1<?xml version="1.0" encoding="iso-8859-1"?> 2<!DOCTYPE appendix PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3 4<chapter id="appendix"> 5 <title>A Collection of Useful Tidbits</title> 6 7 <para> 8 <indexterm><primary>material</primary></indexterm> 9 <indexterm><primary>domain</primary><secondary>joining</secondary></indexterm> 10 Information presented here is considered to be either basic or well-known material that is informative 11 yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that 12 the process for joining a Windows client to a Samba-controlled Windows domain may somehow involve steps 13 different from doing so with Windows NT4 or a Windows ADS domain. Be assured that the steps are identical, 14 as shown in the example given below. 15 </para> 16 17<sect1 id="domjoin"> 18<title>Joining a Domain: Windows 200x/XP Professional</title> 19 20 <para> 21 <indexterm><primary>joining a domain</primary></indexterm> 22 Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security. 23 This section steps through the process for making a Windows 200x/XP Professional machine a 24 member of a Domain Security environment. It should be noted that this process is identical 25 when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC. 26 </para> 27 28 <procedure> 29 <title>Steps to Join a Domain</title> 30 31 <step><para> 32 Click <guimenu>Start</guimenu>. 33 </para></step> 34 35 <step><para> 36 Right-click <guimenu>My Computer</guimenu>, and then select <guimenuitem>Properties</guimenuitem>. 37 </para></step> 38 39 <step><para> 40 The opening panel is the same one that can be reached by clicking <guimenu>System</guimenu> on the Control Panel. 41 See <link linkend="swxpp001"></link>. 42 <figure id="swxpp001"><title>The General Panel.</title><imagefile>wxpp001</imagefile></figure> 43 </para></step> 44 45 <step><para> 46 Click the <guimenu>Computer Name</guimenu> tab. 47 This panel shows the <guimenuitem>Computer Description</guimenuitem>, the <guimenuitem>Full computer name</guimenuitem>, 48 and the <guimenuitem>Workgroup</guimenuitem> or <guimenuitem>Domain name</guimenuitem>. 49 </para> 50 51 <para> 52 Clicking the <guimenu>Network ID</guimenu> button launches the configuration wizard. Do not use this with 53 Samba-3. If you wish to change the computer name, or join or leave the domain, click the <guimenu>Change</guimenu> button. 54 See <link linkend="swxpp004"></link>. 55 <figure id="swxpp004"><title>The Computer Name Panel.</title><imagefile>wxpp004</imagefile></figure> 56 </para></step> 57 58 <step><para> 59 Click on <guimenu>Change</guimenu>. This panel shows that our example machine (TEMPTATION) is in a workgroup called WORKGROUP. 60 We join the domain called MIDEARTH. See <link linkend="swxpp006"></link>. 61 <figure id="swxpp006"><title>The Computer Name Changes Panel</title><imagefile>wxpp006</imagefile></figure> 62 </para></step> 63 64 <step><para> 65 Enter the name <guimenu>MIDEARTH</guimenu> in the field below the Domain radio button. 66 </para> 67 68 <para> 69 This panel shows that our example machine (TEMPTATION) is set to join the domain called MIDEARTH. See <link linkend="swxpp007"></link>. 70 <figure id="swxpp007"><title>The Computer Name Changes Panel &smbmdash; Domain MIDEARTH</title><imagefile>wxpp007</imagefile></figure> 71 </para></step> 72 73 <step><para> 74 Now click the <guimenu>OK</guimenu> button. A dialog box should appear to allow you to provide the credentials (username and password) 75 of a domain administrative account that has the rights to add machines to the domain. 76 </para> 77 78 <para> 79 Enter the name <quote>root</quote> and the root password from your Samba-3 server. See <link linkend="swxpp008"></link>. 80 <figure id="swxpp008"><title>Computer Name Changes &smbmdash; User name and Password Panel</title><imagefile>wxpp008</imagefile></figure> 81 </para></step> 82 83 <step><para> 84 Click <guimenu>OK</guimenu>. 85 </para> 86 87 <para> 88 The <quote>Welcome to the MIDEARTH domain</quote> dialog box should appear. At this point, the machine must be rebooted. 89 Joining the domain is now complete. 90 </para></step> 91 92 </procedure> 93 94 <para> 95 <indexterm><primary>Active Directory</primary></indexterm> 96 <indexterm><primary>DNS</primary></indexterm> 97 The screen capture shown in <link linkend="swxpp007"/> has a button labeled <guimenu>More...</guimenu>. This button opens a 98 panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members 99 of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace. 100 </para> 101 102 <para> 103 <indexterm><primary>Netlogon</primary></indexterm> 104 <indexterm><primary>DNS</primary><secondary>dynamic</secondary></indexterm> 105 Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers 106 register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server 107 to find the services (like which machines are domain controllers or which machines have the Netlogon service running). 108 </para> 109 110 <para> 111 <indexterm><primary>DNS</primary><secondary>suffix</secondary></indexterm> 112 The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix, 113 this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to 114 a valid IP address. 115 </para> 116 117 <para> 118 The Primary DNS suffix parameter principally affects MS Windows clients that are members of an Active Directory domain. 119 Where the client is a member of a Samba domain, it is preferable to leave this field blank. 120 </para> 121 122 <para> 123 <indexterm><primary>Group Policy</primary></indexterm> 124 According to Microsoft documentation, <quote>If this computer belongs to a group with <constant>Group Policy</constant> 125 enabled on <command>Primary DNS suffice of this computer</command>, the string specified in the Group Policy is used 126 as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is 127 used only if Group Policy is disabled or unspecified.</quote> 128 </para> 129 130</sect1> 131 132<sect1> 133 <title>Samba System File Location</title> 134 135 <para><indexterm> 136 <primary>default installation</primary> 137 </indexterm><indexterm> 138 <primary>/usr/local/samba</primary> 139 </indexterm><indexterm> 140 <primary>/usr/local</primary> 141 </indexterm> 142 One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team 143 build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is 144 in the <filename>/usr/local/samba</filename> directory. This is a perfectly reasonable location, particularly given all the other 145 Open Source software that installs into the <filename>/usr/local</filename> subdirectories. 146 </para> 147 148 <para> 149 Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team 150 default. 