1<?xml version="1.0" encoding="iso-8859-1"?> 2<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3<chapter id="small"> 4 <title>Small Office Networking</title> 5 6 <para> 7 <link linkend="simple"/> focused on the basics of simple yet effective 8 network solutions. Network administrators who take pride in their work 9 (that's most of us, right?) take care to deliver what our users want, 10 but not too much more. If we make things too complex, we confound our users 11 and increase costs of network ownership. A professional network manager 12 avoids the temptation to put too much pizazz into the way that the network 13 operates. Some creativity is helpful, but keep it under control &smbmdash; 14 good advice that the following two scenarios illustrate. 15 </para> 16 17 <para> 18 <indexterm><primary>Netware</primary></indexterm> 19 In one case the network administrator of a mid-sized company spent three 20 months building a new network to replace an old Netware server. What he 21 delivered had all the bells and whistles he could muster. There were a 22 few teething problems during the changeover, nothing serious but a little 23 disruptive all the same. Users were exposed to many changes at once. The 24 network administrator was asked to resign two months after implementing 25 the new system because so many staff complained they had lost time and 26 were not happy with the new network. Everything was automated, and he 27 delivered more features than any advanced user could think of. He was 28 just too smart for his own good. 29 </para> 30 31 <para> 32 In the case of the other company, a new network manager was appointed 33 to oversee the replacement of a LanTastic network with an MS Windows 34 NT 4.0 network. He had the replacement installed and operational within 35 two weeks. Before installation and changeover, he called a meeting to 36 explain to all users what was going to happen, how it would affect them, 37 and that he would be available 24 hours a day to help them transition. 38 One week after conversion, he held another meeting asking for cooperation 39 in the introduction of a few new features that would help to make life 40 easier. Network users were thrilled with the help he provided. The network 41 he implemented was nowhere near as complex as in the first example, had fewer 42 features, and yet he had happy users. Months later he was still adding 43 new innovations. He always asked the users if a 44 particular feature was what they wanted. He asked his boss for a raise 45 and got it. He often told me, <quote>Always keep a few new tricks up your 46 sleeves for when you need them.</quote> Was he smart? You decide. Let's 47 get on with our next exercise. 48 </para> 49 50<sect1> 51 <title>Introduction</title> 52 53 <para> 54 Abmas Accounting has grown. Mr. Meany likes you and says he knew you 55 were the right person for the job. That's why he asked you to install the 56 new server. The past few months have been hard work. You advised Mr. Meany 57 that it is time for a change. Abmas now has 52 users, having acquired an 58 investment consulting business recently. The new users were added to the 59 network without any problems. 60 </para> 61 62 <para> 63 Some of the Windows clients are nearly past their use-by date. You found damaged and unusable software on 64 some of the workstations that came with the acquired business and found some machines in need of both 65 hardware and software maintenance. 66 </para> 67 68 <sect2> 69 <title>Assignment Tasks</title> 70 71 <para> 72 <indexterm><primary>Windows XP</primary></indexterm> 73 Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure 74 that the business is running efficiently. Many of the new staff want notebook 75 computers. They visit customer business premises and need to use local network 76 facilities; these users are technically competent. The company uses a 77 business application that requires Windows XP Professional. In short, a complete 78 client upgrade is about to happen. Mr. Meany told you that he is working 79 on another business acquisition and that by the time he retires there will be 80 80 to 100 users. 81 </para> 82 83 <para> 84 Mr. Meany is not concerned about security. He wants to make it easier for 85 staff to do their work. He has hired you to help him appoint a full-time 86 network manager before he retires. Above all, he says he is investing in 87 the ability to grow. He is determined to live his lifelong dream and 88 hand the business over to a bright and capable executive who can make 89 things happen. This means your network design must cope well with 90 growth. 91 </para> 92 93 <para> 94 In a few months, Abmas will require an Internet connection for email and so 95 that staff can easily obtain software updates. Mr. Meany is warming up to 96 the installation of antivirus software but is not yet ready to approve 97 this expense. He told you to spend the money a virus scanner costs 98 on better quality notebook computers for mobile users. 99 </para> 100 101 <para> 102 One of Mr. Meany's golfing partners convinced him to buy new laser 103 printers, one black only, the other a color laser printer. Staff support 104 the need for a color printer so they can present more attractive proposals 105 and reports. 106 </para> 107 108 <para> 109 Mr. Meany also asked if it would be possible for one of the staff to manage 110 user accounts from the Windows desktop. That person will be responsible for 111 basic operations. 112 </para> 113 114 </sect2> 115</sect1> 116 117<sect1> 118 <title>Dissection and Discussion</title> 119 120 <para> 121 What are the key requirements in this business example? A quick review indicates 122 a need for 123 </para> 124 125 <itemizedlist> 126 <listitem><para> 127 Scalability, from 52 to over 100 users in 12 months 128 </para></listitem> 129 130 <listitem><para> 131 Mobile computing capability 132 <indexterm><primary>mobile computing</primary></indexterm> 133 </para></listitem> 134 135 <listitem><para> 136 Improved reliability and usability 137 </para></listitem> 138 139 <listitem><para> 140 Easier administration 141 </para></listitem> 142 </itemizedlist> 143 144 <para> 145 In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server 146 (as in <link linkend="AccountingOffice"/>). 