1<?xml version="1.0" encoding="iso-8859-1"?> 2<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3<chapter id="Big500users"> 4 <title>The 500-User Office</title> 5 6 <para> 7 The Samba-3 networking you explored in <link linkend="secure"/> covers the finer points of 8 configuration of peripheral services such as DHCP and DNS, and WINS. You experienced 9 implementation of a simple configuration of the services that are important adjuncts 10 to successful deployment of Samba. 11 </para> 12 13 <para> 14 An analysis of the history of postings to the Samba mailing list easily demonstrates 15 that the two most prevalent Samba problem areas are 16 </para> 17 18 <itemizedlist> 19 <listitem><para> 20 Defective resolution of a NetBIOS name to its IP address 21 </para></listitem> 22 23 <listitem><para> 24 Printing problems 25 </para></listitem> 26 27 </itemizedlist> 28 29 <para> 30 The exercises 31 so far in this book have focused on implementation of the simplest printing processes 32 involving no print job processing intelligence. In this chapter, you maintain 33 that same approach to printing, but <link linkend="happy"/> presents an opportunity 34 to make printing more complex for the administrator while making it easier for the user. 35 </para> 36 37 <para> 38 <indexterm><primary>WINS server</primary></indexterm> 39 <indexterm><primary>tdbsam</primary></indexterm> 40 <indexterm><primary>passdb backend</primary></indexterm> 41 <link linkend="secure"/> demonstrates operation of a DHCP server and a DNS server 42 as well as a central WINS server. You validated the operation of these services and 43 saw an effective implementation of a Samba domain controller using the 44 <parameter>tdbsam</parameter> passdb backend. 45 </para> 46 47 <para> 48 The objective of this chapter is to introduce more complex techniques that can be used to 49 improve manageability of Samba as networking needs grow. In this chapter, you implement 50 a distributed DHCP server environment, a distributed DNS server arrangement, a centralized 51 WINS server, and a centralized Samba domain controller. 52 </para> 53 54 <para> 55 A note of caution is important regarding the Samba configuration that is used in this 56 chapter. The use of a single domain controller on a routed, multisegment network is 57 a poor design choice that leads to potential network user complaints. 58 This chapter demonstrates some successful 59 techniques in deployment and configuration management. This should be viewed as a 60 foundation chapter for complex Samba deployments. 61 </para> 62 63 <para> 64 As you master the techniques presented here, you may find much better methods to 65 improve network management and control while reducing human resource overheads. 66 You should take the opportunity to innovate and expand on the methods presented 67 here and explore them to the fullest. 68 </para> 69 70<sect1> 71 <title>Introduction</title> 72 73 <para> 74 Business continues to go well for Abmas. Mr. Meany is driving your success and the 75 network continues to grow thanks to the hard work Christine has done. You recently 76 hired Stanley Soroka as manager of information systems. Christine recommended Stan 77 to the role. She told you Stan is so good at handling Samba that he can make a cast 78 iron rocking horse that is embedded in concrete kick like a horse at a rodeo. You 79 need skills like his. Christine and Stan get along just fine. Let's see what 80 you can get out of this pair as they plot the next-generation networks. 81 </para> 82 83 <para> 84 Ten months ago Abmas closed an acquisition of a property insurance business. The 85 founder lost interest in the business and decided to sell it to Mr. Meany. Because 86 they were former university classmates, the purchase was concluded with mutual assent. 87 The acquired business is located at the other end of town in much larger facilities. 88 The old Abmas building has become too small. Located on the same campus as the newly 89 acquired business are two empty buildings that are ideal to provide Abmas with 90 opportunity for growth. 91 </para> 92 93 <para> 94 Abmas has now completed the purchase of the two empty buildings, and you are 95 to install a new network and relocate staff in nicely furnished new facilities. 96 The new network is to be used to fully integrate company operations. You have 97 decided to locate the new network operations control center in the larger building 98 in which the insurance group is located to take advantage of an ideal floor space 99 and to allow Stan and Christine to fully stage the new network and test it before 100 it is rolled out. Your strategy is to complete the new network so that it 101 is ready for operation when the old office moves into the new premises. 102 </para> 103 104 <sect2> 105 <title>Assignment Tasks</title> 106 107 <para> 108 The acquired business had 280 network users. The old Abmas building housed 109 220 network users in unbelievably cramped conditions. The network that 110 initially served 130 users now handles 220 users quite well. 111 </para> 112 113 <para> 114 The two businesses will be fully merged to create a single campus company. 115 The Property Insurance Group (PIG) houses 300 employees, the new Accounting 116 Services Group (ASG) will be in a small building (BLDG1) that houses 50 117 employees, and the Financial Services Group (FSG) will be housed in a large 118 building that has capacity for growth (BLDG2). Building 2 houses 150 network 119 users. 120 </para> 121 122 <para> 123 You have decided to connect the building using fiber optic links between new 124 routers. As a backup, the buildings are interconnected using line-of-sight 125 high-speed infrared facilities. The infrared connection provides a 126 secondary route to be used during periods of high demand for network 127 bandwidth. 128 </para> 129 130 <para> 131 The Internet gateway is upgraded to 15 Mb/sec service. Your ISP 132 provides on your premises a fully managed Cisco PIX firewall. You no longer need 133 to worry about firewall facilities on your network. 134 </para> 135 136 <para> 137 Stanley and Christine have purchased new server hardware. Christine wants to 138 roll out a network that has whistles and bells. Stan wants to start off with 139 a simple to manage, not-too-complex network. He believes that network 140 users need to be gradually introduced to new features and capabilities and not 141 rushed into an environment that may cause disorientation and loss of productivity. 142 </para> 143 144 <para> 145 Your intrepid network team has decided to implement a network configuration 146 that closely mirrors the successful system you installed in the old Abmas building. 147 The new network infrastructure is owned by Abmas, but all desktop systems 148 are being procured through a new out-source services and leasing company. Under 149 the terms of a deal with Mr. M. Proper (CEO), DirectPointe, Inc., provides 150 all desktop systems and includes full level-one help desk support for 151 a flat per-machine monthly fee. The deal allows you to add workstations on demand. 152 This frees Stan and Christine to deal with deeper issues as they emerge and 153 permits Stan to work on creating new future value-added services. 154 </para> 155 156 <para> 157 DirectPointe Inc. receives from you a new standard desktop configuration 158 every four months. They automatically roll that out to each desktop system. 159 You must keep DirectPointe informed of all changes. 160 </para> 161 162 <para><indexterm> 163 <primary>PDC</primary> 164 </indexterm> 165 The new network has a single Samba Primary Domain Controller (PDC) located in the 166 Network Operation Center (NOC). Buildings 1 and 2 each have a local server 167 for local application servicing. It is a domain member. The new system 168 uses the <parameter>tdbsam</parameter> passdb backend. 169 </para> 170 171 <para> 172 Printing is based on raw pass-through facilities just as it has been used so far. 173 All printer drivers are installed on the desktop and notebook computers. 174 </para> 175 176 </sect2> 177</sect1> 178 179<sect1> 180 <title>Dissection and Discussion</title> 181 182 <para> 183 <indexterm><primary>network load factors</primary></indexterm> 184 The example you are building in this chapter is of a network design that works, but this 185 does not make it a design that is recommended. As a general rule, there should be at least 186 one Backup Domain Controller (BDC) per 150 Windows network clients. The principle behind 187 this recommendation is that correct operation of MS Windows clients requires rapid 188 network response to all SMB/CIFS requests. The same rule says that if there are more than 189 50 clients per domain controller, they are too busy to service requests. Let's put such 190 rules aside and recognize that network load affects the integrity of domain controller 191 responsiveness. This network will have 500 clients serviced by one central domain 192 controller. This is not a good omen for user satisfaction. You, of course, address this 193 very soon (see <link linkend="happy"/>). 