1<?xml version="1.0" encoding="iso-8859-1"?> 2<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3<chapter id="upgrading-to-3.0"> 4<chapterinfo> 5 &author.jelmer; 6 &author.jht; 7 &author.jerry; 8 <pubdate>August 16, 2007</pubdate> 9</chapterinfo> 10 11<title>Updating and Upgrading Samba</title> 12<para> 13This chapter provides a detailed record of changes made during the 3.x series releases. At this time this 14series consists of the 3.0.x series that is under the GNU GPL version 2 license, and the Samba 3.2.x series 15that is being released under the terms of the GNU GPL version 3 license. 16</para> 17 18<sect1> 19<title>Key Update Requirements</title> 20<para> 21Samba is a fluid product in which there may be significant changes between releases. Some of these changes are 22brought about as a result of changes in the protocols that are used by Microsoft Windows network clients as a 23result of security or functionality updates through official Microsoft patches and updates. Samba must track 24such changes, particularly where they affect the internal operation of Samba itself. 25</para> 26 27<para> 28Please refer to any notes below that make explicit mention of the version of Samba you are using. In general, 29all changes that apply to a new release will apply to follow-on releases also. For example, changes to Samba 303.0.23 affect all releases up to an including 3.0.25 and later. Samba 3.2.x was originaly cut from Samba 313.0.25 before 3.2.0-specific changes were applied. Unless a 3.0.x series feature is specifically revoked, the 32behavior of the 3.2.x series can be expected to follow the earlier pattern. 33</para> 34 35<sect2> 36<title>Upgrading from Samba-3.0.x to Samba-3.2.0</title> 37<para> 38</para> 39</sect2> 40 41<sect2 id="oldupdatenotes"> 42<title>Upgrading from Samba-2.x to Samba-3.0.25</title> 43<para> 44<indexterm><primary>Samba differences</primary></indexterm> 45<indexterm><primary>changed parameters</primary></indexterm> 46<indexterm><primary>simple guide</primary></indexterm> 47This chapter deals exclusively with the differences between Samba-3.0.25 and Samba-2.2.8a. 48It points out where configuration parameters have changed, and provides a simple guide for 49the move from 2.2.x to 3.0.25. 50</para> 51</sect2> 52 53<sect2> 54<title>Quick Migration Guide</title> 55 56<para> 57Samba-3.0.25 default behavior should be approximately the same as Samba-2.2.x. 58The default behavior when the new parameter <smbconfoption name="passdb backend"/> 59is not defined in the &smb.conf; file provides the same default behavior as Samba-2.2.x 60with <smbconfoption name="encrypt passwords">Yes</smbconfoption> and 61will use the <filename>smbpasswd</filename> database. 62</para> 63 64<para> 65<indexterm><primary>behavior approximately same</primary></indexterm> 66<indexterm><primary>differing protocol</primary></indexterm> 67So why say that <emphasis>behavior should be approximately the same as Samba-2.2.x</emphasis>? Because 68Samba-3.0.25 can negotiate new protocols, such as support for native Unicode, that may result in 69differing protocol code paths being taken. The new behavior under such circumstances is not 70exactly the same as the old one. The good news is that the domain and machine SIDs will be 71preserved across the upgrade. 72</para> 73 74<para> 75<indexterm><primary>LDAP backend</primary></indexterm> 76<indexterm><primary>database</primary></indexterm> 77<indexterm><primary>pdbedit</primary></indexterm> 78<indexterm><primary>Samba-3-compatible LDAP backend</primary></indexterm> 79If the Samba-2.2.x system is using an LDAP backend, and there is no time to update the LDAP 80database, then make sure that <smbconfoption name="passdb backend">ldapsam_compat</smbconfoption> 81is specified in the &smb.conf; file. For the rest, behavior should remain more or less the same. 82At a later date, when there is time to implement a new Samba-3-compatible LDAP backend, it is possible 83to migrate the old LDAP database to the new one through use of the <command>pdbedit</command>. 84See <link linkend="pdbeditthing">The <emphasis>pdbedit</emphasis> Command</link>. 85</para> 86 87</sect2> 88</sect1> 89 90<sect1> 91<title>New Features in Samba-3.x Series</title> 92<para> 93</para> 94 95<sect2> 96<title>New Features in Samba-3.2.x Series</title> 97 98<para>Samba is now distributed under the version 3 99of the new GNU General Public License. 100</para> 101 102<para> 103The major new features are: 104</para> 105 106 107<orderedlist numeration="arabic"> 108 <listitem><para> 109<indexterm><primary>File Service</primary></indexterm> 110<indexterm><primary>limit</primary></indexterm> 111 Removal of the 1024 byte limit on pathnames and 256 byte limit on 112 filename components to honor the MAX_PATH setting from the host OS. 113 </para></listitem> 114 115 <listitem><para> 116<indexterm><primary>Registory</primary></indexterm> 117<indexterm><primary>Configuration</primary></indexterm> 118 Introduction of a registry based configuration system. 