151 </para> 152 153 <para><indexterm> 154 <primary>Free Standards Group</primary> 155 <see>FSG</see> 156 </indexterm><indexterm> 157 <primary>FSG</primary> 158 </indexterm><indexterm> 159 <primary>Linux Standards Base</primary> 160 <see>LSB</see> 161 </indexterm><indexterm> 162 <primary>LSB</primary> 163 </indexterm><indexterm> 164 <primary>File Hierarchy System</primary> 165 <see>FHS</see> 166 </indexterm><indexterm> 167 <primary>FHS</primary> 168 </indexterm><indexterm> 169 <primary>file locations</primary> 170 </indexterm><indexterm> 171 <primary>/etc/samba</primary> 172 </indexterm><indexterm> 173 <primary>/usr/sbin</primary> 174 </indexterm><indexterm> 175 <primary>/usr/bin</primary> 176 </indexterm><indexterm> 177 <primary>/usr/share</primary> 178 </indexterm><indexterm> 179 <primary>/usr/share/swat</primary> 180 </indexterm><indexterm> 181 <primary>/usr/lib/samba</primary> 182 </indexterm><indexterm> 183 <primary>/usr/share/samba/swat</primary> 184 </indexterm><indexterm> 185 <primary>SWAT</primary> 186 </indexterm><indexterm> 187 <primary>VFS modules</primary> 188 </indexterm> 189 Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy 190 System (FHS), have elected to locate the configuration files under the <filename>/etc/samba</filename> directory, common binary 191 files (those used by users) in the <filename>/usr/bin</filename> directory, and the administrative files (daemons) in the 192 <filename>/usr/sbin</filename> directory. Support files for the Samba Web Admin Tool (SWAT) are located under the 193 <filename>/usr/share</filename> directory, either in <filename>/usr/share/samba/swat</filename> or in 194 <filename>/usr/share/swat</filename>. There are additional support files for <command>smbd</command> in the 195 <filename>/usr/lib/samba</filename> directory tree. The files located there include the dynamically loadable modules for the 196 passdb backend as well as for the VFS modules. 197 </para> 198 199 <para><indexterm> 200 <primary>/var/lib/samba</primary> 201 </indexterm><indexterm> 202 <primary>/var/log/samba</primary> 203 </indexterm><indexterm> 204 <primary>run-time control files</primary> 205 </indexterm> 206 Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in 207 the <filename>/var/lib/samba</filename> directory. Log files are created in <filename>/var/log/samba.</filename> 208 </para> 209 210 <para> 211 When Samba is built and installed using the default Samba Team process, all files are located under the 212 <filename>/usr/local/samba</filename> directory tree. This makes it simple to find the files that Samba owns. 213 </para> 214 215 <para><indexterm> 216 <primary>smbd</primary> 217 <secondary>location of files</secondary> 218 </indexterm> 219 One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location 220 of all files called <command>smbd</command>. Here is an example: 221<screen> 222&rootprompt; find / -name smbd -print 223</screen> 224 You can find the location of the configuration files by running: 225<screen> 226&rootprompt; /path-to-binary-file/smbd -b | more 227... 228Paths: 229 SBINDIR: /usr/sbin 230 BINDIR: /usr/bin 231 SWATDIR: /usr/share/samba/swat 232 CONFIGFILE: /etc/samba/smb.conf 233 LOGFILEBASE: /var/log/samba 234 LMHOSTSFILE: /etc/samba/lmhosts 235 LIBDIR: /usr/lib/samba 236 SHLIBEXT: so 237 LOCKDIR: /var/lib/samba 238 PIDDIR: /var/run/samba 239 SMB_PASSWD_FILE: /etc/samba/smbpasswd 240 PRIVATE_DIR: /etc/samba 241... 242</screen> 243 If you wish to locate the Samba version, just run: 244<screen> 245&rootprompt; /path-to-binary-file/smbd -V 246Version 3.0.20-SUSE 247</screen> 248 </para> 249 250 <para> 251 Many people have been caught by installation of Samba using the default Samba Team process when it was already installed 252 by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by 253 executing:<indexterm> 254 <primary>rpm</primary> 255 </indexterm> 256<screen> 257&rootprompt; rpm -qa | grep samba 258samba3-pdb-3.0.20-1 259samba3-vscan-0.3.6-0 260samba3-winbind-3.0.20-1 261samba3-3.0.20-1 262samba3-python-3.0.20-1 263samba3-utils-3.0.20-1 264samba3-doc-3.0.20-1 265samba3-client-3.0.20-1 266samba3-cifsmount-3.0.20-1 267 </screen><indexterm> 268 <primary>package names</primary> 269 </indexterm> 270 The package names, of course, vary according to how the vendor, or the binary package builder, prepared them. 271 </para> 272 273</sect1> 274 275<sect1> 276 <title>Starting Samba</title> 277 278 <para><indexterm> 279 <primary>daemon</primary> 280 </indexterm> 281 Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services. 282 An example of a service is the Apache Web server for which the daemon is called <command>httpd</command>. In the case of Samba, there 283 are three daemons, two of which are needed as a minimum. 284 </para> 285 286 <para> 287 The Samba server is made up of the following daemons: 288 </para> 289 290<example id="ch12SL"> 291<title>A Useful Samba Control Script for SUSE Linux</title> 292<screen> 293#!/bin/bash 294# 295# Script to start/stop samba 296# Locate this in /sbin as a file called 'samba' 297 298RCD=/etc/rc.d 299 300if [ z$1 == 'z' ]; then 301 echo $0 - No arguments given; must be start or stop. 302 exit 303fi 304 305if [ $1 == 'start' ]; then 306 ${RCD}/nmb start 307 ${RCD}/smb start 308 ${RCD}/winbind start 309 310fi 311if [ $1 == 'stop' ]; then 312 ${RCD}/smb stop 313 ${RCD}/winbind stop 314 ${RCD}/nmb stop 315fi 316if [ $1 == 'restart' ]; then 317 ${RCD}/smb stop 318 ${RCD}/winbind stop 319 ${RCD}/nmb stop 320 sleep 5 321 ${RCD}/nmb start 322 ${RCD}/smb start 323 ${RCD}/winbind start 324fi 325exit 0 326</screen> 327</example> 328 329 <variablelist> 330 <varlistentry><term>nmbd</term> 331 <listitem><para> 332 <indexterm><primary>smbd</primary></indexterm> 333 <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm> 334 This daemon handles all name registration and resolution requests. It is the primary vehicle involved 335 in network browsing. It handles all UDP-based protocols. The <command>nmbd</command> daemon should 336 be the first command started as part of the Samba startup process. 337 </para></listitem> 338 </varlistentry> 339 340 <varlistentry><term>smbd</term> 341 <listitem><para> 342 <indexterm><primary>nmbd</primary></indexterm> 343 <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm> 344 This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also 345 manages local authentication. It should be started immediately following the startup of <command>nmbd</command>. 346 </para></listitem> 347 </varlistentry> 348 349 <varlistentry><term>winbindd</term> 350 <listitem><para> 351 <indexterm><primary>winbindd</primary></indexterm> 352 <indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm> 353 This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when 354 Samba has trust relationships with another domain. The <command>winbindd</command> daemon will check the 355 &smb.conf; file for the presence of the <parameter>idmap uid</parameter> and <parameter>idmap gid</parameter> 356 parameters. If they are not found, <command>winbindd</command> bails out and refuses to start. 357 </para></listitem> 358 </varlistentry> 359 </variablelist> 360 361 <para> 362 When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its 363 integration into the platform as a whole. Please refer to your operating system platform administration manuals for 364 specific information pertaining to correct management of Samba startup. 365 </para> 366 367<example id="ch12RHscript"> 368<title>A Sample Samba Control Script for Red Hat Linux</title> 369<screen> 370#!/bin/sh 371# 372# chkconfig: 345 81 35 373# description: Starts and stops the Samba smbd and nmbd daemons \ 374# used to provide SMB network services. 375 376# Source function library. 377. /etc/rc.d/init.d/functions 378# Source networking configuration. 379. /etc/sysconfig/network 380# Check that networking is up. 381[ ${NETWORKING} = "no" ] && exit 0 382CONFIG=/etc/samba/smb.conf 383# Check that smb.conf exists. 384[ -f $CONFIG ] || exit 0 385 386# See how we were called. 