1 Samba meta FAQ 2 Dan Shearer & Paul Blackman, ictinus@samba.org 3 v 0.3, 7 Oct '97 4 5 This is the meta-Frequently Asked Questions (FAQ) document for Samba, 6 the free and very popular SMB and CIFS server product. It contains 7 overview information for the Samba suite of programs, a quick-start 8 guide, and pointers to all other Samba documentation. Other FAQs exist 9 for specific client and server issues, and HOWTO documents for more 10 extended topics to do with Samba software. Current to version Samba 11 1.9.17. Please send any corrections to the author. 12 ______________________________________________________________________ 13 14 Table of Contents: 15 16 1. Quick Reference Guides to Samba Documentation 17 18 1.1. Samba for the Impatient 19 20 1.2. All Samba Documentation 21 22 2. General Information 23 24 2.1. What is Samba? 25 26 2.2. What is the current version of Samba? 27 28 2.3. Where can I get it? 29 30 2.4. What do the version numbers mean? 31 32 2.5. Where can I go for further information? 33 34 2.6. How do I subscribe to the Samba Mailing Lists? 35 36 2.7. Something's gone wrong - what should I do? 37 38 2.8. How do I submit patches or bug reports? 39 40 2.9. What if I have an URGENT message for the developers? 41 42 2.10. What if I need paid-for support? 43 44 2.11. Pizza supply details 45 46 3. About the CIFS and SMB Protocols 47 48 3.1. What is the Server Message Block (SMB) Protocol? 49 50 3.2. What is the Common Internet Filesystem (CIFS)? 51 52 3.3. What is Browsing? 53 54 4. Designing A SMB and CIFS Network 55 56 4.1. Workgroups, Domains, Authentication and Browsing 57 58 4.1.1. Defining the Terms 59 60 4.1.2. Sharelevel (Workgroup) Security Services 61 62 4.1.3. Authentication Domain Mode Services 63 64 4.2. Authentication Schemes 65 66 67 4.2.1. NIS 68 69 4.2.2. Kerberos 70 71 4.2.3. FTP 72 73 4.2.4. Default Server Method 74 75 4.2.5. Client-side Database Only 76 77 4.3. Post-Authentication: Netlogon, Logon Scripts, Profiles 78 79 5. Cross-Protocol File Sharing 80 81 6. Miscellaneous 82 83 6.1. Is Samba Year 2000 compliant? 84 ______________________________________________________________________ 85 86 11.. QQuuiicckk RReeffeerreennccee GGuuiiddeess ttoo SSaammbbaa DDooccuummeennttaattiioonn 87 88 89 We are endeavouring to provide links here to every major class of 90 information about Samba or things related to Samba. We cannot list 91 every document, but we are aiming for all documents to be at most two 92 referrals from those listed here. This needs constant maintaining, so 93 please send the author your feedback. 94 95 96 11..11.. SSaammbbaa ffoorr tthhee IImmppaattiieenntt 97 98 99 You know you should read the documentation but can't wait to start? 100 What you need to do then is follow the instructions in the following 101 documents in the order given. This should be enough to get a fairly 102 simple site going quickly. If you have any problems, refer back to 103 this meta-FAQ and follow the links to find more reading material. 104 105 106 107 GGeettttiinngg SSaammbbaa:: 108 The fastest way to get Samba going is and install it is to have 109 an operating system for which the Samba team has put together an 110 installation package. To see if your OS is included have a look 111 at the directory /pub/samba/Binary_Packages/"OS_Vendor" on your 112 nearest mirror site <../MIRRORS>. If it is included follow the 113 installation instructions in the README file there and then do 114 some ``basic testing''. If you are not so fortunate, follow the 115 normal ``download instructions'' and then continue with 116 ``building and installing Samba''. 117 118 119 BBuuiillddiinngg aanndd IInnssttaalllliinngg SSaammbbaa:: 120 At the moment there are two kinds of Samba server installs 121 besides the prepackaged binaries mentioned in the previous step. 122 You need to decide if you have a Unix or close relative 123 <../UNIX_INSTALL.txt> or other supported operating system 124 <Samba-Server-FAQ.html#PortInfo>. 125 126 127 BBaassiicc TTeessttiinngg:: 128 Try to connect using the supplied smbclient command-line 129 program. You need to know the IP hostname of your server. A 130 service name must be defined in smb.conf, as given in the 131 examples (under many operating systems if there is a homes 132 service you can just use a valid username.) Then type smbclient 133 \hostnamevicename Under most Unixes you will need to put the 134 parameters within quotation marks. If this works, try connecting 135 from one of the SMB clients you were planning to use with Samba. 