119 </para></listitem> 120 121 <listitem><para> 122<indexterm><primary>cluster</primary></indexterm> 123 Experimental support for file serving clusters. 124 </para></listitem> 125 126 <listitem><para> 127<indexterm><primary>IPv6</primary></indexterm> 128 Support for IPv6 in the server, and client tools and libraries. 129 </para></listitem> 130 131 <listitem><para> 132<indexterm><primary>alternate data streams</primary></indexterm> 133 Support for storing alternate data streams in xattrs. 134 </para></listitem> 135 136 <listitem><para> 137<indexterm><primary>Encrypted SMB transport</primary></indexterm> 138 Encrypted SMB transport in client tools and libraries, and server. 139 </para></listitem> 140 141 <listitem><para> 142<indexterm><primary>Windows Vista</primary></indexterm> 143 Support for Vista clients authenticating via Kerberos. 144 </para></listitem> 145 146 <listitem><para> 147<indexterm><primary>Winbind</primary></indexterm> 148<indexterm><primary>forest</primary></indexterm> 149 Full support for Windows 2003 cross-forest, transitive trusts 150 and one-way domain trusts. 151 </para></listitem> 152 153 <listitem><para> 154<indexterm><primary>pam_winbind</primary></indexterm> 155 Support for userPrincipalName logons via pam_winbind and NSS lookups. 156 </para></listitem> 157 158 <listitem><para> 159<indexterm><primary>LDAP</primary></indexterm> 160<indexterm><primary>Active Directory</primary></indexterm> 161<indexterm><primary>Signing</primary></indexterm> 162 Support for Active Directory LDAP Signing policy. 163 </para></listitem> 164 165 <listitem><para> 166<indexterm><primary>Licence</primary></indexterm> 167<indexterm><primary>GPL</primary></indexterm> 168 New LGPL Winbind client library (libwbclient.so). 169 </para></listitem> 170 171 <listitem><para> 172<indexterm><primary>domain</primary></indexterm> 173<indexterm><primary>domain trust</primary></indexterm> 174 Support for establishing interdomain trust relationships with Windows 2008. 175 </para></listitem> 176 177 <listitem><para> 178<indexterm><primary>joining</primary></indexterm> 179 New client and server support for remotely joining and unjoining Domains. 180 </para></listitem> 181 182 183 <listitem><para> 184<indexterm><primary>joining</primary></indexterm> 185 Support for joining into Windows 2008 domains. 186 </para></listitem> 187 188</orderedlist> 189 190<para> 191Plus lots of other improvements! 192</para> 193 194 195</sect2> 196 197<sect2> 198<title>New Features in Samba-3.0.x</title> 199 200<para> 201The major new features are: 202</para> 203 204<orderedlist numeration="arabic"> 205 <listitem><para> 206<indexterm><primary>ADS</primary></indexterm> 207<indexterm><primary>LDAP/Kerberos</primary></indexterm> 208 Active Directory support. This release is able to join an ADS realm 209 as a member server and authenticate users using LDAP/Kerberos. 210 </para></listitem> 211 212 <listitem><para> 213<indexterm><primary>Unicode</primary></indexterm> 214<indexterm><primary>multibyte character sets</primary></indexterm> 215 Unicode support. Samba will now negotiate Unicode on the wire, and 216 internally there is a much better infrastructure for multibyte 217 and Unicode character sets. 218 </para></listitem> 219 220 <listitem><para> 221<indexterm><primary>authentication system</primary></indexterm> 222 New authentication system. The internal authentication system has 223 been almost completely rewritten. Most of the changes are internal, 224 but the new authoring system is also very configurable. 225 </para></listitem> 226 227 <listitem><para> 228<indexterm><primary>filename mangling</primary></indexterm> 229 New filename mangling system. The filename mangling system has been 230 completely rewritten. An internal database now stores mangling maps 231 persistently. 232 </para></listitem> 233 234 <listitem><para> 235<indexterm><primary>net command</primary></indexterm> 236 New <quote>net</quote> command. A new <quote>net</quote> command has been added. It is 237 somewhat similar to the <quote>net</quote> command in Windows. Eventually, we 238 plan to replace a bunch of other utilities (such as smbpasswd) 239 with subcommands in <quote>net</quote>. 240 </para></listitem> 241 242 <listitem><para> 243<indexterm><primary>status32 codes</primary></indexterm> 244 Samba now negotiates NT-style status32 codes on the wire. This 245 considerably improves error handling. 246 </para></listitem> 247 248 <listitem><para> 249<indexterm><primary>printer attributes publishing</primary></indexterm> 250 Better Windows 200x/XP printing support, including publishing 251 printer attributes in Active Directory. 