387case "$1" in 388 start) 389 echo -n "Starting SMB services: " 390 daemon smbd -D; daemon nmbd -D; echo; 391 touch /var/lock/subsys/smb 392 ;; 393 stop) 394 echo -n "Shutting down SMB services: " 395 smbdpids=`ps guax | grep smbd | grep -v grep | awk '{print $2}'` 396 for pid in $smbdpids; do 397 kill -TERM $pid 398 done 399 killproc nmbd -TERM; rm -f /var/lock/subsys/smb 400 echo "" 401 ;; 402 status) 403 status smbd; status nmbd; 404 ;; 405 restart) 406 echo -n "Restarting SMB services: " 407 $0 stop; $0 start; 408 echo "done." 409 ;; 410 *) 411 echo "Usage: smb {start|stop|restart|status}" 412 exit 1 413esac 414</screen> 415</example> 416 417 <para><indexterm> 418 <primary>samba control script</primary> 419 </indexterm> 420 SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently 421 executed from the command line is shown in <link linkend="ch12SL"/>. This can be located in the directory 422 <filename>/sbin</filename> in a file called <filename>samba</filename>. This type of control script should be 423 owned by user root and group root, and set so that only root can execute it. 424 </para> 425 426 <para><indexterm> 427 <primary>startup script</primary> 428 </indexterm> 429 A sample startup script for a Red Hat Linux system is shown in <link linkend="ch12RHscript"/>. 430 This file could be located in the directory <filename>/etc/rc.d</filename> and can be called 431 <filename>samba</filename>. A similar startup script is required to control <command>winbind</command>. 432 If you want to find more information regarding startup scripts please refer to the packaging section of 433 the Samba source code distribution tarball. The packaging files for each platform include a 434 startup control file. 435 </para> 436 437</sect1> 438 439<sect1> 440 <title>DNS Configuration Files</title> 441 442 <para> 443 The following files are common to all DNS server configurations. Rather than repeat them multiple times, they 444 are presented here for general reference. 445 </para> 446 447 <sect2> 448 <title>The Forward Zone File for the Loopback Adaptor</title> 449 450 <para> 451 The forward zone file for the loopback address never changes. An example file is shown 452 in <link linkend="loopback"/>. All traffic destined for an IP address that is hosted on a 453 physical interface on the machine itself is routed to the loopback adaptor. This is 454 a fundamental design feature of the TCP/IP protocol implementation. The loopback adaptor 455 is called <constant>localhost</constant>. 456 </para> 457 458<example id="loopback"> 459<title>DNS Localhost Forward Zone File: <filename>/var/lib/named/localhost.zone</filename></title> 460<screen> 461$TTL 1W 462@ IN SOA @ root ( 463 42 ; serial 464 2D ; refresh 465 4H ; retry 466 6W ; expiry 467 1W ) ; minimum 468 469 IN NS @ 470 IN A 127.0.0.1 471</screen> 472</example> 473 474 </sect2> 475 476 <sect2> 477 <title>The Reverse Zone File for the Loopback Adaptor</title> 478 479 <para> 480 The reverse zone file for the loopback address as shown in <link linkend="dnsloopy"/> 481 is necessary so that references to the address <constant>127.0.0.1</constant> can be 482 resolved to the correct name of the interface. 483 </para> 484 485<example id="dnsloopy"> 486<title>DNS Localhost Reverse Zone File: <filename>/var/lib/named/127.0.0.zone</filename></title> 487<screen> 488$TTL 1W 489@ IN SOA localhost. root.localhost. ( 490 42 ; serial 491 2D ; refresh 492 4H ; retry 493 6W ; expiry 494 1W ) ; minimum 495 496 IN NS localhost. 4971 IN PTR localhost. 498</screen> 499</example> 500 501<example id="roothint"> 502<title>DNS Root Name Server Hint File: <filename>/var/lib/named/root.hint</filename></title> 503<screen> 504; This file is made available by InterNIC under anonymous FTP as 505; file /domain/named.root 506; on server FTP.INTERNIC.NET 507; last update: Nov 5, 2002. Related version of root zone: 2002110501 508; formerly NS.INTERNIC.NET 509. 3600000 IN NS A.ROOT-SERVERS.NET. 510A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4 511; formerly NS1.ISI.EDU 512. 3600000 NS B.ROOT-SERVERS.NET. 513B.ROOT-SERVERS.NET. 3600000 A 128.9.0.107 514; formerly C.PSI.NET 515. 3600000 NS C.ROOT-SERVERS.NET. 516C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12 517; formerly TERP.UMD.EDU 518. 3600000 NS D.ROOT-SERVERS.NET. 519D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90 520; formerly NS.NASA.GOV 521. 3600000 NS E.ROOT-SERVERS.NET. 522E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10 523; formerly NS.ISC.ORG 524. 3600000 NS F.ROOT-SERVERS.NET. 525F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241 526; formerly NS.NIC.DDN.MIL 527. 3600000 NS G.ROOT-SERVERS.NET. 528G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4 529; formerly AOS.ARL.ARMY.MIL 530. 3600000 NS H.ROOT-SERVERS.NET. 531H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53 532; formerly NIC.NORDU.NET 533. 3600000 NS I.ROOT-SERVERS.NET. 534I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17 535; operated by VeriSign, Inc. 536. 3600000 NS J.ROOT-SERVERS.NET. 537J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30 538; housed in LINX, operated by RIPE NCC 539. 3600000 NS K.ROOT-SERVERS.NET. 540K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129 541; operated by IANA 542. 3600000 NS L.ROOT-SERVERS.NET. 543L.ROOT-SERVERS.NET. 3600000 A 198.32.64.12 544; housed in Japan, operated by WIDE 545. 3600000 NS M.ROOT-SERVERS.NET. 546M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 547; End of File 548</screen> 549</example> 550 </sect2> 551 552 <sect2> 553 <title>DNS Root Server Hint File</title> 554 555 <para> 556 The content of the root hints file as shown in <link linkend="roothint"/> changes slowly over time. 557 Periodically this file should be updated from the source shown. Because 558 of its size, this file is located at the end of this chapter. 559 </para> 560 561 </sect2> 562 563</sect1> 564 565<sect1 id="altldapcfg"> 566 <title>Alternative LDAP Database Initialization</title> 567 568 <para><indexterm> 569 <primary>LDAP</primary> 570 <secondary>database</secondary> 571 </indexterm><indexterm> 572 <primary>LDAP</primary> 573 <secondary>initial configuration</secondary> 574 </indexterm> 575 The following procedure may be used as an alternative means of configuring 576 the initial LDAP database. Many administrators prefer to have greater control 577 over how system files get configured. 578 </para> 579 580 <sect2> 581 <title>Initialization of the LDAP Database</title> 582 583 <para><indexterm> 584 <primary>LDIF</primary> 585 </indexterm><indexterm> 586 <primary>Domain Groups</primary> 587 <secondary>well-known</secondary> 588 </indexterm><indexterm> 589 <primary>SID</primary> 590 </indexterm> 591 The first step to get the LDAP server ready for action is to create the LDIF file from 592 which the LDAP database will be preloaded. This is necessary to create the containers 593 into which the user, group, and other accounts are written. It is also necessary to 594 preload the well-known Windows NT Domain Groups, as they must have the correct SID so 595 that they can be recognized as special NT Groups by the MS Windows clients. 596 </para> 597 598 <procedure id="ldapinit"> 599 <title>LDAP Directory Pre-Load Steps</title> 600 601 <step><para> 602 Create a directory in which to store the files you use to generate 603 the LDAP LDIF file for your system. Execute the following: 604<screen> 605&rootprompt; mkdir /etc/openldap/SambaInit 606&rootprompt; chown root:root /etc/openldap/SambaInit 607&rootprompt; chmod 700 /etc/openldap/SambaInit 608</screen> 609 </para></step> 610 611 <step><para> 612 Install the files shown in <link linkend="sbehap-ldapreconfa"/>, <link linkend="sbehap-ldapreconfb"/>, 613 and <link linkend="sbehap-ldapreconfc"/> into the directory 614 <filename>/etc/openldap/SambaInit/SMBLDAP-ldif-preconfig.sh.