147 148 </para> 149 150 151 <sect2> 152 <title>Technical Issues</title> 153 154 <para> 155 <indexterm><primary>smbpasswd</primary></indexterm> 156 <indexterm><primary>DHCP</primary></indexterm> 157 <indexterm><primary>DNS</primary></indexterm> 158 <indexterm><primary>WINS</primary></indexterm> 159 <indexterm><primary>Domain</primary></indexterm> 160 It is time to implement a domain security environment. You will use the <constant> 161 smbpasswd</constant> (default) backend. You should implement a DHCP server. There is no need to 162 run DNS at this time, but the system will use WINS. The domain name will be <constant> 163 BILLMORE</constant>. This time, the name of the server will be <constant>SLEETH</constant>. 164 </para> 165 166 <para> 167 All printers will be configured as DHCP clients. The DHCP server will assign 168 the printer a fixed IP address by way of its Ethernet interface (MAC) address. 169 See <link linkend="dhcp01"/>. 170 </para> 171 172 <note><para> 173 The &smb.conf; file you are creating in this exercise can be used with equal effectiveness 174 with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is 175 possible to start with the installation that you have created here, migrate it 176 to a Samba-3 configuration, and then secure the system further. Configurations following 177 this one utilize features that may not be supported in Samba-2.2.x releases. 178 However, you should note that the examples in each chapter start with the assumption 179 that a fresh new installation is being effected. 180 </para></note> 181 182 <para> 183 Later on, when the Internet connection is implemented, you will add DNS as well as 184 other enhancements. It is important that you plan accordingly. 185 </para> 186 187 <para> 188 <indexterm><primary>Ethernet switch</primary></indexterm> 189 You have split the network into two separate areas. Each has its own Ethernet switch. 190 There are 20 users on the accounting network and 32 users on the financial services 191 network. The server has two network interfaces, one serving each network. The 192 network printers will be located in a central area. You plan to install the new 193 printers and keep the old printer in use also. 194 </para> 195 196 <para> 197 You will provide separate file storage areas for each business entity. The old system 198 will go away, accounting files will be handled under a single directory, and files will 199 be stored under customer name, not under a personal work area. Staff will be made 200 responsible for file location, so the old share point must be maintained. 201 </para> 202 203 <para> 204 Given that DNS will not be used, you will configure WINS name resolution for UNIX 205 hostname name resolution. 206 </para> 207 208 <para> 209 <indexterm><primary>Domain</primary><secondary>groups</secondary></indexterm> 210 <indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm> 211 It is necessary to map Windows Domain Groups to UNIX groups. It is 212 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two 213 key staff groups in the firm are accounting staff and financial services staff. 214 For these, it is necessary to create UNIX groups as well as Windows Domain Groups. 215 </para> 216 217 <para> 218 In the sample &smb.conf; file, you have configured Samba to call the UNIX 219 <command>groupadd</command> to add group entries. This utility does not permit 220 the addition of group names that contain uppercase characters or spaces. This 221 is considered a bug. The <command>groupadd</command> is part of the 222 <command>shadow-utils</command> open source software package. A later release 223 of this package may have been patched to resolve this bug. If your operating 224 platform has this bug, it means that attempts to add a Windows Domain Group that 225 has either a space or uppercase characters in it will fail. See 226 <emphasis>TOSHARG2</emphasis>, Chapter 11, Section 11.3.1, Example 11.1, for 227 more information. 228 </para> 229 230 <para> 231 <indexterm><primary>CUPS</primary></indexterm> 232 Vendor-supplied printer drivers will be installed on each client. The CUPS print 233 spooler on the UNIX host will be operated in <constant>raw</constant> mode. 234 </para> 235 236 </sect2> 237 238 <sect2> 239 <title>Political Issues</title> 240 241 <para> 242 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance. 243 He is willing to spend money on things he believes are of value. You need more 244 time to convince him of real priorities. 245 </para> 246 247 <para> 248 Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be 249 supplied with antivirus software? Above all, demonstrate good purchase value and remember 250 to make your users happy. 251 </para> 252 253 </sect2> 254 255</sect1> 256 257<sect1> 258 <title>Implementation</title> 259 260 <para> 261 <indexterm><primary>migration</primary></indexterm> 262 In this example, the assumption is made that this server is being configured from a clean start. 263 The alternate approach could be to demonstrate the migration of the system that is documented 264 in <link linkend="AcctgNet"/> to meet the new requirements. The decision to treat this case, as with 265 future examples, as a new installation is based on the premise that you can determine 266 the migration steps from the information provided in <link linkend="ntmigration"/>. 267 Additionally, a fresh installation makes the example easier to follow. 268 </para> 269 270 <para> 271 <indexterm><primary>group membership</primary></indexterm> 272 Each user will be given a home directory on the UNIX system, which will be available as a private 273 share. Two additional shares will be created, one for the accounting department and the other for 274 the financial services department. Network users will be given access to these shares by way 275 of group membership. 276 </para> 277 278 <para> 279 <indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm> 280 UNIX group membership is the primary mechanism by which Windows Domain users will be granted 281 rights and privileges within the Windows environment. 