1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�3.�Small Office Networking</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.66.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="simple.html" title="Chapter�2.�No Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter�4.�Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�3.�Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a>�</td><th width="60%" align="center">�</th><td width="20%" align="right">�<a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter�3.�Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id2535100">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2535124">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2535193">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2535249">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2535461">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2535483">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2537323">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2538002">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2538028">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2538104">Questions and Answers</a></span></dt></dl></div><p> 2 So far, this book has focused on the basics of simple yet effective 3 network solutions. Network administrators who take pride in their work 4 (that's most of us, right?) take care to deliver what our users want, 5 but not too much more. If we make things too complex, we confound our users and 6 increase costs of network ownership. A professional network manager 7 avoids the temptation to put too much pizazz into the way that the network 8 operates. Some creativity is helpful, but do keep it under control. 9 </p><p><a class="indexterm" name="id2535052"></a> 10 Five years ago there were two companies from which a lesson can be learned. 11 In one case the network administrator spent three months building a new 12 network to replace an old Netware server. What he delivered had all the 13 bells and whistles he could muster. There were a few teething problems 14 during the change-over, nothing serious but a little disruptive all the 15 same. Users were exposed to many changes at once. The network 16 administrator was asked to resign two months after implementing the 17 new system. This was necessary because so many staff had complained 18 they had lost time and were not happy with the new network. 19 Everything was automated and he delivered more features than any advanced 20 user could think of. He was just too smart for his own good. 21 </p><p> 22 In the case of the other company, a new network manager was appointed 23 to oversee the replacement of a LanTastic network with an MS Windows 24 NT 4.0 network. He had the replacement installed and operational within 25 two weeks. Before installation and change-over, he called a meeting to 26 explain to all users what was going to happen, how it would affect them 27 and that he would be available 24 hours a day to help them transition. 28 One week after conversion, he held another meeting asking for cooperation 29 in the introduction of a few new features that would help to make life 30 easier. Network users were thrilled with what he was doing to help 31 them. The network he implemented was nowhere near as complex as the first example, had fewer 32 features, and yet he had happy users. Months later he was still adding 33 new innovations. He always asked the users if a 34 particular feature was what they wanted. He asked his boss for a raise 35 and got it. He often told me, “<span class="quote"><span class="emphasis"><em>Always keep a few new tricks up your 36 sleeves for when you need them.</em></span></span>” Was he smart? You decide. Let's 37 get on with our next exercise. 38 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2535100"></a>Introduction</h2></div></div></div><p> 39 Abmas Accounting Inc. has grown. Mr. Meany likes you and says he knew you 40 were the right person for the job. That's why he asked you to install the 41 new server. The past few months have been hard work. You advised Mr. Meany 42 that it is time for a change. Abmas now has 52 users, having acquired an 43 investment consulting business recently. The new users were added to the 44 network without any problems. 45 </p><p> 46 Some of the Windows clients are getting to be past their use-by date. 47 You have found damaged and unusable software on some of the workstations 48 that came with the acquired business and found some machines that are 49 in need of both hardware and software maintenance. 50 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2535124"></a>Assignment Tasks</h3></div></div></div><p> 51 <a class="indexterm" name="id2535132"></a> 52 Mr. Meany has decided to retire in 12 months. He wants you to help him 53 make the business run better. Many of the new staff want notebook computers. 54 They visit customer business premises with the need to use local network 55 facilities; these users are technically competent. The company uses a 56 business application that requires Windows XP Professional. In short, a 57 complete client upgrade is about to happen. Mr. Meany told you that he is working 58 on another business acquisition and that by the time he retires there will be 59 80 to 100 users. 60 </p><p> 61 Mr. Meany is not concerned about security. He wants to make it easier for 62 staff to do their work. He has hired you to help him appoint a full-time 63 network manager before he retires. Above all, he says he is investing in 64 the ability to grow. He is determined to live his lifelong dream and 65 hand the business over to a bright and capable executive who can make 66 things happen. This means your network design must cope well with 67 growth. 68 </p><p> 69 In a few months, Abmas will require an Internet connection for email 70 and so staff easily obtain software updates. Mr. Meany is warming up to the 71 installation of anti-virus software, but is not yet ready to approve 72 this expense. He told you to spend the money a virus scanner costs 73 on better quality notebook computers for mobile users. 74 </p><p> 75 One of Mr. Meany's golfing partners sold him on the idea to buy new laser 76 printers. One black only, the other a color laser printer. Staff support 77 the need for a color printer so they can present more attractive proposals 78 and reports. 79 </p><p> 80 Mr. Meany also asked if it would be possible for one of the staff to manage 81 user accounts from the Windows desktop. That person will be responsible for 82 basic operations. 83 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2535193"></a>Dissection and Discussion</h2></div></div></div><p> 84 What are the key requirements in this business example? A quick review indicates 85 a need for: 86 </p><div class="itemizedlist"><ul type="disc"><li><p> 87 Scalability from 52 to over 100 users in 12 months 88 </p></li><li><p> 89 Mobile computing capability 90 <a class="indexterm" name="id2535218"></a> 91 </p></li><li><p> 92 Improved reliability and usability 93 </p></li><li><p> 94 Easier administration 95 </p></li></ul></div><p> 96 In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server 97 (as in <a href="simple.html#AccountingOffice" title="Accounting Office">???