</filename> These three files are, 615 respectively, parts A, B, and C of the <filename>SMBLDAP-ldif-preconfig.sh</filename> file. 616 </para></step> 617 618 <step><para> 619 Install the files shown in <link linkend="sbehap-ldifpata"/> and <link linkend="sbehap-ldifpatb"/> into the directory 620 <filename>/etc/openldap/SambaInit/.</filename> These two files are 621 parts A and B, respectively, of the <filename>init-ldif.pat</filename> file. 622 </para></step> 623 624 <step><para> 625 Change to the <filename>/etc/openldap/SambaInit</filename> directory. Execute the following: 626<screen> 627&rootprompt; sh SMBLDAP-ldif-preconfig.sh 628 629How do you wish to refer to your organization? 630Suggestions: 631 Black Tire Company, Inc. 632 Cat With Hat Ltd. 633How would you like your organization name to appear? 634Your organization name is: My Organization 635Enter a new name is this is not what you want, press Enter to Continue. 636Name [My Organization]: Abmas Inc. 637 638Samba Config File Location [/etc/samba/smb.conf]: 639Enter a new full path or press Enter to continue. 640Samba Config File Location [/etc/samba/smb.conf]: 641Domain Name: MEGANET2 642Domain SID: S-1-5-21-3504140859-1010554828-2431957765 643 644The name of your Internet domain is now needed in a special format 645as follows, if your domain name is mydomain.org, what we need is 646the information in the form of: 647 Domain ID: mydomain 648 Top level: org 649If your fully qualified hostname is: snoopy.bazaar.garagesale.net 650where "snoopy" is the name of the machine, 651Then the information needed is: 652 Domain ID: garagesale 653 Top Level: net 654 655Found the following domain name: abmas.biz 656I think the bit we are looking for might be: abmas 657Enter the domain name or press Enter to continue: 658 659The top level organization name I will use is: biz 660Enter the top level org name or press Enter to continue: 661&rootprompt; 662</screen> 663 This creates a file called <filename>MEGANET2.ldif</filename>. 664 </para></step> 665 666 <step><para> 667 It is now time to preload the LDAP database with the following 668 command: 669<screen> 670&rootprompt; slapadd -v -l MEGANET2.ldif 671added: "dc=abmas,dc=biz" (00000001) 672added: "cn=Manager,dc=abmas,dc=biz" (00000002) 673added: "ou=People,dc=abmas,dc=biz" (00000003) 674added: "ou=Computers,dc=abmas,dc=biz" (00000004) 675added: "ou=Groups,dc=abmas,dc=biz" (00000005) 676added: "ou=Domains,dc=abmas,dc=biz" (00000006) 677added: "sambaDomainName=MEGANET2,ou=Domains,dc=abmas,dc=biz" (00000007) 678added: "cn=domadmins,ou=Groups,dc=abmas,dc=biz" (00000008) 679added: "cn=domguests,ou=Groups,dc=abmas,dc=biz" (00000009) 680added: "cn=domusers,ou=Groups,dc=abmas,dc=biz" (0000000a) 681</screen> 682 You should verify that the account information was correctly loaded by executing: 683<screen> 684&rootprompt; slapcat 685dn: dc=abmas,dc=biz 686objectClass: dcObject 687objectClass: organization 688dc: abmas 689o: Abmas Inc. 690description: Posix and Samba LDAP Identity Database 691structuralObjectClass: organization 692entryUUID: af552f8e-c4a1-1027-9002-9421e01bf474 693creatorsName: cn=manager,dc=abmas,dc=biz 694modifiersName: cn=manager,dc=abmas,dc=biz 695createTimestamp: 20031217055747Z 696modifyTimestamp: 20031217055747Z 697entryCSN: 2003121705:57:47Z#0x0001#0#0000 698... 699 700dn: cn=domusers,ou=Groups,dc=abmas,dc=biz 701objectClass: posixGroup 702objectClass: sambaGroupMapping 703gidNumber: 513 704cn: domusers 705sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513 706sambaGroupType: 2 707displayName: Domain Users 708description: Domain Users 709structuralObjectClass: posixGroup 710entryUUID: af7e98ba-c4a1-1027-900b-9421e01bf474 711creatorsName: cn=manager,dc=abmas,dc=biz 712modifiersName: cn=manager,dc=abmas,dc=biz 713createTimestamp: 20031217055747Z 714modifyTimestamp: 20031217055747Z 715entryCSN: 2003121705:57:47Z#0x000a#0#0000 716</screen> 717 </para></step> 718 719 <step><para> 720 Your LDAP database is ready for testing. You can now start the LDAP server 721 using the system tool for your Linux operating system. For SUSE Linux, you can 722 do this as follows: 723<screen> 724&rootprompt; rcldap start 725</screen> 726 </para></step> 727 728 <step><para> 729 It is now a good idea to validate that the LDAP server is running correctly. 730 Execute the following: 731<screen> 732&rootprompt; ldapsearch -x -b "dc=abmas,dc=biz" "(ObjectClass=*)" 733# extended LDIF 734# 735# LDAPv3 736# base <dc=abmas,dc=biz> with scope sub 737# filter: (ObjectClass=*) 738# requesting: ALL 739# 740 741# abmas.biz 742dn: dc=abmas,dc=biz 743objectClass: dcObject 744objectClass: organization 745dc: abmas 746o: Abmas Inc. 747description: Posix and Samba LDAP Identity Database 748... 749# domusers, Groups, abmas.biz 750dn: cn=domusers,ou=Groups,dc=abmas,dc=biz 751objectClass: posixGroup 752objectClass: sambaGroupMapping 753gidNumber: 513 754cn: domusers 755sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513 756sambaGroupType: 2 757displayName: Domain Users 758description: Domain Users 759 760# search result 761search: 2 762result: 0 Success 763 764# numResponses: 11 765# numEntries: 10 766</screen> 767 Your LDAP server is ready for creation of additional accounts. 768 </para></step> 769 </procedure> 770 771 </sect2> 772 773<example id="sbehap-ldapreconfa"> 774<title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part A</title> 775<screen> 776#!/bin/bash 777# 778# This script prepares the ldif LDAP load file only 779# 780 781# Pattern File Name 782file=init-ldif.pat 783 784# The name of my organization 785ORGNAME="My Organization" 786 787# My Internet domain. ie: if my domain is: buckets.org, INETDOMAIN="buckets" 788INETDOMAIN="my-domain" 789 790# In the above case, md domain is: buckets.org, TLDORG="org" 791TLDORG="org" 792 793# This is the Samba Domain/Workgroup Name 794DOMNAME="MYWORKGROUP" 795 796# 797# Here We Go ... 798# 799 800cat <<EOF 801 802How do you wish to refer to your organization? 803 804Suggestions: 805 Black Tire Company, Inc. 806 Cat With Hat Ltd. 807 808How would you like your organization name to appear? 809 810EOF 811 812echo "Your organization name is: $ORGNAME" 813echo 814echo "Enter a new name or, press Enter to Continue." 815echo 816</screen> 817</example> 818 819<example id="sbehap-ldapreconfb"> 820<title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part B</title> 821<screen> 822echo -e -n "Name [$ORGNAME]: " 823 read name 824 825if [ ! -z "$name" ]; then 826 ORGNAME=${name} 827fi 828echo 829sed "s/ORGNAME/${ORGNAME}/g" < $file > $file.tmp1 830 831# Try to find smb.conf 832 833if [ -e /usr/local/samba/lib/smb.conf ]; then 834 CONF=/usr/local/samba/lib/smb.conf 835elif [ -e /etc/samba/smb.conf ]; then 836 CONF=/etc/samba/smb.conf 837fi 838 839echo "Samba Config File Location [$CONF]: " 840echo 841echo "Enter a new full path or press Enter to continue." 842echo 843echo -n "Samba Config File Location [$CONF]: " 844 read name 845if [ ! -z "$name" ]; then 846 CONF=$name 847fi 848echo 849 850# Find the name of our Domain/Workgroup 851DOMNAME=`grep -i workgroup ${CONF} | sed "s/ //g" | cut -f2 -d=` 852echo Domain Name: $DOMNAME 853echo 854 855sed "s/DOMNAME/${DOMNAME}/g" < $file.tmp1 > $file.tmp2 856 857DOMSID=`net getlocalsid ${DOMNAME} | cut -f2 -d: | sed "s/ //g"` 858echo Domain SID: $DOMSID 859 860sed "s/DOMSID/${DOMSID}/g" < $file.tmp2 > $file.tmp1 861</screen> 862</example> 863 864<example id="sbehap-ldapreconfc"> 865<title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part C</title> 866<screen> 867cat <<EOL 868The name of your Internet domain is now needed in a special format 869as follows, if your domain name is mydomain.org, what we need is 870the information in the form of: 871 Domain ID: mydomain 872 Top level: org 873 874If your fully qualified hostname is: snoopy.bazaar.garagesale.net 875where "snoopy" is the name of the machine, 876Then the information needed is: 877 Domain ID: garagesale 878 Top Level: net 879 880EOL 881INETDOMAIN=`hostname -d | cut -f1 -d.