136 137 138 DDeebbuugg sseeqquueennccee:: 139 If you think you have completed the previous step and things 140 aren't working properly work through the diagnosis recipe. 141 <../DIAGNOSIS.txt> 142 143 144 EExxppoorrttiinngg ffiilleess ttoo SSMMBB cclliieennttss:: 145 You should read the manual pages for smb.conf, but here is a 146 quick answer guide. <Samba-Server-FAQ.html#Exporting> 147 148 149 CCoonnttrroolllliinngg uusseerr aacccceessss:: 150 the quickest and dirtiest way of sharing resources is to use 151 ``share level security.'' If you want to spend more time and 152 have a proper username and password database you must read the 153 paragraph on ``domain mode security.'' If you want encryption 154 (eg you are using Windows NT clients) follow the SMB encryption 155 instructions. <Samba-Server-FAQ.html#SMBEncryptionSteps> 156 157 158 BBrroowwssiinngg:: 159 if you are happy to type in "\samba-serverrename" at the client 160 end then do not read any further. Otherwise you need to 161 understand the ``browsing terminology'' and read <Samba-Server- 162 FAQ.html#NameBrowsing>. 163 164 165 PPrriinnttiinngg:: 166 See the printing quick answer guide. <Samba-Server- 167 FAQ.html#Printing> 168 169 170 If you have got everything working to this point, you can expect Samba 171 to be stable and secure: these are its greatest strengths. However 172 Samba has a great deal to offer and to go further you must do some 173 more reading. Speed and security optimisations, printer accounting, 174 network logons, roving profiles, browsing across multiple subnets and 175 so on are all covered either in this document or in those it refers 176 to. 177 178 179 11..22.. AAllll SSaammbbaa DDooccuummeennttaattiioonn 180 181 182 183 +o Meta-FAQ. This is the mother of all documents, and is the one you 184 are reading now. The latest version is always at 185 <http://samba.org/[.....]> but there is probably a much 186 nearer mirror site <../MIRRORS> which you should use instead. 187 188 +o <Samba-Server-FAQ.html> is the best starting point for information 189 about server-side issues. Includes configuration tips and pointers 190 for Samba on particular operating systems (with 40 to choose 191 from...) 192 193 +o <Samba-Client-FAQ.html> is the best starting point for information 194 about client-side issues, includes a list of all clients that are 195 known to work with Samba. 196 197 +o manual pages <samba-man-index.html> contains descriptions of and 198 links to all the Samba manual pages, in Unix man and postscript 199 format. 200 201 +o <samba-txt-index.html> has descriptions of and links to a large 202 number of text files have been contributed to samba covering many 203 topics. These are gradually being absorbed into the FAQs and HOWTOs 204 but in the meantime you might find helpful answers here. 205 206 +o 207 208 209 22.. GGeenneerraall IInnffoorrmmaattiioonn 210 211 212 All about Samba - what it is, how to get it, related sources of 213 information, how to understand the numbering scheme, pizza details. 214 215 216 22..11.. WWhhaatt iiss SSaammbbaa?? 217 218 219 Samba is a suite of programs which work together to allow clients to 220 access to a server's filespace and printers via the SMB (Server 221 Message Block) and CIFS (Common Internet Filesystem) protocols. 222 Initially written for Unix, Samba now also runs on Netware, OS/2, VMS, 223 StratOS and Amigas. Ports to BeOS and other operating systems are 224 underway. Samba gives the capability for these operating systems to 225 behave much like a LAN Server, Windows NT Server or Pathworks machine, 226 only with added functionality and flexibility designed to make life 227 easier for administrators. 228 229 This means that using Samba you can share a server's disks and 230 printers to many sorts of network clients, including Lan Manager, 231 Windows for Workgroups, Windows NT, Linux, OS/2, and AIX. There is 232 also a generic client program supplied as part of the Samba suite 233 which gives a user on the server an ftp-like interface to access 234 filespace and printers on any other SMB/CIFS servers. 235 236 SMB has been implemented over many protocols, including XNS, NBT, IPX, 237 NetBEUI and TCP/IP. Samba only uses TCP/IP. This is not likely to 238 change although there have been some requests for NetBEUI support. 239 240 Many users report that compared to other SMB implementations Samba is 241 more stable, faster, and compatible with more clients. Administrators 242 of some large installations say that Samba is the only SMB server 243 available which will scale to many tens of thousands of users without 244 crashing. The easy way to test these claims is to download it and try 245 it for yourself! 