282 </para> 283 284 <para> 285 <indexterm><primary>sticky bit</primary></indexterm> 286 The user <command>alanm</command> will be made the owner of all files. This will be preserved 287 by setting the sticky bit (set UID/GID) on the top-level directories. 288 </para> 289 290 <para> 291 <figure id="acct2net"> 292 <title>Abmas Accounting &smbmdash; 52-User Network Topology</title> 293 <imagefile scale="100">acct2net</imagefile> 294 </figure> 295</para> 296 297 <procedure> 298 <title>Server Installation Steps</title> 299 300 <step><para> 301 Using UNIX/Linux system tools, name the server <constant>sleeth</constant>. 302 </para></step> 303 304 <step><para> 305 <indexterm><primary>/etc/hosts</primary></indexterm> 306 Place an entry for the machine <constant>sleeth</constant> in the <filename>/etc/hosts</filename>. 307 The printers are network attached, so there should be entries for the 308 network printers also. An example <filename>/etc/hosts</filename> file is shown here: 309<screen> 310192.168.1.1 sleeth sleeth1 311192.168.2.1 sleeth2 312192.168.1.10 hplj6 313192.168.1.11 hplj4 314192.168.2.10 qms 315</screen> 316 </para></step> 317 318 <step><para> 319 Install the Samba-3 binary RPM from the Samba-Team FTP site. 320 </para></step> 321 322 <step><para> 323 Install the ISC DHCP server using the UNIX/Linux system tools available to you. 324 </para></step> 325 326 <step><para> 327 <indexterm><primary>/etc/rc.d/rc.local</primary></indexterm> 328 <indexterm><primary>IP forwarding</primary></indexterm> 329 <indexterm><primary>router</primary></indexterm> 330 <indexterm><primary>/proc/sys/net/ipv4/ip_forward</primary></indexterm> 331 Because Samba will be operating over two network interfaces and clients on each side 332 may want to be able to reach clients on the other side, it is imperative that IP forwarding 333 is enabled. Use the system tool of your choice to enable IP forwarding. In the 334 absence of such a tool on the Linux system, add to the <filename>/etc/rc.d/rc.local</filename> 335 file an entry as follows: 336<screen> 337echo 1 > /proc/sys/net/ipv4/ip_forward 338</screen> 339 This causes the Linux kernel to forward IP packets so that it acts as a router. 340 </para></step> 341 342 <step><para> 343 Install the &smb.conf; file as shown in <link linkend="acct2conf"/> and 344 <link linkend="acct3conf"/>. Combine these two examples to form a single 345 <filename>/etc/samba/smb.conf</filename> file. 346 </para></step> 347 348 <step><para> 349 <indexterm><primary>smbpasswd</primary></indexterm> 350 Add the user <command>root</command> to the Samba password backend: 351<screen> 352&rootprompt; smbpasswd -a root 353New SMB password: XXXXXXX 354Retype new SMB password: XXXXXXX 355&rootprompt; 356</screen> 357 <indexterm><primary>administrator</primary></indexterm> 358 This is the Windows Domain Administrator password. Never delete this account from 359 the password backend after Windows Domain Groups have been initialized. If you delete 360 this account, your system is crippled. You cannot restore this account, 361 and your Samba server can no longer be administered. 362 </para></step> 363 364 <step><para> 365 <indexterm><primary>username map</primary></indexterm> 366 Create the username map file to permit the <constant>root</constant> account to be called 367 <constant>Administrator</constant> from the Windows network environment. To do this, create 368 the file <filename>/etc/samba/smbusers</filename> with the following contents: 369<screen> 370#### 371# User mapping file 372#### 373# File Format 374# ----------- 375# Unix_ID = Windows_ID 376# 377# Examples: 378# root = Administrator 379# janes = "Jane Smith" 380# jimbo = Jim Bones 381# 382# Note: If the name contains a space it must be double quoted. 383# In the example above the name 'jimbo' will be mapped to Windows 384# user names 'Jim' and 'Bones' because the space was not quoted. 385####################################################################### 386root = Administrator 387#### 388# End of File 389#### 390</screen> 391 </para></step> 392 393 <step><para> 394 <indexterm><primary>initGrps.sh</primary></indexterm> 395 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in 396 <link linkend="initGrps"/>. Create a file containing this script. We called ours 397 <filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed, 398 and then execute the script. Sample output should be as follows: 399 400<example id="initGrps"> 401<title>Script to Map Windows NT Groups to UNIX Groups</title> 402<indexterm><primary>initGrps.sh</primary></indexterm> 403<screen> 404#!/bin/bash 405# 406# initGrps.sh 407# 408 409# Create UNIX groups 410groupadd acctsdep 411groupadd finsrvcs 412 413# Map Windows Domain Groups to UNIX groups 414net groupmap add ntgroup="Domain Admins" unixgroup=root type=d 415net groupmap add ntgroup="Domain Users" unixgroup=users type=d 416net groupmap add ntgroup="Domain Guests" unixgroup=nobody type=d 417 418# Add Functional Domain Groups 419net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d 420net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d 421</screen> 422</example> 423 424<screen> 425&rootprompt; chmod 755 initGrps.sh 426&rootprompt; cd /etc/samba 427&rootprompt; ./initGrps.sh 428Updated mapping entry for Domain Admins 429Updated mapping entry for Domain Users 430Updated mapping entry for Domain Guests 431No rid or sid specified, choosing algorithmic mapping 432Successfully added group Accounts Dept to the mapping db 433No rid or sid specified, choosing algorithmic mapping 434Successfully added group Domain Guests to the mapping db 435 436&rootprompt; cd /etc/samba 437&rootprompt; net groupmap list | sort 438Account Operators (S-1-5-32-548) -> -1 439Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep 440Administrators (S-1-5-32-544) -> -1 441Backup Operators (S-1-5-32-551) -> -1 442Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root 443Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody 444Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users 445Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs 446Guests (S-1-5-32-546) -> -1 447Power Users (S-1-5-32-547) -> -1 448Print Operators (S-1-5-32-550) -> -1 449Replicators (S-1-5-32-552) -> -1 450System Operators (S-1-5-32-549) -> -1 451Users (S-1-5-32-545) -> -1 452</screen> 453 </para></step> 454 455 <step><para> 456 <indexterm><primary>/etc/passwd</primary></indexterm> 457 <indexterm><primary>password</primary><secondary>backend</secondary></indexterm> 458 <indexterm><primary>smbpasswd</primary></indexterm> 459 For each user who needs to be given a Windows Domain account, make an entry in the 460 <filename>/etc/passwd</filename> file as well as in the Samba password backend. 