1<html> 2<body bgcolor="#ffffff"> 3 4<img src="samba2_xs.gif" border="0" alt=" " height="100" width="76" 5hspace="10" align="left" /> 6 7<h1 class="head0">Chapter 1. Learning the Samba</h1> 8 9 10<p><a name="INDEX-1"/>Samba 11is an extremely useful networking tool for anyone who has both 12Windows and Unix systems on his network. Running on a Unix system, it 13allows Windows to share files and printers on the Unix host, and it 14also allows Unix users to access resources shared by Windows systems.</p> 15 16<p>Although it might seem natural to use a Windows server to serve files 17and printers to a network containing Windows clients, there are good 18reasons for preferring a Samba server for this duty. Samba is 19reliable software that runs on reliable Unix operating systems, 20resulting in fewer problems and a low cost of maintenance. Samba also 21offers better performance under heavy loads, outperforming Windows 222000 Server by a factor of 2 to 1 on identical PC hardware, according 23to published third-party benchmarks. When common, inexpensive PC 24hardware fails to meet the demands of a huge client load, the Samba 25server can easily be moved to a proprietary "big 26iron" Unix mainframe, which can outperform Windows 27running on a PC many times. If all that weren't 28enough, Samba has a very nice cost advantage: it's 29free. Not only is the software itself freely available, but also no 30client licenses are required, and it runs on high-quality, free 31operating systems such as Linux and FreeBSD.</p> 32 33<p>After reading the previous paragraph, you might come to the 34conclusion that Samba is commonly used by large organizations with 35thousands of users on their networks—and you'd 36be right! But Samba's user base includes 37organizations all over the planet, of all types and sizes: from 38international corporations, to medium and small businesses, to 39individuals who run Samba on their Linux laptops. In the last case, a 40tool such as VMware is used to run Windows on the same computer, with 41Samba enabling the two operating systems to share files.</p> 42 43<p>The types of users vary even more—Samba is used by 44corporations, banks and other financial institutions, government and 45military organizations, schools, public libraries, art galleries, 46families, and even authors! This book was developed on a Linux system 47running VMware and Windows 2000, with Adobe FrameMaker running on 48Windows and the document files served by Samba from the Linux 49filesystem.</p> 50 51<p>Does all this whet your technological appetite? If so, we encourage 52you to keep reading, learn about Samba, and follow our examples to 53set up a Samba server of your own. In this and upcoming chapters, we 54will tell you exactly how to get started.</p> 55 56 57 58<div class="sect1"><a name="samba2-CHP-1-SECT-1"/> 59 60<h2 class="head1">What Is Samba?</h2> 61 62<p><a name="INDEX-2"/>Samba 63is a suite of Unix applications that speak the 64<a name="INDEX-3"/><a name="INDEX-4"/>Server 65Message Block (SMB) protocol. Microsoft Windows operating systems and 66the OS/2 operating system use SMB to perform client-server networking 67for file and printer sharing and associated operations. By supporting 68this protocol, Samba enables computers running Unix to get in on the 69action, communicating with the same networking protocol as Microsoft 70Windows and appearing as another Windows system on the network from 71the perspective of a Windows client. A <a name="INDEX-5"/>Samba 72server offers the following services:</p> 73 74<ul><li> 75<p>Share one or more directory trees</p> 76</li><li> 77<p>Share one or more Distributed filesystem (Dfs) trees</p> 78</li><li> 79<p>Share printers installed on the server among Windows clients on the 80network</p> 81</li><li> 82<p>Assist clients with network browsing</p> 83</li><li> 84<p>Authenticate clients logging onto a Windows domain</p> 85</li><li> 86<p>Provide or assist with Windows Internet Name Service (WINS) 87name-server resolution</p> 88</li></ul> 89<p>The Samba suite also includes client tools that allow users on a Unix 90system to access folders and printers that Windows systems and Samba 91servers offer on the network.</p> 92 93<p>Samba is the brainchild of Andrew <a name="INDEX-6"/>Tridgell, who currently heads the Samba 94development team. Andrew started the project in 1991, while working 95with a Digital Equipment Corporation (DEC) software suite called 96Pathworks, created for connecting DEC VAX computers to computers made 97by other companies. Without knowing the significance of what he was 98doing, Andrew created a file-server program for an odd protocol that 99was part of Pathworks. That protocol later turned out to be SMB. A 100few years later, he expanded upon his custom-made SMB server and 101began distributing it as a product on the Internet under the name 102"SMB Server." However, Andrew 103couldn't keep that name—it already belonged to 104another company's product—so he tried the 105following Unix renaming approach:</p> 106 107<blockquote><pre class="code">$ <tt class="userinput"><b>grep -i '^s.*m.*b' /usr/dict/words</b></tt></pre></blockquote> 108 109<p>And the response was:</p> 110 111<blockquote><pre class="code">salmonberry 112samba 113sawtimber 114scramble</pre></blockquote> 115 116<p>Thus, the name "Samba" was born.</p> 117 118<p>Today, the Samba suite revolves around a pair of Unix daemons that 119provide shared resources—called <em class="firstterm">shares 120</em>or s<em class="firstterm">ervices</em>—to SMB clients 121on the network. These are:</p> 122 123<dl> 124<dt><b><a name="INDEX-7"/>smbd</b></dt> 125<dd> 126<p>A daemon that handles file and printer sharing and provides 127authentication and authorization for SMB clients.</p> 128</dd> 129 130 131 132<dt><b><a name="INDEX-8"/>nmbd</b></dt> 133<dd> 134<p>A daemon that supports NetBIOS Name Service and WINS, which is 135Microsoft's implementation of a NetBIOS Name Server 136(NBNS). It also assists with network browsing.</p> 137</dd> 138 139</dl> 140 141<p>Samba is currently maintained and extended by a group of volunteers 142under the active supervision of Andrew Tridgell. Like the Linux 143operating system, Samba is distributed as open source software 144(<a href="http://opensource.org">http://opensource.org</a>) by its 145authors and is distributed under the GNU General Public License 146(GPL). Since its inception, development of Samba has been sponsored 147in part by the Australian National University, where Andrew Tridgell 148earned his Ph.D. Since then, many other organizations have sponsored 149Samba developers, including LinuxCare, VA Linux Systems, 150Hewlett-Packard, and IBM. It is a true testament to Samba that both 151commercial and noncommercial entities are prepared to spend money to 152support an open source effort.</p> 153 154<p>Microsoft has also contributed by offering its definition of the SMB 155protocol to the Internet Engineering Task Force (IETF) in 1996 as the 156<a name="INDEX-9"/><a name="INDEX-10"/>Common 157Internet File System (CIFS). Although we prefer to use the term 158"SMB" in this book, you will also 159often find the protocol being referred to as 160"CIFS." This is especially true on 161Microsoft's web site.</p> 162 163 164</div> 165 166 167 168<div class="sect1"><a name="samba2-CHP-1-SECT-2"/> 169 170<h2 class="head1">What Can Samba Do for Me?</h2> 171 172<p><a name="INDEX-11"/>As explained earlier, Samba can help 173Windows and Unix computers coexist in the same network. However, 174there are some specific reasons why you might want to set up a Samba 175server on your network:</p> 176 177<ul><li> 178<p>You don't want to pay for—or 179can't afford—a full-fledged Windows server, 180yet you still need the functionality that one provides.</p> 181</li><li> 182<p>The Client Access Licenses (CALs) that Microsoft requires for each 183Windows client to access a Windows server are unaffordable.</p> 184</li><li> 185<p>You want to provide a common area for data or user directories to 186transition from a Windows server to a Unix one, or vice versa.</p> 187</li><li> 188<p>You want to share printers among Windows and Unix workstations.</p> 189</li><li> 190<p>You are supporting a group of computer users who have a mixture of 191Windows and Unix computers.</p> 192</li><li> 193<p>You want to integrate Unix and Windows authentication, maintaining a 194single database of user accounts that works with both systems.</p> 195</li><li> 196<p>You want to network Unix, Windows, Macintosh (OS X), and other 197systems using a single protocol.</p> 198</li></ul> 199<p>Let's take a quick tour of 200<a name="INDEX-12"/>Samba in action. Assume that we have 201the following basic network configuration: a Samba-enabled Unix 202system, to which we will assign the name <tt class="literal">toltec</tt>, 203and a pair of Windows clients, to which we will assign the names 204<tt class="literal">maya</tt> and <tt class="literal">aztec</tt>, all connected 205via a local area network (LAN). Let's also assume 206that <tt class="literal">toltec</tt> also has a local inkjet printer 207connected to it, <tt class="literal">lp</tt>, and a disk share named 208<tt class="literal">spirit</tt>—both of which it can offer to the 209other two computers. A graphic of this network is shown in <a href="ch01.html#samba2-CHP-1-FIG-1">Figure 1-1</a>.</p> 210 211<div class="figure"><a name="samba2-CHP-1-FIG-1"/><img src="figs/sam2_0101.gif"/></div><h4 class="head4">Figure 1-1. A simple network set up with a Samba server</h4> 212 213<p>In this network, each computer listed shares the same 214<em class="firstterm">workgroup</em>. A workgroup is a group name tag 215that identifies an arbitrary collection of computers and their 216resources on an SMB network. Several workgroups can be on the network 217at any time, but for our basic network example, 218we'll have only one: the METRAN workgroup.