</a>). 98 99 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2535249"></a>Technical Issues</h3></div></div></div><p> 100 <a class="indexterm" name="id2535257"></a> 101 <a class="indexterm" name="id2535264"></a> 102 <a class="indexterm" name="id2535271"></a> 103 <a class="indexterm" name="id2535277"></a> 104 <a class="indexterm" name="id2535284"></a> 105 It is time to implement a domain security environment. You will use the <tt class="constant"> 106 smbpasswd</tt> (default) backend. You should implement a DHCP server. There is no need to 107 run DNS at this time, but the system will use WINS. The Domain name will be <tt class="constant"> 108 BILLMORE</tt>. This time, the name of the server will be <tt class="constant">SLEETH</tt>. 109 </p><p> 110 All printers will be configured as DHCP clients. The DHCP server will assign 111 the printer a fixed IP address by way of its Ethernet interface (MAC) address. 112 See <a href="small.html#dhcp01" title="Example�3.2.�Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">???</a>. 113 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 114 The <tt class="filename">smb.conf</tt> file you are creating in this exercise can be used with equal effectiveness 115 with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is 116 possible to start with the installation that you have created here, migrate it 117 to a Samba-3 configuration and then secure the system further. Configurations following 118 this one will utilize features that may not be supported in Samba-2.2.x releases. 119 However, you should note that the examples in each chapter start with the assumption 120 that a fresh new installation is being effected. 121 </p></div><p> 122 Later on, when the Internet connection is implemented, you will add DNS as well as 123 other enhancements. It is important that you plan accordingly. 124 </p><p> 125 <a class="indexterm" name="id2535348"></a> 126 You have split the network into two separate areas. Each has its own ether-switch. 127 There are 20 users on the accounting network and 32 users on the financial services 128 network. The server has two network interfaces, one serving each network. The 129 network printers will be located in a central area. You plan to install the new 130 printers and keep the old printer in use also. 131 </p><p> 132 You will provide separate file storage areas for each business entity. The old system 133 will go away, accounting files will be handled under a single directory, and files will 134 be stored under customer name, not under a personal work area. Staff will be made 135 responsible for file location, so maintain the old share point. 136 </p><p> 137 Given that DNS will not be used, you will configure WINS name resolution for UNIX 138 hostname name resolution. 139 </p><p> 140 <a class="indexterm" name="id2535379"></a> 141 <a class="indexterm" name="id2535388"></a> 142 It is necessary to map Windows Domain Groups to UNIX groups as a minimum. It is 143 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two 144 key staff groups in the firm are Accounting Staff and Financial Services Staff. 145 For these, it is necessary to create UNIX groups as well as Windows Domain Groups. 146 </p><p> 147 In the sample <tt class="filename">smb.conf</tt> file, you have configured Samba to call the UNIX <span><b class="command">groupadd</b></span> 148 to add group entries. This utility does not permit the addition of group names that 149 contain upper-case characters or spaces. This is considered a bug. The <span><b class="command">groupadd</b></span> 150 is part of the <span><b class="command">shadow-utils</b></span> Open Source Software package. 151 A later release of this package may have been patched to resolve this bug. 152 If your operating platform has this bug, it means that attempts to add a Windows Domain 153 Group that has either a space or upper-case characters in it will fail. See <span class="emphasis"><em>TOSHARG</em></span>, Section 11.3.1, 154 Example 11.1, for more information. 155 </p><p> 156 <a class="indexterm" name="id2535446"></a> 157 Vendor-supplied printer drivers will be installed on each client. The CUPS print spooler 158 on the UNIX host will be operated in <tt class="constant">raw</tt> mode. 159 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2535461"></a>Political Issues</h3></div></div></div><p> 160 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance. 161 He is willing to spend money on things he believes are of value. You need more 162 time to convince him of real priorities. 163 </p><p> 164 Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be 165 supplied with anti-virus software? Above all, demonstrate good purchase value and remember 166 to make your users happy. 167 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2535483"></a>Implementation</h2></div></div></div><p><a class="indexterm" name="id2535489"></a> 168 In this example, the assumption is made that this server is being configured from a clean start. 169 The alternate approach could be to demonstrate the migration of the system that is documented 170 in <a href="simple.html#AcctgNet" title="Implementation">???</a> to meet the new requirements. The decision to treat this case, as with 171 future examples, as a new installation is based on the premise that you can determine 172 the migration steps from the information provided in the separate chapter on this subject. 173 Additionally, a fresh installation makes the example easier to follow. 174 </p><p><a class="indexterm" name="id2535516"></a> 175 Each user will be given a home directory on the UNIX system, which will be available as a private 176 share. Two additional shares will be created, one for the Accounting Department and the other for 177 the Financial Services Department. Network users will be given access to these shares by way 178 of group membership. 179 </p><p> 180 <a class="indexterm" name="id2535533"></a> 181 UNIX group membership is the primary mechanism by which Windows Domain users will be granted 182 rights and privileges within the Windows environment. 183 </p><p><a class="indexterm" name="id2535547"></a> 184 The user <span><b class="command">alanm</b></span> will be made the owner of all files. This will be preserved 185 by setting the sticky bit (set UID/GID) on the top-level directories. 186 </p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure�3.1.�Abmas Accounting 52 User Network Topology</b></p><div class="mediaobject"><img src="images/acct2net.png" width="351" alt="Abmas Accounting 52 User Network Topology"></div></div><div class="procedure"><ol type="1"><li><p> 187 Using UNIX/Linux system tools, name the server <tt class="constant">sleeth</tt>. 