194 </para> 195 196 <sect2> 197 <title>Technical Issues</title> 198 199 <para> 200 Stan has talked you into a horrible compromise, but it is addressed. Just make 201 certain that the performance of this network is well validated before going live. 202 </para> 203 204 <para> 205 Design decisions made in this design include the following: 206 </para> 207 208 <itemizedlist> 209 <listitem><para> 210 <indexterm><primary>PDC</primary></indexterm> 211 <indexterm><primary>LDAP</primary></indexterm> 212 <indexterm><primary>identity management</primary></indexterm> 213 A single PDC is being implemented. This limitation is based on the choice not to 214 use LDAP. Many network administrators fear using LDAP because of the perceived 215 complexity of implementation and management of an LDAP-based backend for all user 216 identity management as well as to store network access credentials. 217 </para></listitem> 218 219 <listitem><para> 220 <indexterm><primary>BDC</primary></indexterm> 221 <indexterm><primary>machine secret password</primary></indexterm> 222 Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the 223 only choice that makes sense with 500 users is to use the tdbsam passwd backend. 224 This type of backend is not receptive to replication to BDCs. If the tdbsam 225 <filename>passdb.tdb</filename> file is replicated to BDCs using 226 <command>rsync</command>, there are two potential problems: (1) data that is in 227 memory but not yet written to disk will not be replicated, and (2) domain member 228 machines periodically change the secret machine password. When this happens, there 229 is no mechanism to return the changed password to the PDC. 230 </para></listitem> 231 232 <listitem><para> 233 All domain user, group, and machine accounts are managed on the PDC. This makes 234 for a simple mode of operation but has to be balanced with network performance and 235 integrity of operations considerations. 236 </para></listitem> 237 238 <listitem><para> 239 <indexterm><primary>WINS</primary></indexterm> 240 A single central WINS server is being used. The PDC is also the WINS server. 241 Any attempt to operate a routed network without a WINS server while using NetBIOS 242 over TCP/IP protocols does not work unless on each client the name resolution 243 entries for the PDC are added to the <filename>LMHOSTS</filename>. This file is 244 normally located on the Windows XP Professional client in the 245 <filename>C:\WINDOWS\SYSTEM32\ETC\DRIVERS</filename> directory. 246 </para></listitem> 247 248 <listitem><para> 249 At this time the Samba WINS database cannot be replicated. That is 250 why a single WINS server is being implemented. This should work without a problem. 251 </para></listitem> 252 253 <listitem><para> 254 <indexterm><primary>winbindd</primary></indexterm> 255 BDCs make use of <command>winbindd</command> to provide 256 access to domain security credentials for file system access and object storage. 257 </para></listitem> 258 259 <listitem><para> 260 <indexterm><primary>DHCP</primary><secondary>relay</secondary></indexterm> 261 <indexterm><primary>DHCP</primary><secondary>requests</secondary></indexterm> 262 Configuration of Windows XP Professional clients is achieved using DHCP. Each 263 subnet has its own DHCP server. Backup DHCP serving is provided by one 264 alternate DHCP server. This necessitates enabling of the DHCP Relay agent on 265 all routers. The DHCP Relay agent must be programmed to pass DHCP Requests from the 266 network directed at the backup DHCP server. 267 </para></listitem> 268 269 <listitem><para> 270 All network users are granted the ability to print to any printer that is 271 network-attached. All printers are available from each server. Print jobs that 272 are spooled to a printer that is not on the local network segment are automatically 273 routed to the print spooler that is in control of that printer. The specific details 274 of how this might be done are demonstrated for one example only. 275 </para></listitem> 276 277 <listitem><para> 278 The network address and subnetmask chosen provide 1022 usable IP addresses in 279 each subnet. If in the future more addresses are required, it would make sense 280 to add further subnets rather than change addressing. 281 </para></listitem> 282 283 </itemizedlist> 284 285 </sect2> 286 287 288 <sect2> 289 <title>Political Issues</title> 290 291 <para> 292 This case gets close to the real world. You and I know the right way to implement 293 domain control. Politically, we have to navigate a minefield. In this case, the need is to 294 get the PDC rolled out in compliance with expectations and also to be ready to save the day 295 by having the real solution ready before it is needed. That real solution is presented in 296 <link linkend="happy"/>. 297 </para> 298 299 </sect2> 300 301</sect1> 302 303<sect1> 304 <title>Implementation</title> 305 306 <para> 307 The following configuration process begins following installation of Red Hat Fedora Core2 on the 308 three servers shown in the network topology diagram in <link linkend="chap05net"/>. You have 309 selected hardware that is appropriate to the task. 310 </para> 311 312 <figure id="chap05net"> 313 <title>Network Topology &smbmdash; 500 User Network Using tdbsam passdb backend.</title> 314 <imagefile scale="50">chap5-net</imagefile> 315 </figure> 316 317 <sect2 id="ch5-dnshcp-setup"> 318 <title>Installation of DHCP, DNS, and Samba Control Files</title> 319 320 <para> 321 Carefully install the configuration files into the correct locations as shown in 322 <link linkend="ch5-filelocations"/>. You should validate that the full file path is 323 correct as shown. 324 </para> 325 326 <para> 327 The abbreviation shown in this table as <constant>{VLN}</constant> refers to 328 the directory location beginning with <filename>/var/lib/named</filename>. 329 </para> 330 331 332 <table id="ch5-filelocations"><title>Domain: <constant>MEGANET</constant>, File Locations for Servers</title> 333 <tgroup cols="5"> 334 <colspec colname='c1' align="left"/> 335 <colspec colname='c2' align="left"/> 336 <colspec colname='c3' align="center"/> 337 <colspec colname='c4' align="center"/> 338 <colspec colname='c5' align="center"/> 339 <thead> 340 <row> 341 <entry align="center" namest='c1' nameend='c2'>File Information</entry> 342 <entry align="center" namest="c3" nameend="c5">Server Name</entry> 343 </row> 344 <row> 345 <entry align="center">Source</entry> 346 <entry align="center">Target Location</entry> 347 <entry align="center">MASSIVE</entry> 348 <entry align="center">BLDG1</entry> 349 <entry align="center">BLDG2</entry> 350 </row> 351 </thead> 352 <tbody> 353 <row> 354 <entry><link linkend="ch5-massivesmb"/></entry> 355 <entry><filename>/etc/samba/smb.conf</filename></entry> 356 <entry>Yes</entry> 357 <entry>No</entry> 358 <entry>No</entry> 359 </row> 360 <row> 361 <entry><link linkend="ch5-dc-common"/></entry> 362 <entry><filename>/etc/samba/dc-common.conf</filename></entry> 363 <entry>Yes</entry> 364 <entry>No</entry> 365 <entry>No</entry> 366 </row> 367 <row> 368 <entry><link linkend="ch5-commonsmb"/></entry> 369 <entry><filename>/etc/samba/common.conf</filename></entry> 370 <entry>Yes</entry> 371 <entry>Yes</entry> 372 <entry>Yes</entry> 373 </row> 374 <row> 375 <entry><link linkend="ch5-bldg1-smb"/></entry> 376 <entry><filename>/etc/samba/smb.conf</filename></entry> 377 <entry>No</entry> 378 <entry>Yes</entry> 379 <entry>No</entry> 380 </row> 381 <row> 382 <entry><link linkend="ch5-bldg2-smb"/></entry> 383 <entry><filename>/etc/samba/smb.conf</filename></entry> 384 <entry>No</entry> 385 <entry>No</entry> 386 <entry>Yes</entry> 387 </row> 388 <row> 389 <entry><link linkend="ch5-dommem-smb"/></entry> 390 <entry><filename>/etc/samba/dommem.conf</filename></entry> 391 <entry>No</entry> 392 <entry>Yes</entry> 393 <entry>Yes</entry> 394 </row> 395 <row> 396 <entry><link linkend="massive-dhcp"/></entry> 397 <entry><filename>/etc/dhcpd.conf</filename></entry> 398 <entry>Yes</entry> 399 <entry>No</entry> 400 <entry>No</entry> 401 </row> 402 <row> 403 <entry><link linkend="bldg1dhcp"/></entry> 404 <entry><filename>/etc/dhcpd.conf</filename></entry> 405 <entry>No</entry> 406 <entry>Yes</entry> 407 <entry>No</entry> 408 </row> 409 <row> 410 <entry><link linkend="bldg2dhcp"/></entry> 411 <entry><filename>/etc/dhcpd.conf</filename></entry> 412 <entry>No</entry> 413 <entry>No</entry> 414 <entry>Yes</entry> 415 </row> 416 <row> 417 <entry><link linkend="massive-nameda"/></entry> 418 <entry><filename>/etc/named.conf (part A)</filename></entry> 419 <entry>Yes</entry> 420 <entry>No</entry> 421 <entry>No</entry> 422 </row> 423 <row> 424 <entry><link linkend="massive-namedb"/></entry> 425 <entry><filename>/etc/named.conf (part B)</filename></entry> 426 <entry>Yes</entry> 427 <entry>No</entry> 428 <entry>No</entry> 429 </row> 430 <row> 431 <entry><link linkend="massive-namedc"/></entry> 432 <entry><filename>/etc/named.conf (part C)</filename></entry> 433 <entry>Yes</entry> 434 <entry>No</entry> 435 <entry>No</entry> 436 </row> 437 <row> 438 <entry><link linkend="abmasbizdns"/></entry> 439 <entry><filename>{VLN}/master/abmas.biz.hosts</filename></entry> 440 <entry>Yes</entry> 441 <entry>No</entry> 442 <entry>No</entry> 443 </row> 444 <row> 445 <entry><link linkend="abmasusdns"/></entry> 446 <entry><filename>{VLN}/master/abmas.us.hosts</filename></entry> 447 <entry>Yes</entry> 448 <entry>No</entry> 449 <entry>No</entry> 450 </row> 451 <row> 452 <entry><link linkend="bldg12nameda"/></entry> 453 <entry><filename>/etc/named.conf (part A)</filename></entry> 454 <entry>No</entry> 455 <entry>Yes</entry> 456 <entry>Yes</entry> 457 </row> 458 <row> 459 <entry><link linkend="bldg12namedb"/></entry> 460 <entry><filename>/etc/named.conf (part B)</filename></entry> 461 <entry>No</entry> 462 <entry>Yes</entry> 463 <entry>Yes</entry> 464 </row> 465 <row> 466 <entry><link linkend="loopback"/></entry> 467 <entry><filename>{VLN}/localhost.zone</filename></entry> 468 <entry>Yes</entry> 469 <entry>Yes</entry> 470 <entry>Yes</entry> 471 </row> 472 <row> 473 <entry><link linkend="dnsloopy"/></entry> 474 <entry><filename>{VLN}/127.0.0.zone</filename></entry> 475 <entry>Yes</entry> 476 <entry>Yes</entry> 477 <entry>Yes</entry> 478 </row> 479 <row> 480 <entry><link linkend="roothint"/></entry> 481 <entry><filename>{VLN}/root.hint</filename></entry> 482 <entry>Yes</entry> 483 <entry>Yes</entry> 484 <entry>Yes</entry> 485 </row> 486 </tbody> 487 </tgroup> 488 </table> 489 490 </sect2> 491 492 <sect2> 493 <title>Server Preparation: All Servers</title> 494 495 <para> 496 The following steps apply to all servers. Follow each step carefully. 