246 247 The suite is supplied with full source code under the GNU Public 248 License <../COPYING>. The GPL means that you can use Samba for 249 whatever purpose you wish (including changing the source or selling it 250 for money) but under all circumstances the source code must be made 251 freely available. A copy of the GPL must always be included in any 252 copy of the package. 253 254 The primary creator of the Samba suite is Andrew Tridgell. Later 255 versions incorporate much effort by many net.helpers. The man pages 256 and this FAQ were originally written by Karl Auer. 257 258 259 22..22.. WWhhaatt iiss tthhee ccuurrrreenntt vveerrssiioonn ooff SSaammbbaa?? 260 261 262 At time of writing, the current version was 1.9.17. If you want to be 263 sure check the bottom of the change-log file. 264 <ftp://samba.org/pub/samba/alpha/change-log> 265 For more information see ``What do the version numbers mean?'' 266 267 268 22..33.. WWhheerree ccaann II ggeett iitt?? 269 270 271 The Samba suite is available via anonymous ftp from samba.org 272 and many mirror <../MIRRORS> sites. You will get much faster 273 performance if you use a mirror site. The latest and greatest versions 274 of the suite are in the directory: 275 276 /pub/samba/ 277 278 Development (read "alpha") versions, which are NOT necessarily stable 279 and which do NOT necessarily have accurate documentation, are 280 available in the directory: 281 282 /pub/samba/alpha 283 284 Note that binaries are NOT included in any of the above. Samba is 285 distributed ONLY in source form, though binaries may be available from 286 other sites. Most Linux distributions, for example, do contain Samba 287 binaries for that platform. The VMS, OS/2, Netware and Amiga and other 288 ports typically have binaries made available. 289 290 A special case is vendor-provided binary packages. Samba binaries and 291 default configuration files are put into packages for a specific 292 operating system. RedHat Linux and Sun Solaris (Sparc and x86) is 293 already included, and others such as OS/2 may follow. All packages are 294 in the directory: 295 296 /pub/samba/Binary_Packages/"OS_Vendor" 297 298 299 22..44.. WWhhaatt ddoo tthhee vveerrssiioonn nnuummbbeerrss mmeeaann?? 300 301 302 It is not recommended that you run a version of Samba with the word 303 "alpha" in its name unless you know what you are doing and are willing 304 to do some debugging. Many, many people just get the latest 305 recommended stable release version and are happy. If you are brave, by 306 all means take the plunge and help with the testing and development - 307 but don't install it on your departmental server. Samba is typically 308 very stable and safe, and this is mostly due to the policy of many 309 public releases. 310 311 How the scheme works: 312 313 314 1. When major changes are made the version number is increased. For 315 example, the transition from 1.9.16 to 1.9.17. However, this 316 version number will not appear immediately and people should 317 continue to use 1.9.15 for production systems (see next point.) 318 319 2. Just after major changes are made the software is considered 320 unstable, and a series of alpha releases are distributed, for 321 example 1.9.16alpha1. These are for testing by those who know what 322 they are doing. The "alpha" in the filename will hopefully scare 323 off those who are just looking for the latest version to install. 324 325 3. When Andrew thinks that the alphas have stabilised to the point 326 where he would recommend new users install it, he renames it to the 327 same version number without the alpha, for example 1.9.17. 328 329 4. Inevitably bugs are found in the "stable" releases and minor patch 330 levels are released which give us the pXX series, for example 331 1.9.17p2. 332 333 So the progression goes: 334 335 336 1.9.16p10 (production) 337 1.9.16p11 (production) 338 1.9.17alpha1 (test sites only) 339 : 340 1.9.17alpha20 (test sites only) 341 1.9.17 (production) 342 1.9.17p1 (production) 343 344 345 346 The above system means that whenever someone looks at the samba ftp 347 site they will be able to grab the highest numbered release without an 348 alpha in the name and be sure of getting the current recommended 349 version. 350 351 352 22..55.. WWhheerree ccaann II ggoo ffoorr ffuurrtthheerr iinnffoorrmmaattiioonn?? 