` 882echo Found the following domain name: `hostname -d` 883echo "I think the bit we are looking for might be: $INETDOMAIN" 884echo 885echo -n "Enter the domain name or press Enter to continue: " 886 read domnam 887if [ ! -z $domnam ]; then 888 INETDOMAIN=$domnam 889fi 890echo 891sed "s/INETDOMAIN/${INETDOMAIN}/g" < $file.tmp1 > $file.tmp2 892TLDORG=`hostname -d | sed "s/${INETDOMAIN}.//g"` 893echo "The top level organization name I will use is: ${TLDORG}" 894echo 895echo -n "Enter the top level org name or press Enter to continue: " 896 read domnam 897if [ ! -z $domnam ]; then 898 TLDORG=$domnam 899fi 900sed "s/TLDORG/${TLDORG}/g" < $file.tmp2 > $DOMNAME.ldif 901rm $file.tmp* 902exit 0 903</screen> 904</example> 905 906<example id="sbehap-ldifpata"> 907<title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part A</title> 908<screen> 909dn: dc=INETDOMAIN,dc=TLDORG 910objectClass: dcObject 911objectClass: organization 912dc: INETDOMAIN 913o: ORGNAME 914description: Posix and Samba LDAP Identity Database 915 916dn: cn=Manager,dc=INETDOMAIN,dc=TLDORG 917objectClass: organizationalRole 918cn: Manager 919description: Directory Manager 920 921dn: ou=People,dc=INETDOMAIN,dc=TLDORG 922objectClass: top 923objectClass: organizationalUnit 924ou: People 925 926dn: ou=Computers,dc=INETDOMAIN,dc=TLDORG 927objectClass: top 928objectClass: organizationalUnit 929ou: Computers 930 931dn: ou=Groups,dc=INETDOMAIN,dc=TLDORG 932objectClass: top 933objectClass: organizationalUnit 934ou: Groups 935 936dn: ou=Idmap,dc=INETDOMAIN,dc=TLDORG 937objectClass: top 938objectClass: organizationalUnit 939ou: Idmap 940 941dn: ou=Domains,dc=INETDOMAIN,dc=TLDORG 942objectClass: top 943objectClass: organizationalUnit 944ou: Domains 945 946dn: sambaDomainName=DOMNAME,ou=Domains,dc=INETDOMAIN,dc=TLDORG 947objectClass: sambaDomain 948sambaDomainName: DOMNAME 949sambaSID: DOMSID 950sambaAlgorithmicRidBase: 1000 951structuralObjectClass: sambaDomain 952</screen> 953</example> 954 955<example id="sbehap-ldifpatb"> 956<title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part B</title> 957<screen> 958dn: cn=domadmins,ou=Groups,dc=INETDOMAIN,dc=TLDORG 959objectClass: posixGroup 960objectClass: sambaGroupMapping 961gidNumber: 512 962cn: domadmins 963sambaSID: DOMSID-512 964sambaGroupType: 2 965displayName: Domain Admins 966description: Domain Administrators 967 968dn: cn=domguests,ou=Groups,dc=INETDOMAIN,dc=TLDORG 969objectClass: posixGroup 970objectClass: sambaGroupMapping 971gidNumber: 514 972cn: domguests 973sambaSID: DOMSID-514 974sambaGroupType: 2 975displayName: Domain Guests 976description: Domain Guests Users 977 978dn: cn=domusers,ou=Groups,dc=INETDOMAIN,dc=TLDORG 979objectClass: posixGroup 980objectClass: sambaGroupMapping 981gidNumber: 513 982cn: domusers 983sambaSID: DOMSID-513 984sambaGroupType: 2 985displayName: Domain Users 986description: Domain Users 987</screen> 988</example> 989 990</sect1> 991 992<sect1> 993<title>The LDAP Account Manager</title> 994 995<para> 996<indexterm><primary>LAM</primary></indexterm> 997<indexterm><primary>LDAP Account Manager</primary><see>LAM</see></indexterm> 998<indexterm><primary>PHP</primary></indexterm> 999<indexterm><primary>unencrypted</primary></indexterm> 1000<indexterm><primary>SSL</primary></indexterm> 1001<indexterm><primary>Posix</primary></indexterm> 1002<indexterm><primary>accounts</primary><secondary>manage</secondary></indexterm> 1003The LDAP Account Manager (LAM) is an application suite that has been written in PHP. 1004LAM can be used with any Web server that has PHP4 support. It connects to the LDAP 1005server either using unencrypted connections or via SSL/TLS. LAM can be used to manage 1006Posix accounts as well as SambaSAMAccounts for users, groups, and Windows machines 1007(hosts). 1008</para> 1009 1010<para> 1011LAM is available from the <ulink url="http://sourceforge.net/projects/lam/">LAM</ulink> 1012home page and from its mirror sites. LAM has been released under the GNU GPL version 2. 1013The current version of LAM is 0.4.9. Release of version 0.5 is expected in the third quarter 1014of 2005. 1015</para> 1016 1017<para> 1018<indexterm><primary>PHP4</primary></indexterm> 1019<indexterm><primary>OpenLDAP</primary></indexterm> 1020<indexterm><primary>Perl</primary></indexterm> 1021Requirements: 1022</para> 1023 1024<itemizedlist> 1025 <listitem><para>A web server that will work with PHP4.</para></listitem> 1026 <listitem><para>PHP4 (available from the <ulink url="http://www.php.net/">PHP</ulink> home page.)</para></listitem> 1027 <listitem><para>OpenLDAP 2.0 or later.</para></listitem> 1028 <listitem><para>A Web browser that supports CSS.</para></listitem> 1029 <listitem><para>Perl.</para></listitem> 1030 <listitem><para>The gettext package.</para></listitem> 1031 <listitem><para>mcrypt + mhash (optional).</para></listitem> 1032 <listitem><para>It is also a good idea to install SSL support.</para></listitem> 1033</itemizedlist> 1034 1035<para> 1036LAM is a useful tool that provides a simple Web-based device that can be used to 1037manage the contents of the LDAP directory to: 1038<indexterm><primary>organizational units</primary></indexterm> 1039<indexterm><primary>operating profiles</primary></indexterm> 1040<indexterm><primary>account policies</primary></indexterm> 1041</para> 1042 1043<itemizedlist> 1044 <listitem><para>Display user/group/host and Domain entries.</para></listitem> 1045 <listitem><para>Manage entries (Add/Delete/Edit).</para></listitem> 1046 <listitem><para>Filter and sort entries.</para></listitem> 1047 <listitem><para>Store and use multiple operating profiles.</para></listitem> 1048 <listitem><para>Edit organizational units (OUs).</para></listitem> 1049 <listitem><para>Upload accounts from a file.</para></listitem> 1050 <listitem><para>Is compatible with Samba-2.2.x and Samba-3.</para></listitem> 1051</itemizedlist> 1052 1053<para> 1054When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba 1055user, group, and windows domain member machine accounts. 1056</para> 1057 1058<para> 1059<indexterm><primary>default password</primary></indexterm> 1060<indexterm><primary>secure connections</primary></indexterm> 1061<indexterm><primary>LAM</primary></indexterm> 1062<indexterm><primary>SSL</primary></indexterm> 1063The default password is <quote>lam.</quote> It is highly recommended that you use only 1064an SSL connection to your Web server for all remote operations involving LAM. If you 1065want secure connections, you must configure your Apache Web server to permit connections 1066to LAM using only SSL. 1067</para> 1068 1069<procedure id="sbehap-laminst"> 1070<title>Apache Configuration Steps for LAM</title> 1071 1072 <step><para> 1073 Extract the LAM package by untarring it as shown here: 1074<screen> 1075&rootprompt; tar xzf ldap-account-manager_0.4.9.tar.gz 1076</screen> 1077 Alternatively, install the LAM DEB for your system using the following command: 1078<screen> 1079&rootprompt; dpkg -i ldap-account-manager_0.4.9.all.deb 1080</screen> 1081 </para></step> 1082 1083 <step><para> 1084 Copy the extracted files to the document root directory of your Web server. 1085 For example, on SUSE Linux Enterprise Server 9, copy to the 1086 <filename>/srv/www/htdocs</filename> directory. 