497 </para> 498 499 <procedure> 500 <title>Server Preparation Steps</title> 501 502 <step><para> 503 Using the UNIX/Linux system tools, set the name of the server as shown in the network 504 topology diagram in <link linkend="chap05net"/>. For SUSE Linux products, the tool 505 that permits this is called <command>yast2</command>; for Red Hat Linux products, 506 you can use the <command>netcfg</command> tool. 507 Verify that your hostname is correctly set by running: 508<screen> 509&rootprompt; uname -n 510</screen> 511 An alternate method to verify the hostname is: 512<screen> 513&rootprompt; hostname -f 514</screen> 515 </para></step> 516 517 <step><para> 518 <indexterm><primary>/etc/hosts</primary></indexterm> 519 <indexterm><primary>named</primary></indexterm> 520 Edit your <filename>/etc/hosts</filename> file to include the primary names and addresses 521 of all network interfaces that are on the host server. This is necessary so that during 522 startup the system is able to resolve all its own names to the IP address prior to 523 startup of the DNS server. You should check the startup order of your system. If the 524 CUPS print server is started before the DNS server (<command>named</command>), you 525 should also include an entry for the printers in the <filename>/etc/hosts</filename> file. 526 </para></step> 527 528 <step><para> 529 <indexterm><primary>/etc/resolv.conf</primary></indexterm> 530 All DNS name resolution should be handled locally. To ensure that the server is configured 531 correctly to handle this, edit <filename>/etc/resolv.conf</filename> so it has the following 532 content: 533<screen> 534search abmas.us abmas.biz 535nameserver 127.0.0.1 536</screen> 537 This instructs the name resolver function (when configured correctly) to ask the DNS server 538 that is running locally to resolve names to addresses. 539 </para></step> 540 541 542 <step><para> 543 <indexterm><primary>administrator</primary></indexterm> 544 <indexterm><primary>smbpasswd</primary></indexterm> 545 Add the <constant>root</constant> user to the password backend: 546<screen> 547&rootprompt; smbpasswd -a root 548New SMB password: XXXXXXXX 549Retype new SMB password: XXXXXXXX 550&rootprompt; 551</screen> 552 The <constant>root</constant> account is the UNIX equivalent of the Windows domain administrator. 553 This account is essential in the regular maintenance of your Samba server. It must never be 554 deleted. If for any reason the account is deleted, you may not be able to recreate this account 555 without considerable trouble. 556 </para></step> 557 558 <step><para> 559 <indexterm><primary>username map</primary></indexterm> 560 <indexterm><primary>/etc/samba/smbusers</primary></indexterm> 561 Create the username map file to permit the <constant>root</constant> account to be called 562 <constant>Administrator</constant> from the Windows network environment. To do this, create 563 the file <filename>/etc/samba/smbusers</filename> with the following contents: 564<screen> 565#### 566# User mapping file 567#### 568# File Format 569# ----------- 570# Unix_ID = Windows_ID 571# 572# Examples: 573# root = Administrator 574# janes = "Jane Smith" 575# jimbo = Jim Bones 576# 577# Note: If the name contains a space it must be double quoted. 578# In the example above the name 'jimbo' will be mapped to Windows 579# user names 'Jim' and 'Bones' because the space was not quoted. 580####################################################################### 581root = Administrator 582#### 583# End of File 584#### 585</screen> 586 </para></step> 587 588 <step><para> 589 Configure all network-attached printers to have a fixed IP address. 590 </para></step> 591 592 <step><para> 593 Create an entry in the DNS database on the server <constant>MASSIVE</constant> 594 in both the forward lookup database for the zone <constant>abmas.biz.hosts</constant> 595 and in the reverse lookup database for the network segment that the printer is 596 located in. Example configuration files for similar zones were presented in <link linkend="secure"/>, 597 <link linkend="abmasbiz"/> and <link linkend="eth2zone"/>. 598 </para></step> 599 600 <step><para> 601 Follow the instructions in the printer manufacturer's manuals to permit printing 602 to port 9100. Use any other port the manufacturer specifies for direct mode, 603 raw printing. This allows the CUPS spooler to print using raw mode protocols. 604 <indexterm><primary>CUPS</primary></indexterm> 605 <indexterm><primary>raw printing</primary></indexterm> 606 </para></step> 607 608 <step><para> 609 <indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm> 610 Only on the server to which the printer is attached configure the CUPS Print 611 Queues as follows: 612<screen> 613&rootprompt; lpadmin -p <parameter>printque</parameter> -v socket://<parameter>printer-name</parameter>.abmas.biz:9100 -E 614</screen> 615 <indexterm><primary>print filter</primary></indexterm> 616 This step creates the necessary print queue to use no assigned print filter. This 617 is ideal for raw printing, that is, printing without use of filters. 618 The name <parameter>printque</parameter> is the name you have assigned for 619 the particular printer. 620 </para></step> 621 622 <step><para> 623 Print queues may not be enabled at creation. Make certain that the queues 624 you have just created are enabled by executing the following: 625<screen> 626&rootprompt; /usr/bin/enable <parameter>printque</parameter> 627</screen> 628 </para></step> 629 630 <step><para> 631 Even though your print queue may be enabled, it is still possible that it 632 does not accept print jobs. A print queue services incoming printing 633 requests only when configured to do so. Ensure that your print queue is 634 set to accept incoming jobs by executing the following command: 635<screen> 636&rootprompt; /usr/bin/accept <parameter>printque</parameter> 637</screen> 638 </para></step> 639 640 <step><para> 641 <indexterm><primary>mime type</primary></indexterm> 642 <indexterm><primary>/etc/mime.convs</primary></indexterm> 643 <indexterm><primary>application/octet-stream</primary></indexterm> 644 This step, as well as the next one, may be omitted where CUPS version 1.1.18 645 or later is in use. Although it does no harm to follow it anyway, and may 646 help to avoid time spent later trying to figure out why print jobs may be 647 disappearing without a trace. Look at these two steps as <emphasis>insurance</emphasis> 648 against lost time. Edit file <filename>/etc/cups/mime.convs</filename> to 649 uncomment the line: 650<screen> 651application/octet-stream application/vnd.cups-raw 0 - 652</screen> 653 </para></step> 654 655 <step><para> 656 <indexterm><primary>/etc/mime.types</primary></indexterm> 657 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line: 658<screen> 659application/octet-stream 660</screen> 661 </para></step> 662 663 <step><para> 664 Refer to the CUPS printing manual for instructions regarding how to configure 665 CUPS so that print queues that reside on CUPS servers on remote networks 666 route print jobs to the print server that owns that queue. The default setting 667 on your CUPS server may automatically discover remotely installed printers and 668 may permit this functionality without requiring specific configuration. 669 </para></step> 670 671 <step><para> 672 As part of the roll-out program, you need to configure the application's 673 server shares. This can be done once on the central server and may then be 674 replicated using a tool such as <command>rsync</command>. Refer to the man 675 page for <command>rsync</command> for details regarding use. The notes in 676 <link linkend="ch4appscfg"/> may help in your decisions to use an application 677 server facility. 678 </para></step> 679 680 </procedure> 681 682 <note><para> 683 Logon scripts that are run from a domain controller (PDC or BDC) are capable of using semi-intelligent 684 processes to automap Windows client drives to an application server that is nearest to the client. This 685 is considerably more difficult when a single PDC is used on a routed network. It can be done, but not 686 as elegantly as you see in the next chapter. 