461 Use the system tool of your choice to create the UNIX system accounts, and use the Samba 462 <command>smbpasswd</command> program to create the Domain user accounts. 463 </para> 464 465 <para> 466 <indexterm><primary>useradd</primary></indexterm> 467 <indexterm><primary>adduser</primary></indexterm> 468 <indexterm><primary>user</primary><secondary>management</secondary></indexterm> 469 There are a number of tools for user management under UNIX, such as 470 <command>useradd</command> and <command>adduser</command>, as well as a plethora of custom 471 tools. With the tool of your choice, create a home directory for each user. 472 </para></step> 473 474 <step><para> 475 Using the preferred tool for your UNIX system, add each user to the UNIX groups created 476 previously, as necessary. File system access control will be based on UNIX group membership. 477 </para></step> 478 479 <step><para> 480 Create the directory mount point for the disk subsystem that is mounted to provide 481 data storage for company files. In this case the mount point is indicated in the &smb.conf; 482 file is <filename>/data</filename>. Format the file system as required, mount the formatted 483 file system partition using <command>mount</command>, 484 and make the appropriate changes in <filename>/etc/fstab</filename>. 485 </para></step> 486 487 <step><para> 488 Create the top-level file storage directories are follows: 489<screen> 490&rootprompt; mkdir -p /data/{accounts,finsvcs} 491&rootprompt; chown -R root:root /data 492&rootprompt; chown -R alanm:acctsdep /data/accounts 493&rootprompt; chown -R alanm:finsrvcs /data/finsrvcs 494&rootprompt; chmod -R ug+rwx,o+rx-w /data 495</screen> 496 Each department is responsible for creating its own directory structure within its 497 share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>. 498 The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>. 499 </para></step> 500 501 <step><para> 502 Configure the printers with the IP addresses as shown in <link linkend="acct2net"/>. 503 Follow the instructions in the manufacturers' manuals to permit printing to port 9100. 504 This allows the CUPS spooler to print using raw mode protocols. 505 <indexterm><primary>CUPS</primary></indexterm> 506 <indexterm><primary>raw printing</primary></indexterm> 507 </para></step> 508 509 <step><para> 510 <indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm> 511 <indexterm><primary>lpadmin</primary></indexterm> 512 Configure the CUPS Print Queues as follows: 513<screen> 514&rootprompt; lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E 515&rootprompt; lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E 516&rootprompt; lpadmin -p qms -v socket://192.168.2.10:9100 -E 517</screen> 518 <indexterm><primary>print filter</primary></indexterm> 519 This creates the necessary print queues with no assigned print filter. 520 </para></step> 521 522 <step><para> 523 <indexterm><primary>mime type</primary></indexterm> 524 <indexterm><primary>/etc/mime.convs</primary></indexterm> 525 <indexterm><primary>application/octet-stream</primary></indexterm> 526 Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line: 527<screen> 528application/octet-stream application/vnd.cups-raw 0 - 529</screen> 530 </para></step> 531 532 <step><para> 533 <indexterm><primary>/etc/mime.types</primary></indexterm> 534 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line: 535<screen> 536application/octet-stream 537</screen> 538 </para></step> 539 540 <step><para> 541 <indexterm><primary>DHCP Server</primary></indexterm> 542 Using your favorite system editor, create an <filename>/etc/dhcpd.conf</filename> with the 543 contents as shown in <link linkend="dhcp01"/>. 544<example id="dhcp01"> 545<title>Abmas Accounting DHCP Server Configuration File &smbmdash; <filename>/etc/dhcpd.conf</filename></title> 546<indexterm><primary>/etc/dhcpd.conf</primary></indexterm> 547<screen> 548default-lease-time 86400; 549max-lease-time 172800; 550default-lease-time 86400; 551 552option ntp-servers 192.168.1.1; 553option domain-name "abmas.biz"; 554option domain-name-servers 192.168.1.1, 192.168.2.1; 555option netbios-name-servers 192.168.1.1, 192.168.2.1; 556option netbios-node-type 8; 557### NOTE ### 558# netbios-node-type=8 means set clients to Hybrid Mode 559# so they will use Unicast communication with the WINS 560# server and thus reduce the level of UDP broadcast 561# traffic by up to 90%. 562############ 563 564subnet 192.168.1.0 netmask 255.255.255.0 { 565 range dynamic-bootp 192.168.1.128 192.168.1.254; 566 option subnet-mask 255.255.255.0; 567 option routers 192.168.1.1; 568 allow unknown-clients; 569 host hplj4 { 570 hardware ethernet 08:00:46:7a:35:e4; 571 fixed-address 192.168.1.10; 572 } 573 host hplj6 { 574 hardware ethernet 00:03:47:cb:81:e0; 575 fixed-address 192.168.1.11; 576 } 577 } 578subnet 192.168.2.0 netmask 255.255.255.0 { 579 range dynamic-bootp 192.168.2.128 192.168.2.254; 580 option subnet-mask 255.255.255.0; 581 option routers 192.168.2.1; 582 allow unknown-clients; 583 host qms { 584 hardware ethernet 01:04:31:db:e1:c0; 585 fixed-address 192.168.1.10; 586 } 587 } 588subnet 127.0.0.0 netmask 255.0.0.0 { 589 } 590</screen> 591</example> 592 </para></step> 593 594 595 <step><para> 596 Use the standard system tool to start Samba and CUPS and configure them to start 597 automatically at every system reboot. For example, 598 </para> 599 600 <para> 601 <indexterm><primary>chkconfig</primary></indexterm> 