1!== 2!== BROWSING.txt for Samba release 2.0.10 23 Jun 2001 3!== 4Author/s: Many (Thanks to Luke, Jeremy, Andrew, etc.) 5Updated: July 5, 1998 6Status: Current - For VERY Advanced Users ONLY 7 8Summary: This describes how to configure Samba for improved browsing. 9===================================================================== 10 11OVERVIEW: 12========= 13SMB networking provides a mechanism by which clients can access a list 14of machines that are available within the network. This list is called 15the browse list and is heavily used by all SMB clients. Configuration 16of SMB browsing has been problematic for some Samba users, hence this 17document. 18 19Browsing will NOT work if name resolution from NetBIOS names to IP 20addresses does not function correctly. Use of a WINS server is highly 21recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. 22WINS allows remote segment clients to obtain NetBIOS name_type information 23that can NOT be provided by any other means of name resolution. 24 25===================================================================== 26 27BROWSING 28======== 29Samba now fully supports browsing. The browsing is supported by nmbd 30and is also controlled by options in the smb.conf file (see smb.conf(5)). 31 32Samba can act as a local browse master for a workgroup and the ability 33for samba to support domain logons and scripts is now available. See 34DOMAIN.txt for more information on domain logons. 35 36Samba can also act as a domain master browser for a workgroup. This 37means that it will collate lists from local browse masters into a 38wide area network server list. In order for browse clients to 39resolve the names they may find in this list, it is recommended that 40both samba and your clients use a WINS server. 41 42Note that you should NOT set Samba to be the domain master for a 43workgroup that has the same name as an NT Domain: on each wide area 44network, you must only ever have one domain master browser per workgroup, 45regardless of whether it is NT, Samba or any other type of domain master 46that is providing this service. 47 48[Note that nmbd can be configured as a WINS server, but it is not 49necessary to specifically use samba as your WINS server. NTAS can 50be configured as your WINS server. In a mixed NT server and 51samba environment on a Wide Area Network, it is recommended that 52you use the NT server's WINS server capabilities. In a samba-only 53environment, it is recommended that you use one and only one nmbd 54as your WINS server]. 55 56To get browsing to work you need to run nmbd as usual, but will need 57to use the "workgroup" option in smb.conf to control what workgroup 58Samba becomes a part of. 59 60Samba also has a useful option for a Samba server to offer itself for 61browsing on another subnet. It is recommended that this option is only 62used for 'unusual' purposes: announcements over the internet, for 63example. See "remote announce" in the smb.conf man page. 64 65If something doesn't work then hopefully the log.nmb file will 66help you track down the problem. Try a debug level of 2 or 3 for 67finding problems. 68 69Note that if it doesn't work for you, then you should still be able to 70type the server name as \\SERVER in filemanager then hit enter and 71filemanager should display the list of available shares. 72 73Some people find browsing fails because they don't have the global 74"guest account" set to a valid account. Remember that the IPC$ 75connection that lists the shares is done as guest, and thus you must 76have a valid guest account. 77 78Also, a lot of people are getting bitten by the problem of too many 79parameters on the command line of nmbd in inetd.conf. This trick is to 80not use spaces between the option and the parameter (eg: -d2 instead 81of -d 2), and to not use the -B and -N options. New versions of nmbd 82are now far more likely to correctly find your broadcast and network 83address, so in most cases these aren't needed. 84 85The other big problem people have is that their broadcast address, 86netmask or IP address is wrong (specified with the "interfaces" option 87in smb.conf) 88 89 90BROWSING ACROSS SUBNETS 91======================= 92 93With the release of Samba 1.9.17(alpha1 and above) Samba has been 94updated to enable it to support the replication of browse lists 95across subnet boundaries. New code and options have been added to 96achieve this. This section describes how to set this feature up 97in different settings. 98 99To see browse lists that span TCP/IP subnets (ie. networks separated 100by routers that don't pass broadcast traffic) you must set up at least 101one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing 102NetBIOS name to IP address translation to be done by doing a direct 103query of the WINS server. This is done via a directed UDP packet on 104port 137 to the WINS server machine. The reason for a WINS server is 105that by default, all NetBIOS name to IP address translation is done 106by broadcasts from the querying machine. This means that machines 107on one subnet will not be able to resolve the names of machines on 108another subnet without using a WINS server. 