687 </para></note> 688 689 </sect2> 690 691 <sect2> 692 <title>Server-Specific Preparation</title> 693 694 <para> 695 There are some steps that apply to particular server functionality only. Each step is critical 696 to correct server operation. The following step-by-step installation guidance will assist you 697 in working through the process of configuring the PDC and then both BDC's. 698 </para> 699 700 <sect3> 701 <title>Configuration for Server: <constant>MASSIVE</constant></title> 702 703 <para> 704 The steps presented here attempt to implement Samba installation in a generic manner. While 705 some steps are clearly specific to Linux, it should not be too difficult to apply them to 706 your platform of choice. 707 </para> 708 709 <procedure> 710 <title>Primary Domain Controller Preparation</title> 711 712 <step><para> 713 <indexterm><primary>/etc/rc.d/boot.local</primary></indexterm> 714 <indexterm><primary>IP forwarding</primary></indexterm> 715 The host server acts as a router between the two internal network segments as well 716 as for all Internet access. This necessitates that IP forwarding be enabled. This can be 717 achieved by adding to the <filename>/etc/rc.d/boot.local</filename> an entry as follows: 718<screen> 719echo 1 > /proc/sys/net/ipv4/ip_forward 720</screen> 721 To ensure that your kernel is capable of IP forwarding during configuration, you may wish to execute 722 that command manually also. This setting permits the Linux system to act as a router. 723 </para></step> 724 725 <step><para> 726 This server is dual hosted (i.e., has two network interfaces) &smbmdash; one goes to the Internet 727 and the other to a local network that has a router that is the gateway to the remote networks. 728 You must therefore configure the server with route table entries so that it can find machines 729 on the remote networks. You can do this using the appropriate system tools for your Linux 730 server or using static entries that you place in one of the system startup files. It is best 731 to always use the tools that the operating system vendor provided. In the case of SUSE Linux, the 732 best tool to do this is YaST (refer to SUSE Administration Manual); in the case of Red Hat, 733 this is best done using the graphical system configuration tools (see the Red Hat documentation). 734 An example of how this may be done manually is as follows: 735<screen> 736&rootprompt; route add net 172.16.4.0 netmask 255.255.252.0 gw 172.16.0.128 737&rootprompt; route add net 172.16.8.0 netmask 255.255.252.0 gw 172.16.0.128 738</screen> 739 If you just execute these commands manually, the route table entries you have created are 740 not persistent across system reboots. You may add these commands directly to the local 741 startup files as follows: (SUSE) <filename>/etc/rc.d/boot.local</filename>, (Red Hat) 742 <filename>/etc/rc.d/init.d/rc.local</filename>. 743 </para></step> 744 745 <step><para> 746 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm> 747 The final step that must be completed is to edit the <filename>/etc/nsswitch.conf</filename> file. 748 This file controls the operation of the various resolver libraries that are part of the Linux 749 Glibc libraries. Edit this file so that it contains the following entries: 750<screen> 751hosts: files dns wins 752</screen> 753 </para></step> 754 755 <step><para> 756 <indexterm><primary>initGrps.sh</primary></indexterm> 757 Create and map Windows domain groups to UNIX groups. A sample script is provided in 758 <link linkend="ch5-initgrps"/>. Create a file containing this script. You called yours 759 <filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed 760 and then execute the script. An example of the execution of this script as well as its 761 validation are shown in Section 4.3.2, Step 5. 762 </para></step> 763 764 <step><para> 765 <indexterm><primary>/etc/passwd</primary></indexterm> 766 <indexterm><primary>password</primary><secondary>backend</secondary></indexterm> 767 <indexterm><primary>smbpasswd</primary></indexterm> 768 For each user who needs to be given a Windows domain account, make an entry in the 769 <filename>/etc/passwd</filename> file as well as in the Samba password backend. 770 Use the system tool of your choice to create the UNIX system account, and use the Samba 771 <command>smbpasswd</command> to create a domain user account. 772 </para> 773 774 <para> 775 <indexterm><primary>useradd</primary></indexterm> 776 <indexterm><primary>adduser</primary></indexterm> 777 <indexterm><primary>user</primary><secondary>management</secondary></indexterm> 778 There are a number of tools for user management under UNIX, such as 779 <command>useradd</command>, <command>adduser</command>, as well as a plethora of custom 780 tools. With the tool of your choice, create a home directory for each user. 781 </para></step> 782 783 <step><para> 784 Using the preferred tool for your UNIX system, add each user to the UNIX groups created 785 previously as necessary. File system access control is based on UNIX group membership. 786 </para></step> 787 788 <step><para> 789 Create the directory mount point for the disk subsystem that is to be mounted to provide 790 data storage for company files, in this case, the mount point indicated in the &smb.conf; 791 file is <filename>/data</filename>. Format the file system as required and mount the formatted 792 file system partition using appropriate system tools. 793 </para></step> 794 795 <step><para> 796 <indexterm><primary>file system</primary> 797 <secondary>permissions</secondary></indexterm> 798 Create the top-level file storage directories for data and applications as follows: 799<screen> 800&rootprompt; mkdir -p /data/{accounts,finsvcs,pidata} 801&rootprompt; mkdir -p /apps 802&rootprompt; chown -R root:root /data 803&rootprompt; chown -R root:root /apps 804&rootprompt; chown -R bjordan:accounts /data/accounts 805&rootprompt; chown -R bjordan:finsvcs /data/finsvcs 806&rootprompt; chown -R bjordan:finsvcs /data/pidata 807&rootprompt; chmod -R ug+rwxs,o-rwx /data 808&rootprompt; chmod -R ug+rwx,o+rx-w /apps 809</screen> 810 Each department is responsible for creating its own directory structure within the departmental 811 share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>. 812 The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>. 813 The <filename>/apps</filename> directory is the root of the <constant>apps</constant> share 814 that provides the application server infrastructure. 815 </para></step> 816 817 <step><para> 818 The &smb.conf; file specifies an infrastructure to support roaming profiles and network 819 logon services. You can now create the file system infrastructure to provide the 820 locations on disk that these services require. Adequate planning is essential 821 because desktop profiles can grow to be quite large. For planning purposes, a minimum of 822 200 MB of storage should be allowed per user for profile storage. The following 823 commands create the directory infrastructure needed: 824<screen> 825&rootprompt; mkdir -p /var/spool/samba 826&rootprompt; mkdir -p /var/lib/samba/{netlogon/scripts,profiles} 827&rootprompt; chown -R root:root /var/spool/samba 828&rootprompt; chown -R root:root /var/lib/samba 829&rootprompt; chmod a+rwxt /var/spool/samba 830</screen> 831 For each user account that is created on the system, the following commands should be 832 executed: 833<screen> 834&rootprompt; mkdir /var/lib/samba/profiles/'username' 835&rootprompt; chown 'username':users /var/lib/samba/profiles/'username' 836&rootprompt; chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username' 837</screen> 838 </para></step> 839 840 <step><para> 841 <indexterm><primary>unix2dos</primary></indexterm> 842 <indexterm><primary>dos2unix</primary></indexterm> 843 Create a logon script. It is important that each line is correctly terminated with 844 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure 845 works if the right tools (<constant>unxi2dos</constant> and <constant>dos2unix</constant>) are installed. 846 First, create a file called <filename>/var/lib/samba/netlogon/scripts/logon.bat.unix</filename> 847 with the following contents: 848<screen> 849net time \\massive /set /yes 850net use h: /home 851</screen> 852 Convert the UNIX file to a DOS file: 853<screen> 854&rootprompt; dos2unix < /var/lib/samba/netlogon/scripts/logon.bat.unix \ 855 > /var/lib/samba/netlogon/scripts/logon.bat 856</screen> 857 </para></step> 858 859 <step><para> 860 There is one preparatory step without which you cannot have a working Samba network 861 environment. You must add an account for each network user. You can do this by executing 862 the following steps for each user: 863<screen> 864&rootprompt; useradd -m <parameter>username</parameter> 865&rootprompt; passwd <parameter>username</parameter> 866Changing password for <parameter>username</parameter>. 867New password: XXXXXXXX 868Re-enter new password: XXXXXXXX 869Password changed 870&rootprompt; smbpasswd -a <parameter>username</parameter> 871New SMB password: XXXXXXXX 872Retype new SMB password: XXXXXXXX 873Added user <parameter>username</parameter>. 874</screen> 875 You do, of course, use a valid user login ID in place of <parameter>username</parameter>. 876 </para></step> 877 878 <step><para> 879 Follow the processes shown in <link linkend="ch5-procstart"/> to start all services. 