188 </p></li><li><p> 189 <a class="indexterm" name="id2535627"></a> 190 Place an entry for the machine <tt class="constant">sleeth</tt> in the <tt class="filename">/etc/hosts</tt>. 191 The printers are network attached, so it is desirable that there should be entries for the 192 network printers also. An example <tt class="filename">/etc/hosts</tt> file is shown here: 193</p><pre class="screen"> 194192.168.1.1 sleeth sleeth1 195192.168.2.1 sleeth2 196192.168.1.10 hplj6 197192.168.1.11 hplj4 198192.168.2.10 qms 199</pre><p> 200 </p></li><li><p> 201 Install the Samba-3 binary RPM from the Samba-Team FTP site. 202 </p></li><li><p> 203 Install the ISC DHCP server using the UNIX/Linux system tools available to you. 204 </p></li><li><p><a class="indexterm" name="id2535681"></a><a class="indexterm" name="id2535689"></a><a class="indexterm" name="id2535697"></a><a class="indexterm" name="id2535705"></a> 205 Given that Samba will be operating over two network interfaces and clients on each side 206 may want to be able to reach clients on the other side, it is imperative that IP forwarding 207 shall be enabled. Use the system tool of your choice to enable IP forwarding. In the 208 absence of such a tool on the Linux system, add to the <tt class="filename">/etc/rc.d/rc.local</tt> 209 file an entry as follows: 210</p><pre class="screen"> 211echo 1 > /proc/sys/net/ipv4/ip_forward 212</pre><p> 213 This causes the Linux kernel to forward IP packets so that it acts as a router. 214 </p></li><li><p> 215 Install the <tt class="filename">smb.conf</tt> file as shown in <a href="small.html#acct2conf" title="Example�3.3.�Accounting Office Network smb.conf File [globals] Section">???</a> and 216 <a href="small.html#acct3conf" title="Example�3.4.�Accounting Office Network smb.conf File Services and Shares Section">???</a>. Combine these two examples to form a single 217 <tt class="filename">/etc/samba/smb.conf</tt> file. 218 </p></li><li><p><a class="indexterm" name="id2535774"></a> 219 Add the user <span><b class="command">root</b></span> to the Samba password backend: 220</p><pre class="screen"> 221<tt class="prompt">root# </tt> smbpasswd -a root 222New SMB password: XXXXXXX 223Retype new SMB password: XXXXXXX 224<tt class="prompt">root# </tt> 225</pre><p> 226 <a class="indexterm" name="id2535808"></a> 227 This is the Windows Domain Administrator password. Never delete this account from 228 the password backend after Windows Domain Groups have been initialized. If you delete 229 this account, your system is crippled. You cannot restore this account 230 and your Samba server is no longer capable of being administered. 231 </p></li><li><p> 232 <a class="indexterm" name="id2535827"></a> 233 Create the username map file to permit the <tt class="constant">root</tt> account to be called 234 <tt class="constant">Administrator</tt> from the Windows network environment. To do this, create 235 the file <tt class="filename">/etc/samba/smbusers</tt> with the following contents: 236</p><pre class="screen"> 237#### 238# User mapping file 239#### 240# File Format 241# ----------- 242# Unix_ID = Windows_ID 243# 244# Examples: 245# root = Administrator 246# janes = "Jane Smith" 247# jimbo = Jim Bones 248# 249# Note: If the name contains a space it must be double quoted. 250# In the example above the name 'jimbo' will be mapped to Windows 251# user names 'Jim' and 'Bones' because the space was not quoted. 252####################################################################### 253root = Administrator 254#### 255# End of File 256#### 257</pre><p> 258 </p></li><li><p> 259 <a class="indexterm" name="id2535871"></a> 260 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in 261 <a href="small.html#initGrps" title="Example�3.1.�Script to Map Windows NT Groups to UNIX Groups">???</a>. Create a file containing this script. We called ours 262 <tt class="filename">/etc/samba/initGrps.sh</tt>. Set this file so it can be executed, 263 and then execute the script. Sample output should be as follows: 264 265</p><div class="example"><a name="initGrps"></a><p class="title"><b>Example�3.1.�Script to Map Windows NT Groups to UNIX Groups</b></p><a class="indexterm" name="id2535904"></a><pre class="screen"> 266#!/bin/bash 267# 268# initGrps.sh 269# 270 271# Create UNIX groups 272groupadd acctsdep 273groupadd finsrvcs 274 275# Map Windows Domain Groups to UNIX groups 276net groupmap modify ntgroup="Domain Admins" unixgroup=root 277net groupmap modify ntgroup="Domain Users" unixgroup=users 278net groupmap modify ntgroup="Domain Guests" unixgroup=nobody 279 280# Add Functional Domain Groups 281net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d 282net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d 283</pre></div><p> 284 285</p><pre class="screen"> 286<tt class="prompt">root# </tt> chmod 755 initGrps.sh 287<tt class="prompt">root# </tt> cd /etc/samba 288<tt class="prompt">root# </tt> ./initGrps.sh 289Updated mapping entry for Domain Admins 290Updated mapping entry for Domain Users 291Updated mapping entry for Domain Guests 292No rid or sid specified, choosing algorithmic mapping 293Successfully added group Accounts Dept to the mapping db 294No rid or sid specified, choosing algorithmic mapping 295Successfully added group Domain Guests to the mapping db 296 297<tt class="prompt">root# </tt> cd /etc/samba 298<tt class="prompt">root# </tt> net groupmap list | sort 299Account Operators (S-1-5-32-548) -> -1 300Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep 301Administrators (S-1-5-32-544) -> -1 302Backup Operators (S-1-5-32-551) -> -1 303Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root 304Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody 305Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users 306Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs 307Guests (S-1-5-32-546) -> -1 308Power Users (S-1-5-32-547) -> -1 309Print Operators (S-1-5-32-550) -> -1 310Replicators (S-1-5-32-552) -> -1 311System Operators (S-1-5-32-549) -> -1 312Users (S-1-5-32-545) -> -1 313</pre><p> 314 </p></li><li><p> 315 <a class="indexterm" name="id2535987"></a> 316 <a class="indexterm" name="id2535994"></a> 317 <a class="indexterm" name="id2536003"></a> 318 For each user who needs to be given a Windows Domain account, make an entry in the 319 <tt class="filename">/etc/passwd</tt> file as well as in the Samba password backend. 320 Use the system tool of your choice to create the UNIX system accounts and use the Samba 321 <span><b class="command">smbpasswd</b></span> program to create the Domain user accounts. 