252 </para></listitem> 253 254 <listitem><para> 255<indexterm><primary>RPC modules</primary></indexterm> 256<indexterm><primary>passdb backends</primary></indexterm> 257<indexterm><primary>character sets</primary></indexterm> 258 New loadable RPC modules for passdb backends and character sets. 259 </para></listitem> 260 261 <listitem><para> 262<indexterm><primary>dual-daemon winbindd</primary></indexterm> 263 New default dual-daemon winbindd support for better performance. 264 </para></listitem> 265 266 <listitem><para> 267<indexterm><primary>migrating</primary></indexterm> 268<indexterm><primary>maintaining ids</primary></indexterm> 269<indexterm><primary>SID</primary></indexterm> 270 Support for migrating from a Windows NT 4.0 domain to a Samba 271 domain and maintaining user, group, and domain SIDs. 272 </para></listitem> 273 274 <listitem><para> 275<indexterm><primary>trust relationships</primary></indexterm> 276<indexterm><primary>domain controllers</primary></indexterm> 277 Support for establishing trust relationships with Windows NT 4.0 278 domain controllers. 279 </para></listitem> 280 281 <listitem><para> 282<indexterm><primary>Winbind architecture</primary></indexterm> 283<indexterm><primary>LDAP directory</primary></indexterm> 284<indexterm><primary>ID mapping</primary></indexterm> 285 Initial support for a distributed Winbind architecture using 286 an LDAP directory for storing SID to UID/GID mappings. 287 </para></listitem> 288 289 <listitem><para> 290 Major updates to the Samba documentation tree. 291 </para></listitem> 292 293 <listitem><para> 294<indexterm><primary>SMB signing</primary></indexterm> 295<indexterm><primary>security settings</primary></indexterm> 296 Full support for client and server SMB signing to ensure 297 compatibility with default Windows 2003 security settings. 298 </para></listitem> 299</orderedlist> 300 301<para> 302Plus lots of other improvements! 303</para> 304 305 306<sect3> 307<title>Configuration Parameter Changes</title> 308 309<para> 310This section contains a brief listing of changes to &smb.conf; options since the Samba-2.2.x series up to and 311including Samba-3.0.25. 312</para> 313 314<para> 315Please refer to the smb.conf(5) man page for complete descriptions of new or modified 316parameters. 317</para> 318 319<para> 320Whenever a Samba update or upgrade is performed it is highly recommended to read the file called 321<emphasis>WHATSNEW.txt</emphasis> that is part of the Samba distribution tarball. This file may also 322be obtain on-line from the Samba <ulink url="http://www.samba.org/samba/">web site</ulink>, in 323the right column, under Current Stable Release, by clicking on <emphasis>Release Notes</emphasis>. 324</para> 325 326</sect3> 327 328<sect3> 329<title>Removed Parameters</title> 330 331<indexterm><primary>deleted parameters</primary></indexterm> 332<para> 333In alphabetical order, these are the parameters eliminated from Samba-2.2.x through 3.0.25. 334</para> 335 336<itemizedlist> 337 <listitem><para>admin log</para></listitem> 338 <listitem><para>alternate permissions</para></listitem> 339 <listitem><para>character set</para></listitem> 340 <listitem><para>client codepage</para></listitem> 341 <listitem><para>code page directory</para></listitem> 342 <listitem><para>coding system</para></listitem> 343 <listitem><para>domain admin group</para></listitem> 344 <listitem><para>domain guest group</para></listitem> 345 <listitem><para>enable rid algorithm</para></listitem> 346 <listitem><para>enable svcctl</para></listitem> 347 <listitem><para>force unknown acl user</para></listitem> 348 <listitem><para>hosts equiv</para></listitem> 349 <listitem><para>ldap filter</para></listitem> 350 <listitem><para>min password length</para></listitem> 351 <listitem><para>nt smb support</para></listitem> 352 <listitem><para>post script</para></listitem> 353 <listitem><para>printer admin</para></listitem> 354 <listitem><para>printer driver</para></listitem> 355 <listitem><para>printer driver file</para></listitem> 356 <listitem><para>printer driver location</para></listitem> 357 <listitem><para>read size</para></listitem> 358 <listitem><para>source environment</para></listitem> 359 <listitem><para>status </para></listitem> 360 <listitem><para>strip dot </para></listitem> 361 <listitem><para>total print jobs</para></listitem> 362 <listitem><para>unicode</para></listitem> 363 <listitem><para>use rhosts</para></listitem> 364 <listitem><para>valid chars</para></listitem> 365 <listitem><para>vfs options</para></listitem> 366 <listitem><para>winbind enable local accounts</para></listitem> 367 <listitem><para>winbind max idle children</para></listitem> 368 <listitem><para>wins partners</para></listitem> 