602 <indexterm><primary>starting dhcpd</primary></indexterm> 603 <indexterm><primary>starting samba</primary></indexterm> 604 <indexterm><primary>starting CUPS</primary></indexterm> 605 <indexterm><primary>chkconfig</primary></indexterm> 606<screen> 607&rootprompt; chkconfig dhcp on 608&rootprompt; chkconfig smb on 609&rootprompt; chkconfig cups on 610&rootprompt; /etc/rc.d/init.d/dhcp restart 611&rootprompt; /etc/rc.d/init.d/smb restart 612&rootprompt; /etc/rc.d/init.d/cups restart 613</screen> 614 </para></step> 615 616 <step><para> 617 <indexterm><primary>name service switch</primary></indexterm> 618 <indexterm><primary>NSS</primary><see>same service switch</see></indexterm> 619 <indexterm><primary>DNS</primary></indexterm> 620 <indexterm><primary>DNS server</primary></indexterm> 621 <indexterm><primary>WINS</primary></indexterm> 622 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm> 623 Configure the name service switch (NSS) to handle WINS-based name resolution. 624 Since this system does not use a DNS server, it is safe to remove this option from 625 the NSS configuration. Edit the <filename>/etc/nsswitch.conf</filename> file so that 626 the <constant>hosts:</constant> entry looks like this: 627<screen> 628hosts: files wins 629</screen> 630 </para></step> 631 632 </procedure> 633 634<example id="acct2conf"> 635<title>Accounting Office Network &smb.conf; File &smbmdash; [globals] Section</title> 636<smbconfblock> 637<smbconfcomment>Global parameters</smbconfcomment> 638<smbconfsection name="[global]"/> 639<smbconfoption name="workgroup">BILLMORE</smbconfoption> 640<smbconfoption name="passwd chat">*New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</smbconfoption> 641<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption> 642<smbconfoption name="syslog">0</smbconfoption> 643<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption> 644<smbconfoption name="printcap name">CUPS</smbconfoption> 645<smbconfoption name="show add printer wizard">No</smbconfoption> 646<smbconfoption name="add user script">/usr/sbin/useradd -m -G users '%u'</smbconfoption> 647<smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption> 648<smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption> 649<smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption> 650<smbconfoption name="add user to group script">/usr/sbin/usermod -A '%g' '%u'</smbconfoption> 651<smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</smbconfoption> 652<smbconfoption name="logon script">scripts\login.bat</smbconfoption> 653<smbconfoption name="logon path"> </smbconfoption> 654<smbconfoption name="logon drive">X:</smbconfoption> 655<smbconfoption name="domain logons">Yes</smbconfoption> 656<smbconfoption name="preferred master">Yes</smbconfoption> 657<smbconfoption name="wins support">Yes</smbconfoption> 658<smbconfoption name="printing">CUPS</smbconfoption> 659</smbconfblock> 660</example> 661 662<example id="acct3conf"> 663<title>Accounting Office Network &smb.conf; File &smbmdash; Services and Shares Section</title> 664<smbconfblock> 665<smbconfsection name="[homes]"/> 666<smbconfoption name="comment">Home Directories</smbconfoption> 667<smbconfoption name="valid users">%S</smbconfoption> 668<smbconfoption name="read only">No</smbconfoption> 669<smbconfoption name="browseable">No</smbconfoption> 670 671<smbconfsection name="[printers]"/> 672<smbconfoption name="comment">SMB Print Spool</smbconfoption> 673<smbconfoption name="path">/var/spool/samba</smbconfoption> 674<smbconfoption name="printable">Yes</smbconfoption> 675<smbconfoption name="guest ok">Yes</smbconfoption> 676<smbconfoption name="use client driver">Yes</smbconfoption> 677<smbconfoption name="browseable">No</smbconfoption> 678 679<smbconfsection name="[netlogon]"/> 680<smbconfoption name="comment">Network Logon Service</smbconfoption> 681<smbconfoption name="path">/data/%U</smbconfoption> 682<smbconfoption name="valid users">%S</smbconfoption> 683<smbconfoption name="read only">No</smbconfoption> 684 685<smbconfsection name="[accounts]"/> 686<smbconfoption name="comment">Accounting Files</smbconfoption> 687<smbconfoption name="path">/data/accounts</smbconfoption> 688<smbconfoption name="valid users">%G</smbconfoption> 689<smbconfoption name="read only">No</smbconfoption> 690 691<smbconfsection name="[finsrvcs]"/> 692<smbconfoption name="comment">Financial Service Files</smbconfoption> 693<smbconfoption name="path">/data/finsrvcs</smbconfoption> 694<smbconfoption name="valid users">%G</smbconfoption> 695<smbconfoption name="read only">No</smbconfoption> 696</smbconfblock> 697</example> 698 699 <sect2> 700 <title>Validation</title> 701 702 <para> 703 Does everything function as it ought? That is the key question at this point. 704 Here are some simple steps to validate your Samba server configuration. 705 </para> 706 707 <procedure> 708 <title>Validation Steps</title> 709 710 <step><para> 711 <indexterm><primary>testparm</primary></indexterm> 712 If your &smb.conf; file has bogus options or parameters, this may cause Samba 713 to refuse to start. The first step should always be to validate the contents 714 of this file by running: 715<screen> 716&rootprompt; testparm -s 717Load smb config files from smb.conf 718Processing section "[homes]" 719Processing section "[printers]" 720Processing section "[netlogon]" 721Processing section "[accounts]" 722Processing section "[service]" 723Loaded services file OK. 724# Global parameters 725[global] 726 workgroup = BILLMORE 727 passwd chat = *New*Password* \ 728 %n\n *Re-enter*new*password* %n\n *Password*changed* 729 username map = /etc/samba/smbusers 730 syslog = 0 731 name resolve order = wins bcast hosts 732 printcap name = CUPS 733 show add printer wizard = No 734 add user script = /usr/sbin/useradd -m -G users '%u' 735 delete user script = /usr/sbin/userdel -r '%u' 736 add group script = /usr/sbin/groupadd '%g' 737 delete group script = /usr/sbin/groupdel '%g' 738 add user to group script = /usr/sbin/usermod -A '%g' '%u' 739 add machine script = /usr/sbin/useradd 740 -s /bin/false -d /var/lib/nobody '%u' 741 logon script = scripts\logon.bat 742 logon path = 743 logon drive = X: 744 domain logons = Yes 745 preferred master = Yes 746 wins support = Yes 747... 