</p> 219 220 221<div class="sect2"><a name="samba2-CHP-1-SECT-2.1"/> 222 223<h3 class="head2">Sharing a Disk Service</h3> 224 225<p><a name="INDEX-13"/><a name="INDEX-14"/><a name="INDEX-15"/>If everything is properly 226configured, we should be able to see the Samba server, 227<tt class="literal">toltec</tt>, through the Network Neighborhood of the 228<tt class="literal">maya</tt> Windows desktop. In fact, <a href="ch01.html#samba2-CHP-1-FIG-2">Figure 1-2</a> shows the Network Neighborhood of the 229<tt class="literal">maya</tt> computer, including <tt class="literal">toltec</tt> 230and each computer that resides in the METRAN workgroup. Note the 231Entire Network icon at the top of the list. As we just mentioned, 232more than one workgroup can be on an SMB network at any given time. 233If a user clicks the Entire Network icon, she will see a list of all 234the workgroups that currently exist on the network.</p> 235 236<div class="figure"><a name="samba2-CHP-1-FIG-2"/><img src="figs/sam2_0102.gif"/></div><h4 class="head4">Figure 1-2. The Network Neighborhood directory</h4> 237 238<p>We can take a closer look at the <tt class="literal">toltec</tt> server by 239double-clicking its icon. This contacts <tt class="literal">toltec</tt> 240itself and requests a list of its 241<em class="firstterm">shares</em>—the file and printer 242resources—that the computer provides. In this case, a printer 243named <tt class="literal">lp</tt>, a home directory named 244<tt class="literal">jay</tt>, and a disk share named 245<tt class="literal">spirit</tt> are on the server, as shown in <a href="ch01.html#samba2-CHP-1-FIG-3">Figure 1-3</a>. Note that the Windows display shows hostnames 246in mixed case (Toltec). Case is irrelevant in hostnames, so you might 247see toltec, Toltec, and TOLTEC in various displays or command output, 248but they all refer to a single system. Thanks to Samba, Windows 98 249sees the Unix server as a valid SMB server and can access the 250<tt class="literal">spirit</tt> folder as if it were just another system 251folder.</p> 252 253<div class="figure"><a name="samba2-CHP-1-FIG-3"/><img src="figs/sam2_0103.gif"/></div><h4 class="head4">Figure 1-3. Shares available on the Toltec server as viewed from maya</h4> 254 255<p>One popular Windows feature is the ability to map a drive letter 256(such as E:, F:, or Z:) to a shared directory on the network using 257the Map Network Drive option in Windows Explorer.<a name="FNPTR-1"/><a href="#FOOTNOTE-1">[1]</a> 258Once you do so, your applications can access the folder across the 259network using the drive letter. You can store data on it, install and 260run programs from it, and even password-protect it against unwanted 261visitors. See <a href="ch01.html#samba2-CHP-1-FIG-4">Figure 1-4</a> for an example of mapping 262a <a name="INDEX-16"/><a name="INDEX-17"/>drive letter to a network 263directory.</p> 264 265<div class="figure"><a name="samba2-CHP-1-FIG-4"/><img src="figs/sam2_0104.gif"/></div><h4 class="head4">Figure 1-4. Mapping a network drive to a Windows drive letter</h4> 266 267<p>Take a look at the Path: entry in the dialog box of <a href="ch01.html#samba2-CHP-1-FIG-4">Figure 1-4</a>. An equivalent way to represent a directory on 268a network computer is by using two backslashes, followed by the name 269of the networked computer, another backslash, and the networked 270directory of the computer, as shown here:</p> 271 272<blockquote><pre class="code">\\<em class="replaceable">network-computer</em>\<em class="replaceable">directory</em></pre></blockquote> 273 274<p>This is known as the <em class="firstterm"/><a name="INDEX-18"/>Universal 275Naming Convention (UNC)</em> in the Windows world. For example, the dialog 276box in <a href="ch01.html#samba2-CHP-1-FIG-4">Figure 1-4</a> represents the network directory 277on the <tt class="literal">toltec</tt> server as:</p> 278 279<blockquote><pre class="code">\\toltec\spirit</pre></blockquote> 280 281<p>If this looks somewhat familiar to you, you're 282probably thinking of <em class="firstterm">uniform resource 283locators</em><a name="INDEX-19"/><a name="INDEX-20"/> (URLs), which are addresses that web 284browsers such as Netscape Navigator and Internet Explorer use to 285resolve systems across the Internet. Be sure not to confuse the two: 286URLs such as <a href="http://www.oreilly.com">http://www.oreilly.com</a> use forward slashes 287instead of backslashes, and they precede the initial slashes with the 288data transfer protocol (i.e., ftp, http) and a colon (:). In reality, 289URLs and UNCs are two completely separate things, although sometimes 290you can specify an SMB share using a URL rather than a UNC. As a URL, 291the <em class="filename">\\toltec\spirit</em> share would be specified as 292<em class="filename">smb://toltec/spirit</em>.</p> 293 294<p>Once the network drive is set up, Windows and its programs behave as 295if the networked directory were a local disk. If you have any 296applications that support multiuser functionality on a network, you 297can install those programs on the network drive.<a name="FNPTR-2"/><a href="#FOOTNOTE-2">[2]</a> <a href="ch01.html#samba2-CHP-1-FIG-5">Figure 1-5</a> shows the 298resulting network drive as it would appear with other storage devices 299in the Windows 98 client. Note the pipeline attachment in the icon 300for the J: drive; this indicates that it is a network drive rather 301than a fixed drive.</p> 302 303<div class="figure"><a name="samba2-CHP-1-FIG-5"/><img src="figs/sam2_0105.gif"/></div><h4 class="head4">Figure 1-5. The Network directory mapped to the client drive letter J</h4> 304 305<p>My Network Places, found in Windows Me, 2000, and XP, works 306differently from Network Neighborhood. It is necessary to click a few 307more icons, but eventually we can get to the view of the 308<tt class="literal">toltec</tt> server as shown in <a href="ch01.html#samba2-CHP-1-FIG-6">Figure 1-6</a>. This is from a Windows 2000 system. Setting 309up the network drive using the Map Network Drive option in Windows 3102000 works similarly to other Windows versions. <a name="INDEX-21"/><a name="INDEX-22"/><a name="INDEX-23"/></p> 311 312<div class="figure"><a name="samba2-CHP-1-FIG-6"/><img src="figs/sam2_0106.gif"/></div><h4 class="head4">Figure 1-6. Shares available on Toltec (viewed from dine)</h4> 313 314 315</div> 316 317 318<div class="sect2"><a name="samba2-CHP-1-SECT-2.2"/> 319 320<h3 class="head2">Sharing a Printer</h3> 321 322<p><a name="INDEX-24"/><a name="INDEX-25"/><a name="INDEX-26"/>You probably noticed that the printer 323<tt class="literal">lp</tt> appeared under the available shares for 324<tt class="literal">toltec</tt> in <a href="ch01.html#samba2-CHP-1-FIG-3">Figure 1-3</a>. This 325indicates that the Unix server has a printer that can be shared by 326the various SMB clients in the workgroup. Data sent to the printer 327from any of the clients will be spooled on the Unix server and 328printed in the order in which it is received.</p> 329 330<p><a name="INDEX-27"/><a name="INDEX-28"/>Setting up a Samba-enabled 331printer on the Windows side is even easier than setting up a disk 332share. By double-clicking the printer and identifying the 333manufacturer and model, you can install a driver for this printer on 334the Windows client. Windows can then properly format any information 335sent to the network printer and access it as if it were a local 336printer. On Windows 98, double-clicking the Printers icon in the 337Control Panel opens the Printers window shown in <a href="ch01.html#samba2-CHP-1-FIG-7">Figure 1-7</a>. Again, note the pipeline attachment below the 338printer, which identifies it as being on a network.</p> 339 340<div class="figure"><a name="samba2-CHP-1-FIG-7"/><img src="figs/sam2_0107.gif"/></div><h4 class="head4">Figure 1-7. A network printer available on Toltec</h4> 341 342 343<div class="sect3"><a name="samba2-CHP-1-SECT-2.2.1"/> 344 345<h3 class="head3">Seeing things from the Unix side</h3> 346 347<p><a name="INDEX-29"/><a name="INDEX-30"/>As mentioned earlier, Samba 348appears in Unix as a set of daemon programs. You can view them with 349the Unix <a name="INDEX-31"/><em class="emphasis">ps</em> command; you can 350read any messages they generate through custom debug files or the 351Unix <em class="emphasis">syslog</em> (depending on how Samba is set up); 352and you can configure them from a single Samba configuration file: 353<em class="emphasis">smb.conf</em>. In addition, if you want to get an idea of 354what the daemons are doing, Samba has a program called 355<em class="emphasis">smbstatus</em><a name="INDEX-32"/> that will lay it all on the line. Here 356is how it works:</p> 357 358<blockquote><pre class="code"># <tt class="userinput"><b>smbstatus</b></tt> 359Processing section "[homes]" 360Processing section "[printers]" 361Processing section "[spirit]" 362 363Samba version 2.2.6 364Service uid gid pid machine 365----------------------------------------- 366spirit jay jay 7735 maya (172.16.1.6) Sun Aug 12 12:17:14 2002 367spirit jay jay 7779 aztec (172.16.1.2) Sun Aug 12 12:49:11 2002 368jay jay jay 7735 maya (172.16.1.6) Sun Aug 12 12:56:19 2002 369 370Locked files: 371Pid DenyMode R/W Oplock Name 372-------------------------------------------------- 3737735 DENY_WRITE RDONLY NONE /u/RegClean.exe Sun Aug 12 13:01:22 2002 374 375Share mode memory usage (bytes): 376 1048368(99%) free + 136(0%) used + 72(0%) overhead = 1048576(100%) total</pre></blockquote> 377 378<p>The Samba status from this output provides three sets of data, each 379divided into separate sections. The first section tells which systems 380have connected to the Samba server, identifying each client by its 381machine name (<tt class="literal">maya</tt> and <tt class="literal">aztec</tt>) 382and IP (Internet Protocol) address. The second section reports the 383name and status of the files that are currently in use on a share on 384the server, including the read/write status and any locks on the 385files. Finally, Samba reports the amount of memory it has currently 386allocated to the shares that it administers, including the amount 387actively used by the shares plus additional overhead. (Note that this 388is not the same as the total amount of memory that the 389<em class="emphasis">smbd</em> or <em class="emphasis">nmbd</em> processes are 390using.)</p> 391 392<p>Don't worry if you don't understand 393these statistics; they will become easier to understand as you move 394through the book.