369</itemizedlist> 370 371</sect3> 372 373<sect3> 374<title>New Parameters</title> 375 376<para>The following new parameters have been released up to and including Samba 3.0.25 (grouped by function:)</para> 377 378<para>Remote Management</para> 379 380<indexterm><primary>new parameters</primary></indexterm> 381 382<itemizedlist> 383 <listitem><para>abort shutdown script</para></listitem> 384 <listitem><para>shutdown script</para></listitem> 385</itemizedlist> 386 387<para>User and Group Account Management</para> 388 389<itemizedlist> 390 <listitem><para>add group script</para></listitem> 391 <listitem><para>add machine script</para></listitem> 392 <listitem><para>add user to group script</para></listitem> 393 <listitem><para>algorithmic rid base</para></listitem> 394 <listitem><para>delete group script</para></listitem> 395 <listitem><para>delete user from group script</para></listitem> 396 <listitem><para>passdb backend</para></listitem> 397 <listitem><para>rename user script</para></listitem> 398 <listitem><para>set primary group script</para></listitem> 399 <listitem><para>username map script</para></listitem> 400</itemizedlist> 401 402<para>Authentication</para> 403 404<itemizedlist> 405 <listitem><para>auth methods</para></listitem> 406 <listitem><para>ldap password sync</para></listitem> 407 <listitem><para>passdb expand explicit</para></listitem> 408 <listitem><para>realm</para></listitem> 409</itemizedlist> 410 411<para>Protocol Options</para> 412 413<itemizedlist> 414 <listitem><para>add port command</para></listitem> 415 <listitem><para>afs token lifetime</para></listitem> 416 <listitem><para>client lanman auth</para></listitem> 417 <listitem><para>client NTLMv2 auth</para></listitem> 418 <listitem><para>client schannel</para></listitem> 419 <listitem><para>client signing</para></listitem> 420 <listitem><para>client use spnego</para></listitem> 421 <listitem><para>defer sharing violations</para></listitem> 422 <listitem><para>disable netbios</para></listitem> 423 <listitem><para>dmapi support</para></listitem> 424 <listitem><para>enable privileges</para></listitem> 425 <listitem><para>use kerberos keytab</para></listitem> 426 <listitem><para>log nt token command</para></listitem> 427 <listitem><para>ntlm auth</para></listitem> 428 <listitem><para>paranoid server security </para></listitem> 429 <listitem><para>sendfile</para></listitem> 430 <listitem><para>server schannel</para></listitem> 431 <listitem><para>server signing</para></listitem> 432 <listitem><para>smb ports</para></listitem> 433 <listitem><para>svcctl list</para></listitem> 434 <listitem><para>use spnego</para></listitem> 435</itemizedlist> 436 437<para>File Service</para> 438 439<itemizedlist> 440 <listitem><para>allocation roundup size</para></listitem> 441 <listitem><para>acl check permissions</para></listitem> 442 <listitem><para>acl group control</para></listitem> 443 <listitem><para>acl map full control</para></listitem> 444 <listitem><para>aio read size</para></listitem> 445 <listitem><para>aio write size</para></listitem> 446 <listitem><para>dfree cache time</para></listitem> 447 <listitem><para>dfree command</para></listitem> 448 <listitem><para>ea support</para></listitem> 449 <listitem><para>enable asu support</para></listitem> 450 <listitem><para>fam change notify</para></listitem> 451 <listitem><para>force unknown acl user</para></listitem> 452 <listitem><para>get quota command</para></listitem> 453 <listitem><para>hide special files</para></listitem> 454 <listitem><para>hide unwriteable files</para></listitem> 455 <listitem><para>inherit owner</para></listitem> 456 <listitem><para>hostname lookups</para></listitem> 457 <listitem><para>kernel change notify</para></listitem> 458 <listitem><para>mangle prefix</para></listitem> 459 <listitem><para>map acl inherit</para></listitem> 460 <listitem><para>map read only</para></listitem> 461 <listitem><para>max stat cache size</para></listitem> 462 <listitem><para>msdfs proxy</para></listitem> 463 <listitem><para>open files database hash size</para></listitem> 464 <listitem><para>set quota command</para></listitem> 465 <listitem><para>store dos attributes</para></listitem> 466 <listitem><para>use sendfile</para></listitem> 467 <listitem><para>usershare allow guests</para></listitem> 468 <listitem><para>usershare max shares</para></listitem> 469 <listitem><para>usershare owner only</para></listitem> 470 <listitem><para>usershare path</para></listitem> 471 <listitem><para>usershare prefix allow list</para></listitem> 472 <listitem><para>usershare prefix deny list</para></listitem> 473 <listitem><para>usershare template share</para></listitem> 474 <listitem><para>vfs objects</para></listitem> 475</itemizedlist> 476 477<para>Printing</para> 478 479<itemizedlist> 480 <listitem><para>cups