748### Remainder cut to save space ### 749</screen> 750 The inclusion of an invalid parameter (say one called dogbert) would generate an 751 error as follows: 752<screen> 753Unknown parameter encountered: "dogbert" 754Ignoring unknown parameter "dogbert" 755</screen> 756 Clear away all errors before proceeding, and start or restart samba as necessary. 757 </para></step> 758 759 <step><para> 760 <indexterm><primary>check samba daemons</primary></indexterm> 761 <indexterm><primary>nmbd</primary></indexterm> 762 <indexterm><primary>smbd</primary></indexterm> 763 <indexterm><primary>winbindd</primary></indexterm> 764 Check that the Samba server is running: 765<screen> 766&rootprompt; ps ax | grep mbd 76714244 ? S 0:00 /usr/sbin/nmbd -D 76814245 ? S 0:00 /usr/sbin/nmbd -D 76914290 ? S 0:00 /usr/sbin/smbd -D 770 771$rootprompt; ps ax | grep winbind 77214293 ? S 0:00 /usr/sbin/winbindd -D 77314295 ? S 0:00 /usr/sbin/winbindd -D 774</screen> 775 The <command>winbindd</command> daemon is running in split mode (normal), so there are also 776 two instances of it. For more information regarding <command>winbindd</command>, see 777 <emphasis>TOSHARG2</emphasis>, Chapter 23, Section 23.3. The single instance of 778 <command>smbd</command> is normal. 779 </para></step> 780 781 <step><para> 782 <indexterm><primary>anonymous connection</primary></indexterm> 783 Check that an anonymous connection can be made to the Samba server: 784<screen> 785&rootprompt; smbclient -L localhost -U% 786 787 Sharename Type Comment 788 --------- ---- ------- 789 netlogon Disk Network Logon Service 790 accounts Disk Accounting Files 791 finsvcs Disk Financial Service Files 792 IPC$ IPC IPC Service (Samba3) 793 ADMIN$ IPC IPC Service (Samba3) 794 hplj4 Printer Hewlett-Packard LaserJet 4 795 hplj6 Printer Hewlett-Packard LaserJet 6 796 qms Printer QMS Magicolor Laser Printer XXXX 797 798 Server Comment 799 --------- ------- 800 SLEETH Samba 3.0.20 801 802 Workgroup Master 803 --------- ------- 804 BILLMORE SLEETH 805</screen> 806 This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent 807 of browsing the server from a Windows client to obtain a list of shares on the server. 808 The <constant>-U%</constant> argument means to send a <constant>NULL</constant> username and 809 a <constant>NULL</constant> password. 810 </para></step> 811 812 <step><para> 813 <indexterm><primary>dhcp client validation</primary></indexterm> 814 <indexterm><primary>printer validation</primary></indexterm> 815 <indexterm><primary>/etc/dhcpd.conf</primary></indexterm> 816 Verify that the printers have the IP addresses assigned in the DHCP server configuration file. 817 The easiest way to do this is to ping the printer name. Immediately after the ping response 818 has been received, execute <command>arp -a</command> to find the MAC address of the printer 819 that has responded. Now you can compare the IP address and the MAC address of the printer 820 with the configuration information in the <filename>/etc/dhcpd.conf</filename> file. They 821 should, of course, match. For example, 822<screen> 823&rootprompt; ping hplj4 824PING hplj4 (192.168.1.11) 56(84) bytes of data. 82564 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms 826 827&rootprompt; arp -a 828hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0 829</screen> 830 The MAC address <constant>08:00:46:7A:35:E4</constant> matches that specified for the 831 IP address from which the printer has responded and the entry for it in the 832 <filename>/etc/dhcpd.conf</filename> file. 833 </para></step> 834 835 <step><para> 836 <indexterm><primary>authenticated connection</primary></indexterm> 837 Make an authenticated connection to the server using the <command>smbclient</command> tool: 838<screen> 839&rootprompt; smbclient //sleeth/accounts -U alanm 840Password: XXXXXXX 841smb: \> dir 842 . D 0 Sun Nov 9 01:28:34 2003 843 .. D 0 Sat Aug 16 17:24:26 2003 844 .mc DH 0 Sat Nov 8 21:57:38 2003 845 .qt DH 0 Fri Sep 5 00:48:25 2003 846 SMB D 0 Sun Oct 19 23:04:30 2003 847 Documents D 0 Sat Nov 1 00:31:51 2003 848 xpsp1a_en_x86.exe 131170400 Sun Nov 2 01:25:44 2003 849 850 65387 blocks of size 65536. 28590 blocks available 851smb: \> q 852</screen> 853 </para></step> 854 855 </procedure> 856 857 </sect2> 858 859 860 <procedure> 861 <title>Windows XP Professional Client Configuration</title> 862 863 <step><para> 864 Configure clients to the network settings shown in <link linkend="acct2net"/>. 865 All clients use DHCP for TCP/IP protocol stack configuration. 866 <indexterm><primary>WINS</primary></indexterm> 867 <indexterm><primary>DHCP</primary></indexterm> 868 DHCP configures all Windows clients to use the WINS Server address <constant>192.168.1.1</constant>. 869 </para></step> 870 871 <step><para> 872 Join the Windows Domain called <constant>BILLMORE</constant>. Use the Domain Administrator 873 username <constant>root</constant> and the SMB password you assigned to this account. 874 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to 875 a Windows Domain is given in <link linkend="appendix"/>, <link linkend="domjoin"/>. 876 Reboot the machine as prompted and then log on using a Domain User account. 877 </para></step> 878 879 <step><para> 880 Verify on each client that the machine called <constant>SLEETH</constant> 881 is visible in <guimenu>My Network Places</guimenu>, that it is 882 possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem> 883 and <guimenuitem>finsvcs</guimenuitem>, 884 and that it is possible to open that share to reveal its contents. 885 </para></step> 886 887 <step><para> 888 Instruct all users to log onto the workstation using their assigned username and password. 889 </para></step> 890 891 <step><para> 892 Install a printer on each using the following steps: 893 </para> 894 895 <procedure> 896 <step><para> 897 Click <menuchoice> 898 <guimenu>Start</guimenu> 899 <guimenuitem>Settings</guimenuitem> 900 <guimenuitem>Printers</guimenuitem> 901 <guiicon>Add Printer</guiicon> 902 <guibutton>Next</guibutton> 903 </menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>. 