</p> 395 396 397</div> 398 399 400</div> 401 402 403</div> 404 405 406 407<div class="sect1"><a name="samba2-CHP-1-SECT-3"/> 408 409<h2 class="head1">Getting Familiar with an SMB Network</h2> 410 411<p><a name="INDEX-33"/>Now that you have had a brief tour of 412Samba, let's take some time to get familiar with 413Samba's adopted environment: an SMB network. 414Networking with SMB is significantly different from working with 415common TCP/IP protocols such as FTP and Telnet because there are 416several new concepts to learn and a lot of information to cover. 417First, we will discuss the basic concepts behind an SMB network, 418followed by some Microsoft implementations of it, and finally we will 419show you where a Samba server can and cannot fit into the picture.</p> 420 421 422<div class="sect2"><a name="samba2-CHP-1-SECT-3.1"/> 423 424<h3 class="head2">Understanding NetBIOS</h3> 425 426<p>To begin, let's step back in time. In 1984, IBM 427authored a simple application programming interface (API) for 428networking its computers, called the <em class="firstterm">Network Basic 429Input/Output System 430</em>(<a name="INDEX-34"/>NetBIOS). 431The NetBIOS API provided a rudimentary design for an application to 432connect and share data with other computers.</p> 433 434<p>It's helpful to think of the NetBIOS API as 435networking extensions to the standard BIOS API calls. The BIOS 436contains low-level code for performing filesystem operations on the 437local computer. NetBIOS originally had to exchange instructions with 438computers across IBM PC or Token Ring networks. It therefore required 439a low-level transport protocol to carry its requests from one 440computer to the next.</p> 441 442<p>In late 1985, IBM released one such protocol, which it merged with 443the NetBIOS API to become the <em class="firstterm">NetBIOS Extended User 444Interface</em> (<em class="emphasis">NetBEUI</em> ). 445<a name="INDEX-35"/>NetBEUI was 446designed for small LANs, and it let each computer claim a name (up to 44715 characters) that wasn't already in use on the 448network. By a "small LAN," we mean 449fewer than 255 nodes on the network—which was considered a 450generous number in 1985!</p> 451 452<p>The NetBEUI protocol was very popular with networking applications, 453including those running under Windows for Workgroups. Later, 454implementations of NetBIOS over Novell's IPX 455networking protocols also emerged, which competed with NetBEUI. 456However, the networking protocols of choice for the burgeoning 457Internet community were TCP/IP and UDP/IP, and implementing the 458NetBIOS APIs over those protocols soon became a necessity.</p> 459 460<p>Recall that TCP/IP uses numbers to represent computer addresses 461(192.168.220.100, for instance) while NetBIOS uses only names. This 462was a major issue when trying to mesh the two protocols together. In 4631987, the IETF published standardization documents, titled RFC 1001 464and 1002, that outlined how NetBIOS would work over a TCP/UDP 465network. This set of documents still governs each implementation that 466exists today, including those provided by Microsoft with its Windows 467operating systems, as well as the Samba suite.</p> 468 469<p>Since then, the standard that this document governs has become known 470as <em class="firstterm">NetBIOS over 471TCP/IP</em><a name="INDEX-36"/><a name="INDEX-37"/><a name="INDEX-38"/>, or NBT for short.<a name="FNPTR-3"/><a href="#FOOTNOTE-3">[3]</a> </p> 472 473<p>The NBT standard (RFC 1001/1002) 474currently outlines a trio of services on a network:</p> 475 476<ul><li> 477<p>A name service</p> 478</li><li> 479<p>Two communication services:</p> 480<ul><li> 481<p>Datagrams</p> 482</li> 483 484<li> 485<p>Sessions</p> 486</li></ul> 487</li> 488</ul> 489 490<p>The <a name="INDEX-39"/>name 491service solves the name-to-address problem mentioned earlier; it 492allows each computer to declare a specific name on the network that 493can be translated to a machine-readable IP address, much like 494today's Domain Name System (DNS) on the Internet. 495The <a name="INDEX-40"/>datagram and <a name="INDEX-41"/>session services are both 496secondary communication protocols used to transmit data back and 497forth from NetBIOS computers across the network.</p> 498 499 500</div> 501 502 503<div class="sect2"><a name="samba2-CHP-1-SECT-3.2"/> 504 505<h3 class="head2">Getting a Name</h3> 506 507<p><a name="INDEX-42"/><a name="INDEX-43"/>In the NetBIOS world, when each 508computer comes online, it wants to claim a name for itself; this is 509called <em class="firstterm">name registration</em>. However, no two 510computers in the same workgroup should be able to claim the same 511name; this would cause endless confusion for any computer that wanted 512to communicate with either of them. There are two different 513approaches to ensuring that this doesn't happen:</p> 514 515<ul><li> 516<p>Use an <em class="firstterm"/>NBNS</em> to keep track of which hosts have 517registered a NetBIOS name.</p> 518</li><li> 519<p>Allow each computer on the network to defend its name in the event 520that another computer attempts to use it.</p> 521</li></ul> 522<p><a href="ch01.html#samba2-CHP-1-FIG-8">Figure 1-8</a> illustrates a (failed) name 523registration, with and without an NBNS.</p> 524 525<div class="figure"><a name="samba2-CHP-1-FIG-8"/><img src="figs/sam2_0108.gif"/></div><h4 class="head4">Figure 1-8. Broadcast versus NBNS name registration</h4> 526 527<p><a name="INDEX-44"/><a name="INDEX-45"/>As mentioned earlier, 528there must be a way to resolve a NetBIOS name to a specific IP 529address; this is known as <em class="firstterm">name resolution</em>. 530There are two different approaches with NBT here as well:</p> 531 532<ul><li> 533<p>Have each computer report back its IP address when it 534"hears" a broadcast request for its 535NetBIOS name.</p> 536</li><li> 537<p>Use an NBNS to help resolve NetBIOS names to IP addresses.</p> 538</li></ul> 539<p><a href="ch01.html#samba2-CHP-1-FIG-9">Figure 1-9</a> illustrates the two types of name 540resolution.</p> 541 542<div class="figure"><a name="samba2-CHP-1-FIG-9"/><img src="figs/sam2_0109.gif"/></div><h4 class="head4">Figure 1-9. Broadcast versus NBNS name resolution</h4> 543 544<p>As you might expect, having an NBNS on your network can help out 545tremendously. To see exactly why, let's look at the 546broadcast method.</p> 547 548<p>Here, when a client computer boots, it will 549<a name="INDEX-46"/>broadcast a 550message declaring that it wishes to register a specified NetBIOS name 551as its own. If nobody objects to the use of the name, it keeps the 552name. On the other hand, if another computer on the local subnet is 553currently using the requested name, it will send a message back to 554the requesting client that the name is already taken. This is known 555as <em class="firstterm">defending</em><a name="INDEX-47"/><a name="INDEX-48"/> the hostname. This type of system 556comes in handy when one client has unexpectedly dropped off the 557network—another can take its name unchallenged—but it 558does incur an inordinate amount of traffic on the network for 559something as simple as name registration.</p> 560 561<p>With an NBNS, the same thing occurs, except the communication is 562confined to the requesting computer and the NBNS. No broadcasting 563occurs when the computer wishes to register the name; the 564registration message is simply sent directly from the client to the 565NBNS, and the NBNS replies regardless of whether the name is already 566taken. This is known as <em class="firstterm">point-to-point 567communication</em><a name="INDEX-49"/>, and it is often beneficial on 568networks with more than one subnet. This is because routers are 569generally configured to block incoming packets that are broadcast to 570all computers in the subnet.</p> 571 572<p>The same principles apply to name resolution. Without an NBNS, 573NetBIOS name resolution would also be done with a broadcast 574mechanism. All request packets would be sent to each computer in the 575network, with the hope that one computer that might be affected will 576respond directly back to the computer that asked. Using an NBNS and 577point-to-point communication for this purpose is far less taxing on 578the network than flooding the network with broadcasts for every 579name-resolution request.</p> 580 581<p>It can be argued that broadcast packets do not cause significant 582problems in modern, high-bandwidth networks of hosts with fast CPUs, 583if only a small number of hosts are on the network, or the demand for 584bandwidth is low. There are certainly cases where this is true; 585however, our advice throughout this book is to avoid relying on 586broadcasts as much as possible. This is a good rule to follow for 587large, busy networks, and if you follow our advice when configuring a 588small network, your network will be able to grow without encountering 589problems later on that might be difficult to diagnose. <a name="INDEX-50"/><a name="INDEX-51"/></p> 590 591 592</div> 593 594 595<div class="sect2"><a name="samba2-CHP-1-SECT-3.3"/> 596 597<h3 class="head2">Node Types</h3> 598 599<p><a name="INDEX-52"/><a name="INDEX-53"/>How can you tell what strategy each 600client on your network will use when performing name registration and 601resolution? Each computer on an NBT network earns one of the 602following designations, depending on how it handles name registration 603and resolution: <a name="INDEX-54"/><a name="INDEX-55"/><a name="INDEX-56"/><a name="INDEX-57"/>b-node, p-node, m-node, and h-node. The 604behaviors of each type of node are summarized in <a href="ch01.html#samba2-CHP-1-TABLE-1">Table 1-1</a>.</p> 605 606<a name="samba2-CHP-1-TABLE-1"/><h4 class="head4">Table 1-1. NetBIOS node types</h4><table border="1"> 607 608 609 610<tr> 611<th> 612<p>Role</p> 613</th> 614<th> 615<p>Value</p> 616</th> 617</tr> 618 619 620<tr> 621<td> 622<p>b-node</p> 623</td> 624<td> 625<p>Uses broadcast registration and resolution only.</p> 626</td> 627</tr> 628<tr> 629<td> 630<p>p-node</p> 631</td> 632<td> 633<p>Uses point-to-point registration and resolution only.