1087 </para></step> 1088 1089 <step><para> 1090 <indexterm><primary>file permissions</primary></indexterm> 1091 Set file permissions using the following commands: 1092<screen> 1093&rootprompt; chown -R wwwrun:www /srv/www/htdocs/lam 1094&rootprompt; chmod 755 /srv/www/htdocs/lam/sess 1095&rootprompt; chmod 755 /srv/www/htdocs/lam/tmp 1096&rootprompt; chmod 755 /srv/www/htdocs/lam/config 1097&rootprompt; chmod 755 /srv/www/htdocs/lam/lib/*pl 1098</screen> 1099 </para></step> 1100 1101 <step><para> 1102 <indexterm><primary>LAM</primary><secondary>configuration file</secondary></indexterm> 1103 Using your favorite editor create the following <filename>config.cfg</filename> 1104 LAM configuration file: 1105<screen> 1106&rootprompt; cd /srv/www/htdocs/lam/config 1107&rootprompt; cp config.cfg_sample config.cfg 1108&rootprompt; vi config.cfg 1109</screen> 1110 <indexterm><primary>LAM</primary><secondary>profile</secondary></indexterm> 1111 <indexterm><primary>LAM</primary><secondary>wizard</secondary></indexterm> 1112 An example file is shown in <link linkend="lamcfg"/>. 1113 This is the minimum configuration that must be completed. The LAM profile 1114 file can be created using a convenient wizard that is part of the LAM 1115 configuration suite. 1116 </para></step> 1117 1118 <step><para> 1119 Start your Web server then, using your Web browser, connect to 1120 <ulink url="http://localhost/lam">LAM</ulink> URL. Click on the 1121 the <parameter>Configuration Login</parameter> link then click on the 1122 Configuration Wizard link to begin creation of the default profile so that 1123 LAM can connect to your LDAP server. Alternately, copy the 1124 <filename>lam.conf_sample</filename> file to a file called 1125 <filename>lam.conf</filename> then, using your favorite editor, 1126 change the settings to match local site needs. 1127 </para></step> 1128</procedure> 1129 1130 <para> 1131 <indexterm><primary>pitfalls</primary></indexterm> 1132 An example of a working file is shown here in <link linkend="lamconf"/>. 1133 This file has been stripped of comments to keep the size small. The comments 1134 and help information provided in the profile file that the wizard creates 1135 is very useful and will help many administrators to avoid pitfalls. 1136 Your configuration file obviously reflects the configuration options that 1137 are preferred at your site. 1138 </para> 1139 1140 <para> 1141 <indexterm><primary>LAM</primary><secondary>login screen</secondary></indexterm> 1142 It is important that your LDAP server is running at the time that LAM is 1143 being configured. This permits you to validate correct operation. 1144 An example of the LAM login screen is provided in <link linkend="lam-login"/>. 1145 </para> 1146 1147 <figure id="lam-login"> 1148 <title>The LDAP Account Manager Login Screen</title> 1149 <imagefile scale="50">lam-login</imagefile> 1150 </figure> 1151 1152 <para> 1153 <indexterm><primary>LAM</primary><secondary>configuration editor</secondary></indexterm> 1154 The LAM configuration editor has a number of options that must be managed correctly. 1155 An example of use of the LAM configuration editor is shown in <link linkend="lam-config"/>. 1156 It is important that you correctly set the minimum and maximum UID/GID values that are 1157 permitted for use at your site. The default values may not be compatible with a need to 1158 modify initial default account values for well-known Windows network users and groups. 1159 The best work-around is to temporarily set the minimum values to zero (0) to permit 1160 the initial settings to be made. Do not forget to reset these to sensible values before 1161 using LAM to add additional users and groups. 1162 </para> 1163 1164 <figure id="lam-config"> 1165 <title>The LDAP Account Manager Configuration Screen</title> 1166 <imagefile scale="50">lam-config</imagefile> 1167 </figure> 1168 1169 <para> 1170 <indexterm><primary>PDF</primary></indexterm> 1171 LAM has some nice, but unusual features. For example, one unexpected feature in most application 1172 screens permits the generation of a PDF file that lists configuration information. This is a well 1173 thought out facility. This option has been edited out of the following screen shots to conserve 1174 space. 1175 </para> 1176 1177 <para> 1178 <indexterm><primary>LAM</primary><secondary>opening screen</secondary></indexterm> 1179 When you log onto LAM the opening screen drops you right into the user manager as shown in 1180 <link linkend="lam-user"/>. This is a logical action as it permits the most-needed facility 1181 to be used immediately. The editing of an existing user, as with the addition of a new user, 1182 is easy to follow and very clear in both layout and intent. It is a simple matter to edit 1183 generic settings, UNIX specific parameters, and then Samba account requirements. Each step 1184 involves clicking a button that intuitively drives you through the process. When you have 1185 finished editing simply press the <guimenu>Final</guimenu> button. 1186 </para> 1187 1188 <figure id="lam-user"> 1189 <title>The LDAP Account Manager User Edit Screen</title> 1190 <imagefile scale="50">lam-users</imagefile> 1191 </figure> 1192 1193 <para> 1194 The edit screen for groups is shown in <link linkend="lam-group"/>. As with the edit screen 1195 for user accounts, group accounts may be rapidly dealt with. <link linkend="lam-group-mem"/> 1196 shows a sub-screen from the group editor that permits users to be assigned secondary group 1197 memberships. 1198 </para> 1199 1200 <figure id="lam-group"> 1201 <title>The LDAP Account Manager Group Edit Screen</title> 1202 <imagefile scale="50">lam-groups</imagefile> 1203 </figure> 1204 1205 <figure id="lam-group-mem"> 1206 <title>The LDAP Account Manager Group Membership Edit Screen</title> 1207 <imagefile scale="50">lam-group-members</imagefile> 1208 </figure> 1209 1210 <para> 1211 <indexterm><primary>smbldap-tools</primary></indexterm><indexterm><primary>scripts</primary></indexterm> 1212 The final screen presented here is one that you should not normally need to use. Host accounts will 1213 be automatically managed using the smbldap-tools scripts. This means that the screen <link linkend="lam-host"/> 1214 will, in most cases, not be used. 1215 </para> 1216 1217 <figure id="lam-host"> 1218 <title>The LDAP Account Manager Host Edit Screen</title> 1219 <imagefile scale="50">lam-hosts</imagefile> 1220 </figure> 1221 1222 <para> 1223 One aspect of LAM that may annoy some users is the way it forces certain conventions on 1224 the administrator. For example, LAM does not permit the creation of Windows user and group 1225 accounts that contain spaces even though the underlying UNIX/Linux 1226 operating system may exhibit no problems with them. Given the propensity for using upper-case 1227 characters and spaces (particularly in the default Windows account names) this may cause 1228 some annoyance. For the rest, LAM is a very useful administrative tool. 1229 </para> 1230 1231 <para> 1232 The next major release, LAM 0.5, will have fewer restrictions and support the latest Samba features 1233 (e.g., logon hours). The new plugin-based architecture also allows management of much more different 1234 account types like plain UNIX accounts. The upload can now handle groups and hosts, too. Another 1235 important point is the tree view which allows browsing and editing LDAP objects directly. 