options</para></listitem> 481 <listitem><para>cups server</para></listitem> 482 <listitem><para>force printername</para></listitem> 483 <listitem><para>iprint server</para></listitem> 484 <listitem><para>max reported print jobs</para></listitem> 485 <listitem><para>printcap cache time</para></listitem> 486</itemizedlist> 487 488 489<para>Unicode and Character Sets</para> 490 491<itemizedlist> 492 <listitem><para>display charset</para></listitem> 493 <listitem><para>dos charset</para></listitem> 494 <listitem><para>UNIX charset</para></listitem> 495</itemizedlist> 496 497<para>SID to UID/GID Mappings</para> 498 499<itemizedlist> 500 <listitem><para>idmap backend</para></listitem> 501 <listitem><para>idmap gid</para></listitem> 502 <listitem><para>idmap uid</para></listitem> 503 <listitem><para>username map script</para></listitem> 504 <listitem><para>winbind nss info</para></listitem> 505 <listitem><para>winbind offline logon</para></listitem> 506 <listitem><para>winbind refresh tickets</para></listitem> 507 <listitem><para>winbind trusted domains only</para></listitem> 508 <listitem><para>template primary group</para></listitem> 509</itemizedlist> 510 511<para>LDAP</para> 512 513<itemizedlist> 514 <listitem><para>ldap delete dn</para></listitem> 515 <listitem><para>ldap group suffix</para></listitem> 516 <listitem><para>ldap idmap suffix</para></listitem> 517 <listitem><para>ldap machine suffix</para></listitem> 518 <listitem><para>ldap passwd sync</para></listitem> 519 <listitem><para>ldap replication sleep</para></listitem> 520 <listitem><para>ldap timeout</para></listitem> 521 <listitem><para>ldap user suffix</para></listitem> 522</itemizedlist> 523 524<para>General Configuration</para> 525 526<itemizedlist> 527 <listitem><para>eventlog list</para></listitem> 528 <listitem><para>preload modules</para></listitem> 529 <listitem><para>reset on zero vc</para></listitem> 530 <listitem><para>privatedir</para></listitem> 531</itemizedlist> 532 533</sect3> 534 535<sect3> 536<title>Modified Parameters (Changes in Behavior)</title> 537 538<itemizedlist> 539 <listitem><para>acl group control (new default is No, deprecated parameter)</para></listitem> 540 <listitem><para>change notify timeout (scope changed)</para></listitem> 541 <listitem><para>dos filemode (disabled by default)</para></listitem> 542 <listitem><para>dos filetimes (enabled by default)</para></listitem> 543 <listitem><para>enable asu support (disabled by default)</para></listitem> 544 <listitem><para>enable privileges (enabled by default)</para></listitem> 545 <listitem><para>encrypt passwords (enabled by default) </para></listitem> 546 <listitem><para>host msdfs (enabled by default)</para></listitem> 547 <listitem><para>mangling method (set to hash2 by default) </para></listitem> 548 <listitem><para>map to guest</para></listitem> 549 <listitem><para>only user (deprecated)</para></listitem> 550 <listitem><para>passwd chat</para></listitem> 551 <listitem><para>passwd program</para></listitem> 552 <listitem><para>password server</para></listitem> 553 <listitem><para>restrict anonymous (integer value)</para></listitem> 554 <listitem><para>security (new ads value)</para></listitem> 555 <listitem><para>strict locking (auto by default)</para></listitem> 556 <listitem><para>winbind cache time (increased to 5 minutes)</para></listitem> 557 <listitem><para>winbind enum groups (disabled by default)</para></listitem> 558 <listitem><para>winbind enum users (disabled by default)</para></listitem> 559 <listitem><para>winbind nested groups (enabled by default)</para></listitem> 560 <listitem><para>winbind uid (deprecated in favor of idmap uid)</para></listitem> 561 <listitem><para>winbind gid (deprecated in favor of idmap gid)</para></listitem> 562 <listitem><para>winbindd nss info</para></listitem> 563 <listitem><para>write cache (deprecated)</para></listitem> 564</itemizedlist> 565 566</sect3> 567 568</sect2> 569 570<sect2> 571<title>New Functionality</title> 572 573 <para> 574<indexterm><primary>major changes</primary></indexterm> 575 The major changes in behavior since that Samba-2.2.x series are documented in this section. 576 Please refer to the <filename>WHATSNEW.txt</filename> file that ships with every release of 577 Samba to obtain detailed information regarding the changes that have been made during the 578 life of the current Samba release. 579 </para> 580 581 <sect3> 582 <title>TDB Data Files</title> 583 584<indexterm><primary>tdb data files</primary></indexterm> 585 <para> 586 Refer to <link linkend="install">Installation, Chapter 1</link>, <link linkend="tdbdocs">Chapter 1</link> 587 for information pertaining to the Samba-3 data files, their location and the information that must be 588 preserved across server migrations, updates and upgrades. 