353 354 355 There are a number of places to look for more information on Samba, 356 including: 357 358 359 +o Two mailing lists devoted to discussion of Samba-related matters. 360 See below for subscription information. 361 362 +o The newsgroup comp.protocols.smb, which has a great deal of 363 discussion about Samba. 364 365 +o The WWW site 'SAMBA Web Pages' at <http://samba.org/samba/> 366 includes: 367 368 369 +o Links to man pages and documentation, including this FAQ 370 371 +o A comprehensive survey of Samba users 372 373 +o A searchable hypertext archive of the Samba mailing list 374 375 +o Links to Samba source code, binaries, and mirrors of both 376 377 +o This FAQ and the rest in its family 378 379 380 381 22..66.. HHooww ddoo II ssuubbssccrriibbee ttoo tthhee SSaammbbaa MMaaiilliinngg LLiissttss?? 382 383 384 Send email to listproc@samba.org. Make sure the subject line is 385 blank, and include the following two lines in the body of the message: 386 387 388 389 subscribe samba Firstname Lastname 390 subscribe samba-announce Firstname Lastname 391 392 393 394 395 Obviously you should substitute YOUR first name for "Firstname" and 396 YOUR last name for "Lastname"! Try not to send any signature, it 397 sometimes confuses the list processor. 398 399 The samba list is a digest list - every eight hours or so it sends a 400 single message containing all the messages that have been received by 401 the list since the last time and sends a copy of this message to all 402 subscribers. There are thousands of people on this list. 403 404 If you stop being interested in Samba, please send another email to 405 listproc@samba.org. Make sure the subject line is blank, and 406 include the following two lines in the body of the message: 407 408 409 410 unsubscribe samba 411 unsubscribe samba-announce 412 413 414 415 416 The FFrroomm:: line in your message _M_U_S_T be the same address you used when 417 you subscribed. 418 419 420 22..77.. SSoommeetthhiinngg''ss ggoonnee wwrroonngg -- wwhhaatt sshhoouulldd II ddoo?? 421 422 423 ## ****** IIMMPPOORRTTAANNTT!! ****** ## 424 425 426 DO NOT post messages on mailing lists or in newsgroups until you have 427 carried out the first three steps given here! 428 429 430 1. See if there are any likely looking entries in this FAQ! If you 431 have just installed Samba, have you run through the checklist in 432 DIAGNOSIS.txt <ftp://samba.org/pub/samba/DIAGNOSIS.txt>? It 433 can save you a lot of time and effort. DIAGNOSIS.txt can also be 434 found in the docs directory of the Samba distribution. 435 436 2. Read the man pages for smbd, nmbd and smb.conf, looking for topics 437 that relate to what you are trying to do. 438 439 3. If there is no obvious solution to hand, try to get a look at the 440 log files for smbd and/or nmbd for the period during which you were 441 having problems. You may need to reconfigure the servers to provide 442 more extensive debugging information - usually level 2 or level 3 443 provide ample debugging info. Inspect these logs closely, looking 444 particularly for the string "Error:". 445 446 4. If you need urgent help and are willing to pay for it see ``Paid 447 Support''. 448 449 If you still haven't got anywhere, ask the mailing list or newsgroup. 450 In general nobody minds answering questions provided you have followed 451 the preceding steps. It might be a good idea to scan the archives of 452 the mailing list, which are available through the Samba web site 453 described in the previous section. When you post be sure to include a 454 good description of your environment and your problem. 455 456 If you successfully solve a problem, please mail the FAQ maintainer a 457 succinct description of the symptom, the problem and the solution, so 458 that an explanation can be incorporated into the next version. 459 460 461 462 463 22..88.. HHooww ddoo II ssuubbmmiitt ppaattcchheess oorr bbuugg rreeppoorrttss?? 