</p> 634</td> 635</tr> 636<tr> 637<td> 638<p>m-node (mixed)</p> 639</td> 640<td> 641<p>Uses broadcast for registration. If successful, it notifies the NBNS 642of the result. Uses broadcast for resolution; uses the NBNS if 643broadcast is unsuccessful.</p> 644</td> 645</tr> 646<tr> 647<td> 648<p>h-node (hybrid)</p> 649</td> 650<td> 651<p>Uses the NBNS for registration and resolution; uses broadcast if the 652NBNS is unresponsive or inoperative.</p> 653</td> 654</tr> 655 656</table> 657 658<p>In the case of Windows clients, you will usually find them listed as 659h-nodes or hybrid nodes. The first three node types appear in RFC 6601001/1002, and h-nodes were invented later by Microsoft, as a more 661fault-tolerant method.</p> 662 663<p>You can find the node type of a Windows 95/98/Me computer by running 664the <em class="emphasis">winipcfg</em><a name="INDEX-58"/><a name="INDEX-59"/> command from the Start 665→ Run dialog (or from an MS-DOS prompt) and clicking 666the More Info>> button. On Windows NT/2000/XP, you can use the 667<tt class="literal">ipconfig</tt><a name="INDEX-60"/><a name="INDEX-61"/><a name="INDEX-62"/><a name="INDEX-63"/> 668<tt class="literal">/all</tt> command in a command-prompt window. In either 669case, search for the line that says <tt class="literal">Node Type</tt>.</p> 670 671 672</div> 673 674 675<div class="sect2"><a name="samba2-CHP-1-SECT-3.4"/> 676 677<h3 class="head2">What's in a Name?</h3> 678 679<p>The names <a name="INDEX-64"/><a name="INDEX-65"/>NetBIOS uses are quite different 680from the DNS hostnames you might be familiar with. First, NetBIOS 681names exist in a flat namespace. In other words, there are no 682hierarchical levels, such as in <tt class="literal">oreilly.com</tt> (two 683levels) or <em class="emphasis">ftp</em><em class="emphasis">.samba.org</em> (three 684levels). NetBIOS names consist of a single unique string such as 685<tt class="literal">navaho</tt> or <tt class="literal">hopi</tt> within each 686workgroup or domain. Second, NetBIOS names are allowed to be only 15 687characters and can consist only of standard alphanumeric characters 688(a-z, A-Z, 0-9) and the following:</p> 689 690<blockquote><pre class="code">! @ # $ % ^ & ( ) - ' { } . ~</pre></blockquote> 691 692<p>Although you are allowed to use a <a name="INDEX-66"/><a name="INDEX-67"/><a name="INDEX-68"/>period (.) in a NetBIOS name, we recommend 693against it because those names are not guaranteed to work in future 694versions of NBT.</p> 695 696<p>It's not a coincidence that all valid DNS names are 697also valid NetBIOS names. In fact, the unqualified DNS name for a 698Samba server is often reused as its NetBIOS name. For example, if you 699had a system with a hostname of <tt class="literal">mixtec.ora.com</tt> , 700its NetBIOS name would likely be MIXTEC (followed by 9 spaces).</p> 701 702 703<div class="sect3"><a name="samba2-CHP-1-SECT-3.4.1"/> 704 705<h3 class="head3">Resource names and types</h3> 706 707<p><a name="INDEX-69"/><a name="INDEX-70"/>With NetBIOS, a computer not 708only advertises its presence, but also tells others what types of 709services it offers. For example, <tt class="literal">mixtec</tt> can 710indicate that it's not just a workstation, but that 711it's also a file server and can receive Windows 712Messenger messages. This is done by adding a 16th byte to the end of 713the machine (resource) name, called the <em class="firstterm">resource 714type</em>, and registering the name multiple times, once for 715each service that it offers. See <a href="ch01.html#samba2-CHP-1-FIG-10">Figure 1-10</a>.</p> 716 717<div class="figure"><a name="samba2-CHP-1-FIG-10"/><img src="figs/sam2_0110.gif"/></div><h4 class="head4">Figure 1-10. The structure of NetBIOS names</h4> 718 719<p>The 1-byte resource type indicates a unique service that the named 720computer provides. In this book, you will often see the resource type 721shown in angled brackets (<>) after the NetBIOS name, such as:</p> 722 723<blockquote><pre class="code">MIXTEC<00></pre></blockquote> 724 725<p>You can see which names are registered for a particular NBT computer 726using the Windows command-line 727<em class="emphasis">nbtstat</em><a name="INDEX-71"/> utility. 728Because these services are unique (i.e., there cannot be more than 729one registered), you will see them listed as type UNIQUE in the 730output. For example, the following partial output describes the 731<tt class="literal">toltec</tt> server:</p> 732 733<blockquote><pre class="code">C:\><tt class="userinput"><b>nbtstat -a toltec</b></tt> 734 735 NetBIOS Remote Machine Name Table 736 Name Type Status 737--------------------------------------------- 738TOLTEC <00> UNIQUE Registered 739TOLTEC <03> UNIQUE Registered 740TOLTEC <20> UNIQUE Registered 741...</pre></blockquote> 742 743<p>This says the server has registered the NetBIOS name 744<tt class="literal">toltec</tt> as a machine (computer) name, as a 745recipient of messages from the Windows Messenger service, and as a 746file server. Some possible attributes a name can have are listed in 747<a href="ch01.html#samba2-CHP-1-TABLE-2">Table 1-2</a>.</p> 748 749<a name="samba2-CHP-1-TABLE-2"/><h4 class="head4">Table 1-2. NetBIOS unique resource types</h4><table border="1"> 750 751 752 753<tr> 754<th> 755<p>Named resource</p> 756</th> 757<th> 758<p>Hexadecimal byte value</p> 759</th> 760</tr> 761 762 763<tr> 764<td> 765<p>Standard Workstation Service</p> 766</td> 767<td> 768<p>00</p> 769</td> 770</tr> 771<tr> 772<td> 773<p>Messenger Service</p> 774</td> 775<td> 776<p>03</p> 777</td> 778</tr> 779<tr> 780<td> 781<p>RAS Server Service</p> 782</td> 783<td> 784<p>06</p> 785</td> 786</tr> 787<tr> 788<td> 789<p>Domain Master Browser Service (associated with primary domain controller)</p> 790</td> 791<td> 792<p>1B</p> 793</td> 794</tr> 795<tr> 796<td> 797<p>Master Browser name</p> 798</td> 799<td> 800<p>1D</p> 801</td> 802</tr> 803<tr> 804<td> 805<p>NetDDE Service</p> 806</td> 807<td> 808<p>1F</p> 809</td> 810</tr> 811<tr> 812<td> 813<p>Fileserver (including printer server)</p> 814</td> 815<td> 816<p>20</p> 817</td> 818</tr> 819<tr> 820<td> 821<p>RAS Client Service</p> 822</td> 823<td> 824<p>21</p> 825</td> 826</tr> 827<tr> 828<td> 829<p>Network Monitor Agent</p> 830</td> 831<td> 832<p>BE</p> 833</td> 834</tr> 835<tr> 836<td> 837<p>Network Monitor Utility</p> 838</td> 839<td> 840<p>BF</p> 841</td> 842</tr> 843 844</table> 845 846 847</div> 848 849 850 851<div class="sect3"><a name="samba2-CHP-1-SECT-3.4.2"/> 852 853<h3 class="head3">Group names and types</h3> 854 855<p>SMB also uses the concept of groups, with which computers can 856register themselves. Earlier we mentioned that the computers in our 857example belonged to a 858<em class="firstterm">workgroup</em><a name="INDEX-73"/>, 859which is a partition of computers on the same network. For example, a 860business might very easily have an ACCOUNTING and a SALES workgroup, 861each with different servers and printers. In the Windows world, a 862workgroup and an 863<a name="INDEX-74"/>SMB 864group are the same thing.</p> 865 866<p>Continuing our 867<em class="emphasis">nbtstat</em><a name="INDEX-75"/> example, 868the <tt class="literal">toltec</tt> Samba server is also a member of the 869METRAN workgroup (the GROUP attribute hex 00) and will participate in 870elections for the browse master (GROUP attribute 1E). Here is the 871remainder of the <em class="emphasis">nbtstat</em> output:</p> 872 873<blockquote><pre class="code"> NetBIOS Remote Machine Name Table 874 Name Type Status 875--------------------------------------------- 876METRAN <00> GROUP Registered 877METRAN <1E> GROUP Registered 878..__MSBROWSE__.<01> GROUP Registered</pre></blockquote> 879 880<p>The possible group attributes a computer can have are illustrated in 881<a href="ch01.html#samba2-CHP-1-TABLE-3">Table 1-3</a>. More 882<a name="INDEX-76"/><a name="INDEX-77"/>information 883is available in <em class="emphasis">Windows NT in a Nutshell</em> by Eric 884<a name="INDEX-78"/>Pearce, also 885published by O'Reilly.</p> 886 887<a name="samba2-CHP-1-TABLE-3"/><h4 class="head4">Table 1-3. NetBIOS group resource types</h4><table border="1"> 888 889 890 891<tr> 892<th> 893<p>Named resource</p> 894</th> 895<th> 896<p>Hexadecimal byte value</p> 897</th> 898</tr> 899 900 901<tr> 902<td> 903<p>Standard Workstation group</p> 904</td> 905<td> 906<p>00</p> 907</td> 908</tr> 909<tr> 910<td> 911<p>Logon server</p> 912</td> 913<td> 914<p>1C</p> 915</td> 916</tr> 917<tr> 918<td> 919<p>Master Browser name</p> 920</td> 921<td> 922<p>1D</p> 923</td> 924</tr> 925<tr> 926<td> 927<p>Normal Group name (used in browser elections)</p> 928</td> 929<td> 930<p>1E</p> 931</td> 932</tr> 933<tr> 934<td> 935<p>Internet Group name (administrative)</p> 936</td> 937<td> 938<p>20</p> 939</td> 940</tr> 941<tr> 942<td> 943<p><tt class="literal"><01><02>_ _MSBROWSE_ _<02></tt></p> 944</td> 945<td> 946<p>01</p> 947</td> 948</tr> 949 950</table> 951 952<p>The final entry, <tt class="literal">_ _ MSBROWSE _ _</tt> 953<a name="INDEX-80"/>, is used to announce a group to other 954master browsers. The nonprinting characters in the name show up as 955dots in an <em class="emphasis">nbtstat</em> printout. 956Don't worry if you don't understand 957all of the resource or group types. Some of them you will not need 958with Samba, and others you will pick up as you move through the rest 959of the chapter. The important thing to remember here is the logistics 960of the naming mechanism.</p> 961 962 963</div> 964 965 966 967<div class="sect3"><a name="samba2-CHP-1-SECT-3.4.3"/> 968 969<h3 class="head3">Scope ID</h3> 970 971<p>In the dark ages of SMB networking before NetBIOS groups were 972introduced, you could use a very primitive method to isolate groups 973of computers from the rest of the network. Each SMB packet contains a 974field called the <em class="firstterm">scope 975ID</em><a name="INDEX-81"/><a name="INDEX-82"/>, with the idea being that 976systems on the network could be configured to accept only packets 977with a scope ID matching that of their configuration. This feature 978was hardly ever used and unfortunately lingers in modern 979implementations. Some of the utilities included in the Samba 980distribution allow the scope ID to be set. Setting the scope ID in a 981network is likely to cause problems, and we are mentioning scope ID 982only so that you will not be confused by it when you later encounter 983it in various places.