880 </para></step> 881 882 <step><para> 883 Your server is ready for validation testing. Do not proceed with the steps in 884 <link linkend="ch5-domsvrspec"/> until after the operation of the server has been 885 validated following the same methods as outlined in <link linkend="secure"/>, <link linkend="ch4valid"/>. 886 </para></step> 887 888 </procedure> 889 890 </sect3> 891 892 <sect3 id="ch5-domsvrspec"> 893 <title>Configuration Specific to Domain Member Servers: <constant>BLDG1, BLDG2</constant></title> 894 895 <para> 896 The following steps will guide you through the nuances of implementing BDCs for the broadcast 897 isolated network segments. Remember that if the target installation platform is not Linux, it may 898 be necessary to adapt some commands to the equivalent on the target platform. 899 </para> 900 901 <procedure> 902 <title>Backup Domain Controller Configuration Steps</title> 903 904 <step><para> 905 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm> 906 The final step that must be completed is to edit the <filename>/etc/nsswitch.conf</filename> file. 907 This file controls the operation of the various resolver libraries that are part of the Linux 908 Glibc libraries. Edit this file so that it contains the following entries: 909<screen> 910passwd: files winbind 911group: files winbind 912hosts: files dns wins 913</screen> 914 </para></step> 915 916 <step><para> 917 Follow the steps outlined in <link linkend="ch5-procstart"/> to start all services. Do not 918 start Samba at this time. Samba is controlled by the process called <command>smb</command>. 919 </para></step> 920 921 <step><para> 922 <indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm> 923 You must now attempt to join the domain member servers to the domain. The following 924 instructions should be executed to effect this: 925<screen> 926&rootprompt; net rpc join 927</screen> 928 </para></step> 929 930 <step><para> 931 <indexterm><primary>service</primary><secondary>smb</secondary><tertiary>start</tertiary></indexterm> 932 You now start the Samba services by executing: 933<screen> 934&rootprompt; service smb start 935</screen> 936 </para></step> 937 938 <step><para> 939 Your server is ready for validation testing. Do not proceed with the steps in 940 <link linkend="ch5-domsvrspec"/> until after the operation of the server has been 941 validated following the same methods as outlined in <link linkend="ch4valid"/>. 942 </para></step> 943 944 </procedure> 945 946 </sect3> 947 948 </sect2> 949 950<!-- One --> 951<example id="ch5-massivesmb"> 952<title>Server: MASSIVE (PDC), File: <filename>/etc/samba/smb.conf</filename></title> 953<smbconfblock> 954<smbconfcomment>Global parameters</smbconfcomment> 955<smbconfsection name="[global]"/> 956<smbconfoption name="workgroup">MEGANET</smbconfoption> 957<smbconfoption name="netbios name">MASSIVE</smbconfoption> 958<smbconfoption name="interfaces">eth1, lo</smbconfoption> 959<smbconfoption name="bind interfaces only">Yes</smbconfoption> 960<smbconfoption name="passdb backend">tdbsam</smbconfoption> 961<smbconfoption name="smb ports">139</smbconfoption> 962<smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption> 963<smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption> 964<smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption> 965<smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption> 966<smbconfoption name="add user to group script">/usr/sbin/usermod -G '%g' '%u'</smbconfoption> 967<smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</smbconfoption> 968<smbconfoption name="preferred master">Yes</smbconfoption> 969<smbconfoption name="wins support">Yes</smbconfoption> 970<smbconfoption name="include">/etc/samba/dc-common.conf</smbconfoption> 971 972<smbconfsection name="[accounts]"/> 973<smbconfoption name="comment">Accounting Files</smbconfoption> 974<smbconfoption name="path">/data/accounts</smbconfoption> 975<smbconfoption name="read only">No</smbconfoption> 976 977<smbconfsection name="[service]"/> 978<smbconfoption name="comment">Financial Services Files</smbconfoption> 979<smbconfoption name="path">/data/service</smbconfoption> 980<smbconfoption name="read only">No</smbconfoption> 981 982<smbconfsection name="[pidata]"/> 983<smbconfoption name="comment">Property Insurance Files</smbconfoption> 984<smbconfoption name="path">/data/pidata</smbconfoption> 985<smbconfoption name="read only">No</smbconfoption> 986</smbconfblock> 987</example> 988 989<!-- Two --> 990<example id="ch5-dc-common"> 991<title>Server: MASSIVE (PDC), File: <filename>/etc/samba/dc-common.conf</filename></title> 992<smbconfblock> 993<smbconfcomment>Global parameters</smbconfcomment> 994<smbconfsection name="[global]"/> 995<smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption> 996<smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption> 997<smbconfoption name="logon script">scripts\logon.bat</smbconfoption> 998<smbconfoption name="logon path">\%L\profiles\%U</smbconfoption> 999<smbconfoption name="logon drive">X:</smbconfoption> 1000<smbconfoption name="logon home">\%L\%U</smbconfoption> 1001<smbconfoption name="domain logons">Yes</smbconfoption> 1002<smbconfoption name="preferred master">Yes</smbconfoption> 1003<smbconfoption name="include">/etc/samba/common.conf</smbconfoption> 1004 1005<smbconfsection name="[homes]"/> 1006<smbconfoption name="comment">Home Directories</smbconfoption> 1007<smbconfoption name="valid users">%S</smbconfoption> 1008<smbconfoption name="read only">No</smbconfoption> 1009<smbconfoption name="browseable">No</smbconfoption> 1010 1011<smbconfsection name="[netlogon]"/> 1012<smbconfoption name="comment">Network Logon Service</smbconfoption> 1013<smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption> 1014<smbconfoption name="guest ok">Yes</smbconfoption> 1015<smbconfoption name="locking">No</smbconfoption> 1016 1017<smbconfsection name="[profiles]"/> 1018<smbconfoption name="comment">Profile Share</smbconfoption> 1019<smbconfoption name="path">/var/lib/samba/profiles</smbconfoption> 1020<smbconfoption name="read only">No</smbconfoption> 1021<smbconfoption name="profile acls">Yes</smbconfoption> 1022</smbconfblock> 1023</example> 1024 1025<!-- Three --> 1026<example id="ch5-commonsmb"> 1027<title>Common Samba Configuration File: <filename>/etc/samba/common.conf</filename></title> 1028<smbconfblock> 1029<smbconfsection name="[global]"/> 1030<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption> 1031<smbconfoption name="log level">1</smbconfoption> 1032<smbconfoption name="syslog">0</smbconfoption> 1033<smbconfoption name="log file">/var/log/samba/%m</smbconfoption> 1034<smbconfoption name="max log size">50</smbconfoption> 1035<smbconfoption name="smb ports">139</smbconfoption> 1036<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption> 1037<smbconfoption name="time server">Yes</smbconfoption> 1038<smbconfoption name="printcap name">CUPS</smbconfoption> 1039<smbconfoption name="show add printer wizard">No</smbconfoption> 1040<smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption> 1041<smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption> 1042<smbconfoption name="utmp">Yes</smbconfoption> 1043<smbconfoption name="map acl inherit">Yes</smbconfoption> 1044<smbconfoption name="printing">cups</smbconfoption> 1045<smbconfoption name="veto files">/*.eml/*.nws/*.{*}/</smbconfoption> 1046<smbconfoption name="veto oplock files">/*.doc/*.xls/*.mdb/</smbconfoption> 1047<smbconfoption name="include"> </smbconfoption> 1048 1049<smbconfcomment>Share and Service Definitions are common to all servers</smbconfcomment> 1050<smbconfsection name="[printers]"/> 1051<smbconfoption name="comment">SMB Print Spool</smbconfoption> 1052<smbconfoption name="path">/var/spool/samba</smbconfoption> 1053<smbconfoption name="guest ok">Yes</smbconfoption> 1054<smbconfoption name="printable">Yes</smbconfoption> 1055<smbconfoption name="use client driver">Yes</smbconfoption> 1056<smbconfoption name="default devmode">Yes</smbconfoption> 1057<smbconfoption name="browseable">No</smbconfoption> 1058 1059<smbconfsection name="[apps]"/> 1060<smbconfoption name="comment">Application Files</smbconfoption> 1061<smbconfoption name="path">/apps</smbconfoption> 1062<smbconfoption name="admin users">bjordan</smbconfoption> 1063<smbconfoption name="read only">No</smbconfoption> 1064</smbconfblock> 1065</example> 1066 1067<!-- Four --> 1068<example id="ch5-bldg1-smb"> 1069<title>Server: BLDG1 (Member), File: smb.conf</title> 1070<smbconfblock> 1071<smbconfcomment>Global parameters</smbconfcomment> 1072<smbconfsection name="[global]"/> 1073<smbconfoption name="workgroup">MEGANET</smbconfoption> 1074<smbconfoption name="netbios name">BLDG1</smbconfoption> 1075<smbconfoption name="include">/etc/samba/dom-mem.conf</smbconfoption> 1076</smbconfblock> 1077</example> 1078 1079<!-- Five --> 1080<example id="ch5-bldg2-smb"> 1081<title>Server: BLDG2 (Member), File: smb.conf</title> 1082<smbconfblock> 1083<smbconfcomment>Global parameters</smbconfcomment> 1084<smbconfsection name="[global]"/> 1085<smbconfoption name="workgroup">MEGANET</smbconfoption> 1086<smbconfoption name="netbios name">BLDG2</smbconfoption> 1087<smbconfoption name="include">/etc/samba/dom-mem.conf</smbconfoption> 1088</smbconfblock> 1089</example> 1090 1091<!