322 </p><p> 323 <a class="indexterm" name="id2536029"></a> 324 <a class="indexterm" name="id2536036"></a> 325 <a class="indexterm" name="id2536043"></a> 326 There are a number of tools for user management under UNIX. Commonly known ones include: 327 <span><b class="command">useradd</b></span>, <span><b class="command">adduser</b></span>. In addition to these, there are a plethora of custom 328 tools. With the tool of your choice, create a home directory for each user. 329 </p></li><li><p> 330 Using the preferred tool for your UNIX system, add each user to the UNIX groups created 331 previously as necessary. File system access control will be based on UNIX group membership. 332 </p></li><li><p> 333 Create the directory mount point for the disk sub-system that is mounted to provide 334 data storage for company files. In this case the mount point indicated in the <tt class="filename">smb.conf</tt> 335 file is <tt class="filename">/data</tt>. Format the file system as required, mount the formatted 336 file system partition using <span><b class="command">mount</b></span>, 337 and make the appropriate changes in <tt class="filename">/etc/fstab</tt>. 338 </p></li><li><p> 339 Create the top-level file storage directories are follows: 340</p><pre class="screen"> 341<tt class="prompt">root# </tt> mkdir -p /data/{accounts,finsvcs} 342<tt class="prompt">root# </tt> chown -R root.root /data 343<tt class="prompt">root# </tt> chown -R alanm.accounts /data/accounts 344<tt class="prompt">root# </tt> chown -R alanm.finsvcs /data/finsvcs 345<tt class="prompt">root# </tt> chmod -R ug+rwx,o+rx-w /data 346</pre><p> 347 Each department is responsible for creating its own directory structure within its 348 share. The directory root of the <span><b class="command">accounts</b></span> share is <tt class="filename">/data/accounts</tt>. 349 The directory root of the <span><b class="command">finsvcs</b></span> share is <tt class="filename">/data/finsvcs</tt>. 350 </p></li><li><p> 351 Configure the printers with the IP addresses as shown in <a href="small.html#acct2net" title="Figure�3.1.�Abmas Accounting 52 User Network Topology">???</a>. 352 Follow the instructions in the manufacturers' manuals to permit printing to port 9100. 353 This allows the CUPS spooler to print using raw mode protocols. 354 <a class="indexterm" name="id2536202"></a> 355 <a class="indexterm" name="id2536209"></a> 356 </p></li><li><p> 357 <a class="indexterm" name="id2536222"></a><a class="indexterm" name="id2536230"></a> 358 Configure the CUPS Print Queues as follows: 359</p><pre class="screen"> 360<tt class="prompt">root# </tt> lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E 361<tt class="prompt">root# </tt> lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E 362<tt class="prompt">root# </tt> lpadmin -p qms -v socket://192.168.2.10:9100 -E 363</pre><p> 364 <a class="indexterm" name="id2536266"></a> 365 This creates the necessary print queues with no assigned print filter. 366 </p></li><li><p> 367 <a class="indexterm" name="id2536281"></a> 368 <a class="indexterm" name="id2536287"></a> 369 <a class="indexterm" name="id2536294"></a> 370 Edit the file <tt class="filename">/etc/cups/mime.convs</tt> to uncomment the line: 371</p><pre class="screen"> 372application/octet-stream application/vnd.cups-raw 0 - 373</pre><p> 374 </p></li><li><p> 375 <a class="indexterm" name="id2536322"></a> 376 Edit the file <tt class="filename">/etc/cups/mime.types</tt> to uncomment the line: 377</p><pre class="screen"> 378application/octet-stream 379</pre><p> 380 </p></li><li><p><a class="indexterm" name="id2536347"></a> 381 Using your favorite system editor, create an <tt class="filename">/etc/dhcpd.conf</tt> with the 382 contents as shown in <a href="small.html#dhcp01" title="Example�3.2.�Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">???</a>. 383</p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example�3.2.�Abmas Accounting DHCP Server Configuration File <tt class="filename">/etc/dhcpd.conf</tt></b></p><a class="indexterm" name="id2536386"></a><pre class="screen"> 384default-lease-time 86400; 385max-lease-time 172800; 386default-lease-time 86400; 387 388option ntp-servers 192.168.1.1; 389option domain-name "abmas.biz"; 390option domain-name-servers 192.168.1.1, 192.168.2.1; 391option netbios-name-servers 192.168.1.1, 192.168.2.1; 392option netbios-node-type 8; 393### NOTE ### 394# netbios-node-type=8 means set clients to Hybrid Mode 395# so they will use Unicast communication with the WINS 396# server and thus reduce the level of UDP broadcast 397# traffic by up to 90%. 398############ 399 400subnet 192.168.1.0 netmask 255.255.255.0 { 401 range dynamic-bootp 192.168.1.128 192.168.1.254; 402 option subnet-mask 255.255.255.0; 403 option routers 192.168.1.1; 404 allow unknown-clients; 405 host hplj4 { 406 hardware ethernet 08:00:46:7a:35:e4; 407 fixed-address 192.168.1.10; 408 } 409 host hplj6 { 410 hardware ethernet 00:03:47:cb:81:e0; 411 fixed-address 192.168.1.11; 412 } 413 } 414subnet 192.168.2.0 netmask 255.255.255.0 { 415 range dynamic-bootp 192.168.2.128 192.168.2.254; 416 option subnet-mask 255.255.255.0; 417 option routers 192.168.2.1; 418 allow unknown-clients; 419 host qms { 420 hardware ethernet 01:04:31:db:e1:c0; 421 fixed-address 192.168.1.10; 422 } 423 } 424subnet 127.0.0.0 netmask 255.0.0.0 { 425 } 426</pre></div><p> 427 </p></li><li><p> 428 Use the standard system tool to start Samba and CUPS and configure them to start 429 automatically at every system reboot. For example: 430 </p><p> 431 <a class="indexterm" name="id2536431"></a> 432 <a class="indexterm" name="id2536438"></a> 433 <a class="indexterm" name="id2536445"></a> 434 <a class="indexterm" name="id2536452"></a><a class="indexterm" name="id2536458"></a> 435</p><pre class="screen"> 436<tt class="prompt">root# </tt> chkconfig dhpc on 437<tt class="prompt">root# </tt> chkconfig smb on 438<tt class="prompt">root# </tt> chkconfig cups on 439<tt class="prompt">root# </tt> /etc/rc.d/init.d/dhcp restart 440<tt class="prompt">root# </tt> /etc/rc.d/init.d/smb restart 441<tt class="prompt">root# </tt> /etc/rc.d/init.d/cups restart 442</pre><p> 443 </p></li><li><p> 444 <a class="indexterm" name="id2536516"></a> 445 <a class="indexterm" name="id2536523"></a> 446 <a class="indexterm" name="id2536532"></a><a class="indexterm" name="id2536538"></a> 447 <a class="indexterm" name="id2536547"></a> 448 <a class="indexterm" name="id2536553"></a> 449 Configure the Name Service Switch (NSS) to handle WINS based name resolution. 450 Since this system does not use a DNS server, it is safe to remove this option from 451 the NSS configuration. Edit the <tt class="filename">/etc/nsswitch.conf</tt> file so that 452 the <tt class="constant">hosts:</tt> entry looks like this: 453</p><pre class="screen"> 454hosts: files wins 455</pre><p> 456 </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example�3.3.