464 465 466 If you make changes to the source code, _p_l_e_a_s_e submit these patches so 467 that everyone else gets the benefit of your work. This is one of the 468 most important aspects to the maintainence of Samba. Send all patches 469 to samba@samba.org. Do not send patches to Andrew Tridgell 470 or any other individual, they may be lost if you do. 471 472 Patch format ------------ 473 474 If you are sending a patch to fix a problem then please don't just use 475 standard diff format. As an example, samba received this patch 476 from someone: 477 478 382a #endif 381a #if !defined(NEWS61) 479 480 How are we supposed to work out what this does and where it goes? 481 These sort of patches only work if we both have identical files in the 482 first place. The Samba sources are constantly changing at the hands of 483 multiple developers, so it doesn't work. 484 485 Please use either context diffs or (even better) unified diffs. You 486 get these using "diff -c4" or "diff -u". If you don't have a diff that 487 can generate these then please send manualy commented patches to I 488 know what is being changed and where. Most patches are applied by hand 489 so the info must be clear. 490 491 This is a basic guideline that will assist us with assessing your 492 problem more efficiently : 493 494 Machine Arch: Machine OS: OS Version: Kernel: 495 496 Compiler: Libc Version: 497 498 Samba Version: 499 500 Network Layout (description): 501 502 What else is on machine (services, etc): 503 504 Some extras : 505 506 507 +o what you did and what happened 508 509 +o relevant parts of a debugging output file with debuglevel higher. 510 If you can't find the relevant parts, please ask before mailing 511 huge files. 512 513 +o anything else you think is useful to trace down the bug 514 515 516 22..99.. WWhhaatt iiff II hhaavvee aann UURRGGEENNTT mmeessssaaggee ffoorr tthhee ddeevveellooppeerrss?? 517 518 519 If you have spotted something very serious and believe that it is 520 important to contact the developers quickly send a message to samba- 521 urgent@samba.org. This will be processed more quickly than mail 522 to samba. Please think carefully before using this address. An 523 example of its use might be to report a security hole. 524 525 Examples of things _n_o_t to send to samba-urgent include problems 526 getting Samba to work at all and bugs that cannot potentially cause 527 damage. 528 529 22..1100.. WWhhaatt iiff II nneeeedd ppaaiidd--ffoorr ssuuppppoorrtt?? 530 531 532 Samba has a large network of consultants who provide Samba support on 533 a commercial basis. The list is included in the package in 534 <../Support.txt>, and the latest version will always be on the main 535 samba ftp site. Any company in the world can request that the samba 536 team include their details in Support.txt so we can give no guarantee 537 of their services. 538 539 540 22..1111.. PPiizzzzaa ssuuppppllyy ddeettaaiillss 541 542 543 Those who have registered in the Samba survey as "Pizza Factory" will 544 already know this, but the rest may need some help. Andrew doesn't ask 545 for payment, but he does appreciate it when people give him pizza. 546 This calls for a little organisation when the pizza donor is twenty 547 thousand kilometres away, but it has been done. 548 549 550 1. Ring up your local branch of an international pizza chain and see 551 if they honour their vouchers internationally. Pizza Hut do, which 552 is how the entire Canberra Linux Users Group got to eat pizza one 553 night, courtesy of someone in the US. 554 555 2. Ring up a local pizza shop in Canberra and quote a credit card 556 number for a certain amount, and tell them that Andrew will be 557 collecting it (don't forget to tell him.) One kind soul from 558 Germany did this. 559 560 3. Purchase a pizza voucher from your local pizza shop that has no 561 international affiliations and send it to Andrew. It is completely 562 useless but he can hang it on the wall next to the one he already 563 has from Germany :-) 564 565 4. Air freight him a pizza with your favourite regional flavours. It 566 will probably get stuck in customs or torn apart by hungry sniffer 567 dogs but it will have been a noble gesture. 568 569 570 33.. AAbboouutt tthhee CCIIFFSS aanndd SSMMBB PPrroottooccoollss 571 572 573 574 33..11.. WWhhaatt iiss tthhee SSeerrvveerr MMeessssaaggee BBlloocckk ((SSMMBB)) PPrroottooccooll?? 575 576 SMB is a filesharing protocol that has had several maintainers and 577 contributors over the years including Xerox, 3Com and most recently 578 Microsoft. Names for this protocol include LAN Manager and Microsoft 579 Networking. Parts of the specification has been made public at several 580 versions including in an X/Open document, as listed at 581 <ftp://ftp.microsoft.com/developr/drg/CIFS/>. No specification 582 releases were made between 1992 and 1996, and during that period 583 Microsoft became the SMB implementor with the largest market share. 