</p> 984 985 986</div> 987 988 989</div> 990 991 992<div class="sect2"><a name="samba2-CHP-1-SECT-3.5"/> 993 994<h3 class="head2">Datagrams and Sessions</h3> 995 996<p>At this point, let's digress to discuss the 997responsibility of NBT: to provide connection services between two 998NetBIOS computers. 999<a name="INDEX-83"/>NBT 1000offers two services: the <em class="firstterm">session 1001service</em><a name="INDEX-84"/> and the 1002<em class="firstterm">datagram service</em><a name="INDEX-85"/>. 1003Understanding how these two services work is not essential to using 1004Samba, but it does give you an idea of how NBT works and how to 1005troubleshoot Samba when it doesn't work.</p> 1006 1007<p>The datagram service has no stable connection between computers. 1008Packets of data are simply sent or broadcast from one computer to 1009another, without regard to the order in which they arrive at the 1010destination, or even if they arrive at all. The use of datagrams 1011requires less processing overhead than sessions, although the 1012reliability of the connection can suffer. Datagrams, therefore, are 1013used for quickly sending nonvital blocks of data to one or more 1014computers. The datagram service communicates using the simple 1015primitives shown in <a href="ch01.html#samba2-CHP-1-TABLE-4">Table 1-4</a>.</p> 1016 1017<a name="samba2-CHP-1-TABLE-4"/><h4 class="head4">Table 1-4. Datagram primitives</h4><table border="1"> 1018 1019 1020 1021<tr> 1022<th> 1023<p>Primitive</p> 1024</th> 1025<th> 1026<p>Description</p> 1027</th> 1028</tr> 1029 1030 1031<tr> 1032<td> 1033<p>Send Datagram</p> 1034</td> 1035<td> 1036<p>Send datagram packet to computer or groups of computers.</p> 1037</td> 1038</tr> 1039<tr> 1040<td> 1041<p>Send Broadcast Datagram</p> 1042</td> 1043<td> 1044<p>Broadcast datagram to any computer waiting with a Receive Broadcast 1045datagram.</p> 1046</td> 1047</tr> 1048<tr> 1049<td> 1050<p>Receive Datagram</p> 1051</td> 1052<td> 1053<p>Receive a datagram from a computer.</p> 1054</td> 1055</tr> 1056<tr> 1057<td> 1058<p>Receive Broadcast Datagram</p> 1059</td> 1060<td> 1061<p>Wait for a Broadcast datagram.</p> 1062</td> 1063</tr> 1064 1065</table> 1066 1067<p>The session service is more complex. Sessions are a communication 1068method that, in theory, offers the ability to detect problematic or 1069inoperable connections between two NetBIOS applications. It helps to 1070think of an NBT session as being similar to a telephone call, an 1071analogy that obviously influenced the design of the CIFS standard.</p> 1072 1073<p>Once the connection is made, it remains open throughout the duration 1074of the conversation, each side knows who the caller and the called 1075computer are, and each can communicate with the simple primitives 1076shown in <a href="ch01.html#samba2-CHP-1-TABLE-5">Table 1-5</a>.</p> 1077 1078<a name="samba2-CHP-1-TABLE-5"/><h4 class="head4">Table 1-5. Session primitives</h4><table border="1"> 1079 1080 1081 1082<tr> 1083<th> 1084<p>Primitive</p> 1085</th> 1086<th> 1087<p>Description</p> 1088</th> 1089</tr> 1090 1091 1092<tr> 1093<td> 1094<p>Call</p> 1095</td> 1096<td> 1097<p>Initiate a session with a computer listening under a specified name.</p> 1098</td> 1099</tr> 1100<tr> 1101<td> 1102<p>Listen</p> 1103</td> 1104<td> 1105<p>Wait for a call from a known caller or any caller.</p> 1106</td> 1107</tr> 1108<tr> 1109<td> 1110<p>Hang-up</p> 1111</td> 1112<td> 1113<p>Exit a call.</p> 1114</td> 1115</tr> 1116<tr> 1117<td> 1118<p>Send</p> 1119</td> 1120<td> 1121<p>Send data to the other computer.</p> 1122</td> 1123</tr> 1124<tr> 1125<td> 1126<p>Receive</p> 1127</td> 1128<td> 1129<p>Receive data from the other computer.</p> 1130</td> 1131</tr> 1132<tr> 1133<td> 1134<p>Session Status</p> 1135</td> 1136<td> 1137<p>Get information on requested sessions.</p> 1138</td> 1139</tr> 1140 1141</table> 1142 1143<p>Sessions are the backbone of resource sharing on an NBT network. They 1144are typically used for establishing stable connections from client 1145computers to disk or printer shares on a server. The client 1146"calls" the server and starts 1147trading information such as which files it wishes to open, which data 1148it wishes to exchange, etc. These calls can last a long 1149time—hours, even days—and all of this occurs within the 1150context of a single connection. If there is an error, the session 1151software (TCP) will retransmit until the data is received properly, 1152unlike the "punt-and-pray" approach 1153of the datagram service (UDP).</p> 1154 1155<p>In truth, while sessions are supposed to handle problematic 1156communications, they sometimes don't. If the 1157connection is interrupted, session information that is open between 1158the two computers might become invalid. If that happens, the only way 1159to regain the session information is for the same two computers to 1160call each other again and start over.</p> 1161 1162<p>If you want more information on each service, we recommend you look 1163at RFC 1001. However, there are two important things to remember 1164here:</p> 1165 1166<ul><li> 1167<p><a name="INDEX-88"/>Sessions always 1168occur between two NetBIOS computers. If a session service is 1169interrupted, the client is supposed to store sufficient state 1170information for it to reestablish the connection. However, in 1171practice, this often does not happen.</p> 1172</li><li> 1173<p><a name="INDEX-89"/>Datagrams can 1174be broadcast to multiple computers, but they are unreliable. In other 1175words, there is no way for the source to know that the datagrams it 1176sent have indeed arrived at their destinations. <a name="INDEX-90"/></p> 1177</li></ul> 1178 1179</div> 1180 1181 1182</div> 1183 1184 1185 1186<div class="sect1"><a name="samba2-CHP-1-SECT-4"/> 1187 1188<h2 class="head1">An Introduction to the SMB Protocol</h2> 1189 1190<p><a name="INDEX-91"/>Now 1191we're going to cover some low-level technical 1192details and explore the elementals of the SMB protocol. You probably 1193don't need to know much about this to implement a 1194simple Samba network, and therefore you might want to skip or skim 1195over this section and go on to the next one 1196("Windows Workgroups and Domains") 1197on your first reading. However, assuming you are going to be 1198responsible for long-term maintenance of a Samba network, it will 1199help if you understand how it actually works. You will more easily be 1200able to diagnose and correct any odd problems that pop up.</p> 1201 1202<p>At a high level, the SMB protocol suite is relatively simple. It 1203includes commands for all the file and print operations that you 1204might perform on a local disk or printer, such as:</p> 1205 1206<ul><li> 1207<p>Opening and closing files</p> 1208</li><li> 1209<p>Creating and deleting files and directories</p> 1210</li><li> 1211<p>Reading and writing files</p> 1212</li><li> 1213<p>Searching for files</p> 1214</li><li> 1215<p>Queueing and dequeueing files in a print spool</p> 1216</li></ul> 1217<p>Each operation can be encoded into an SMB message and transmitted to 1218and from a server. The original name 1219"SMB" comes from the way in which 1220the commands are formatted: they are versions of the standard DOS 1221system-call data structures, or <em class="firstterm">Server Message 1222Blocks</em>, redesigned for transmitting to another computer 1223across a network.</p> 1224 1225 1226<div class="sect2"><a name="samba2-CHP-1-SECT-4.1"/> 1227 1228<h3 class="head2">SMB Format</h3> 1229 1230<p>Richard <a name="INDEX-92"/>Sharpe of the Samba team defines SMB as 1231a <em class="firstterm">request-response</em> protocol.<a name="FNPTR-4"/><a href="#FOOTNOTE-4">[4]</a> In effect, 1232this means that a client sends an SMB request to a server and the 1233server sends an SMB response back to the client. In only one rare 1234circumstance does a server send a message that is not in response to 1235a client.</p> 1236 1237<p>An <a name="INDEX-94"/>SMB message is not as complex as you 1238might think. Let's take a closer look at the 1239internal structure of such a message. It can be broken down into two 1240parts: the <em class="firstterm">header</em>, which is a fixed size, and 1241the <em class="firstterm">command string</em>, whose size can vary 1242dramatically based on the contents of the message.</p> 1243 1244 1245<div class="sect3"><a name="samba2-CHP-1-SECT-4.1.1"/> 1246 1247<h3 class="head3">SMB header format</h3> 1248 1249<p><a href="ch01.html#samba2-CHP-1-TABLE-6">Table 1-6</a> shows the format of an 1250<a name="INDEX-95"/>SMB header. The COM field identifies 1251the command being performed. SMB commands are not required to use all 1252the fields in the SMB header. For example, when a client first 1253attempts to connect to a server, it does not yet have a tree 1254identifier (TID) value—one is assigned after it successfully 1255connects—so a null TID is placed in its header field. Other 1256fields can be padded with zeros when not used.</p> 1257 1258<p>The <a name="INDEX-96"/>SMB header fields are listed in <a href="ch01.html#samba2-CHP-1-TABLE-6">Table 1-6</a>.