589 </para> 590 591 <para> 592<indexterm><primary>tdb file backup</primary></indexterm> 593 Please remember to back up your existing ${lock directory}/*tdb before upgrading to Samba-3. If necessary, 594 Samba will upgrade databases as they are opened. Downgrading from Samba-3 to 2.2, or reversion to an earlier 595 version of Samba-3 from a later release, is an unsupported path. 596 </para> 597 598 <para> 599<indexterm><primary>tdb file descriptions</primary></indexterm> 600 The old Samba-2.2.x tdb files are described in <link linkend="oldtdbfiledesc">the next table</link>. 601 </para> 602 603 604 <table frame='all' id="oldtdbfiledesc"><title>Samba-2.2.x TDB File Descriptions</title> 605 <tgroup cols='3'> 606 <colspec align="left"/> 607 <colspec align="justify" colwidth="1*"/> 608 <colspec align="left"/> 609 <thead> 610 <row> 611 <entry align="left">Name</entry> 612 <entry align="justify">Description</entry> 613 <entry align="center">Backup?</entry> 614 </row> 615 </thead> 616 <tbody> 617 <row> 618 <entry>account_policy</entry> 619 <entry>User policy settings</entry> 620 <entry>yes</entry> 621 </row> 622 <row> 623 <entry>brlock</entry> 624 <entry>Byte-range file locking information.</entry> 625 <entry>no</entry> 626 </row> 627 <row> 628 <entry>connections</entry> 629 <entry><para>Client connection information</para></entry> 630 <entry>no</entry> 631 </row> 632 <row> 633 <entry>locking</entry> 634 <entry>Temporary file locking data.</entry> 635 <entry>no</entry> 636 </row> 637 <row> 638 <entry>messages</entry> 639 <entry><para>Temporary storage of messages being processed by smbd.</para></entry> 640 <entry>no</entry> 641 </row> 642 <row> 643 <entry>ntdrivers</entry> 644 <entry><para>Stores per-printer driver information.</para></entry> 645 <entry>yes</entry> 646 </row> 647 <row> 648 <entry>ntforms</entry> 649 <entry><para>Stores per-printer forms information.</para></entry> 650 <entry>yes</entry> 651 </row> 652 <row> 653 <entry>ntprinters</entry> 654 <entry><para>Stores the per-printer devmode configuration settings.</para></entry> 655 <entry>yes</entry> 656 </row> 657 <row> 658 <entry>printing/*.tdb</entry> 659 <entry><para>Cached output from lpq command created on a per-print-service basis.</para></entry> 660 <entry>no</entry> 661 </row> 662 <row> 663 664 <entry>registry</entry> 665 <entry><para>Read-only Samba registry skeleton that provides support for 666 exporting various database tables via the winreg RPCs.</para></entry> 667 <entry>no</entry> 668 </row> 669 <row> 670 <entry>sessionid</entry> 671 <entry><para>Temporary cache for miscellaneous session information.</para></entry> 672 <entry>no</entry> 673 </row> 674 <row> 675 <entry>share_info</entry> 676 <entry>Share ACL settings.</entry> 677 <entry>yes</entry> 678 </row> 679 <row> 680 681 <entry>unexpected</entry> 682 <entry><para>Packets received for which no process was listening.</para></entry> 683 <entry>no</entry> 684 </row> 685 <row> 686 <entry>winbindd_cache</entry> 687 <entry><para>Cache of identity information received from an NT4 or an ADS domain.</para></entry> 688 <entry>yes</entry> 689 </row> 690 <row> 691 <entry>winbindd_idmap</entry> 692 <entry><para>New ID map table from SIDS to UNIX UIDs/GIDs.</para></entry> 693 <entry>yes</entry> 694 </row> 695 </tbody> 696 </tgroup> 697 </table> 698 699 </sect3> 700 701 <sect3> 702 <title>Changes in Behavior</title> 703 704 <para> 705 The following issues are known changes in behavior between Samba-2.2 and 706 Samba-3 that may affect certain installations of Samba. 707 </para> 708 709 <orderedlist> 710 <listitem><para> 711<indexterm><primary>Windows domain</primary></indexterm> 712<indexterm><primary>getpwnam() call</primary></indexterm> 713<indexterm><primary>NT_STATUS_LOGON_FAILURE</primary></indexterm> 714 When operating as a member of a Windows domain, Samba-2.2 would map any users authenticated by the remote DC 715 to the <quote>guest account</quote> if a UID could not be obtained via the getpwnam() call. Samba-3 rejects 716 the connection with the error message <quote>NT_STATUS_LOGON_FAILURE.</quote> There is no current workaround 717 to re-establish the Samba-2.2 behavior. 718 </para></listitem> 719 720 <listitem><para> 721<indexterm><primary>add user script</primary></indexterm> 722<indexterm><primary>add machine script</primary></indexterm> 723 When adding machines to a Samba-2.2 controlled domain, the 724 <quote>add user script</quote> was used to create the UNIX identity of the 725 machine trust account. Samba-3 introduces a new <quote>add machine 726 script</quote> that must be specified for this purpose. Samba-3 will 727 not fall back to using the <quote>add user script</quote> in the absence of 728 an <quote>add machine script</quote>. 