Hewlett-Packard LaserJet 4 555 hplj6 Printer Hewlett-Packard LaserJet 6 556 qms Printer QMS Magicolor Laser Printer XXXX 557 558 Server Comment 559 --------- ------- 560 SLEETH Samba 3.0.20 561 562 Workgroup Master 563 --------- ------- 564 BILLMORE SLEETH 565</pre><p> 566 This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent 567 of browsing the server from a Windows client to obtain a list of shares on the server. 568 The <code class="constant">-U%</code> argument means to send a <code class="constant">NULL</code> username and 569 a <code class="constant">NULL</code> password. 570 </p></li><li><p> 571 <a class="indexterm" name="id323387"></a> 572 <a class="indexterm" name="id323393"></a> 573 <a class="indexterm" name="id323400"></a> 574 Verify that the printers have the IP addresses assigned in the DHCP server configuration file. 575 The easiest way to do this is to ping the printer name. Immediately after the ping response 576 has been received, execute <code class="literal">arp -a</code> to find the MAC address of the printer 577 that has responded. Now you can compare the IP address and the MAC address of the printer 578 with the configuration information in the <code class="filename">/etc/dhcpd.conf</code> file. They 579 should, of course, match. For example, 580</p><pre class="screen"> 581<code class="prompt">root# </code> ping hplj4 582PING hplj4 (192.168.1.11) 56(84) bytes of data. 58364 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms 584 585<code class="prompt">root# </code> arp -a 586hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0 587</pre><p> 588 The MAC address <code class="constant">08:00:46:7A:35:E4</code> matches that specified for the 589 IP address from which the printer has responded and the entry for it in the 590 <code class="filename">/etc/dhcpd.conf</code> file. 591 </p></li><li><p> 592 <a class="indexterm" name="id323459"></a> 593 Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: 594</p><pre class="screen"> 595<code class="prompt">root# </code> smbclient //sleeth/accounts -U alanm 596Password: XXXXXXX 597smb: \> dir 598 . D 0 Sun Nov 9 01:28:34 2003 599 .. D 0 Sat Aug 16 17:24:26 2003 600 .mc DH 0 Sat Nov 8 21:57:38 2003 601 .qt DH 0 Fri Sep 5 00:48:25 2003 602 SMB D 0 Sun Oct 19 23:04:30 2003 603 Documents D 0 Sat Nov 1 00:31:51 2003 604 xpsp1a_en_x86.exe 131170400 Sun Nov 2 01:25:44 2003 605 606 65387 blocks of size 65536. 28590 blocks available 607smb: \> q 608</pre><p> 609 </p></li></ol></div></div><div class="procedure"><a name="id323498"></a><p class="title"><b>Procedure�2.3.�Windows XP Professional Client Configuration</b></p><ol type="1"><li><p> 610 Configure clients to the network settings shown in <a href="small.html#acct2net" title="Figure�2.1.�Abmas Accounting 52-User Network Topology">???</a>. 611 All clients use DHCP for TCP/IP protocol stack configuration. 612 <a class="indexterm" name="id323516"></a> 613 <a class="indexterm" name="id323523"></a> 614 DHCP configures all Windows clients to use the WINS Server address <code class="constant">192.168.1.1</code>. 615 </p></li><li><p> 616 Join the Windows Domain called <code class="constant">BILLMORE</code>. Use the Domain Administrator 617 username <code class="constant">root</code> and the SMB password you assigned to this account. 618 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to 619 a Windows Domain is given in <a href="appendix.html" title="Chapter�15.�A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>. 620 Reboot the machine as prompted and then log on using a Domain User account. 621 </p></li><li><p> 622 Verify on each client that the machine called <code class="constant">SLEETH</code> 623 is visible in <span class="guimenu">My Network Places</span>, that it is 624 possible to connect to it and see the shares <span class="guimenuitem">accounts</span> 625 and <span class="guimenuitem">finsvcs</span>, 626 and that it is possible to open that share to reveal its contents. 627 </p></li><li><p> 628 Instruct all users to log onto the workstation using their assigned username and password. 629 </p></li><li><p> 630 Install a printer on each using the following steps: 631 </p><div class="procedure"><ol type="1"><li><p> 632 Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. 633 Ensure that <span class="guimenuitem">Local printer</span> is selected. 634 </p></li><li><p> 635 Click <span class="guibutton">Next</span>. In the 636 <span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>. 637 In the <span class="guimenuitem">Printers:</span> panel, select the printer called 638 <code class="constant">HP LaserJet 4</code>. Click <span class="guibutton">Next</span>. 639 </p></li><li><p> 640 In the <span class="guimenuitem">Available ports:</span> panel, select 641 <code class="constant">FILE:</code>. Accept the default printer name by clicking 642 <span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a 643 test page?</span>”, click <span class="guimenuitem">No</span>. Click 644 <span class="guibutton">Finish</span>. 645 </p></li><li><p> 646 You may be prompted for the name of a file to print to. If so, close the 647 dialog panel. Right-click <span class="guiicon">HP LaserJet 4</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>. 648 </p></li><li><p> 649 In the <span class="guimenuitem">Network</span> panel, enter the name of 650 the print queue on the Samba server as follows: <code class="constant">\\SERVER\hplj4</code>. 651 Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation. 652 </p></li><li><p> 653 Repeat the printer installation steps above for the HP LaserJet 6 printer 654 as well as for the QMS Magicolor XXXX laser printer. 655 </p></li></ol></div></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id323822"></a>Notebook Computers: A Special Case</h3></div></div></div><p> 656 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP 657 Professional systems. This is the preferred solution to provide continuity of work for notebook users 658 so that absence from the office network environment does not become a barrier to productivity. 