109 110Remember, for browsing across subnets to work correctly, all machines, 111be they Windows 95, Windows NT, or Samba servers must have the IP address 112of a WINS server given to them by a DHCP server, or by manual configuration 113(for Win95 and WinNT, this is in the TCP/IP Properties, under Network 114settings) for Samba this is in the smb.conf file. 115 116How does cross subnet browsing work ? 117===================================== 118 119Cross subnet browsing is a complicated dance, containing multiple 120moving parts. It has taken Microsoft several years to get the code 121that achieves this correct, and Samba lags behind in some areas. 122However, with the 1.9.17 release, Samba is capable of cross subnet 123browsing when configured correctly. 124 125Consider a network set up as follows : 126 127 (DMB) 128 N1_A N1_B N1_C N1_D N1_E 129 | | | | | 130 ------------------------------------------------------- 131 | subnet 1 | 132 +---+ +---+ 133 |R1 | Router 1 Router 2 |R2 | 134 +---+ +---+ 135 | | 136 | subnet 2 subnet 3 | 137 -------------------------- ------------------------------------ 138 | | | | | | | | 139 N2_A N2_B N2_C N2_D N3_A N3_B N3_C N3_D 140 (WINS) 141 142Consisting of 3 subnets (1, 2, 3) conneted by two routers 143(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines 144on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume 145for the moment that all these machines are configured to be in the 146same workgroup (for simplicities sake). Machine N1_C on subnet 1 147is configured as Domain Master Browser (ie. it will collate the 148browse lists for the workgroup). Machine N2_D is configured as 149WINS server and all the other machines are configured to register 150their NetBIOS names with it. 151 152As all these machines are booted up, elections for master browsers 153will take place on each of the three subnets. Assume that machine 154N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on 155subnet 3 - these machines are known as local master browsers for 156their particular subnet. N1_C has an advantage in winning as the 157local master browser on subnet 1 as it is set up as Domain Master 158Browser. 159 160On each of the three networks, machines that are configured to 161offer sharing services will broadcast that they are offering 162these services. The local master browser on each subnet will 163receive these broadcasts and keep a record of the fact that 164the machine is offering a service. This list of records is 165the basis of the browse list. For this case, assume that 166all the machines are configured to offer services so all machines 167will be on the browse list. 168 169For each network, the local master browser on that network is 170considered 'authoritative' for all the names it receives via 171local broadcast. This is because a machine seen by the local 172master browser via a local broadcast must be on the same 173network as the local master browser and thus is a 'trusted' 174and 'verifiable' resource. Machines on other networks that 175the local master browsers learn about when collating their 176browse lists have not been directly seen - these records are 177called 'non-authoritative'. 178 179At this point the browse lists look as follows (these are 180the machines you would see in your network neighborhood if 181you looked in it on a particular network right now). 182 183Subnet Browse Master List 184------ ------------- ---- 185Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E 186 187Subnet2 N2_B N2_A, N2_B, N2_C, N2_D 188 189Subnet3 N3_D N3_A, N3_B, N3_C, N3_D 190 191Note that at this point all the subnets are separate, no 192machine is seen across any of the subnets. 193 194Now examine subnet 2. As soon as N2_B has become the local 195master browser it looks for a Domain master browser to synchronize 196its browse list with. It does this by querying the WINS server 197(N2_D) for the IP address associated with the NetBIOS name 198WORKGROUP<1B>. This name was registerd by the Domain master 199browser (N1_C) with the WINS server as soon as it was booted. 200 201Once N2_B knows the address of the Domain master browser it 202tells it that is the local master browser for subnet 2 by 203sending a MasterAnnouncement packet as a UDP port 138 packet. 204It then synchronizes with it by doing a NetServerEnum2 call. This 205tells the Domain Master Browser to send it all the server 206names it knows about. Once the domain master browser receives 207the MasterAnnouncement packet it schedules a synchronization 208request to the sender of that packet. After both synchronizations 209are done the browse lists look like : 210 211Subnet Browse Master List 212------ ------------- ---- 213Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, 214 N2_A(*), N2_B(*), N2_C(*), N2_D(*) 215 216Subnet2 N2_B N2_A, N2_B, N2_C, N2_D 217 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) 218 219Subnet3 N3_D N3_A, N3_B, N3_C, N3_D 220 221Servers with a (*) after them are non-authoritative names. 