584 Microsoft developed the specification further for its products but for 585 various reasons connected with developer's workload rather than market 586 strategy did not make the changes public. This culminated with the 587 "Windows NT 0.12" version released with NT 3.5 in 1995 which had 588 significant improvements and bugs. Because Microsoft client systems 589 are so popular, it is fair to say that what Microsoft with Windows 590 affects all suppliers of SMB server products. 591 592 From 1994 Andrew Tridgell began doing some serious work on his 593 Smbserver (now Samba) product and with some helpers started to 594 implement more and more of these protocols. Samba began to take a 595 significant share of the SMB server market. 596 597 598 33..22.. WWhhaatt iiss tthhee CCoommmmoonn IInntteerrnneett FFiilleessyysstteemm ((CCIIFFSS))?? 599 600 The initial pressure for Microsoft to document their current SMB 601 implementation came from the Samba team, who kept coming across things 602 on the wire that Microsoft either didn't know about or hadn't 603 documented anywhere (even in the sourcecode to Windows NT.) Then Sun 604 Microsystems came out with their WebNFS initiative, designed to 605 replace FTP for file transfers on the Internet. There are many 606 drawbacks to WebNFS (including its scope - it aims to replace HTTP as 607 well!) but the concept was attractive. FTP is not very clever, and why 608 should it be harder to get files from across the world than across the 609 room? 610 611 Some hasty revisions were made and an Internet Draft for the Common 612 Internet Filesystem (CIFS) was released. Note that CIFS is not an 613 Internet standard and is a very long way from becoming one, BUT the 614 protocol specification is in the public domain and ongoing discussions 615 concerning the spec take place on a public mailing list according to 616 the rules of the Internet Engineering Task Force. For more information 617 and pointers see <http://samba.org/cifs/> 618 619 The following is taken from <http://www.microsoft.com/intdev/cifs/> 620 621 622 CIFS defines a standard remote file system access protocol for use 623 over the Internet, enabling groups of users to work together and 624 share documents across the Internet or within their corporate 625 intranets. CIFS is an open, cross-platform technology based on the 626 native file-sharing protocols built into Microsoft Windows and 627 other popular PC operating systems, and supported on dozens of 628 other platforms, including UNIX. With CIFS, millions of computer 629 users can open and share remote files on the Internet without having 630 to install new software or change the way they work." 631 632 633 634 If you consider CIFS as a backwardsly-compatible refinement of SMB 635 that will work reasonably efficiently over the Internet you won't be 636 too far wrong. 637 638 The net effect is that Microsoft is now documenting large parts of 639 their Windows NT fileserver protocols. The security concepts embodied 640 in Windows NT are part of the specification, which is why Samba 641 documentation often talks in terms of Windows NT. However there is no 642 reason why a site shouldn't conduct all its file and printer sharing 643 with CIFS and yet have no Microsoft products at all. 644 645 646 33..33.. WWhhaatt iiss BBrroowwssiinngg?? 647 648 The term "Browsing" causes a lot of confusion. It is the part of the 649 SMB/CIFS protocol which allows for resource discovery. For example, in 650 the Windows NT Explorer it is possible to see a "Network 651 Neighbourhood" of computers in the same SMB workgroup. Clicking on the 652 name of one of these machines brings up a list of file and printer 653 resources for connecting to. In this way you can cruise the network, 654 seeing what things are available. How this scales to the Internet is a 655 subject for debate. Look at the CIFS list archives to see what the 656 experts think. 657 658 659 660 661 44.. DDeessiiggnniinngg AA SSMMBB aanndd CCIIFFSS NNeettwwoorrkk 662 663 664 The big issues for installing any network of LAN or WAN file and print 665 servers are 666 667 668 +o How and where usernames, passwords and other security information 669 is stored 670 671 +o What method can be used for locating the resources that users have 672 permission to use 673 674 +o What protocols the clients can converse with 675 676 677 If you buy Netware, Windows NT or just about any other LAN fileserver 678 product you are expected to lock yourself into the product's preferred 679 answers to these questions. This tendancy is restrictive and often 680 very expensive for a site where there is only one kind of client or 681 server, and for sites with a mixture of operating systems it often 682 makes it impossible to share resources between some sets of users. 