659 </p><p> 660 By creating a local machine account that has the same username and password as you create for that 661 user in the Windows Domain environment, the user can log onto the machine locally and still 662 transparently access network resources as if logged onto the domain itself. There are some trade-offs 663 that mean that as the network is more tightly secured, it becomes necessary to modify Windows client 664 configuration somewhat. 665 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id323841"></a>Key Points Learned</h3></div></div></div><p> 666 In this network design and implementation exercise, you created a Windows NT4-style Domain 667 Controller using Samba-3.0.20. Following these guidelines, you experienced 668 and implemented several important aspects of Windows networking. In the next chapter, 669 you build on the experience. These are the highlights from this chapter: 670 </p><div class="itemizedlist"><ul type="disc"><li><p> 671 <a class="indexterm" name="id323858"></a> 672 You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary 673 network configuration settings from this server. 674 </p></li><li><p> 675 <a class="indexterm" name="id323871"></a> 676 You created a Windows Domain Controller. You were able to use the network logon service 677 and successfully joined Windows 200x/XP Professional clients to the Domain. 678 </p></li><li><p> 679 <a class="indexterm" name="id323883"></a> 680 You created raw print queues in the CUPS printing system. You maintained a simple 681 printing system so that all users can share centrally managed printers. You installed 682 native printer drivers on the Windows clients. 683 </p></li><li><p> 684 You experienced the benefits of centrally managed user accounts on the server. 685 </p></li><li><p> 686 You offered Mobile notebook users a solution that allows them to continue to work 687 while away from the office and not connected to the corporate network. 688 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id323907"></a>Questions and Answers</h2></div></div></div><p> 689 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that 690 may help. 691 </p><div class="qandaset"><dl><dt>1. <a href="small.html#id323919"> 692 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 693 </a></dt><dt>2. <a href="small.html#id323941"> 694 Are there any DHCP server configuration parameters in the /etc/dhcpd.conf 695 that should be noted in particular? 696 </a></dt><dt>3. <a href="small.html#id323968"> 697 Is it possible to create a Windows Domain account that is specifically called Administrator? 698 </a></dt><dt>4. <a href="small.html#id324004"> 699 Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0? 700 </a></dt><dt>5. <a href="small.html#id324039"> 701 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 702 root access. How can we do this? 703 </a></dt><dt>6. <a href="small.html#id324077"> 704 Why must I map Windows Domain Groups to UNIX groups? 705 </a></dt><dt>7. <a href="small.html#id324114"> 706 I deleted my root account and now I cannot add it back! What can I do? 707 </a></dt><dt>8. <a href="small.html#id324184"> 708 When I run net groupmap list, it reports a group called Administrators 709 as well as Domain Admins. What is the difference between them? 710 </a></dt><dt>9. <a href="small.html#id324228"> 711 What is the effect of changing the name of a Samba server or of changing the Domain name? 712 </a></dt><dt>10. <a href="small.html#id324272"> 713 How can I manage user accounts from my Windows XP Professional workstation? 714 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id323919"></a><a name="id323922"></a><b>1.</b></td><td align="left" valign="top"><p> 715 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 716 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 717 First and foremost, portability. It means that notebook users can move between 718 the Abmas office and client offices (so long as they, too, use DHCP) without having to manually 719 reconfigure their machines. It also means that when they work from their home environments 720 either using DHCP assigned addressing or when using dial-up networking, settings such as 721 default routes and DNS server addresses that apply only to the Abmas office environment do 722 not interfere with remote operations. This is an extremely important feature of DHCP. 723 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id323941"></a><a name="id323943"></a><b>2.</b></td><td align="left" valign="top"><p> 724 Are there any DHCP server configuration parameters in the <code class="filename">/etc/dhcpd.conf</code> 725 that should be noted in particular? 726 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 727 Yes. The configuration you created automatically provides each client with the IP address 728 of your WINS server. It also configures the client to preferentially register NetBIOS names 729 with the WINS server, and then instructs the client to first query the WINS server when a 730 NetBIOS machine name needs to be resolved to an IP Address. This configuration 731 results in far lower UDP broadcast traffic than would be the case if WINS was not used. 732 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id323968"></a><a name="id323970"></a><b>3.</b></td><td align="left" valign="top"><p> 733 Is it possible to create a Windows Domain account that is specifically called <code class="constant">Administrator</code>? 734 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 735 You can surely create a Windows Domain account called <code class="constant">Administrator</code>. It is also 736 possible to map that account so that it has the effective UNIX UID of 0. This way it isn't 737 necessary to use the <em class="parameter"><code>username map</code></em> facility to map this account to the UNIX 738 account called <code class="constant">root</code>. 739 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id324004"></a><a name="id324006"></a><b>4.</b></td><td align="left" valign="top"><p> 740 Why is it necessary to give the Windows Domain <code class="constant">Administrator</code> a UNIX UID of 0? 