222 223At this point users looking in their network neighborhood on 224subnets 1 or 2 will see all the servers on both, users on 225subnet 3 will still only see the servers on their own subnet. 226 227The same sequence of events that occured for N2_B now occurs 228for the local master browser on subnet 3 (N3_D). When it 229synchronizes browse lists with the domain master browser (N1_A) 230it gets both the server entries on subnet 1, and those on 231subnet 2. After N3_D has synchronized with N1_C and vica-versa 232the browse lists look like. 233 234Subnet Browse Master List 235------ ------------- ---- 236Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, 237 N2_A(*), N2_B(*), N2_C(*), N2_D(*), 238 N3_A(*), N3_B(*), N3_C(*), N3_D(*) 239 240Subnet2 N2_B N2_A, N2_B, N2_C, N2_D 241 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) 242 243Subnet3 N3_D N3_A, N3_B, N3_C, N3_D 244 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), 245 N2_A(*), N2_B(*), N2_C(*), N2_D(*) 246 247Servers with a (*) after them are non-authoritative names. 248 249At this point users looking in their network neighborhood on 250subnets 1 or 3 will see all the servers on all sunbets, users on 251subnet 2 will still only see the servers on subnets 1 and 2, but not 3. 252 253Finally, the local master browser for subnet 2 (N2_B) will sync again 254with the domain master browser (N1_C) and will recieve the missing 255server entries. Finally - and as a steady state (if no machines 256are removed or shut off) the browse lists will look like : 257 258Subnet Browse Master List 259------ ------------- ---- 260Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, 261 N2_A(*), N2_B(*), N2_C(*), N2_D(*), 262 N3_A(*), N3_B(*), N3_C(*), N3_D(*) 263 264Subnet2 N2_B N2_A, N2_B, N2_C, N2_D 265 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) 266 N3_A(*), N3_B(*), N3_C(*), N3_D(*) 267 268Subnet3 N3_D N3_A, N3_B, N3_C, N3_D 269 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), 270 N2_A(*), N2_B(*), N2_C(*), N2_D(*) 271 272Servers with a (*) after them are non-authoritative names. 273 274Synchronizations between the domain master browser and local 275master browsers will continue to occur, but this should be a 276steady state situation. 277 278If either router R1 or R2 fails the following will occur: 279 2801) Names of computers on each side of the inaccessible network fragments 281will be maintained for as long as 36 minutes, in the network neighbourhood 282lists. 283 2842) Attempts to connect to these inaccessible computers will fail, but the 285names will not be removed from the network neighbourhood lists. 286 2873) If one of the fragments is cut off from the WINS server, it will only 288be able to access servers on its local subnet, by using subnet-isolated 289broadcast NetBIOS name resolution. The effects are similar to that of 290losing access to a DNS server. 291 292Setting up a WINS server 293======================== 294 295Either a Samba machine or a Windows NT Server machine may be set up 296as a WINS server. To set a Samba machine to be a WINS server you must 297add the following option to the smb.conf file on the selected machine : 298in the [globals] section add the line 299 300 wins support = yes 301 302Versions of Samba previous to 1.9.17 had this parameter default to 303yes. If you have any older versions of Samba on your network it is 304strongly suggested you upgrade to 1.9.17 or above, or at the very 305least set the parameter to 'no' on all these machines. 306 307Machines with "wins support = yes" will keep a list of all NetBIOS 308names registered with them, acting as a DNS for NetBIOS names. 309 310You should set up only ONE wins server. Do NOT set the 311"wins support = yes" option on more than one Samba server. 312 313To set up a Windows NT Server as a WINS server you need to set up 314the WINS service - see your NT documentation for details. Note that 315Windows NT WINS Servers can replicate to each other, allowing more 316than one to be set up in a complex subnet environment. As Microsoft 317refuse to document these replication protocols Samba cannot currently 318participate in these replications. It is possible in the future that 319a Samba->Samba WINS replication protocol may be defined, in which 320case more than one Samba machine could be set up as a WINS server 321but currently only one Samba server should have the "wins support = yes" 322parameter set. 323 324After the WINS server has been configured you must ensure that all 325machines participating on the network are configured with the address 326of this WINS server. If your WINS server is a Samba machine, fill in 327the Samba machine IP address in the "Primary WINS Server" field of 328the "Control Panel->Network->Protocols->TCP->WINS Server" dialogs 329in Windows 95 or Windows NT. To tell a Samba server the IP address 330of the WINS server add the following line to the [global] section of 331all smb.conf files : 332 333 wins server = <name or IP address> 334 335where <name or IP address> is either the DNS name of the WINS server 336machine or its IP address. 