�Accounting Office Network smb.conf File [globals] Section</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[global]</tt></i></td></tr><tr><td><a class="indexterm" name="id2536610"></a><i class="parameter"><tt> 457 458 workgroup = BILLMORE</tt></i></td></tr><tr><td><a class="indexterm" name="id2536626"></a><i class="parameter"><tt> 459 460 passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</tt></i></td></tr><tr><td><a class="indexterm" name="id2536643"></a><i class="parameter"><tt> 461 462 username map = /etc/samba/smbusers</tt></i></td></tr><tr><td><a class="indexterm" name="id2536659"></a><i class="parameter"><tt> 463 464 syslog = 0</tt></i></td></tr><tr><td><a class="indexterm" name="id2536674"></a><i class="parameter"><tt> 465 466 name resolve order = wins bcast hosts</tt></i></td></tr><tr><td><a class="indexterm" name="id2536690"></a><i class="parameter"><tt> 467 468 printcap name = CUPS</tt></i></td></tr><tr><td><a class="indexterm" name="id2536705"></a><i class="parameter"><tt> 469 470 show add printer wizard = No</tt></i></td></tr><tr><td><a class="indexterm" name="id2536720"></a><i class="parameter"><tt> 471 472 add user script = /usr/sbin/useradd -m '%u'</tt></i></td></tr><tr><td><a class="indexterm" name="id2536737"></a><i class="parameter"><tt> 473 474 delete user script = /usr/sbin/userdel -r '%u'</tt></i></td></tr><tr><td><a class="indexterm" name="id2536753"></a><i class="parameter"><tt> 475 476 add group script = /usr/sbin/groupadd '%g'</tt></i></td></tr><tr><td><a class="indexterm" name="id2536769"></a><i class="parameter"><tt> 477 478 delete group script = /usr/sbin/groupdel '%g'</tt></i></td></tr><tr><td><a class="indexterm" name="id2536785"></a><i class="parameter"><tt> 479 480 add user to group script = /usr/sbin/usermod -G '%g' '%u'</tt></i></td></tr><tr><td><a class="indexterm" name="id2536801"></a><i class="parameter"><tt> 481 482 add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</tt></i></td></tr><tr><td><a class="indexterm" name="id2536817"></a><i class="parameter"><tt> 483 484 logon script = scripts\login.bat</tt></i></td></tr><tr><td><a class="indexterm" name="id2536833"></a><i class="parameter"><tt> 485 486 logon path = </tt></i></td></tr><tr><td><a class="indexterm" name="id2536848"></a><i class="parameter"><tt> 487 488 logon drive = X:</tt></i></td></tr><tr><td><a class="indexterm" name="id2536863"></a><i class="parameter"><tt> 489 490 domain logons = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2536879"></a><i class="parameter"><tt> 491 492 preferred master = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2536894"></a><i class="parameter"><tt> 493 494 wins support = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2536910"></a><i class="parameter"><tt> 495 496 printing = CUPS</tt></i></td></tr></table></div><div class="example"><a name="acct3conf"></a><p class="title"><b>Example�3.4.�Accounting Office Network smb.conf File Services and Shares Section</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><i class="parameter"><tt>[homes]</tt></i></td></tr><tr><td><a class="indexterm" name="id2536948"></a><i class="parameter"><tt> 497 498 comment = Home Directories</tt></i></td></tr><tr><td><a class="indexterm" name="id2536963"></a><i class="parameter"><tt> 499 500 valid users = %S</tt></i></td></tr><tr><td><a class="indexterm" name="id2536979"></a><i class="parameter"><tt> 501 502 read only = No</tt></i></td></tr><tr><td><a class="indexterm" name="id2536994"></a><i class="parameter"><tt> 503 504 browseable = No</tt></i></td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[printers]</tt></i></td></tr><tr><td><a class="indexterm" name="id2537018"></a><i class="parameter"><tt> 505 506 comment = SMB Print Spool</tt></i></td></tr><tr><td><a class="indexterm" name="id2537034"></a><i class="parameter"><tt> 507 508 path = /var/spool/samba</tt></i></td></tr><tr><td><a class="indexterm" name="id2537049"></a><i class="parameter"><tt> 509 510 printable = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2537065"></a><i class="parameter"><tt> 511 512 guest ok = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2537080"></a><i class="parameter"><tt> 513 514 use client driver = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2537096"></a><i class="parameter"><tt> 515 516 browseable = No</tt></i></td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[netlogon]</tt></i></td></tr><tr><td><a class="indexterm" name="id2537120"></a><i class="parameter"><tt> 517 518 comment = Network Logon Service</tt></i></td></tr><tr><td><a class="indexterm" name="id2537136"></a><i class="parameter"><tt> 519 520 path = /data/%U</tt></i></td></tr><tr><td><a class="indexterm" name="id2537151"></a><i class="parameter"><tt> 521 522 valid users = %S</tt></i></td></tr><tr><td><a class="indexterm" name="id2537167"></a><i class="parameter"><tt> 523 524 read only = No</tt></i></td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[accounts]</tt></i></td></tr><tr><td><a class="indexterm" name="id2537191"></a><i class="parameter"><tt> 525 526 comment = Accounting Files</tt></i></td></tr><tr><td><a class="indexterm" name="id2537206"></a><i class="parameter"><tt> 527 528 path = /data/accounts</tt></i></td></tr><tr><td><a class="indexterm" name="id2537222"></a><i class="parameter"><tt> 529 530 valid users = %G</tt></i></td></tr><tr><td><a class="indexterm" name="id2537237"></a><i class="parameter"><tt> 531 532 read only = No</tt></i></td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[finsvcs]</tt></i></td></tr><tr><td><a class="indexterm" name="id2537261"></a><i class="parameter"><tt> 533 534 comment = Financial Service Files</tt></i></td></tr><tr><td><a class="indexterm" name="id2537278"></a><i class="parameter"><tt> 535 536 path = /data/finsvcs</tt></i></td></tr><tr><td><a class="indexterm" name="id2537292"></a><i class="parameter"><tt> 537 538 valid users = %G</tt></i></td></tr><tr><td><a class="indexterm" name="id2537308"></a><i class="parameter"><tt> 539 540 read only = No</tt></i></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2537323"></a>Validation</h3></div></div></div><p> 541 Does everything function as it ought? That is the key question at this point. 542 Here are some simple steps to validate your Samba server configuration. 543 </p><div class="procedure"><ol type="1"><li><p><a class="indexterm" name="id2537341"></a> 544 If your <tt class="filename">smb.conf</tt> file has bogus options or parameters, this may cause Samba 545 to refuse to start. The first step should always be to validate the contents 546 of this file by running: 547</p><pre class="screen"> 548<tt class="prompt">root# </tt> testparm -s 549Load smb config files from smb.conf 550Processing section "[homes]" 551Processing section "[printers]" 552Processing section "[netlogon]" 553Processing section "[accounts]" 554Processing section "[service]" 555Loaded services file OK. 556# Global parameters 557[global] 558 workgroup = BILLMORE 559 passwd chat = *New*Password* \ 560 %n\n *Re-enter*new*password* %n\n *Password*changed* 561 username map = /etc/samba/smbusers 562 syslog = 0 563 name resolve order = wins bcast hosts 564 printcap name = CUPS 565 show add printer wizard = No 566 add user script = /usr/sbin/useradd -m '%u' 567 delete user script = /usr/sbin/userdel -r '%u' 568 add group script = /usr/sbin/groupadd '%g' 569 delete group script = /usr/sbin/groupdel '%g' 570 add user to group script = /usr/sbin/usermod -G '%g' '%u' 571 add machine script = /usr/sbin/useradd 572 -s /bin/false -d /var/lib/nobody '%u' 573 logon script = scripts\logon.bat 574 logon path = 575 logon drive = X: 576 domain logons = Yes 577 preferred master = Yes 578 wins support = Yes 579 printing = cups 580... 