-- Six --> 1092<example id="ch5-dommem-smb"> 1093<title>Common Domain Member Include File: dom-mem.conf</title> 1094<smbconfblock> 1095<smbconfcomment>Global parameters</smbconfcomment> 1096<smbconfsection name="[global]"/> 1097<smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption> 1098<smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption> 1099<smbconfoption name="preferred master">Yes</smbconfoption> 1100<smbconfoption name="wins server">172.16.0.1</smbconfoption> 1101<smbconfoption name="idmap uid">15000-20000</smbconfoption> 1102<smbconfoption name="idmap gid">15000-20000</smbconfoption> 1103<smbconfoption name="include">/etc/samba/common.conf</smbconfoption> 1104</smbconfblock> 1105</example> 1106 1107<!-- Seven --> 1108<example id="massive-dhcp"> 1109<title>Server: MASSIVE, File: dhcpd.conf</title> 1110<screen> 1111# Abmas Accounting Inc. 1112 1113default-lease-time 86400; 1114max-lease-time 172800; 1115default-lease-time 86400; 1116ddns-updates on; 1117ddns-update-style interim; 1118 1119option ntp-servers 172.16.0.1; 1120option domain-name "abmas.biz"; 1121option domain-name-servers 172.16.0.1, 172.16.4.1; 1122option netbios-name-servers 172.16.0.1; 1123option netbios-node-type 8; 1124 1125subnet 172.16.1.0 netmask 255.255.252.0 { 1126 range dynamic-bootp 172.16.1.0 172.16.2.255; 1127 option subnet-mask 255.255.252.0; 1128 option routers 172.16.0.1, 172.16.0.128; 1129 allow unknown-clients; 1130 } 1131subnet 172.16.4.0 netmask 255.255.252.0 { 1132 range dynamic-bootp 172.16.7.0 172.16.7.254; 1133 option subnet-mask 255.255.252.0; 1134 option routers 172.16.4.128; 1135 allow unknown-clients; 1136 } 1137subnet 172.16.8.0 netmask 255.255.252.0 { 1138 range dynamic-bootp 172.16.11.0 172.16.11.254; 1139 option subnet-mask 255.255.252.0; 1140 option routers 172.16.4.128; 1141 allow unknown-clients; 1142 } 1143subnet 127.0.0.0 netmask 255.0.0.0 { 1144 } 1145subnet 123.45.67.64 netmask 255.255.255.252 { 1146 } 1147</screen> 1148</example> 1149 1150<!-- Eight --> 1151<example id="bldg1dhcp"> 1152<title>Server: BLDG1, File: dhcpd.conf</title> 1153<screen> 1154# Abmas Accounting Inc. 1155 1156default-lease-time 86400; 1157max-lease-time 172800; 1158default-lease-time 86400; 1159ddns-updates on; 1160ddns-update-style ad-hoc; 1161 1162option ntp-servers 172.16.0.1; 1163option domain-name "abmas.biz"; 1164option domain-name-servers 172.16.0.1, 172.16.4.1; 1165option netbios-name-servers 172.16.0.1; 1166option netbios-node-type 8; 1167 1168subnet 172.16.1.0 netmask 255.255.252.0 { 1169 range dynamic-bootp 172.16.3.0 172.16.3.255; 1170 option subnet-mask 255.255.252.0; 1171 option routers 172.16.0.1, 172.16.0.128; 1172 allow unknown-clients; 1173 } 1174subnet 172.16.4.0 netmask 255.255.252.0 { 1175 range dynamic-bootp 172.16.5.0 172.16.6.255; 1176 option subnet-mask 255.255.252.0; 1177 option routers 172.16.4.128; 1178 allow unknown-clients; 1179 } 1180subnet 127.0.0.0 netmask 255.0.0.0 { 1181 } 1182</screen> 1183</example> 1184 1185<!-- Nine --> 1186<example id="bldg2dhcp"> 1187<title>Server: BLDG2, File: dhcpd.conf</title> 1188<screen> 1189# Abmas Accounting Inc. 1190 1191default-lease-time 86400; 1192max-lease-time 172800; 1193default-lease-time 86400; 1194ddns-updates on; 1195ddns-update-style interim; 1196 1197option ntp-servers 172.16.0.1; 1198option domain-name "abmas.biz"; 1199option domain-name-servers 172.16.0.1, 172.16.4.1; 1200option netbios-name-servers 172.16.0.1; 1201option netbios-node-type 8; 1202 1203subnet 172.16.8.0 netmask 255.255.252.0 { 1204 range dynamic-bootp 172.16.9.0 172.16.10.255; 1205 option subnet-mask 255.255.252.0; 1206 option routers 172.16.8.128; 1207 allow unknown-clients; 1208 } 1209subnet 127.0.0.0 netmask 255.0.0.0 { 1210 } 1211</screen> 1212</example> 1213 1214<!-- Ten --> 1215<example id="massive-nameda"> 1216<title>Server: MASSIVE, File: named.conf, Part: A</title> 1217<screen> 1218### 1219# Abmas Biz DNS Control File 1220### 1221# Date: November 15, 2003 1222### 1223options { 1224 directory "/var/lib/named"; 1225 forwarders { 1226 123.45.12.23; 1227 123.45.54.32; 1228 }; 1229 forward first; 1230 listen-on { 1231 mynet; 1232 }; 1233 auth-nxdomain yes; 1234 multiple-cnames yes; 1235 notify no; 1236}; 1237 1238zone "." in { 1239 type hint; 1240 file "root.hint"; 1241}; 1242 1243zone "localhost" in { 1244 type master; 1245 file "localhost.zone"; 1246}; 1247 1248zone "0.0.127.in-addr.arpa" in { 1249 type master; 1250 file "127.0.0.zone"; 1251}; 1252 1253acl mynet { 1254 172.16.0.0/24; 1255 172.16.4.0/24; 1256 172.16.8.0/24; 1257 127.0.0.1; 1258}; 1259 1260acl seconddns { 1261 123.45.54.32; 1262}; 1263</screen> 1264</example> 1265 1266<!-- Eleven --> 1267<example id="massive-namedb"> 1268<title>Server: MASSIVE, File: named.conf, Part: B</title> 1269<screen> 1270zone "abmas.biz" { 1271 type master; 1272 file "/var/lib/named/master/abmas.biz.hosts"; 1273 allow-query { 1274 mynet; 1275 }; 1276 allow-transfer { 1277 mynet; 1278 }; 1279 allow-update { 1280 mynet; 1281 }; 1282}; 1283 1284zone "abmas.us" { 1285 type master; 1286 file "/var/lib/named/master/abmas.us.hosts"; 1287 allow-query { 1288 all; 1289 }; 1290 allow-transfer { 1291 seconddns; 1292 }; 1293}; 1294</screen> 1295</example> 1296 1297<!-- Twelve --> 1298<example id="massive-namedc"> 1299<title>Server: MASSIVE, File: named.conf, Part: C</title> 1300<screen> 1301zone "0.16.172.in-addr.arpa" { 1302 type master; 1303 file "/var/lib/named/master/172.16.0.0.rev"; 1304 allow-query { 1305 mynet; 1306 }; 1307 allow-transfer { 1308 mynet; 1309 }; 1310 allow-update { 1311 mynet; 1312 }; 1313}; 1314 1315zone "4.16.172.in-addr.arpa" { 1316 type master; 1317 file "/var/lib/named/master/172.16.4.0.rev"; 1318 allow-query { 1319 mynet; 1320 }; 1321 allow-transfer { 1322 mynet; 1323 }; 1324 allow-update { 1325 mynet; 1326 }; 1327}; 1328 1329zone "8.16.172.in-addr.arpa" { 1330 type master; 1331 file "/var/lib/named/master/172.16.8.0.rev"; 1332 allow-query { 1333 mynet; 1334 }; 1335 allow-transfer { 1336 mynet; 1337 }; 1338 allow-update { 1339 mynet; 1340 }; 1341}; 1342</screen> 1343</example> 1344 1345<!-- Thirteen --> 1346<example id="abmasbizdns"> 1347<title>Forward Zone File: abmas.biz.hosts</title> 1348<screen> 1349$ORIGIN . 1350$TTL 38400 ; 10 hours 40 minutes 1351abmas.biz IN SOA massive.abmas.biz. root.abmas.biz. ( 1352 2003021833 ; serial 1353 10800 ; refresh (3 hours) 1354 3600 ; retry (1 hour) 1355 604800 ; expire (1 week) 1356 38400 ; minimum (10 hours 40 minutes) 1357 ) 1358 NS massive.abmas.biz. 1359 NS bldg1.abmas.biz. 1360 NS bldg2.abmas.biz. 1361 MX 10 massive.abmas.biz. 1362$ORIGIN abmas.biz. 1363massive A 172.16.0.1 1364router0 A 172.16.0.128 1365bldg1 A 172.16.4.1 1366router4 A 172.16.4.128 1367bldg2 A 172.16.8.1 1368router8 A 172.16.8.128 1369</screen> 1370</example> 1371 1372<!-- Forteen --> 1373<example id="abmasusdns"> 1374<title>Forward Zone File: abmas.biz.hosts</title> 1375<screen> 1376$ORIGIN . 1377$TTL 38400 ; 10 hours 40 minutes 1378abmas.us IN SOA server.abmas.us. root.abmas.us. ( 1379 2003021833 ; serial 1380 10800 ; refresh (3 hours) 1381 3600 ; retry (1 hour) 1382 604800 ; expire (1 week) 1383 38400 ; minimum (10 hours 40 minutes) 1384 ) 1385 NS dns.abmas.us. 1386 NS dns2.abmas.us. 1387 MX 10 mail.abmas.us. 1388$ORIGIN abmas.us. 1389server A 123.45.67.66 1390dns2 A 123.45.54.32 1391gw A 123.45.67.65 1392www CNAME server 1393mail CNAME server 1394dns CNAME server 1395</screen> 1396</example> 1397 1398<!-- Fifteen --> 1399<example id="bldg12nameda"> 1400<title>Servers: BLDG1/BLDG2, File: named.conf, Part: A</title> 1401<screen> 1402### 1403# Abmas Biz DNS Control File 1404### 1405# Date: November 15, 2003 1406### 1407options { 1408 directory "/var/lib/named"; 1409 forwarders { 1410 172.16.0.1; 1411 }; 1412 forward first; 1413 listen-on { 1414 mynet; 1415 }; 1416 auth-nxdomain yes; 1417 multiple-cnames yes; 1418 notify no; 1419}; 1420 1421zone "." in { 1422 type hint; 1423 file "root.hint"; 1424}; 1425 1426zone "localhost" in { 1427 type master; 1428 file "localhost.zone"; 1429}; 1430 1431zone "0.0.127.in-addr.arpa" in { 1432 type master; 1433 file "127.0.0.zone"; 1434}; 1435 1436acl mynet { 1437 172.16.0.0/24; 1438 172.16.4.0/24; 1439 172.16.8.0/24; 1440 127.0.0.1; 1441}; 1442 1443acl seconddns { 1444 123.45.54.32; 1445}; 1446</screen> 1447</example> 1448 1449<!-- Sixteen --> 1450<example id="bldg12namedb"> 1451<title>Servers: BLDG1/BLDG2, File: named.conf, Part: B</title> 1452<screen> 1453zone "abmas.biz" { 1454 type slave; 1455 file "/var/lib/named/slave/abmas.biz.hosts"; 1456 allow-query { 1457 mynet; 1458 }; 1459 allow-transfer { 1460 mynet; 1461 }; 1462}; 1463 1464zone "0.16.172.in-addr.arpa" { 1465 type slave; 1466 file "/var/lib/slave/master/172.16.0.0.rev"; 1467 allow-query { 1468 mynet; 1469 }; 1470 allow-transfer { 1471 mynet; 1472 }; 1473}; 1474 1475zone "4.16.172.in-addr.arpa" { 1476 type slave; 1477 file "/var/lib/named/slave/172.16.4.0.rev"; 1478 allow-query { 1479 mynet; 1480 }; 1481 allow-transfer { 1482 mynet; 1483 }; 1484}; 1485 1486zone "8.16.172.in-addr.arpa" { 1487 type slave; 1488 file "/var/lib/named/slave/172.16.8.0.rev"; 1489 allow-query { 1490 mynet; 1491 }; 1492 allow-transfer { 1493 mynet; 1494 }; 1495}; 1496</screen> 1497</example> 1498 1499 1500<!