1236 </para> 1237 1238<example id="lamcfg"> 1239<title>Example LAM Configuration File &smbmdash; <filename>config.cfg</filename></title> 1240<screen> 1241# password to add/delete/rename configuration profiles 1242password: not24get 1243 1244# default profile, without ".conf" 1245default: lam 1246</screen> 1247</example> 1248 1249<example id="lamconf"> 1250<title>LAM Profile Control File &smbmdash; <filename>lam.conf</filename></title> 1251<screen> 1252ServerURL: ldap://massive.abmas.org:389 1253Admins: cn=Manager,dc=abmas,dc=biz 1254Passwd: not24get 1255usersuffix: ou=People,dc=abmas,dc=biz 1256groupsuffix: ou=Groups,dc=abmas,dc=biz 1257hostsuffix: ou=Computers,dc=abmas,dc=biz 1258domainsuffix: ou=Domains,dc=abmas,dc=biz 1259MinUID: 0 1260MaxUID: 65535 1261MinGID: 0 1262MaxGID: 65535 1263MinMachine: 20000 1264MaxMachine: 25000 1265userlistAttributes: #uid;#givenName;#sn;#uidNumber;#gidNumber 1266grouplistAttributes: #cn;#gidNumber;#memberUID;#description 1267hostlistAttributes: #cn;#description;#uidNumber;#gidNumber 1268maxlistentries: 30 1269defaultLanguage: en_GB:ISO-8859-1:English (Great Britain) 1270scriptPath: 1271scriptServer: 1272samba3: yes 1273cachetimeout: 5 1274pwdhash: SSHA 1275</screen> 1276</example> 1277 1278</sect1> 1279 1280<sect1> 1281 <title>IDEALX Management Console</title> 1282 1283 <para> 1284 IMC (the IDEALX Mamagement Console) is a tool that can be used as the basis for a comprehensive 1285 web-based management interface for UNIX and Linux systems. 1286 </para> 1287 1288 <para> 1289 The Samba toolset is the first console developped for IMC. It offers a simple and ergonomic 1290 interface for managing a Samba domain controler. The goal is to give Linux administrators who 1291 need to manage production Samba servers an effective, intuitive and consistent management 1292 experience. An IMC screenshot of the user management tool is shown in <link linkend="imcidealx"/>. 1293 </para> 1294 1295 <figure id="imcidealx"> 1296 <title>The IMC Samba User Account Screen</title> 1297 <imagefile scale="40">imc-usermanager2</imagefile> 1298 </figure> 1299 1300 <para> 1301 IMC is built on a set of Perl modules. Most modules are standard CPAN modules. Some are bundled with IMC, 1302 but will soon to be hosted on the CPAN independently, like Struts4P, a port of Struts to the Perl language. 1303 </para> 1304 1305 <para> 1306 For further information regarding IMC refer to the web <ulink url="http://imc.sourceforge.net/">site.</ulink> 1307 Prebuilt RPM packages are also <ulink url="http://imc.sourceforge.net/download.html">available.</ulink> 1308 </para> 1309 1310</sect1> 1311 1312<sect1 id="ch12-SUIDSGID"> 1313 <title>Effect of Setting File and Directory SUID/SGID Permissions Explained</title> 1314 1315 <indexterm><primary>SUID</primary></indexterm> 1316 <indexterm><primary>SGID</primary></indexterm> 1317 <para> 1318 The setting of the SUID/SGID bits on the file or directory permissions flag has particular 1319 consequences. If the file is executable and the SUID bit is set, it executes with the privilege 1320 of (with the UID of) the owner of the file. For example, if you are logged onto a system as 1321 a normal user (let's say as the user <constant>bobj</constant>), and you execute a file that is owned 1322 by the user <constant>root</constant> (uid = 0), and the file has the SUID bit set, then the file is 1323 executed as if you had logged in as the user <constant>root</constant> and then executed the file. 1324 The SUID bit effectively gives you (as <constant>bobj</constant>) administrative privilege for the 1325 use of that executable file. 1326 </para> 1327 1328 <para> 1329 The setting of the SGID bit does precisely the same as the effect of the SUID bit, except that it 1330 applies the privilege to the UNIX group setting. In other words, the file executes with the force 1331 of capability of the group. 1332 </para> 1333 1334 <para> 1335 When the SUID/SGID permissions are set on a directory, all files that are created within that directory 1336 are automatically given the ownership of the SUID user and the SGID group, as per the ownership 1337 of the directory in which the file is created. This means that the system level <command>create()</command> 1338 function executes with the SUID user and/or SGID group of the directory in which the file is 1339 created. 1340 </para> 1341 1342 <para> 1343 If you want to obtain the SUID behavior, simply execute the following command: 1344<screen> 1345&rootprompt; chmod u+s file-or-directory 1346</screen> 1347 To set the SGID properties on a file or a directory, execute this command: 1348<screen> 1349&rootprompt; chmod g+s file-or-directory 1350</screen> 1351 And to set both SUID and SGID properties, execute the following: 1352<screen> 1353&rootprompt; chmod ug+s file-or-directory 1354</screen> 1355 </para> 1356 1357 <para> 1358 Let's consider the example of a directory <filename>/data/accounts</filename>. The permissions on this 1359 directory before setting both SUID and SGID on this directory are: 1360<screen> 1361&rootprompt; ls -al /data/accounts 1362total 1 1363drwxr-xr-x 10 root root 232 Dec 18 17:08 . 1364drwxr-xr-x 21 root root 600 Dec 17 23:15 .. 1365drwxrwxrwx 2 bobj Domain Users 48 Dec 18 17:08 accounts/ 1366drwx------ 2 root root 48 Jan 26 2002 lost+found 1367</screen> 1368 In this example, if the user <constant>maryv</constant> creates a file, it is owned by her. 1369 If <constant>maryv</constant> has the primary group of <constant>Accounts</constant>, the file is 1370 owned by the group <constant>Accounts</constant>, as shown in this listing: 1371<screen> 1372&rootprompt; ls -al /data/accounts/maryvfile.txt 1373drw-rw-r-- 2 maryv Accounts 12346 Dec 18 17:53 1374</screen> 1375 </para> 1376 1377 <para> 1378 Now you set the SUID and SGID and check the result as follows: 1379<screen> 1380&rootprompt; chmod ug+s /data/accounts 1381&rootprompt; ls -al /data/accounts 1382total 1 1383drwxr-xr-x 10 root root 232 Dec 18 17:08 . 1384drwxr-xr-x 21 root root 600 Dec 17 23:15 .. 1385drwsrwsr-x 2 bobj Domain Users 48 Dec 18 17:08 accounts 1386drwx------ 2 root root 48 Jan 26 2002 lost+found 1387</screen> 1388 If <constant>maryv</constant> creates a file in this directory after this change has been made, the 1389 file is owned by the user <constant>bobj</constant>, and the group is set to the group 1390 <constant>Domain Users</constant>, as shown here: 1391<screen> 1392&rootprompt; chmod ug+s /data/accounts 1393&rootprompt; ls -al /data/accounts/maryvfile.txt 1394total 1 1395drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt 1396</screen> 1397 </para> 1398 1399</sect1> 1400 1401<sect1 id="ch12dblck"> 1402 <title>Shared Data Integrity</title> 1403 1404 <para><indexterm> 1405 <primary>data integrity</primary> 1406 </indexterm><indexterm> 1407 <primary>multi-user</primary> 1408 <secondary>data access</secondary> 1409 </indexterm> 1410 The integrity of shared data is often viewed as a particularly emotional issue, especially where 1411 there are concurrent problems with multiuser data access. Contrary to the assertions of some who have 1412 experienced problems in either area, the cause has nothing to do with the phases of the moons of Jupiter. 