</p> 1259 1260<a name="samba2-CHP-1-TABLE-6"/><h4 class="head4">Table 1-6. SMB header fields</h4><table border="1"> 1261 1262 1263 1264 1265<tr> 1266<th> 1267<p>Field</p> 1268</th> 1269<th> 1270<p>Size (bytes)</p> 1271</th> 1272<th> 1273<p>Description</p> 1274</th> 1275</tr> 1276 1277 1278<tr> 1279<td> 1280<p><tt class="literal">0xFF 'SMB</tt>'</p> 1281</td> 1282<td> 1283<p><tt class="literal">1</tt></p> 1284</td> 1285<td> 1286<p>Protocol identifier</p> 1287</td> 1288</tr> 1289<tr> 1290<td> 1291<p><tt class="literal">COM</tt></p> 1292</td> 1293<td> 1294<p><tt class="literal">1</tt></p> 1295</td> 1296<td> 1297<p>Command code, from 0x00 to 0xFF</p> 1298</td> 1299</tr> 1300<tr> 1301<td> 1302<p><tt class="literal">RCLS</tt></p> 1303</td> 1304<td> 1305<p><tt class="literal">1</tt></p> 1306</td> 1307<td> 1308<p>Error class</p> 1309</td> 1310</tr> 1311<tr> 1312<td> 1313<p><tt class="literal">REH</tt></p> 1314</td> 1315<td> 1316<p><tt class="literal">1</tt></p> 1317</td> 1318<td> 1319<p>Reserved</p> 1320</td> 1321</tr> 1322<tr> 1323<td> 1324<p><tt class="literal">ERR</tt></p> 1325</td> 1326<td> 1327<p><tt class="literal">2</tt></p> 1328</td> 1329<td> 1330<p>Error code</p> 1331</td> 1332</tr> 1333<tr> 1334<td> 1335<p><tt class="literal">REB</tt></p> 1336</td> 1337<td> 1338<p><tt class="literal">1</tt></p> 1339</td> 1340<td> 1341<p>Reserved</p> 1342</td> 1343</tr> 1344<tr> 1345<td> 1346<p><tt class="literal">RES</tt></p> 1347</td> 1348<td> 1349<p><tt class="literal">14</tt></p> 1350</td> 1351<td> 1352<p>Reserved</p> 1353</td> 1354</tr> 1355<tr> 1356<td> 1357<p><tt class="literal">TID</tt></p> 1358</td> 1359<td> 1360<p><tt class="literal">2</tt></p> 1361</td> 1362<td> 1363<p>TID; a unique ID for a resource in use by the client</p> 1364</td> 1365</tr> 1366<tr> 1367<td> 1368<p><tt class="literal">PID</tt></p> 1369</td> 1370<td> 1371<p><tt class="literal">2</tt></p> 1372</td> 1373<td> 1374<p>Caller process ID</p> 1375</td> 1376</tr> 1377<tr> 1378<td> 1379<p><tt class="literal">UID</tt></p> 1380</td> 1381<td> 1382<p><tt class="literal">2</tt></p> 1383</td> 1384<td> 1385<p>User identifier</p> 1386</td> 1387</tr> 1388<tr> 1389<td> 1390<p><tt class="literal">MID</tt></p> 1391</td> 1392<td> 1393<p><tt class="literal">2</tt></p> 1394</td> 1395<td> 1396<p>Multiplex identifier; used to route requests inside a process</p> 1397</td> 1398</tr> 1399 1400</table> 1401 1402 1403</div> 1404 1405 1406 1407<div class="sect3"><a name="samba2-CHP-1-SECT-4.1.2"/> 1408 1409<h3 class="head3">SMB command format</h3> 1410 1411<p>Immediately after the header is a variable number of bytes that 1412constitute an <a name="INDEX-97"/>SMB command or reply. Each command, 1413such as Open File (COM field identifier: <tt class="literal">SMBopen</tt>) 1414or Get Print Queue (<tt class="literal">SMBsplretq</tt> ), has its own set 1415of parameters and data. Like the SMB header fields, not all of the 1416command fields need to be filled, depending on the specific command. 1417For example, the Get Server Attributes 1418(<tt class="literal">SMBdskattr</tt>) command sets the WCT and BCC fields 1419to zero. The fields of the command segment are shown in <a href="ch01.html#samba2-CHP-1-TABLE-7">Table 1-7</a>.</p> 1420 1421<a name="samba2-CHP-1-TABLE-7"/><h4 class="head4">Table 1-7. SMB command contents</h4><table border="1"> 1422 1423 1424 1425 1426<tr> 1427<th> 1428<p>Field</p> 1429</th> 1430<th> 1431<p>Size (bytes)</p> 1432</th> 1433<th> 1434<p>Description</p> 1435</th> 1436</tr> 1437 1438 1439<tr> 1440<td> 1441<p><tt class="literal">WCT</tt></p> 1442</td> 1443<td> 1444<p><tt class="literal">1</tt></p> 1445</td> 1446<td> 1447<p>Word count</p> 1448</td> 1449</tr> 1450<tr> 1451<td> 1452<p><tt class="literal">VWV</tt></p> 1453</td> 1454<td> 1455<p>Variable</p> 1456</td> 1457<td> 1458<p>Parameter words (size given by WCT)</p> 1459</td> 1460</tr> 1461<tr> 1462<td> 1463<p><tt class="literal">BCC</tt></p> 1464</td> 1465<td> 1466<p><tt class="literal">2</tt></p> 1467</td> 1468<td> 1469<p>Parameter byte count</p> 1470</td> 1471</tr> 1472<tr> 1473<td> 1474<p><tt class="literal">DATA</tt></p> 1475</td> 1476<td> 1477<p>Variable</p> 1478</td> 1479<td> 1480<p>Data (size given by BCC)</p> 1481</td> 1482</tr> 1483 1484</table> 1485 1486<p>Don't worry if you don't understand 1487each field; they are not necessary for using Samba at an 1488administrator level. However, they do come in handy when debugging 1489system messages. We will show you some of the more common SMB 1490messages that clients and servers send using a modified version of 1491<em class="filename">tcpdump</em> later in this section. (If you prefer an 1492<a name="INDEX-98"/><a name="INDEX-99"/>SMB sniffer with a graphical 1493interface, try Ethereal, which uses the GTK libraries; see 1494<a href="http://www.ethereal.com">http://www.ethereal.com</a> for more 1495information on this tool.)</p> 1496 1497<a name="samba2-CHP-1-NOTE-84"/><blockquote class="note"><h4 class="objtitle">TIP</h4> 1498<p>For more information on each command in the 1499<a name="INDEX-100"/>SMB protocol, see the 1500<em class="citetitle">CIFS Technical 1501Reference</em><a name="INDEX-101"/> at <a href="http://www.snia.org/tech_activities/CIFS">http://www.snia.org/tech_activities/CIFS</a>.</p> 1502</blockquote> 1503 1504 1505</div> 1506 1507 1508 1509<div class="sect3"><a name="samba2-CHP-1-SECT-4.1.3"/> 1510 1511<h3 class="head3">SMB variations</h3> 1512 1513<p>The SMB protocol has been extended with new commands several times 1514since its inception. Each new version is backward-compatible with the 1515previous versions, so it is possible for a LAN to have clients and 1516servers concurrently running different versions of the SMB protocol.</p> 1517 1518<p><a href="ch01.html#samba2-CHP-1-TABLE-8">Table 1-8</a> outlines the major versions of the 1519<a name="INDEX-102"/>SMB 1520protocol. Within each "dialect" of 1521SMB are many sub-versions that include commands supporting particular 1522releases of major operating systems. The ID string in column 2 is 1523used by clients and servers to determine in which level of the 1524protocol they will speak to each other.</p> 1525 1526<a name="samba2-CHP-1-TABLE-8"/><h4 class="head4">Table 1-8. SMB protocol dialects</h4><table border="1"> 1527 1528 1529 1530 1531<tr> 1532<th> 1533<p>Protocol name</p> 1534</th> 1535<th> 1536<p>ID string</p> 1537</th> 1538<th> 1539<p>Used by</p> 1540</th> 1541</tr> 1542 1543 1544<tr> 1545<td> 1546<p>Core</p> 1547</td> 1548<td> 1549<p><tt class="literal">PC NETWORK PROGRAM 1.0</tt></p> 1550</td> 1551<td> 1552</td> 1553</tr> 1554<tr> 1555<td> 1556<p><a name="INDEX-103"/>Core Plus</p> 1557</td> 1558<td> 1559<p><tt class="literal">MICROSOFT NETWORKS 1.03</tt></p> 1560</td> 1561<td> 1562</td> 1563</tr> 1564<tr> 1565<td> 1566<p><a name="INDEX-104"/>LAN Manager 1.0</p> 1567</td> 1568<td> 1569<p><tt class="literal">LANMAN1.0</tt></p> 1570</td> 1571<td> 1572</td> 1573</tr> 1574<tr> 1575<td> 1576<p>LAN Manager 2.0</p> 1577</td> 1578<td> 1579<p><tt class="literal">LM1.2X002</tt></p> 1580</td> 1581<td> 1582</td> 1583</tr> 1584<tr> 1585<td> 1586<p>LAN Manager 2.1</p> 1587</td> 1588<td> 1589<p><tt class="literal">LANMAN2.1</tt></p> 1590</td> 1591<td> 1592</td> 1593</tr> 1594<tr> 1595<td> 1596<p><a name="INDEX-105"/>NT LAN 1597Manager 1.0</p> 1598</td> 1599<td> 1600<p><tt class="literal">NT LM 0.12</tt></p> 1601</td> 1602<td> 1603<p>Windows NT 4.0</p> 1604</td> 1605</tr> 1606<tr> 1607<td> 1608<p><a name="INDEX-106"/>Samba's NT LM 0.12</p> 1609</td> 1610<td> 1611<p><tt class="literal">Samba</tt></p> 1612</td> 1613<td> 1614<p>Samba</p> 1615</td> 1616</tr> 1617<tr> 1618<td> 1619<p><a name="INDEX-107"/><a name="INDEX-108"/>Common 1620Internet File System</p> 1621</td> 1622<td> 1623<p><tt class="literal">CIFS 1.0</tt></p> 1624</td> 1625<td> 1626<p>Windows 2000/XP</p> 1627</td> 1628</tr> 1629 1630</table> 1631 1632<p>Samba implements the NT LM 0.12 specification for NT LAN Manager 1.0. 1633It is backward-compatible with all the other SMB variants. The CIFS 1634specification is, in reality, LAN Manager 0.12 with a few specific 1635additions.</p> 1636 1637 1638</div> 1639 1640 1641</div> 1642 1643 1644<div class="sect2"><a name="samba2-CHP-1-SECT-4.2"/> 1645 1646<h3 class="head2">SMB Clients and Servers</h3> 1647 1648<p><a name="INDEX-109"/><a name="INDEX-110"/>As 1649mentioned earlier, SMB is a client/server protocol. In the purest 1650sense, this means that a client sends a request to a server, which 1651acts on the request and returns a reply. However, the client/server 1652roles can often be reversed, sometimes within the context of a single 1653SMB session. For example, consider the two Windows 95/98/Me computers 1654in <a href="ch01.html#samba2-CHP-1-FIG-11">Figure 1-11</a>. The computer named 1655<tt class="literal">maya</tt> shares a printer to the network, and the 1656computer named <tt class="literal">toltec</tt> shares a disk directory. 1657<tt class="literal">maya</tt> is in the client role when accessing 1658<tt class="literal">toltec</tt>'s network drive and in the 1659server role when printing a job for <tt class="literal">toltec</tt>.</p> 1660 1661<div class="figure"><a name="samba2-CHP-1-FIG-11"/><img src="figs/sam2_0111.gif"/></div><h4 class="head4">Figure 1-11. Two computers that both have resources to share</h4> 1662 1663<p>This brings out an important point in Samba terminology:</p> 1664 1665<ul><li> 1666<p>A <em class="firstterm">server</em> is a computer with a resource to 1667share.</p> 1668</li><li> 1669<p>A <em class="firstterm">client</em> is a computer that wishes to use that 1670resource.</p> 1671</li><li> 1672<p>A computer can be a client, a server, or both, or it can be neither 1673at any given time.</p> 1674</li></ul> 1675<p>Microsoft Windows products have both the SMB client and server built 1676into the operating system, and it is common to find Windows acting as 1677a server, client, both, or neither at any given time in a production 1678network. Although Samba has been developed primarily to function as a 1679server, there are also ways that it and associated software can act 1680as an SMB client. As with Windows, it is even possible to set up a 1681Unix system to act as an SMB client and not as a server. See <a href="ch05.html">Chapter 5</a> for more details on this topic.</p> 1682 1683 1684</div> 1685 1686 1687<div class="sect2"><a name="samba2-CHP-1-SECT-4.3"/> 1688 1689<h3 class="head2">A Simple SMB Connection</h3> 1690 1691<p><a name="INDEX-111"/>The client and server must complete 1692three steps to establish a connection to a resource:</p> 1693 1694<ol><li> 1695<p>Establish a NetBIOS session.</p> 1696</li><li> 1697<p>Negotiate the protocol variant.</p> 1698</li><li> 1699<p>Set session parameters, and make a tree connection to a resource.</p> 1700</li></ol> 1701<p>We will examine each step through the eyes of a useful tool that we 1702mentioned earlier: the modified 1703<em class="filename">tcpdump</em><a name="INDEX-112"/> that is 1704available from the Samba web site.