741 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 742 The Windows Domain <code class="constant">Administrator</code> account is the most privileged account that 743 exists on the Windows platform. This user can change any setting, add, delete, or modify user 744 accounts, and completely reconfigure the system. The equivalent to this account in the UNIX 745 environment is the <code class="constant">root</code> account. If you want to permit the Windows Domain 746 Administrator to manage accounts as well as permissions, privileges, and security 747 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is 748 achieved with the <code class="constant">root</code> UID equal to 0. 749 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id324039"></a><a name="id324042"></a><b>5.</b></td><td align="left" valign="top"><p> 750 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 751 <code class="constant">root</code> access. How can we do this? 752 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 753 Users who are members of the <code class="constant">Domain Admins</code> group can add machines to the 754 Domain. This group is mapped to the UNIX group account called <code class="constant">root</code> 755 (or the equivalent <code class="constant">wheel</code> on some UNIX systems) that has a GID of 0. 756 This must be the primary GID of the account of the user who is a member of the Windows <code class="constant"> 757 Domain Admins</code> account. 758 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id324077"></a><a name="id324079"></a><b>6.</b></td><td align="left" valign="top"><p> 759 Why must I map Windows Domain Groups to UNIX groups? 760 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 761 Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account 762 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are 763 <span class="guimenu">Domain Guests</span>, <span class="guimenu">Domain Users</span>, and <span class="guimenu">Domain Admins</span>. 764 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id324114"></a><a name="id324116"></a><b>7.</b></td><td align="left" valign="top"><p> 765 I deleted my <code class="constant">root</code> account and now I cannot add it back! What can I do? 766 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 767 This is a nasty problem. Fortunately, there is a solution. 768 </p><div class="procedure"><ol type="1"><li><p> 769 Back up your existing configuration files in case you need to restore them. 770 </p></li><li><p> 771 Rename the <code class="filename">group_mapping.tdb</code> file. 772 </p></li><li><p> 773 Use the <code class="literal">smbpasswd</code> to add the root account. 774 </p></li><li><p> 775 Restore the <code class="filename">group_mapping.tdb</code> file. 776 </p></li></ol></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id324184"></a><a name="id324186"></a><b>8.</b></td><td align="left" valign="top"><p> 777 When I run <code class="literal">net groupmap list</code>, it reports a group called <span class="guimenu">Administrators</span> 778 as well as <span class="guimenu">Domain Admins</span>. What is the difference between them? 779 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 780 The group called <span class="guimenu">Administrators</span> is representative of the same account that would be 781 present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain 782 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This 783 may change at some later date. These accounts are provided only so that security objects are correctly shown. 784 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id324228"></a><a name="id324230"></a><b>9.</b></td><td align="left" valign="top"><p> 785 What is the effect of changing the name of a Samba server or of changing the Domain name? 786 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 787 If you elect to change the name of the Samba server, on restarting <code class="literal">smbd</code>, 788 Windows security identifiers are changed. In the case of a standalone server or a Domain Member server, 789 the machine SID is changed. This may break Domain membership. In the case of a change of the Domain name 790 (Workgroup name), the Domain SID is changed. This affects all Domain memberships. 791 </p><p> 792 If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective 793 SID before the change is made. You can back up the SID using the <code class="literal">net getlocalsid</code> (Samba-3) 794 or the <code class="literal">smbpasswd</code> (Samba-2.2.x). To change the SID, you use the same tool. Be sure 795 to check the man page for this command for detailed instructions regarding the steps involved. 796 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id324272"></a><a name="id324274"></a><b>10.</b></td><td align="left" valign="top"><p> 797 How can I manage user accounts from my Windows XP Professional workstation? 798 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 799 Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot 800 be managed using tools present on a Windows XP Professional installation. You may download from the 801 Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use 802 it. This package extracts the tools: <code class="literal">User Manager for Domains</code>, <code class="literal">Server Manager</code>, and <code class="literal">Event 803 Viewer</code>. You may use the <span class="guimenu">User Manager for Domains</span> to manage your Samba-3 804 Domain user and group accounts. Of course, you do need to be logged on as the <code class="constant">Administrator</code> 805 for the Samba-3 Domain. It may help to log on as the <code class="constant">root</code> account. 806 </p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="simple.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="secure.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�1.�No-Frills Samba Servers�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�3.�Secure Office Networking</td></tr></table></div></body></html> 807