581### Remainder cut to save space ### 582</pre><p> 583 The inclusion of an invalid parameter (say one called dogbert) would generate an 584 error as follows: 585</p><pre class="screen"> 586Unknown parameter encountered: "dogbert" 587Ignoring unknown parameter "dogbert" 588</pre><p> 589 Clear away all errors before proceeding and start or restart samba as necessary. 590 </p></li><li><p> 591 <a class="indexterm" name="id2537407"></a><a class="indexterm" name="id2537413"></a><a class="indexterm" name="id2537421"></a><a class="indexterm" name="id2537429"></a> 592 Check that the Samba server is running: 593</p><pre class="screen"> 594<tt class="prompt">root# </tt> ps ax | grep mbd 59514244 ? S 0:00 /usr/sbin/nmbd -D 59614245 ? S 0:00 /usr/sbin/nmbd -D 59714290 ? S 0:00 /usr/sbin/smbd -D 598 599$rootprompt; ps ax | grep winbind 60014293 ? S 0:00 /usr/sbin/winbindd -B 60114295 ? S 0:00 /usr/sbin/winbindd -B 602</pre><p> 603 The <span><b class="command">winbindd</b></span> daemon is running in split mode (normal) so there are also 604 two instances of it. For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG</em></span>, 605 Chapter 22, Section 22.3. The single instance of <span><b class="command">smbd</b></span> is normal. 606 </p></li><li><p> 607 <a class="indexterm" name="id2537481"></a> 608 Check that an anonymous connection can be made to the Samba server: 609</p><pre class="screen"> 610<tt class="prompt">root# </tt> smbclient -L localhost -U% 611 612 Sharename Type Comment 613 --------- ---- ------- 614 netlogon Disk Network Logon Service 615 accounts Disk Accounting Files 616 finsvcs Disk Financial Service Files 617 IPC$ IPC IPC Service (Samba3) 618 ADMIN$ IPC IPC Service (Samba3) 619 hplj4 Printer Hewlett-Packard LaserJet 4 620 hplj6 Printer Hewlett-Packard LaserJet 6 621 qms Printer QMS Magicolor Laser Printer XXXX 622 623 Server Comment 624 --------- ------- 625 SLEETH Samba 3.0.12 626 627 Workgroup Master 628 --------- ------- 629 BILLMORE SLEETH 630</pre><p> 631 This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent 632 of browsing the server from a Windows client to obtain a list of shares on the server. 633 The <tt class="constant">-U%</tt> argument means, send a "<tt class="constant">NULL</tt> username and 634 a <tt class="constant">NULL</tt> password." 635 </p></li><li><p> 636 <a class="indexterm" name="id2537535"></a> 637 <a class="indexterm" name="id2537542"></a><a class="indexterm" name="id2537548"></a> 638 Verify that the printers have the IP addresses assigned in the DHCP server configuration file. 639 The easiest way to do this is to ping the printer name. Immediately after the ping response 640 has been received, execute <span><b class="command">arp -a</b></span> to find the MAC address of the printer 641 that has responded. Now you can compare the IP address and the MAC address of the printer 642 with the configuration information in the <tt class="filename">/etc/dhcpd.conf</tt> file. They 643 should, of course, match. For example: 644</p><pre class="screen"> 645<tt class="prompt">root# </tt> ping hplj4 646PING hplj4 (192.168.1.11) 56(84) bytes of data. 64764 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms 648 649<tt class="prompt">root# </tt> arp -a 650hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0 651</pre><p> 652 The MAC address <tt class="constant">08:00:46:7A:35:E4</tt> matches that specified for the 653 IP address from which the printer has responded and with the entry for it in the 654 <tt class="filename">/etc/dhcpd.conf</tt> file. 655 </p></li><li><p> 656 <a class="indexterm" name="id2537616"></a> 657 Make an authenticated connection to the server using the <span><b class="command">smbclient</b></span> tool: 658</p><pre class="screen"> 659<tt class="prompt">root# </tt> smbclient //sleeth/accounts -U alanm 660Password: XXXXXXX 661smb: \> dir 662 . D 0 Sun Nov 9 01:28:34 2003 663 .. D 0 Sat Aug 16 17:24:26 2003 664 .mc DH 0 Sat Nov 8 21:57:38 2003 665 .qt DH 0 Fri Sep 5 00:48:25 2003 666 SMB D 0 Sun Oct 19 23:04:30 2003 667 Documents D 0 Sat Nov 1 00:31:51 2003 668 xpsp1a_en_x86.exe 131170400 Sun Nov 2 01:25:44 2003 669 670 65387 blocks of size 65536. 28590 blocks available 671smb: \> q 672</pre><p> 673 </p></li></ol></div></div><div class="procedure"><a name="id2537668"></a><p class="title"><b>Procedure�3.3.�Windows XP Professional Client Configuration</b></p><ol type="1"><li><p> 674 Configure clients to the network settings shown in <a href="small.html#acct2net" title="Figure�3.1.�Abmas Accounting 52 User Network Topology">???</a>. 675 All clients use DHCP for TCP/IP protocol stack configuration. 676 <a class="indexterm" name="id2537688"></a> 677 <a class="indexterm" name="id2537694"></a> 678 DHCP configures all Windows clients to use the WINS Server address <tt class="constant">192.168.1.1</tt>. 679 </p></li><li><p> 680 Join the Windows Domain called <tt class="constant">BILLMORE</tt>. Use the Domain Administrator 681 user name <tt class="constant">root</tt> and the SMB password you assigned to this account. 682 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to 683 a Windows Domain is given in <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>. 684 Reboot the machine as prompted and then logon using a Domain User account. 685 </p></li><li><p> 686 Verify on each client that the machine called <tt class="constant">SLEETH</tt> 687 is visible in <span class="guimenu">My Network Places</span>, that it is 688 possible to connect to it and see the shares <span class="guimenuitem">accounts</span> 689 and <span class="guimenuitem">finsvcs</span>, 690 and that it is possible to open that share to reveal its contents. 691 </p></li><li><p> 692 Instruct all users to log onto the workstation using their assigned user name and password. 693 </p></li><li><p> 694 Install a printer on each using the following steps: 695 </p><div class="procedure"><ol type="1"><li><p> 696 Click <span class="guimenu">Start</span>-><span class="guimenuitem">Settings</span>-><span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. 697 Ensure that <span class="guimenuitem">Local printer</span> is selected. 698 </p></li><li><p> 699 Click <span class="guibutton">Next</span>. In the panel labeled 700 <span class="guimenuitem">Manufacturer:</span>, select <tt class="constant">HP</tt>. 701 In the <span class="guimenuitem">Printers:</span> panel, select the printer called 702 <tt class="constant">HP LaserJet 4</tt>. Click <span class="guibutton">Next</span>. 