683 684 The Samba philosophy is to make things as easy as possible for 685 administators, which means allowing as many combinations of clients, 686 servers, operating systems and protocols as possible. 687 688 689 44..11.. WWoorrkkggrroouuppss,, DDoommaaiinnss,, AAuutthheennttiiccaattiioonn aanndd BBrroowwssiinngg 690 691 692 From the point of view of networking implementation, Domains and 693 Workgroups are _e_x_a_c_t_l_y the same, except for the client logon sequence. 694 Some kind of distributed authentication database is associated with a 695 domain (there are quite a few choices) and this adds so much 696 flexibility that many people think of a domain as a completely 697 different entity to a workgroup. From Samba's point of view a client 698 connecting to a service presents an authentication token, and it if it 699 is valid they have access. Samba does not care what mechanism was used 700 to generate that token in the first place. 701 702 The SMB client logging on to a domain has an expectation that every 703 other server in the domain should accept the same authentication 704 information. However the network browsing functionality of domains 705 and workgroups is identical and is explained in <../BROWSING.txt>. 706 707 There are some implementation differences: Windows 95 can be a member 708 of both a workgroup and a domain, but Windows NT cannot. Windows 95 709 also has the concept of an "alternative workgroup". Samba can only be 710 a member of a single workgroup or domain, although this is due to 711 change with a future version when nmbd will be split into two daemons, 712 one for WINS and the other for browsing ( <../NetBIOS.txt> explains 713 what WINS is.) 714 715 716 44..11..11.. DDeeffiinniinngg tthhee TTeerrmmss 717 718 719 720 721 WWoorrkkggrroouupp 722 means a collection of machines that maintain a common browsing 723 database containing information about their shared resources. 724 They do not necessarily have any security information in common 725 (if they do, it gets called a Domain.) The browsing database is 726 dynamic, modified as servers come and go on the network and as 727 resources are added or deleted. The term "browsing" refers to a 728 user accessing the database via whatever interface the client 729 provides, eg the OS/2 Workplace Shell or Windows 95 Explorer. 730 SMB servers agree between themselves as to which ones will 731 maintain the browsing database. Workgroups can be anywhere on a 732 connected TCP/IP network, including on different subnets or even 733 on the Interet. This is a very tricky part of SMB to implement. 734 735 736 MMaasstteerr BBrroowwsseerrss 737 are machines which holds the master browsing database for a 738 workgroup or domain. There are two kinds of Master Browser: 739 740 741 +o Domain Master Browser, which holds the master browsing 742 information for an entire domain, which may well cross multiple 743 TCP/IP subnets. 744 745 +o Local Master Browser, which holds the master browsing database 746 for a particular subnet and communicates with the Domain Master 747 Browser to get information on other subnets. 748 749 Subnets are differentiated because browsing is based on 750 broadcasts, and broadcasts do not pass through routers. Subnets 751 are not routed: while it is possible to have more than one 752 subnet on a single network segment this is regarded as very bad 753 practice. 754 755 Master Browsers (both Domain and Local) are elected dynamically 756 according to an algorithm which is supposed to take into account 757 the machine's ability to sustain the browsing load. Samba can be 758 configured to always act as a master browser, ie it always wins 759 elections under all circumstances, even against systems such as 760 a Windows NT Primary Domain Controller which themselves expect 761 to win. 762 763 There are also Backup Browsers which are promoted to Master 764 Browsers in the event of a Master Browser disappearing from the 765 network. 766 767 Alternative terms include confusing variations such as "Browse 768 Master", and "Master Browser" which we are trying to eliminate 769 from the Samba documentation. 770 771 772 DDoommaaiinn CCoonnttrroolllleerr 773 is a term which comes from the Microsoft and IBM etc 774 implementation of the LAN Manager protocols. It is tied to 775 authentication. There are other ways of doing domain 776 authentication, but the Windows NT method has a large market 777 share. The general issues are discussed in <../DOMAIN.txt> and 778 a Windows NT-specific discussion is in <../DOMAIN_CONTROL.txt>. 