-- Seventeen --> 1501<example id="ch5-initgrps"> 1502<title>Initialize Groups Script, File: /etc/samba/initGrps.sh</title> 1503<screen> 1504#!/bin/bash 1505 1506# Create UNIX groups 1507groupadd acctsdep 1508groupadd finsrvcs 1509groupadd piops 1510 1511# Map Windows Domain Groups to UNIX groups 1512net groupmap add ntgroup="Domain Admins" unixgroup=root type=d 1513net groupmap add ntgroup="Domain Users" unixgroup=users type=d 1514net groupmap add ntgroup="Domain Guests" unixgroup=nobody type=d 1515 1516# Add Functional Domain Groups 1517net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d 1518net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d 1519net groupmap add ntgroup="Insurance Group" unixgroup=piops type=d 1520</screen> 1521</example> 1522 1523<!-- End of Examples --> 1524 1525 <sect2 id="ch5-procstart"> 1526 <title>Process Startup Configuration</title> 1527 1528 <para> 1529 <indexterm><primary>chkconfig</primary></indexterm> 1530 <indexterm><primary>daemon control</primary></indexterm> 1531 There are two essential steps to process startup configuration. A process 1532 must be configured so that it is automatically restarted each time the server 1533 is rebooted. This step involves use of the <command>chkconfig</command> tool that 1534 created appropriate symbolic links from the master daemon control file that is 1535 located in the <filename>/etc/rc.d</filename> directory to the <filename>/etc/rc'x'.d</filename> 1536 directories. Links are created so that when the system run-level is changed, the 1537 necessary start or kill script is run. 1538 </para> 1539 1540 <para> 1541 <indexterm><primary>/etc/xinetd.d</primary></indexterm> 1542 In the event that a service is provided not as a daemon but via the internetworking 1543 super daemon (<command>inetd</command> or <command>xinetd</command>), then the <command>chkconfig</command> 1544 tool makes the necessary entries in the <filename>/etc/xinetd.d</filename> directory 1545 and sends a hang-up (HUP) signal to the super daemon, thus forcing it to 1546 re-read its control files. 1547 </para> 1548 1549 <para> 1550 Last, each service must be started to permit system validation to proceed. The following steps 1551 are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you 1552 are installing Samba. 1553 </para> 1554 1555 <procedure> 1556 <title>Process Startup Configuration Steps</title> 1557 1558 <step><para> 1559 Use the standard system tool to configure each service to restart 1560 automatically at every system reboot. For example, 1561 <indexterm><primary>chkconfig</primary></indexterm> 1562<screen> 1563&rootprompt; chkconfig dhpc on 1564&rootprompt; chkconfig named on 1565&rootprompt; chkconfig cups on 1566&rootprompt; chkconfig smb on 1567&rootprompt; chkconfig swat on 1568</screen> 1569 </para></step> 1570 1571 <step><para> 1572 <indexterm><primary>starting dhcpd</primary></indexterm> 1573 <indexterm><primary>starting samba</primary></indexterm> 1574 <indexterm><primary>starting CUPS</primary></indexterm> 1575 Now start each service to permit the system to be validated. 1576 Execute each of the following in the sequence shown: 1577 1578<screen> 1579&rootprompt; service dhcp restart 1580&rootprompt; service named restart 1581&rootprompt; service cups restart 1582&rootprompt; service smb restart 1583&rootprompt; service swat restart 1584</screen> 1585 </para></step> 1586 </procedure> 1587 1588 </sect2> 1589 1590 <sect2 id="ch5wincfg"> 1591 <title>Windows Client Configuration</title> 1592 1593 <para> 1594 The procedure for desktop client configuration for the network in this chapter is similar to 1595 that used for the previous one. There are a few subtle changes that should be noted. 1596 </para> 1597 1598 <procedure> 1599 <title>Windows Client Configuration Steps</title> 1600 1601 <step><para> 1602 Install MS Windows XP Professional. During installation, configure the client to use DHCP for 1603 TCP/IP protocol configuration. 1604 <indexterm><primary>WINS</primary></indexterm> 1605 <indexterm><primary>DHCP</primary></indexterm> 1606 DHCP configures all Windows clients to use the WINS Server address that has been defined 1607 for the local subnet. 1608 </para></step> 1609 1610 <step><para> 1611 Join the Windows domain <constant>MEGANET</constant>. Use the domain administrator 1612 username <constant>root</constant> and the SMB password you assigned to this account. 1613 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to 1614 a Windows domain is given in <link linkend="appendix"/>, <link linkend="domjoin"/>. 1615 Reboot the machine as prompted and then log on using the domain administrator account 1616 (<constant>root</constant>). 1617 </para></step> 1618 1619 <step><para> 1620 Verify that the server called <constant>MEGANET</constant> is visible in <guimenu>My Network Places</guimenu>, 1621 that it is possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>, 1622 <guimenuitem>apps</guimenuitem>, and <guimenuitem>finsvcs</guimenuitem>, 1623 and that it is possible to open each share to reveal its contents. 1624 </para></step> 1625 1626 <step><para> 1627 Create a drive mapping to the <constant>apps</constant> share on a server. At this time, it does 1628 not particularly matter which application server is used. It is necessary to manually 1629 set a persistent drive mapping to the local applications server on each workstation at the time of 1630 installation. This step is avoided by the improvements to the design of the network configuration 1631 in the next chapter. 1632 </para></step> 1633 1634 <step><para> 1635 Perform an administrative installation of each application to be used. Select the options 1636 that you wish to use. Of course, you choose to run applications over the network, correct? 1637 </para></step> 1638 1639 <step><para> 1640 Now install all applications to be installed locally. Typical tools include Adobe Acrobat, 1641 NTP-based time synchronization software, drivers for specific local devices such as fingerprint 1642 scanners, and the like. Probably the most significant application to be locally installed 1643 is antivirus software. 1644 </para></step> 1645 1646 <step><para> 1647 Now install all four printers onto the staging system. The printers you install 1648 include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers, and you 1649 also configure use of the identical printers that are located in the financial services department. 1650 Install printers on each machine using the following steps: 1651 </para> 1652 1653 <procedure> 1654 <title>Steps to Install Printer Drivers on Windows Clients</title> 1655 1656 <step><para> 1657 Click <menuchoice> 1658 <guimenu>Start</guimenu> 1659 <guimenuitem>Settings</guimenuitem> 1660 <guimenuitem>Printers</guimenuitem> 1661 <guiicon>Add Printer</guiicon> 1662 <guibutton>Next</guibutton> 1663 </menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>. 1664 Ensure that <guimenuitem>Local printer</guimenuitem> is selected. 1665 </para></step> 1666 1667 <step><para> 1668 Click <guibutton>Next</guibutton>. In the 1669 <guimenuitem>Manufacturer:</guimenuitem> panel, select <constant>HP</constant>. 1670 In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called 1671 <constant>HP LaserJet 6</constant>. Click <guibutton>Next</guibutton>. 1672 </para></step> 1673 1674 <step><para> 1675 In the <guimenuitem>Available ports:</guimenuitem> panel, select 1676 <constant>FILE:</constant>. Accept the default printer name by clicking 1677 <guibutton>Next</guibutton>. When asked, <quote>Would you like to print a 1678 test page?</quote>, click <guimenuitem>No</guimenuitem>. Click 1679 <guibutton>Finish</guibutton>. 1680 </para></step> 1681 1682 <step><para> 1683 You may be prompted for the name of a file to print to. If so, close the 1684 dialog panel. Right-click <menuchoice> 1685 <guiicon>HP LaserJet 6</guiicon> 1686 <guimenuitem>Properties</guimenuitem> 1687 <guisubmenu>Details (Tab)</guisubmenu> 1688 <guibutton>Add Port</guibutton> 1689 </menuchoice>. 1690 </para></step> 1691 1692 <step><para> 1693 In the <guimenuitem>Network</guimenuitem> panel, enter the name of 1694 the print queue on the Samba server as follows: <constant>\\BLDG1\hplj6a</constant>. 1695 Click <menuchoice> 1696 <guibutton>OK</guibutton> 1697 <guibutton>OK</guibutton> 1698 </menuchoice> to complete the installation. 1699 </para></step> 1700 1701 <step><para> 1702 Repeat the printer installation steps above for both HP LaserJet 6 printers 1703 as well as for both QMS Magicolor laser printers. Remember to install all 1704 printers but to set the destination port for each to the server on the 1705 local network. For example, a workstation in the accounting group should 1706 have all printers directed at the server <constant>BLDG1</constant>. 1707 You may elect to point all desktop workstation configurations at the 1708 server called <constant>MASSIVE</constant> and then in your deployment 1709 procedures, it would be wise to document the need to redirect the printer 1710 configuration (as well as the applications server drive mapping) to the 1711 server on the network segment on which the workstation is to be located. 