703 </p></li><li><p> 704 In the panel labeled <span class="guimenuitem">Available ports:</span>, select 705 <tt class="constant">FILE:</tt>. Accept the default printer name by clicking 706 <span class="guibutton">Next</span>. When asked, “<span class="quote"><span class="emphasis"><em>Would you like to print a 707 test page?</em></span></span>”, click <span class="guimenuitem">No</span>. Click 708 <span class="guibutton">Finish</span>. 709 </p></li><li><p> 710 You may be prompted for the name of a file to print to. If so, close the 711 dialog panel. Right-click <span class="guiicon">HP LaserJet 4</span>-><span class="guimenuitem">Properties</span>-><span class="guisubmenu">Details (Tab)</span>-><span class="guimenuitem">Add Port</span>. 712 </p></li><li><p> 713 In the panel labeled <span class="guimenuitem">Network</span>, enter the name of 714 the print queue on the Samba server as follows: <tt class="constant">\\SERVER\hplj4</tt>. 715 Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation. 716 </p></li><li><p> 717 Repeat the printer installation steps above for the HP LaserJet 6 printer 718 as well as for the QMS Magicolor XXXX laser printer. 719 </p></li></ol></div></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2538002"></a>Notebook Computers: A Special Case</h3></div></div></div><p> 720 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP 721 Professional systems. This is the preferred solution to provide continuity of work for notebook users 722 so that absence from the office network environment does not become a barrier to productivity. 723 </p><p> 724 By creating a local machine account that has the same user name and password as you create for that 725 user in the Windows Domain environment, the user can log onto the machine locally and still 726 transparently access network resources as if logged onto the domain itself. There are some trade-offs 727 that mean that as the network is more tightly secured it becomes necessary to modify Windows client 728 configuration somewhat. 729 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2538028"></a>Key Points Learned</h3></div></div></div><p> 730 In this network design and implementation exercise, you have created a Windows NT4 style Domain 731 Controller using Samba-3.0.12. As a result of following these guidelines meant that you experienced 732 and implemented several important aspects of Windows networking. In the next chapter of this book, 733 you build on the experience gained. These are the highlights from this chapter: 734 </p><div class="itemizedlist"><ul type="disc"><li><p> 735 <a class="indexterm" name="id2538048"></a> 736 You implemented a DHCP Server and Microsoft Windows clients were able to obtain all necessary 737 network configuration settings from this server. 738 </p></li><li><p> 739 <a class="indexterm" name="id2538062"></a> 740 You created a Windows Domain Controller. You were able to use the network logon service 741 and successfully joined Windows 200x/XP Professional clients to the Domain. 742 </p></li><li><p> 743 <a class="indexterm" name="id2538076"></a> 744 You created raw print queues in the CUPS printing system. You maintained a simple 745 printing system so that all users can share centrally managed printers. You installed 746 native printer drivers on the Windows clients. 747 </p></li><li><p> 748 You experienced the benefits of centrally managed user accounts on the server. 749 </p></li><li><p> 750 You offered Mobile notebook users a solution that allows them to continue to work 751 while away from the office and not connected to the corporate network. 752 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2538104"></a>Questions and Answers</h2></div></div></div><p> 753 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that 754 may help. 755 </p><div class="qandaset"><dl><dt>1. <a href="small.html#id2538118"> 756 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 757 </a></dt><dt>2. <a href="small.html#id2538145"> 758 Are there any DHCP server configuration parameters in the /etc/dhcpd.conf 759 that should be noted in particular? 760 </a></dt><dt>3. <a href="small.html#id2538177"> 761 Is it possible to create a Windows Domain account that is specifically called Administrator? 762 </a></dt><dt>4. <a href="small.html#id2538216"> 763 Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0? 764 </a></dt><dt>5. <a href="small.html#id2538257"> 765 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 766 root access. How can we do this? 767 </a></dt><dt>6. <a href="small.html#id2538299"> 768 Why must I map Windows Domain Groups to UNIX groups? 769 </a></dt><dt>7. <a href="small.html#id2538326"> 770 I deleted my root account and now I cannot add it back! What can I do? 771 </a></dt><dt>8. <a href="small.html#id2538399"> 772 When I run net groupmap list, it reports a group called Administrators 773 as well as Domain Admins. What is the difference between them? 774 </a></dt><dt>9. <a href="small.html#id2538447"> 775 What is the effect of changing the name of a Samba server, or of changing the Domain name? 776 </a></dt><dt>10. <a href="small.html#id2538499"> 777 How can I manage user accounts from my Windows XP Professional workstation? 778 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2538118"></a><a name="id2538120"></a><b>1.</b></td><td align="left" valign="top"><p> 779 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 780 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 781 First and foremost, portability. It means that notebook users can move between 782 the Abmas office and client offices (so long as they, too, use DHCP) without having to manually 783 reconfigure their machines. It also means that when they work from their home environments 784 either using DHCP assigned addressing or when using dial-up networking, settings such as 785 default routes and DNS server addresses that apply only to the Abmas office environment do 786 not interfere with remote operations. This is an extremely important feature of DHCP. 787 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538145"></a><a name="id2538147"></a><b>2.</b></td><td align="left" valign="top"><p> 788 Are there any DHCP server configuration parameters in the <tt class="filename">/etc/dhcpd.conf</tt> 789 that should be noted in particular? 790 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 791 Yes. The configuration you created automatically provides each client with the IP address 792 of your WINS server. It also configures the client to preferentially register NetBIOS names 793 with the WINS server, and then instructs the client to first query the WINS server when a 794 NetBIOS machine name needs to be resolved to an IP Address. This means that this configuration 795 results in far lower UDP broadcast traffic than would be the case if WINS was not used. 796 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538177"></a><a name="id2538179"></a><b>3.