337 338Note that this line MUST NOT BE SET in the smb.conf file of the Samba 339server acting as the WINS server itself. If you set both the 340"wins support = yes" option and the "wins server = <name>" option then 341nmbd will fail to start. 342 343There are two possible scenarios for setting up cross subnet browsing. 344The first details setting up cross subnet browsing on a network containing 345Windows 95, Samba and Windows NT machines that are not configured as 346part of a Windows NT Domain. The second details setting up cross subnet 347browsing on networks that contain NT Domains. 348 349Setting up Browsing in a WORKGROUP 350================================== 351 352To set up cross subnet browsing on a network containing machines 353in up to be in a WORKGROUP, not an NT Domain you need to set up one 354Samba server to be the Domain Master Browser (note that this is *NOT* 355the same as a Primary Domain Controller, although in an NT Domain the 356same machine plays both roles). The role of a Domain master browser is 357to collate the browse lists from local master browsers on all the 358subnets that have a machine participating in the workgroup. Without 359one machine configured as a domain master browser each subnet would 360be an isolated workgroup, unable to see any machines on any other 361subnet. It is the presense of a domain master browser that makes 362cross subnet browsing possible for a workgroup. 363 364In an WORKGROUP environment the domain master browser must be a 365Samba server, and there must only be one domain master browser per 366workgroup name. To set up a Samba server as a domain master browser, 367set the following option in the [global] section of the smb.conf file : 368 369 domain master = yes 370 371The domain master browser should also preferrably be the local master 372browser for its own subnet. In order to achieve this set the following 373options in the [global] section of the smb.conf file : 374 375 domain master = yes 376 local master = yes 377 preferred master = yes 378 os level = 65 379 380The domain master browser may be the same machine as the WINS 381server, if you require. 382 383Next, you should ensure that each of the subnets contains a 384machine that can act as a local master browser for the 385workgroup. Any NT machine should be able to do this, as will 386Windows 95 machines (although these tend to get rebooted more 387often, so it's not such a good idea to use these). To make a 388Samba server a local master browser set the following 389options in the [global] section of the smb.conf file : 390 391 domain master = no 392 local master = yes 393 preferred master = yes 394 os level = 65 395 396Do not do this for more than one Samba server on each subnet, 397or they will war with each other over which is to be the local 398master browser. 399 400The "local master" parameter allows Samba to act as a local master 401browser. The "preferred master" causes nmbd to force a browser 402election on startup and the "os level" parameter sets Samba high 403enough so that it should win any browser elections. 404 405If you have an NT machine on the subnet that you wish to 406be the local master browser then you can disable Samba from 407becoming a local master browser by setting the following 408options in the [global] section of the smb.conf file : 409 410 domain master = no 411 local master = no 412 preferred master = no 413 os level = 0 414 415Setting up Browsing in a DOMAIN 416=============================== 417 418If you are adding Samba servers to a Windows NT Domain then 419you must not set up a Samba server as a domain master browser. 420By default, a Windows NT Primary Domain Controller for a Domain 421name is also the Domain master browser for that name, and many 422things will break if a Samba server registers the Domain master 423browser NetBIOS name (DOMAIN<1B>) with WINS instead of the PDC. 424 425For subnets other than the one containing the Windows NT PDC 426you may set up Samba servers as local master browsers as 427described. To make a Samba server a local master browser set 428the following options in the [global] section of the smb.conf 429file : 430 431 domain master = no 432 local master = yes 433 preferred master = yes 434 os level = 65 435 436If you wish to have a Samba server fight the election with machines 437on the same subnet you may set the "os level" parameter to lower 438levels. By doing this you can tune the order of machines that 439will become local master browsers if they are running. For 440more details on this see the section "FORCING SAMBA TO BE THE MASTER" 441below. 