1413 </para> 1414 1415 <para> 1416 The solution to concurrent multiuser data access problems must consider three separate areas 1417 from which the problem may stem:<indexterm> 1418 <primary>locking</primary> 1419 <secondary>Application level</secondary> 1420 </indexterm><indexterm> 1421 <primary>locking</primary> 1422 <secondary>Client side</secondary> 1423 </indexterm><indexterm> 1424 <primary>locking</primary> 1425 <secondary>Server side</secondary> 1426 </indexterm> 1427 </para> 1428 1429 <itemizedlist> 1430 <listitem><para>application-level locking controls</para></listitem> 1431 <listitem><para>client-side locking controls</para></listitem> 1432 <listitem><para>server-side locking controls</para></listitem> 1433 </itemizedlist> 1434 1435 <para><indexterm> 1436 <primary>database applications</primary> 1437 </indexterm><indexterm> 1438 <primary>Microsoft Access</primary> 1439 </indexterm> 1440 Many database applications use some form of application-level access control. An example of one 1441 well-known application that uses application-level locking is Microsoft Access. Detailed guidance 1442 is provided here because this is the most common application for which problems have been reported. 1443 </para> 1444 1445 <para><indexterm> 1446 <primary>Microsoft Excel</primary> 1447 </indexterm><indexterm> 1448 <primary>Act!</primary> 1449 </indexterm> 1450 Common applications that are affected by client- and server-side locking controls include MS 1451 Excel and Act!. Important locking guidance is provided here. 1452 </para> 1453 1454 1455 <sect2> 1456 <title>Microsoft Access</title> 1457 1458 <para> 1459 The best advice that can be given is to carefully read the Microsoft knowledgebase articles that 1460 cover this area. Examples of relevant documents include: 1461 </para> 1462 1463 <itemizedlist> 1464 <listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</para></listitem> 1465 <listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</para></listitem> 1466 </itemizedlist> 1467 1468 1469 <para><indexterm> 1470 <primary>multi-user</primary> 1471 <secondary>access</secondary> 1472 </indexterm><indexterm> 1473 <primary>exclusive open</primary> 1474 </indexterm> 1475 Make sure that your MS Access database file is configured for multiuser access (not set for 1476 exclusive open). Open MS Access on each client workstation, then set the following: <menuchoice> 1477 <guimenu>(Menu bar) Tools</guimenu><guimenu>Options</guimenu><guimenu>[tab] General</guimenu> 1478 </menuchoice>. Set network path to Default database folder: <filename>\\server\share\folder</filename>. 1479 </para> 1480 1481 <para> 1482 You can configure MS Access file sharing behavior as follows: click <guimenu>[tab] Advanced</guimenu>. 1483 Set:<indexterm> 1484 <primary>record locking</primary> 1485 </indexterm> 1486 </para> 1487 1488 <itemizedlist> 1489 <listitem><para>Default open mode: Shared</para></listitem> 1490 <listitem><para>Default Record Locking: Edited Record</para></listitem> 1491 <listitem><para>Open databases using record_level locking</para></listitem> 1492 </itemizedlist> 1493 1494 <para><indexterm> 1495 <primary>MS Access</primary> 1496 <secondary>validate</secondary> 1497 </indexterm> 1498 You must now commit the changes so that they will take effect. To do so, click 1499 <guimenu>Apply</guimenu><guimenu>Ok</guimenu>. At this point, you should exit MS Access, restart 1500 it, and then validate that these settings have not changed. 1501 </para> 1502 1503 </sect2> 1504 1505 <sect2> 1506 <title>Act! Database Sharing</title> 1507 1508 <para><indexterm> 1509 <primary>ACT! database</primary> 1510 </indexterm><indexterm> 1511 <primary>data corruption</primary> 1512 </indexterm> 1513 Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you 1514 must disable opportunistic locking on the server and all workstations. Failure to do so 1515 results in data corruption. This information is available from the Act! Web site 1516 knowledgebase articles 1517 <ulink url="http://itdomino.saleslogix.com/act.nsf/docid/1998223162925">1998223162925</ulink> 1518 as well as from article 1519 <ulink url="http://itdomino.saleslogix.com/act.nsf/docid/200110485036">200110485036</ulink>. 1520 </para> 1521 1522 <para><indexterm> 1523 <primary>opportunistic locking</primary> 1524 </indexterm><indexterm> 1525 <primary>Act!Diag</primary> 1526 </indexterm> 1527 These documents clearly state that opportunistic locking must be disabled on both 1528 the server (Samba in the case we are interested in here), as well as on every workstation 1529 from which the centrally shared Act! database will be accessed. Act! provides 1530 a tool called <command>Act!Diag</command> that may be used to disable all workstation 1531 registry settings that may otherwise interfere with the operation of Act! 1532 Registered Act! users may download this utility from the Act! Web 1533 <ulink url="http://www.act.com/support/updates/index.cfm">site.</ulink> 1534 </para> 1535 1536 </sect2> 1537 1538 <sect2> 1539 <title>Opportunistic Locking Controls</title> 1540 1541 <para><indexterm> 1542 <primary>file caching</primary> 1543 </indexterm> 1544 Third-party Windows applications may not be compatible with the use of opportunistic file 1545 and record locking. For applications that are known not to be compatible,<footnote><para>Refer to 1546 the application manufacturer's installation guidelines and knowledge base for specific 1547 information regarding compatibility. It is often safe to assume that if the software 1548 manufacturer does not specifically mention incompatibilities with opportunistic file 1549 and record locking, or with Windows client file caching, the application is probably 1550 compatible with Windows (as well as Samba) default settings.</para></footnote> oplock 1551 support may need to be disabled both on the Samba server and on the Windows workstations. 1552 </para> 1553 1554 <para><indexterm> 1555 <primary>cache</primary> 1556 </indexterm><indexterm> 1557 <primary>write lock</primary> 1558 </indexterm><indexterm> 1559 <primary>flush</primary> 1560 <secondary>cache memory</secondary> 1561 </indexterm> 1562 Oplocks enable a Windows client to cache parts of a file that are being 1563 edited. Another windows client may then request to open the file with the 1564 ability to write to it. The server will then ask the original workstation 1565 that had the file open with a write lock to release its lock. Before 1566 doing so, that workstation must flush the file from cache memory to the 1567 disk or network drive. 1568 </para> 1569 1570 <para><indexterm> 1571 <primary>Oplocks</primary> 1572 <secondary>disabled</secondary> 1573 </indexterm> 1574 Disabling of Oplocks usage may require server and client changes. 1575 Oplocks may be disabled by file, by file pattern, on the share, or on the 1576 Samba server. 1577 </para> 1578 1579 <para> 1580 The following are examples showing how Oplock support may be managed using 1581 Samba &smb.conf; file settings: 1582<screen> 1583By file: veto oplock files = myfile.mdb 1584 1585By Pattern: veto oplock files = /*.mdb/ 1586 1587On the Share: oplocks = No 1588 level2 oplocks = No 1589 1590On the server: 1591(in [global]) oplocks = No 1592 level2 oplocks = No 1593</screen> 1594 </para> 1595 1596 <para> 1597 The following registry entries on Microsoft Windows XP Professional, 2000 Professional, and Windows NT4 1598 workstation clients must be configured as shown here: 1599<screen> 1600REGEDIT4 1601 1602[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ 1603 Services\LanmanServer\Parameters] 1604 "EnableOplocks"=dword:00000000 1605 1606[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ 1607 Services\LanmanWorkstation\Parameters] 1608 "UseOpportunisticLocking"=dword:00000000 1609</screen> 1610 </para> 1611 1612 <para> 1613 Comprehensive coverage of file and record-locking controls is provided in TOSHARG2, Chapter 13. 1614 The information in that chapter was obtained from a wide variety of sources. 1615 </para> 1616 1617 </sect2> 1618 1619</sect1> 1620 1621</chapter> 1622 1623