904 Ensure that <guimenuitem>Local printer</guimenuitem> is selected. 905 </para></step> 906 907 <step><para> 908 Click <guibutton>Next</guibutton>. In the 909 <guimenuitem>Manufacturer:</guimenuitem> panel, select <constant>HP</constant>. 910 In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called 911 <constant>HP LaserJet 4</constant>. Click <guibutton>Next</guibutton>. 912 </para></step> 913 914 <step><para> 915 In the <guimenuitem>Available ports:</guimenuitem> panel, select 916 <constant>FILE:</constant>. Accept the default printer name by clicking 917 <guibutton>Next</guibutton>. When asked, <quote>Would you like to print a 918 test page?</quote>, click <guimenuitem>No</guimenuitem>. Click 919 <guibutton>Finish</guibutton>. 920 </para></step> 921 922 <step><para> 923 You may be prompted for the name of a file to print to. If so, close the 924 dialog panel. Right-click <menuchoice> 925 <guiicon>HP LaserJet 4</guiicon> 926 <guimenuitem>Properties</guimenuitem> 927 <guisubmenu>Details (Tab)</guisubmenu> 928 <guimenuitem>Add Port</guimenuitem> 929 </menuchoice>. 930 </para></step> 931 932 <step><para> 933 In the <guimenuitem>Network</guimenuitem> panel, enter the name of 934 the print queue on the Samba server as follows: <constant>\\SERVER\hplj4</constant>. 935 Click <menuchoice> 936 <guibutton>OK</guibutton> 937 <guibutton>OK</guibutton> 938 </menuchoice> to complete the installation. 939 </para></step> 940 941 <step><para> 942 Repeat the printer installation steps above for the HP LaserJet 6 printer 943 as well as for the QMS Magicolor XXXX laser printer. 944 </para></step> 945 </procedure> 946 </step> 947 </procedure> 948 949 <sect2> 950 <title>Notebook Computers: A Special Case</title> 951 952 <para> 953 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP 954 Professional systems. This is the preferred solution to provide continuity of work for notebook users 955 so that absence from the office network environment does not become a barrier to productivity. 956 </para> 957 958 <para> 959 By creating a local machine account that has the same username and password as you create for that 960 user in the Windows Domain environment, the user can log onto the machine locally and still 961 transparently access network resources as if logged onto the domain itself. There are some trade-offs 962 that mean that as the network is more tightly secured, it becomes necessary to modify Windows client 963 configuration somewhat. 964 </para> 965 966 </sect2> 967 968 <sect2> 969 <title>Key Points Learned</title> 970 971 <para> 972 In this network design and implementation exercise, you created a Windows NT4-style Domain 973 Controller using Samba-3.0.20. Following these guidelines, you experienced 974 and implemented several important aspects of Windows networking. In the next chapter, 975 you build on the experience. These are the highlights from this chapter: 976 </para> 977 978 <itemizedlist> 979 <listitem><para> 980 <indexterm><primary>DHCP</primary></indexterm> 981 You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary 982 network configuration settings from this server. 983 </para></listitem> 984 985 <listitem><para> 986 <indexterm><primary>Domain Controller</primary></indexterm> 987 You created a Windows Domain Controller. You were able to use the network logon service 988 and successfully joined Windows 200x/XP Professional clients to the Domain. 989 </para></listitem> 990 991 <listitem><para> 992 <indexterm><primary>CUPS</primary></indexterm> 993 You created raw print queues in the CUPS printing system. You maintained a simple 994 printing system so that all users can share centrally managed printers. You installed 995 native printer drivers on the Windows clients. 996 </para></listitem> 997 998 <listitem><para> 999 You experienced the benefits of centrally managed user accounts on the server. 1000 </para></listitem> 1001 1002 <listitem><para> 1003 You offered Mobile notebook users a solution that allows them to continue to work 1004 while away from the office and not connected to the corporate network. 1005 </para></listitem> 1006 </itemizedlist> 1007 1008 </sect2> 1009 1010</sect1> 1011 1012<sect1> 1013 <title>Questions and Answers</title> 1014 1015 <para> 1016 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that 1017 may help. 1018 </para> 1019 1020 <qandaset> 1021 <qandaentry> 1022 <question> 1023 1024 <para> 1025 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 1026 </para> 1027 1028 </question> 1029 <answer> 1030 1031 <para> 1032 First and foremost, portability. It means that notebook users can move between 1033 the Abmas office and client offices (so long as they, too, use DHCP) without having to manually 1034 reconfigure their machines. It also means that when they work from their home environments 1035 either using DHCP assigned addressing or when using dial-up networking, settings such as 1036 default routes and DNS server addresses that apply only to the Abmas office environment do 1037 not interfere with remote operations. This is an extremely important feature of DHCP. 1038 </para> 1039 1040 </answer> 1041 </qandaentry> 1042 1043 <qandaentry> 1044 <question> 1045 1046 <para> 1047 Are there any DHCP server configuration parameters in the <filename>/etc/dhcpd.conf</filename> 1048 that should be noted in particular? 1049 </para> 1050 1051 </question> 1052 <answer> 1053 1054 <para> 1055 Yes. The configuration you created automatically provides each client with the IP address 1056 of your WINS server. It also configures the client to preferentially register NetBIOS names 1057 with the WINS server, and then instructs the client to first query the WINS server when a 1058 NetBIOS machine name needs to be resolved to an IP Address. This configuration 1059 results in far lower UDP broadcast traffic than would be the case if WINS was not used. 1060 </para> 1061 1062 </answer> 1063 </qandaentry> 1064 1065 <qandaentry> 1066 <question> 1067 1068 <para> 1069 Is it possible to create a Windows Domain account that is specifically called <constant>Administrator</constant>? 