</p> 1705 1706<a name="samba2-CHP-1-NOTE-85"/><blockquote class="note"><h4 class="objtitle">TIP</h4> 1707<p>You can download the tcpdump program at <a href="http://www.samba.org">http://www.samba.org</a> in the 1708<em class="filename">samba/ftp/tcpdump-smb</em> directory; the latest 1709version as of this writing is 3.4-10. Use this program as you would 1710use the standard <em class="filename">tcpdump</em> application, but add 1711the <tt class="literal">-s 1500</tt> switch to ensure that you get the 1712whole packet and not just the first few bytes.</p> 1713</blockquote> 1714 1715 1716</div> 1717 1718 1719<div class="sect2"><a name="samba2-CHP-1-SECT-4.4"/> 1720 1721<h3 class="head2">Establishing a NetBIOS Session</h3> 1722 1723<p><a name="INDEX-113"/>When a user first makes a request 1724to access a network disk or send a print job to a remote printer, 1725NetBIOS takes care of making a connection at the session layer. The 1726result is a bidirectional channel between the client and server. The 1727client and server need only two messages to establish this 1728connection. This is shown in the following example session request 1729and response, as captured by <em class="filename">tcpdump</em> .</p> 1730 1731<p>First, the client sends a request to open a session, and 1732<em class="filename">tcpdump </em><a name="INDEX-114"/>reports:</p> 1733 1734<blockquote><pre class="code">>>> NBT Packet 1735NBT Session Request 1736Flags=0x81000044 1737Destination=TOLTEC NameType=0x20 (Server) 1738Source=MAYA NameType=0x00 (Workstation)</pre></blockquote> 1739 1740<p>Then the server responds, granting a session to the client:</p> 1741 1742<blockquote><pre class="code">>>> NBT Packet 1743NBT Session Granted 1744Flags=0x82000000</pre></blockquote> 1745 1746<p>At this point, there is an open channel between the client and server.</p> 1747 1748 1749</div> 1750 1751 1752<div class="sect2"><a name="samba2-CHP-1-SECT-4.5"/> 1753 1754<h3 class="head2">Negotiating the Protocol Variant</h3> 1755 1756<p>Next, the client sends a message to the server to negotiate an 1757<a name="INDEX-115"/>SMB protocol. As mentioned 1758earlier, the client sets its <a name="INDEX-116"/>tree identifier (TID) field to 1759zero, because it does not yet know what TID to use. A <em class="emphasis">tree 1760identifier</em> is a number that represents a connection to a 1761share on a server.</p> 1762 1763<p>The command in the message is <tt class="literal">SMBnegprot</tt>, a 1764request to negotiate a protocol variant that will be used for the 1765entire session. Note that the client sends to the server a list of 1766all the variants that it can speak, not vice versa:</p> 1767 1768<blockquote><pre class="code">>>> NBT Packet 1769NBT Session Packet 1770Flags=0x0 1771Length=154 1772 1773SMB PACKET: SMBnegprot (REQUEST) 1774SMB Command = 0x72 1775Error class = 0x0 1776Error code = 0 1777Flags1 = 0x0 1778Flags2 = 0x0 1779Tree ID = 0 1780Proc ID = 5315 1781UID = 0 1782MID = 257 1783Word Count = 0 1784Dialect=PC NETWORK PROGRAM 1.0 1785Dialect=MICROSOFT NETWORKS 3.0 1786Dialect=DOS LM1.2X002 1787Dialect=DOS LANMAN2.1 1788Dialect=Windows for Workgroups 3.1a 1789Dialect=NT LM 0.12</pre></blockquote> 1790 1791<p>The server responds to the 1792<tt class="literal">SMBnegprot</tt><a name="INDEX-117"/> request with an index (with counting 1793starting at 0) into the list of variants that the client offered, or 1794with the value 0xFF if none of the protocol variants is acceptable:</p> 1795 1796<blockquote><pre class="code">>>> NBT Packet 1797NBT Session Packet 1798Flags=0x0 1799Length=84 1800 1801SMB PACKET: SMBnegprot (REPLY) 1802SMB Command = 0x72 1803Error class = 0x0 1804Error code = 0 1805Flags1 = 0x80 1806Flags2 = 0x1 1807Tree ID = 0 1808Proc ID = 5315 1809UID = 0 1810MID = 257 1811Word Count = 17 1812NT1 Protocol 1813DialectIndex=5 1814[...]</pre></blockquote> 1815 1816<p>In this example, the server responds with the value 5, which 1817indicates that the <tt class="literal">NT</tt> <tt class="literal">LM</tt> 1818<tt class="literal">0.12</tt> dialect will be used for the remainder of the 1819session.</p> 1820 1821 1822</div> 1823 1824 1825<div class="sect2"><a name="samba2-CHP-1-SECT-4.6"/> 1826 1827<h3 class="head2">Set Session and Login Parameters</h3> 1828 1829<p><a name="INDEX-118"/><a name="INDEX-119"/>The next step is to transmit session and 1830login parameters for the session, which you do using the 1831<a name="INDEX-120"/><tt class="literal">SMBSesssetupX</tt> 1832command. The parameters include the following:</p> 1833 1834<ul><li> 1835<p>The account name and password (if there is one)</p> 1836</li><li> 1837<p>The workgroup name</p> 1838</li><li> 1839<p>The maximum size of data that can be transferred</p> 1840</li><li> 1841<p>The number of pending requests that can be in the queue at a time</p> 1842</li></ul> 1843<p>The resulting output from <em class="filename">tcpdump </em>is:</p> 1844 1845<blockquote><pre class="code">>>> NBT Packet 1846NBT Session Packet 1847Flags=0x0 1848Length=150 1849 1850SMB PACKET: SMBsesssetupX (REQUEST) 1851SMB Command = 0x73 1852Error class = 0x0 1853Error code = 0 1854Flags1 = 0x10 1855Flags2 = 0x0 1856Tree ID = 0 1857Proc ID = 5315 1858UID = 1 1859MID = 257 1860Word Count = 13 1861Com2=0x75 1862Res1=0x0 1863Off2=120 1864MaxBuffer=2920 1865MaxMpx=50 1866VcNumber=0 1867SessionKey=0x1380 1868CaseInsensitivePasswordLength=24 1869CaseSensitivePasswordLength=0 1870Res=0x0 1871Capabilities=0x1 1872Pass1&Pass2&Account&Domain&OS&LanMan= 1873 JAY METRAN Windows 4.0 Windows 4.0 1874 1875SMB PACKET: SMBtconX (REQUEST) (CHAINED) 1876smbvwv[]= 1877Com2=0xFF 1878Off2=0 1879Flags=0x2 1880PassLen=1 1881Passwd&Path&Device= 1882smb_bcc=23 1883smb_buf[]=\\TOLTEC\SPIRIT</pre></blockquote> 1884 1885<p>In this example, the <tt class="literal">SMBsesssetupX</tt> Session Setup 1886command allows for an additional SMB command to be piggybacked onto 1887it (indicated by the letter X at the end of the command name). The 1888hexadecimal code of the second command is given in the 1889<tt class="literal">Com2</tt> field. In this case the command is 1890<tt class="literal">0x75</tt>, which is the <tt class="literal">SMBtconX</tt> 1891<tt class="literal">(</tt>Tree Connect and X) command. The 1892<tt class="literal">SMBtconX</tt><a name="INDEX-121"/> message looks for the name of the 1893resource in the <em class="emphasis">smb_buf</em> buffer. In this example, 1894<em class="emphasis">smb_buf</em> contains the string 1895<tt class="literal">\\TOLTEC\SPIRIT</tt>, which is the full pathname to a 1896shared directory on <tt class="literal">toltec</tt>. Using the 1897"and X" commands like this speeds 1898up each transaction because the server doesn't have 1899to wait on the client to make a second request.</p> 1900 1901<p>Note that the TID is still zero. Finally, the server returns a TID to 1902the client, indicating that the user has been authorized access and 1903that the resource is ready to be used:</p> 1904 1905<blockquote><pre class="code">>>> NBT Packet 1906NBT Session Packet 1907Flags=0x0 1908Length=85 1909 1910SMB PACKET: SMBsesssetupX (REPLY) 1911SMB Command = 0x73 1912Error class = 0x0 1913Error code = 0 1914Flags1 = 0x80 1915Flags2 = 0x1 1916Tree ID = 1 1917Proc ID = 5315 1918UID = 100 1919MID = 257 1920Word Count = 3 1921Com2=0x75 1922Off2=68 1923Action=0x1 1924[000] Unix Samba 2.2.6 1925[010] METRAN 1926 1927SMB PACKET: SMBtconX (REPLY) (CHAINED) 1928smbvwv[]= 1929Com2=0xFF 1930Off2=0 1931smbbuf[]= 1932ServiceType=A:</pre></blockquote> 1933 1934<p>The <em class="emphasis">ServiceType</em> field is set to 1935"A" to indicate that this is a file 1936service. Available service types are:</p> 1937 1938<ul><li> 1939<p>"A" for a disk or file</p> 1940</li><li> 1941<p>"LPT1" for a spooled output</p> 1942</li><li> 1943<p>"COMM" for a direct-connect printer 1944or modem</p> 1945</li><li> 1946<p>"IPC" for a named pipe</p> 1947</li></ul> 1948<p>Now that a TID has been assigned, the client can use it as a handle 1949to perform any operation that it would use on a local disk drive. It 1950can open files, read and write to them, delete them, create new 1951files, search for filenames, and so on. <a name="INDEX-122"/></p> 1952 1953 1954</div> 1955 1956 1957</div> 1958 1959 1960 1961<div class="sect1"><a name="samba2-CHP-1-SECT-5"/> 1962 1963<h2 class="head1">Windows Workgroups and Domains</h2> 1964 1965<p>Up to now, we've covered basic SMB technology, which 1966is all you would need if you had nothing more advanced than MS-DOS 1967clients on your network. We do assume you want to support Windows 1968clients, especially the more recent versions, so next 1969we'll describe the enhancements Microsoft has added 1970to SMB networking—namely, Windows for Workgroups and Windows 1971domains.</p> 1972 1973 1974<div class="sect2"><a name="samba2-CHP-1-SECT-5.1"/> 1975 1976<h3 class="head2">Windows Workgroups</h3> 1977 1978<p><a name="INDEX-123"/><a name="INDEX-124"/>Windows 1979Workgroups are very similar to the SMB groups already described. You 1980need to know just a few additional things.</p> 1981 1982 1983<div class="sect3"><a name="samba2-CHP-1-SECT-5.1.1"/> 1984 1985<h3 class="head3">Browsing</h3> 1986 1987<p><a name="INDEX-125"/>Browsing 1988is the process of finding the other computers and shared resources in 1989the Windows network. Note that there is no connection with a World 1990Wide Web browser, apart from the general idea of 1991"discovering what's 1992there." On the other hand, browsing the Windows 1993network is like the Web in that what's out there can 1994change without warning.</p> 1995 1996<p>Before browsing existed, users had to know the name of the computer 1997they wanted to connect to on the network and then manually enter a 1998UNC such as the following into an application or file manager to 1999access resources:</p> 2000 2001<blockquote><pre class="code">\\toltec\spirit\</pre></blockquote> 2002 2003<p>Browsing is much more convenient, making it possible to examine the 2004contents of a network by using the point-and-click GUI interface of 2005the Network Neighborhood (or My Network Places<a name="FNPTR-5"/><a href="#FOOTNOTE-5">[5]</a>) on a Windows client.