1712 </para></step> 1713 </procedure> 1714 </step> 1715 1716 <step><para> 1717 When you are satisfied that the staging systems are complete, use the appropriate procedure to 1718 remove the client from the domain. Reboot the system, and then log on as the local administrator 1719 and clean out all temporary files stored on the system. Before shutting down, use the disk 1720 defragmentation tool so that the file system is in optimal condition before replication. 1721 </para></step> 1722 1723 <step><para> 1724 Boot the workstation using the Norton (Symantec) Ghosting disk (or CD-ROM) and image the 1725 machine to a network share on the server. 1726 </para></step> 1727 1728 <step><para> 1729 You may now replicate the image using the appropriate Norton Ghost procedure to the target 1730 machines. Make sure to use the procedure that ensures each machine has a unique 1731 Windows security identifier (SID). When the installation of the disk image is complete, boot the PC. 1732 </para></step> 1733 1734 <step><para> 1735 Log onto the machine as the local Administrator (the only option), and join the machine to 1736 the domain following the procedure set out in <link linkend="appendix"/>, <link linkend="domjoin"/>. You must now set the 1737 persistent drive mapping to the applications server that the user is to use. The system is now 1738 ready for the user to log on, provided you have created a network logon account for that 1739 user, of course. 1740 </para></step> 1741 1742 <step><para> 1743 Instruct all users to log onto the workstation using their assigned username and password. 1744 </para></step> 1745 </procedure> 1746 1747 </sect2> 1748 1749 <sect2> 1750 <title>Key Points Learned</title> 1751 1752 <para> 1753 The network you have just deployed has been a valuable exercise in forced constraint. 1754 You have deployed a network that works well, although you may soon start to see 1755 performance problems, at which time the modifications demonstrated in <link linkend="happy"/> 1756 bring the network to life. The following key learning points were experienced: 1757 </para> 1758 1759 <itemizedlist> 1760 <listitem><para> 1761 The power of using &smb.conf; include files 1762 </para></listitem> 1763 1764 <listitem><para> 1765 Use of a single PDC over a routed network 1766 </para></listitem> 1767 1768 <listitem><para> 1769 Joining a Samba-3 domain member server to a Samba-3 domain 1770 </para></listitem> 1771 1772 <listitem><para> 1773 Configuration of winbind to use domain users and groups for Samba access 1774 to resources on the domain member servers 1775 </para></listitem> 1776 1777 <listitem><para> 1778 The introduction of roaming profiles 1779 </para></listitem> 1780 1781 </itemizedlist> 1782 1783 </sect2> 1784 1785</sect1> 1786 1787<sect1> 1788 <title>Questions and Answers</title> 1789 1790 <para> 1791 </para> 1792 1793 <qandaset defaultlabel="chap01qa" type="number"> 1794 <qandaentry> 1795 <question> 1796 1797 <para> 1798 The example &smb.conf; files in this chapter make use of the <parameter>include</parameter> facility. 1799 How may I get to see what the actual working &smb.conf; settings are? 1800 </para> 1801 1802 </question> 1803 <answer> 1804 1805 <para> 1806 You may readily see the net compound effect of the included files by running: 1807<screen> 1808&rootprompt; testparm -s | less 1809</screen> 1810 </para> 1811 1812 </answer> 1813 </qandaentry> 1814 1815 <qandaentry> 1816 <question> 1817 1818 <para> 1819 Why does the include file <filename>common.conf</filename> have an empty include statement? 1820 </para> 1821 1822 </question> 1823 <answer> 1824 1825 <para> 1826 The use of the empty include statement nullifies further includes. For example, let's say you 1827 desire to have just an smb.conf file that is built from the array of include files of which the 1828 master control file is called <filename>master.conf</filename>. The following command 1829 produces a compound &smb.conf; file. 1830<screen> 1831&rootprompt; testparm -s /etc/samba/master.conf > /etc/samba/smb.conf 1832</screen> 1833 If the include parameter was not in the common.conf file, the final &smb.conf; file leaves 1834 the include in place, even though the file it points to has already been included. This is a bug 1835 that will be fixed at a future date. 1836 </para> 1837 1838 </answer> 1839 </qandaentry> 1840 1841 <qandaentry> 1842 <question> 1843 1844 <para> 1845 I accept that the simplest configuration necessary to do the job is the best. The use of <parameter>tdbsam</parameter> 1846 passdb backend is much simpler than having to manage an LDAP-based <parameter>ldapsam</parameter> passdb backend. 1847 I tried using <command>rsync</command> to replicate the <filename>passdb.tdb</filename>, and it seems to work fine! 1848 So what is the problem? 1849 </para> 1850 1851 </question> 1852 <answer> 1853 1854 <para> 1855 Replication of the <parameter>tdbsam</parameter> database file can result in loss of currency in its 1856 contents between the PDC and BDCs. The most notable symptom is that workstations may not be able 1857 to log onto the network following a reboot and may have to rejoin the domain to recover network 1858 access capability. 1859 </para> 1860 1861 </answer> 1862 </qandaentry> 1863 1864 <qandaentry> 1865 <question> 1866 1867 <para> 1868 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? 1869 </para> 1870 1871 </question> 1872 <answer> 1873 1874 <para> 1875 No. It is possible to have as many DHCP servers on a network segment as makes sense. A DHCP server 1876 offers an IP address lease, but it is the client that determines which offer is accepted, no matter how many 1877 offers are made. Under normal operation, the client accepts the first offer it receives. 1878 </para> 1879 1880 <para> 1881 The only exception to this rule is when the client makes a directed request from a specific DHCP server 1882 for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash. 1883 </para> 1884 1885 </answer> 1886 </qandaentry> 1887 1888 <qandaentry> 1889 <question> 1890 1891 <para> 1892 How does the Windows client find the PDC? 1893 </para> 1894 1895 </question> 1896 <answer> 1897 1898 <para> 1899 The Windows client obtains the WINS server address from the DHCP lease information. It also 1900 obtains from the DHCP lease information the parameter that causes it to use directed UDP (UDP Unicast) 1901 to register itself with the WINS server and to obtain enumeration of vital network information to 1902 enable it to operate successfully. 1903 </para> 1904 1905 </answer> 1906 </qandaentry> 1907 1908 <qandaentry> 1909 <question> 1910 1911 <para> 1912 Why did you enable IP forwarding (routing) only on the server called <constant>MASSIVE</constant>? 1913 </para> 1914 1915 </question> 1916 <answer> 1917 1918 <para> 1919 The server called <constant>MASSIVE</constant> is acting as a router to the Internet. No other server 1920 (BLDG1 or BLDG2) has any need for IP forwarding because they are attached only to their own network. 1921 Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network 1922 segments to the router that is its gateway to them. 1923 </para> 1924 1925 </answer> 1926 </qandaentry> 1927 1928 <qandaentry> 1929 <question> 1930 1931 <para> 1932 You did nothing special to implement roaming profiles. Why? 1933 </para> 1934 1935 </question> 1936 <answer> 1937 1938 <para> 1939 Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional 1940 clients is to use roaming profiles. 1941 </para> 1942 1943 </answer> 1944 </qandaentry> 1945 1946 <qandaentry> 1947 <question> 1948 1949 <para> 1950 On the domain member computers, you configured winbind in the <filename>/etc/nsswitch.conf</filename> file. 1951 You did not configure any PAM settings. Is this an omission? 1952 </para> 1953 1954 </question> 1955 <answer> 1956 1957 <para> 1958 PAM is needed only for authentication. When Samba is using Microsoft encrypted passwords, it makes only 1959 marginal use of PAM. PAM configuration handles only authentication. If you want to log onto the domain 1960 member servers using Windows networking usernames and passwords, it is necessary to configure PAM 1961 to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name 1962 service switch (NSS). 1963 </para> 1964 1965 </answer> 1966 </qandaentry> 1967 1968 <qandaentry> 1969 <question> 1970 1971 <para> 1972 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this? 1973 </para> 1974 1975 </question> 1976 <answer> 1977 1978 <para> 1979 Oh, I did not think you would notice that. It is there so that it can be used. This is more fully discussed 1980 in <emphasis>TOSHARG2</emphasis>, which has a full chapter dedicated to the subject. While we are on the 1981 subject, it should be noted that you should definitely not use SWAT on any system that makes use 1982 of &smb.conf; <parameter>include</parameter> files because SWAT optimizes them out into an aggregated 1983 file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to 1984 handle this functionality gracefully. 1985 </para> 1986 1987 </answer> 1988 </qandaentry> 1989 1990 <qandaentry> 1991 <question> 1992 1993 <para> 1994 The domain controller has an auto-shutdown script. Isn't that dangerous? 1995 </para> 1996 1997 </question> 1998 <answer> 1999 2000 <para> 2001 Well done, you spotted that! I guess it is dangerous. It is good to know that you can do this, though. 2002 </para> 2003 2004 </answer> 2005 </qandaentry> 2006 2007 </qandaset> 2008 2009</sect1> 2010 2011</chapter> 2012 2013