729 </para></listitem> 730 </orderedlist> 731 732 </sect3> 733 734 <sect3> 735 <title>Passdb Backends and Authentication</title> 736 737 <para> 738 There have been a few new changes that Samba administrators should be 739 aware of when moving to Samba-3. 740 </para> 741 742 <orderedlist> 743 <listitem><para> 744<indexterm><primary>encrypted passwords</primary></indexterm> 745 Encrypted passwords have been enabled by default in order to 746 interoperate better with out-of-the-box Windows client 747 installations. This does mean that either (a) a Samba account 748 must be created for each user, or (b) <quote>encrypt passwords = no</quote> 749 must be explicitly defined in &smb.conf;. 750 </para></listitem> 751 752 <listitem><para> 753<indexterm><primary>ADS</primary></indexterm> 754<indexterm><primary>Kerberos</primary></indexterm> 755<indexterm><primary>LDAP</primary></indexterm> 756 Inclusion of new <smbconfoption name="security">ads</smbconfoption> option for integration 757 with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols. 758 </para></listitem> 759 </orderedlist> 760 761 <para> 762<indexterm><primary>account storage backends</primary></indexterm> 763 Samba-3 also includes the possibility of setting up chains of authentication methods (<smbconfoption 764 name="auth methods"/>) and account storage backends (<smbconfoption name="passdb backend"/>). Please refer to 765 the &smb.conf; man page and <link linkend="passdb">Account Information Databases</link>, for 766 details. While both parameters assume sane default values, it is likely that you will need to understand what 767 the values actually mean in order to ensure Samba operates correctly. 768 </para> 769 770 <para> 771<indexterm><primary>pdbedit</primary></indexterm> 772<indexterm><primary>smbpasswd</primary></indexterm> 773<indexterm><primary>net tool</primary></indexterm> 774 Certain functions of the <command>smbpasswd</command> tool have been split between the 775 new <command>smbpasswd</command> utility, the <command>net</command> tool, and the new <command>pdbedit</command> 776 utility. See the respective man pages for details. 777 </para> 778 779 </sect3> 780 781 <sect3> 782 <title>LDAP</title> 783 784 <para> 785 This section outlines the new features effecting Samba/LDAP integration. 786 </para> 787 788 <sect4> 789 <title>New Schema</title> 790 791 <para> 792<indexterm><primary>object class</primary></indexterm> 793<indexterm><primary>sambaSamAccount</primary></indexterm> 794<indexterm><primary>LDIF</primary></indexterm> 795<indexterm><primary>attributes</primary></indexterm> 796 A new object class (sambaSamAccount) has been introduced to replace 797 the old sambaAccount. This change aids in the renaming of attributes 798 to prevent clashes with attributes from other vendors. There is a 799 conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF 800 file to the new schema. 801 </para> 802 803 <para> 804 Example: 805<indexterm><primary>ldapsearch</primary></indexterm> 806 </para> 807 <para><screen> 808 &prompt;ldapsearch .... -LLL -b "ou=people,dc=..." > old.ldif 809 &prompt;convertSambaAccount --sid <DOM SID> --input old.ldif --output new.ldif 810 </screen></para> 811 812 <para> 813<indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm> 814 The <DOM SID> can be obtained by running 815<screen> 816&prompt;<userinput>net getlocalsid <DOMAINNAME></userinput> 817</screen> 818<indexterm><primary>PDC</primary></indexterm> 819 on the Samba PDC as root. 820 </para> 821 822 <para> 823 Under Samba-2.x the domain SID can be obtained by executing: 824<indexterm><primary>smbpasswd</primary></indexterm> 825<screen> 826&prompt;<userinput>smbpasswd -S <DOMAINNAME></userinput> 827</screen> 828 </para> 829 830 <para> 831<indexterm><primary>old sambaAccount</primary></indexterm> 832<indexterm><primary>ldapsam_compat</primary></indexterm> 833<indexterm><primary>object class declaration</primary></indexterm> 834<indexterm><primary>samba.schema</primary></indexterm> 835 The old <literal>sambaAccount</literal> schema may still be used by specifying the 836 <parameter>ldapsam_compat</parameter> passdb backend. However, the sambaAccount and 837 associated attributes have been moved to the historical section of 838 the schema file and must be uncommented before use if needed. 839 The Samba-2.2 object class declaration for a <literal>sambaAccount</literal> has not changed 840 in the Samba-3 <filename>samba.schema</filename> file. 841 </para> 842 843 <para> 844 Other new object classes and their uses include: 845 </para> 846 847 <itemizedlist> 848 <listitem><para> 849<indexterm><primary>sambaDomain</primary></indexterm> 850<indexterm><primary>domain information</primary></indexterm> 851<indexterm><primary>RID</primary></indexterm> 852<indexterm><primary>ldap suffix</primary></indexterm> 853<indexterm><primary>ldapsam</primary></indexterm> 854<indexterm><primary>idmap</primary></indexterm> 855 <literal>sambaDomain</literal> &smbmdash; domain information used to allocate RIDs 856 for users and groups as necessary. The attributes are added 857 in <quote>ldap suffix</quote> directory entry automatically if 858 an idmap UID/GID range has been set and the <quote>ldapsam</quote> 859 passdb backend has been selected. 