442 443If you have Windows NT machines that are members of the domain 444on all subnets, and you are sure they will always be running then 445you can disable Samba from taking part in browser elections and 446ever becoming a local master browser by setting following options 447in the [global] section of the smb.conf file : 448 449 domain master = no 450 local master = no 451 preferred master = no 452 os level = 0 453 454FORCING SAMBA TO BE THE MASTER 455============================== 456 457Who becomes the "master browser" is determined by an election process 458using broadcasts. Each election packet contains a number of parameters 459which determine what precedence (bias) a host should have in the 460election. By default Samba uses a very low precedence and thus loses 461elections to just about anyone else. 462 463If you want Samba to win elections then just set the "os level" global 464option in smb.conf to a higher number. It defaults to 0. Using 34 465would make it win all elections over every other system (except other 466samba systems!) 467 468A "os level" of 2 would make it beat WfWg and Win95, but not NTAS. A 469NTAS domain controller uses level 32. 470 471The maximum os level is 255 472 473If you want samba to force an election on startup, then set the 474"preferred master" global option in smb.conf to "yes". Samba will 475then have a slight advantage over other potential master browsers 476that are not preferred master browsers. Use this parameter with 477care, as if you have two hosts (whether they are windows 95 or NT or 478samba) on the same local subnet both set with "preferred master" to 479"yes", then periodically and continually they will force an election 480in order to become the local master browser. 481 482If you want samba to be a "domain master browser", then it is 483recommended that you also set "preferred master" to "yes", because 484samba will not become a domain master browser for the whole of your 485LAN or WAN if it is not also a local master browser on its own 486broadcast isolated subnet. 487 488It is possible to configure two samba servers to attempt to become 489the domain master browser for a domain. The first server that comes 490up will be the domain master browser. All other samba servers will 491attempt to become the domain master browser every 5 minutes. They 492will find that another samba server is already the domain master 493browser and will fail. This provides automatic redundancy, should 494the current domain master browser fail. 495 496 497MAKING SAMBA THE DOMAIN MASTER 498============================== 499 500The domain master is responsible for collating the browse lists of 501multiple subnets so that browsing can occur between subnets. You can 502make samba act as the domain master by setting "domain master = yes" 503in smb.conf. By default it will not be a domain master. 504 505Note that you should NOT set Samba to be the domain master for a 506workgroup that has the same name as an NT Domain. 507 508When samba is the domain master and the master browser it will listen 509for master announcements (made roughly every twelve minutes) from local 510master browsers on other subnets and then contact them to synchronise 511browse lists. 512 513If you want samba to be the domain master then I suggest you also set 514the "os level" high enough to make sure it wins elections, and set 515"preferred master" to "yes", to get samba to force an election on 516startup. 517 518Note that all your servers (including samba) and clients should be 519using a WINS server to resolve NetBIOS names. If your clients are only 520using broadcasting to resolve NetBIOS names, then two things will occur: 521 522a) your local master browsers will be unable to find a domain master 523 browser, as it will only be looking on the local subnet. 524 525b) if a client happens to get hold of a domain-wide browse list, and 526 a user attempts to access a host in that list, it will be unable to 527 resolve the NetBIOS name of that host. 528 529If, however, both samba and your clients are using a WINS server, then: 530 531a) your local master browsers will contact the WINS server and, as long as 532 samba has registered that it is a domain master browser with the WINS 533 server, your local master browser will receive samba's ip address 534 as its domain master browser. 535 536b) when a client receives a domain-wide browse list, and a user attempts 537 to access a host in that list, it will contact the WINS server to 538 resolve the NetBIOS name of that host. as long as that host has 539 registered its NetBIOS name with the same WINS server, the user will 540 be able to see that host. 541 542NOTE ABOUT BROADCAST ADDRESSES 543============================== 544 545If your network uses a "0" based broadcast address (for example if it 546ends in a 0) then you will strike problems. Windows for Workgroups 547does not seem to support a 0's broadcast and you will probably find 548that browsing and name lookups won't work. 549 550 551MULTIPLE INTERFACES 552=================== 553 554Samba now supports machines with multiple network interfaces. If you 555have multiple interfaces then you will need to use the "interfaces" 556option in smb.conf to configure them. See smb.conf(5) for details. 557 558