779 780 781 782 44..11..22.. SShhaarreelleevveell ((WWoorrkkggrroouupp)) SSeeccuurriittyy SSeerrvviicceess 783 784 785 With the Samba setting "security = SHARE", all shared resources 786 information about what password is associated with them but only hints 787 as to what usernames might be valid (the hint can be 'all users', in 788 which case any username will work. This is usually a bad idea, but 789 reflects both the initial implementations of SMB in the mid-80s and 790 its reincarnation with Windows for Workgroups in 1992. The idea behind 791 workgroup security was that small independant groups of people could 792 share information on an ad-hoc basis without there being an 793 authentication infrastructure present or requiring them to do more 794 than fill in a dialogue box. 795 796 797 44..11..33.. AAuutthheennttiiccaattiioonn DDoommaaiinn MMooddee SSeerrvviicceess 798 799 800 With the Samba settings "security = USER" or "security = SERVER" 801 accesses to all resources are checked for username/password pair 802 matches in a more rigorous manner. To the client, this has the effect 803 of emulating a Microsoft Domain. The client is not concerned whether 804 or not Samba looks up a Windows NT SAM or does it in some other way. 805 806 807 44..22.. AAuutthheennttiiccaattiioonn SScchheemmeess 808 809 810 In the simple case authentication information is stored on a single 811 server and the user types a password on connecting for the first time. 812 However client operating systems often require a password before they 813 can be used at all, and in addition users usually want access to more 814 than one server. Asking users to remember many different passwords in 815 different contexts just does not work. Some kind of distributed 816 authentication database is needed. It must cope with password changes 817 and provide for assigning groups of users the same level of access 818 permissions. This is why Samba installations often choose to implement 819 a Domain model straight away. 820 821 Authentication decisions are some of the biggest in designing a 822 network. Are you going to use a scheme native to the client operating 823 system, native to the server operating system, or newly installed on 824 both? A list of options relevant to Samba (ie that make sense in the 825 context of the SMB protocol) follows. Any experiences with other 826 setups would be appreciated. refer to server FAQ for "passwd chat" 827 passwd program password server etc etc... 828 829 830 44..22..11.. NNIISS 831 832 833 For Windows 95, Windows for Workgroups and most other clients Samba 834 can be a domain controller and share the password database via NIS 835 transparently. Windows NT is different. Free NIS NT client 836 <http://www.dcs.qmw.ac.uk/~williams> 837 838 839 44..22..22.. KKeerrbbeerrooss 840 841 842 Kerberos for US users only: Kerberos overview 843 <http://www.cygnus.com/product/unifying-security.html> Download 844 Kerberos <http://www.cygnus.com/product/kerbnet-download.html> 845 846 847 44..22..33.. FFTTPP 848 849 850 Other NT w/s logon hack via NT 851 852 853 44..22..44.. DDeeffaauulltt SSeerrvveerr MMeetthhoodd 854 855 856 857 858 859 44..22..55.. CClliieenntt--ssiiddee DDaattaabbaassee OOnnllyy 860 861 862 863 44..33.. PPoosstt--AAuutthheennttiiccaattiioonn:: NNeettllooggoonn,, LLooggoonn SSccrriippttss,, PPrrooffiilleess 864 865 866 See <../DOMAIN.txt> 867 868 869 55.. CCrroossss--PPrroottooccooll FFiillee SShhaarriinngg 870 871 872 Samba is an important tool for... 873 874 It is possible to... 875 876 File protocol gateways... 877 878 "Setting up a Linux File Server" 879 http://vetrec.mit.edu/people/narf/linux.html 880 881 Two free implementations of Appletalk for Unix are Netatalk, 882 <http://www.umich.edu/~rsug/netatalk/>, and CAP, 883 <http://www.cs.mu.oz.au/appletalk/atalk.html>. What Samba offers MS 884 Windows users, these packages offer to Macs. For more info on these 885 packages, Samba, and Linux (and other UNIX-based systems) see 886 <http://www.eats.com/linux_mac_win.html> 3.5) Sniffing your nework 887 888 889 890 66.. MMiisscceellllaanneeoouuss 891 892 893 66..11.. IIss SSaammbbaa YYeeaarr 22000000 ccoommpplliiaanntt?? 894 895 896 The CIFS protocol that Samba implements negotiates times in various 897 formats, all of which are able to cope with dates beyond 2000. 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925