1070 </para> 1071 1072 </question> 1073 <answer> 1074 1075 <para> 1076 You can surely create a Windows Domain account called <constant>Administrator</constant>. It is also 1077 possible to map that account so that it has the effective UNIX UID of 0. This way it isn't 1078 necessary to use the <parameter>username map</parameter> facility to map this account to the UNIX 1079 account called <constant>root</constant>. 1080 </para> 1081 1082 </answer> 1083 </qandaentry> 1084 1085 <qandaentry> 1086 <question> 1087 1088 <para> 1089 Why is it necessary to give the Windows Domain <constant>Administrator</constant> a UNIX UID of 0? 1090 </para> 1091 1092 </question> 1093 <answer> 1094 1095 <para> 1096 The Windows Domain <constant>Administrator</constant> account is the most privileged account that 1097 exists on the Windows platform. This user can change any setting, add, delete, or modify user 1098 accounts, and completely reconfigure the system. The equivalent to this account in the UNIX 1099 environment is the <constant>root</constant> account. If you want to permit the Windows Domain 1100 Administrator to manage accounts as well as permissions, privileges, and security 1101 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is 1102 achieved with the <constant>root</constant> UID equal to 0. 1103 </para> 1104 1105 </answer> 1106 </qandaentry> 1107 1108 <qandaentry> 1109 <question> 1110 1111 <para> 1112 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 1113 <constant>root</constant> access. How can we do this? 1114 </para> 1115 1116 </question> 1117 <answer> 1118 1119 <para> 1120 Users who are members of the <constant>Domain Admins</constant> group can add machines to the 1121 Domain. This group is mapped to the UNIX group account called <constant>root</constant> 1122 (or the equivalent <constant>wheel</constant> on some UNIX systems) that has a GID of 0. 1123 This must be the primary GID of the account of the user who is a member of the Windows <constant> 1124 Domain Admins</constant> account. 1125 </para> 1126 1127 </answer> 1128 </qandaentry> 1129 1130 <qandaentry> 1131 <question> 1132 1133 <para> 1134 Why must I map Windows Domain Groups to UNIX groups? 1135 </para> 1136 1137 </question> 1138 <answer> 1139 1140 <para> 1141 Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account 1142 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are 1143 <guimenu>Domain Guests</guimenu>, <guimenu>Domain Users</guimenu>, and <guimenu>Domain Admins</guimenu>. 1144 </para> 1145 1146 </answer> 1147 </qandaentry> 1148 1149 <qandaentry> 1150 <question> 1151 1152 <para> 1153 I deleted my <constant>root</constant> account and now I cannot add it back! What can I do? 1154 </para> 1155 1156 </question> 1157 <answer> 1158 1159 <para> 1160 This is a nasty problem. Fortunately, there is a solution. 1161 </para> 1162 1163 <procedure> 1164 <step><para> 1165 Back up your existing configuration files in case you need to restore them. 1166 </para></step> 1167 1168 <step><para> 1169 Rename the <filename>group_mapping.tdb</filename> file. 1170 </para></step> 1171 1172 <step><para> 1173 Use the <command>smbpasswd</command> to add the root account. 1174 </para></step> 1175 1176 <step><para> 1177 Restore the <filename>group_mapping.tdb</filename> file. 1178 </para></step> 1179 </procedure> 1180 1181 </answer> 1182 </qandaentry> 1183 1184 <qandaentry> 1185 <question> 1186 1187 <para> 1188 When I run <command>net groupmap list</command>, it reports a group called <guimenu>Administrators</guimenu> 1189 as well as <guimenu>Domain Admins</guimenu>. What is the difference between them? 1190 </para> 1191 1192 </question> 1193 <answer> 1194 1195 <para> 1196 The group called <guimenu>Administrators</guimenu> is representative of the same account that would be 1197 present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain 1198 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This 1199 may change at some later date. These accounts are provided only so that security objects are correctly shown. 1200 </para> 1201 1202 </answer> 1203 </qandaentry> 1204 1205 <qandaentry> 1206 <question> 1207 1208 <para> 1209 What is the effect of changing the name of a Samba server or of changing the Domain name? 1210 </para> 1211 1212 </question> 1213 <answer> 1214 1215 <para> 1216 If you elect to change the name of the Samba server, on restarting <command>smbd</command>, 1217 Windows security identifiers are changed. In the case of a standalone server or a Domain Member server, 1218 the machine SID is changed. This may break Domain membership. In the case of a change of the Domain name 1219 (Workgroup name), the Domain SID is changed. This affects all Domain memberships. 1220 </para> 1221 1222 <para> 1223 If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective 1224 SID before the change is made. You can back up the SID using the <command>net getlocalsid</command> (Samba-3) 1225 or the <command>smbpasswd</command> (Samba-2.2.x). To change the SID, you use the same tool. Be sure 1226 to check the man page for this command for detailed instructions regarding the steps involved. 1227 </para> 1228 1229 </answer> 1230 </qandaentry> 1231 1232 <qandaentry> 1233 <question> 1234 1235 <para> 1236 How can I manage user accounts from my Windows XP Professional workstation? 1237 </para> 1238 1239 </question> 1240 <answer> 1241 1242 <para> 1243 Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot 1244 be managed using tools present on a Windows XP Professional installation. You may download from the 1245 Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use 1246 it. This package extracts the tools: <command>User Manager for Domains</command>, <command>Server Manager</command>, and <command>Event 1247 Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba-3 1248 Domain user and group accounts. Of course, you do need to be logged on as the <constant>Administrator</constant> 1249 for the Samba-3 Domain. It may help to log on as the <constant>root</constant> account. 1250 </para> 1251 1252 </answer> 1253 </qandaentry> 1254 1255 </qandaset> 1256 1257</sect1> 1258 1259</chapter> 1260 1261