</b></td><td align="left" valign="top"><p> 797 Is it possible to create a Windows Domain account that is specifically called <tt class="constant">Administrator</tt>? 798 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 799 You can surely create a Windows Domain Account called <tt class="constant">Administrator</tt>. It is also 800 possible to map that account so that it has the effective UNIX UID of 0. This way it isn't 801 necessary to use the <i class="parameter"><tt>username map</tt></i> facility to map this account to the UNIX 802 account called <tt class="constant">root</tt>. 803 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538216"></a><a name="id2538218"></a><b>4.</b></td><td align="left" valign="top"><p> 804 Why is it necessary to give the Windows Domain <tt class="constant">Administrator</tt> a UNIX UID of 0? 805 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 806 The Windows Domain <tt class="constant">Administrator</tt> account is the most privileged account that 807 exists on the Windows platform. This user can change any setting, add/delete or modify user 808 accounts, and completely reconfigure the system. The equivalent to this account in the UNIX 809 environment is the <tt class="constant">root</tt> account. If you want to permit the Windows Domain 810 Administrator to manage accounts, as well as permissions, privileges, and security 811 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is 812 achieved with the <tt class="constant">root</tt> UID equal to 0. 813 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538257"></a><a name="id2538259"></a><b>5.</b></td><td align="left" valign="top"><p> 814 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 815 <tt class="constant">root</tt> access. How can we do this? 816 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 817 Users who are members of the <tt class="constant">Domain Admins</tt> group can add machines to the 818 Domain. This group is mapped to the UNIX group account called <tt class="constant">root</tt> 819 (or equivalent on <tt class="constant">wheel</tt> on some UNIX systems) that has a GID of 0. 820 This must be the primary GID of the account of the user who is a member of the Windows <tt class="constant"> 821 Domain Admins</tt> account. 822 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538299"></a><a name="id2538301"></a><b>6.</b></td><td align="left" valign="top"><p> 823 Why must I map Windows Domain Groups to UNIX groups? 824 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 825 Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account 826 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are: 827 <span class="guimenu">Domain Guests, Domain Users, Domain Admins</span>. 828 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538326"></a><a name="id2538328"></a><b>7.</b></td><td align="left" valign="top"><p> 829 I deleted my <tt class="constant">root</tt> account and now I cannot add it back! What can I do? 830 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 831 This is a nasty problem. Fortunately, here is a solution. 832 </p><div class="procedure"><ol type="1"><li><p> 833 Back up your existing configuration files in case you need to restore them. 834 </p></li><li><p> 835 Rename the <tt class="filename">group_mapping.tdb</tt> file. 836 </p></li><li><p> 837 Use the <span><b class="command">smbpasswd</b></span> to add the root account. 838 </p></li><li><p> 839 Restore the <tt class="filename">group_mapping.tdb</tt> file. 840 </p></li></ol></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538399"></a><a name="id2538401"></a><b>8.</b></td><td align="left" valign="top"><p> 841 When I run <span><b class="command">net groupmap list</b></span>, it reports a group called <span class="guimenu">Administrators</span> 842 as well as <span class="guimenu">Domain Admins</span>. What is the difference between them? 843 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 844 The group called <span class="guimenu">Administrators</span> is representative of the same account that would be 845 present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain 846 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This 847 may change at some later date. These accounts are provided only so that security objects are correctly shown. 848 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538447"></a><a name="id2538449"></a><b>9.</b></td><td align="left" valign="top"><p> 849 What is the effect of changing the name of a Samba server, or of changing the Domain name? 850 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 851 In the event that you elect to change the name of the Samba server, on restarting <span><b class="command">smbd</b></span>, 852 Windows security identifiers are changed. In the case of a Stand-Alone server or a Domain Member server, 853 the machine SID is changed. This may break Domain Membership. In the case of a change of the Domain name 854 (Workgroup name), the Domain SID is changed. This affects all Domain Memberships. 855 </p><p> 856 If it becomes necessary to change either the Server name or the Domain name, be sure to back up the respective 857 SID before the change is made. You can back up the SID from use of the <span><b class="command">net getlocalsid</b></span> (Samba-3), 858 or by way of the <span><b class="command">smbpasswd</b></span> (Samba-2.2.x). To change the SID, you use the same tool. Be sure 859 to check the man page for this command for detailed instructions regarding the steps involved. 860 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538499"></a><a name="id2538501"></a><b>10.</b></td><td align="left" valign="top"><p> 861 How can I manage user accounts from my Windows XP Professional workstation? 862 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 863 Samba-3 implements a Windows NT4 style security domain architecture. This type of Domain cannot 864 be managed using tools present on a Windows XP Professional installation. You may download from the 865 Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use 866 it. This package extracts the tools known as: <span><b class="command">User Manager for Domains, Server Manager, Event 867 Viewer</b></span>. You may use the <span class="guimenu">User Manager for Domains</span> to manage your Samba-3 868 Domain user and group accounts. Of course, you do need to be logged on as the <tt class="constant">Administrator</tt> 869 for the Samba-3 Domain. It may help to log on as the <tt class="constant">root</tt> account. 870 </p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="simple.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="index.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="secure.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�2.�No Frills Samba Servers�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�4.�Secure Office Networking</td></tr></table></div></body></html> 871