860 </para></listitem> 861 862 <listitem><para> 863<indexterm><primary>sambaGroupMapping</primary></indexterm> 864<indexterm><primary>ldap group suffix</primary></indexterm> 865<indexterm><primary>net groupmap</primary></indexterm> 866 sambaGroupMapping &smbmdash; an object representing the 867 relationship between a posixGroup and a Windows 868 group/SID. These entries are stored in the <quote>ldap 869 group suffix</quote> and managed by the <quote>net groupmap</quote> command. 870 </para></listitem> 871 872 <listitem><para> 873<indexterm><primary>sambaUNIXIdPool</primary></indexterm> 874<indexterm><primary>ldap idmap suffix</primary></indexterm> 875<indexterm><primary>idmap UID</primary></indexterm> 876<indexterm><primary>idmap GID</primary></indexterm> 877 <literal>sambaUNIXIdPool</literal> &smbmdash; created in the <quote>ldap idmap suffix</quote> entry 878 automatically and contains the next available <quote>idmap UID</quote> and 879 <quote>idmap GID</quote>. 880 </para></listitem> 881 882 <listitem><para> 883<indexterm><primary>sambaIdmapEntry</primary></indexterm> 884<indexterm><primary>idmap_ldap module</primary></indexterm> 885 <literal>sambaIdmapEntry</literal> &smbmdash; object storing a mapping between a 886 SID and a UNIX UID/GID. These objects are created by the 887 idmap_ldap module as needed. 888 </para></listitem> 889 </itemizedlist> 890 891 </sect4> 892 893 <sect4> 894 <title>New Suffix for Searching</title> 895 896 <para> 897<indexterm><primary>LDAP queries</primary></indexterm> 898<indexterm><primary>passdb backend</primary></indexterm> 899<indexterm><primary>ldap suffix</primary></indexterm> 900<indexterm><primary>ldap user suffix</primary></indexterm> 901<indexterm><primary>ldap machine suffix</primary></indexterm> 902<indexterm><primary>ldap group suffix</primary></indexterm> 903<indexterm><primary>ldap idmap suffix</primary></indexterm> 904 The following new &smb.conf; parameters have been added to aid in directing 905 certain LDAP queries when <parameter>passdb backend = ldapsam://...</parameter> has been 906 specified. 907 </para> 908 909 <itemizedlist> 910 <listitem><para>ldap suffix &smbmdash; used to search for user and computer accounts.</para></listitem> 911 <listitem><para>ldap user suffix &smbmdash; used to store user accounts.</para></listitem> 912 <listitem><para>ldap machine suffix &smbmdash; used to store machine trust accounts.</para></listitem> 913 <listitem><para>ldap group suffix &smbmdash; location of posixGroup/sambaGroupMapping entries.</para></listitem> 914 <listitem><para>ldap idmap suffix &smbmdash; location of sambaIdmapEntry objects.</para></listitem> 915 </itemizedlist> 916 917 <para> 918<indexterm><primary>ldap suffix</primary></indexterm> 919<indexterm><primary>subsuffix parameters</primary></indexterm> 920 If an <parameter>ldap suffix</parameter> is defined, it will be appended to all of the 921 remaining subsuffix parameters. In this case, the order of the suffix 922 listings in &smb.conf; is important. Always place the <parameter>ldap suffix</parameter> first 923 in the list. 924 </para> 925 926 <para> 927 Due to a limitation in Samba's &smb.conf; parsing, you should not surround 928 the domain names with quotation marks. 929 </para> 930 931 </sect4> 932 933 <sect4> 934 <title>IdMap LDAP Support</title> 935 936 <para> 937<indexterm><primary>idmap backend</primary></indexterm> 938 Samba-3 supports an LDAP backend for the idmap subsystem. The 939 following options inform Samba that the idmap table should be 940 stored on the directory server <emphasis>onterose</emphasis> in the ou=Idmap,dc=quenya,dc=org partition. 941 </para> 942 943 <smbconfblock> 944 <smbconfsection name="[global]"/> 945 <member>...</member> 946 <smbconfoption name="idmap backend">ldap:ldap://onterose/</smbconfoption> 947 <smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption> 948 <smbconfoption name="idmap uid">40000-50000</smbconfoption> 949 <smbconfoption name="idmap gid">40000-50000</smbconfoption> 950 </smbconfblock> 951 952 <para> 953<indexterm><primary>NFS</primary></indexterm> 954 This configuration allows Winbind installations on multiple servers to 955 share a UID/GID number space, thus avoiding the interoperability problems 956 with NFS that were present in Samba-2.2. 957 </para> 958 959 </sect4> 960 961 </sect3> 962 963 </sect2> 964 965</sect1> 966 967</chapter> 968