</p> 2006 2007<p>You will encounter two types of browsing in an SMB network:</p> 2008 2009<ul><li> 2010<p><a name="INDEX-129"/>Browsing a list 2011of computers and shared resources</p> 2012</li><li> 2013<p><a name="INDEX-130"/>Browsing the shared resource 2014of a specific computer</p> 2015</li></ul> 2016<p>Let's look at the first one. On each LAN (or subnet) 2017with a Windows workgroup or domain, one computer has the 2018responsibility of maintaining a list of the computers that are 2019currently accessible through the network. This computer is called the 2020<em class="firstterm">local master 2021browser</em><a name="INDEX-131"/><a name="INDEX-132"/>, and the list that it maintains is 2022called the <em class="firstterm">browse 2023list</em><a name="INDEX-133"/>. Computers on a subnet use the browse 2024list to cut down on the amount of network traffic generated while 2025browsing. Instead of each computer dynamically polling to determine a 2026list of the currently available computers, the computer can simply 2027query the local master browser to obtain a complete, up-to-date list.</p> 2028 2029<p>To browse the resources on a computer, a user must connect to the 2030specific computer; this information cannot be obtained from the 2031browse list. Browsing the list of resources on a computer can be done 2032by double-clicking the computer's icon when it is 2033presented in the Network Neighborhood. As you saw at the opening of 2034the chapter, the computer will respond with a list of shared 2035resources that can be accessed after the user is successfully 2036authenticated.</p> 2037 2038<p>Each server on a Windows workgroup is required to announce its 2039presence to the local master browser after it has registered a 2040NetBIOS name, and (theoretically) announce that it is leaving the 2041workgroup when it is shut down. It is the local master 2042browser's responsibility to record what the servers 2043have announced.</p> 2044<a name="samba2-CHP-1-NOTE-86"/><blockquote class="note"><h4 class="objtitle">WARNING</h4> 2045<p>The Windows <a name="INDEX-134"/>Network Neighborhood can behave 2046oddly: until you select a particular computer to browse, the Network 2047Neighborhood window might contain data that is not up-to-date. That 2048means the Network Neighborhood window can be showing computers that 2049have crashed or can be missing computers that 2050haven't been noticed yet. Put succinctly, once 2051you've selected a server and connected to it, you 2052can be a lot more confident that the shares and printers really exist 2053on the network.</p> 2054</blockquote> 2055 2056<p>Unlike the roles you've seen earlier, almost any 2057Windows system (including Windows for Workgroups and Windows 95/98/Me 2058or NT/2000/XP) can act as a local master browser. The local master 2059browser can have one or more 2060<em class="firstterm"/><a name="INDEX-135"/><a name="INDEX-136"/>backup 2061browsers</em> on the local subnet 2062that will take over in the event that the local master browser fails 2063or becomes inaccessible. To ensure fluid operation, the local backup 2064browsers will frequently synchronize their browse list with the local 2065master browser.</p> 2066 2067<p>Here is how to calculate the minimum number of backup browsers that 2068will be allocated on a workgroup:</p> 2069 2070<ul><li> 2071<p>If up to 32 Windows NT/2000/XP workstations are on the network, or up 2072to 16 Windows 95/98/Me computers are on the network, the local master 2073browser allocates one backup browser in addition to the local master 2074browser.</p> 2075</li><li> 2076<p>If the number of Windows NT/2000/XP workstations falls between 33 and 207764, or the number of Windows 95/98/Me workstations falls between 17 2078and 32, the local master browser allocates two backup browsers.</p> 2079</li><li> 2080<p>For each group of 32 NT/2000/XP workstations or 16 Windows 95/98/Me 2081computers beyond this, the local master browser allocates another 2082backup browser.</p> 2083</li></ul> 2084<p>There is currently no upper limit on the number of backup browsers 2085that can be allocated by the local master browser.</p> 2086 2087 2088</div> 2089 2090 2091 2092<div class="sect3"><a name="samba2-CHP-1-SECT-5.1.2"/> 2093 2094<h3 class="head3">Browsing elections</h3> 2095 2096<p><a name="INDEX-137"/>Browsing 2097is a critical aspect of any Windows workgroup. However, not 2098everything runs perfectly on any network. For example, 2099let's say that a computer running Windows on the 2100desk of a small company's CEO is the local master 2101browser—that is, until he switches it off while plugging in his 2102massage chair. At this point the Windows NT Workstation in the spare 2103parts department might agree to take over the job. However, that 2104computer is currently running a large, poorly written program that 2105has brought its processor to its knees. The moral: browsing has to be 2106very tolerant of servers coming and going. Because nearly every 2107Windows system can serve as a browser, there has to be a way of 2108deciding at any time who will take on the job. This decision-making 2109process is called an <em class="firstterm">election</em>.</p> 2110 2111<p>An election algorithm is built into nearly all Windows operating 2112systems such that they can each agree who is going to be a local 2113master browser and who will be local backup browsers. An election can 2114be forced at any time. For example, let's assume 2115that the CEO has finished his massage and reboots his server. As the 2116server comes online, it will announce its presence, and an election 2117will take place to see if the PC in the spare parts department should 2118still be the master browser.</p> 2119 2120<p>When an election is performed, each computer broadcasts information 2121about itself via datagrams. This information includes the following:</p> 2122 2123<ul><li> 2124<p>The version of the election protocol used</p> 2125</li><li> 2126<p>The operating system on the computer</p> 2127</li><li> 2128<p>The amount of time the client has been on the network</p> 2129</li><li> 2130<p>The hostname of the client</p> 2131</li></ul> 2132<p>These values determine which operating system has seniority and will 2133fulfill the role of the local master browser. (<a href="ch07.html">Chapter 7</a> describes the election process in more 2134detail.) The architecture developed to achieve this is not elegant 2135and has built-in security problems. While a browsing domain can be 2136integrated with domain security, the election algorithm does not take 2137into consideration which computers become browsers. Thus it is 2138possible for any computer running a browser service to register 2139itself as participating in the browsing election and (after winning) 2140being able to change the browse list. Nevertheless, browsing is a key 2141feature of Windows networking, and backward-compatibility 2142requirements will ensure that it is in use for years to come. 2143<a name="INDEX-138"/></p> 2144 2145 2146</div> 2147 2148 2149 2150<div class="sect3"><a name="samba2-CHP-1-SECT-5.1.3"/> 2151 2152<h3 class="head3">Windows 95/98/Me authentication</h3> 2153 2154<p>Three types of passwords arise when 2155<a name="INDEX-139"/><a name="INDEX-140"/>Windows 215695/98/Me is operating in a Windows workgroup:</p> 2157 2158<ul><li> 2159<p>A Windows password</p> 2160</li><li> 2161<p>A Windows Networking password</p> 2162</li><li> 2163<p>A password for each shared resource that has been assigned password 2164protection</p> 2165</li></ul> 2166<p>The Windows <a name="INDEX-141"/>password functions in a manner 2167that might be a source of confusion for Unix system administrators. 2168It is not there to prevent unauthorized users from using the 2169computer. (If you don't believe that, try clicking 2170the Cancel button on the password dialog box and see what happens!) 2171Instead, the Windows password is used to gain access to a file that 2172contains the Windows Networking and network resource passwords. There 2173is one such file per registered user of the system, and they can be 2174found in the <em class="filename">C:\Windows</em> directory with a name 2175composed of the user's account name, followed by a 2176<em class="filename">.pwl</em><a name="INDEX-142"/><a name="INDEX-143"/><a name="INDEX-144"/> extension. For example, if the 2177user's account name is 2178"sarah," the file will be 2179<em class="filename">C:\Windows\sarah.pwl</em>. This file is encrypted 2180using the Windows password as the encryption key.</p> 2181 2182<a name="samba2-CHP-1-NOTE-87"/><blockquote class="note"><h4 class="objtitle">TIP</h4> 2183<p>As a security measure, you might want to check for junk 2184<em class="filename">.pwl</em> files on Windows 95/98/Me clients, which 2185might have been created by mistakes users made while attempting to 2186log on. A <em class="filename">.pwl</em> file is easily cracked and can 2187contain valid passwords for Samba accounts and network shares.</p> 2188</blockquote> 2189 2190<p>The first time the network is accessed, Windows attempts to use the 2191Windows password as the Windows Networking password. If this is 2192successful, the user will not be prompted for two separate passwords, 2193and subsequent logins to the Windows system will automatically result 2194in logging on to the Windows network as well, making things much 2195simpler for the user.</p> 2196 2197<p>Shared network resources in the workgroup can also have passwords 2198assigned to them to limit their accessibility. The first time a user 2199attempts to access the resource, she is asked for its password, and a 2200checkbox in the password dialog box gives the user the option to add 2201the password to her password list. This is the default; if it is 2202accepted, Windows will store the password in the 2203user's <em class="filename">.pwl</em> file, and all 2204further authentication to the resource will be handled automatically 2205by Windows.</p> 2206 2207<p>Samba's approach to workgroup authentication is a 2208little different, which is a result of blending the Windows workgroup 2209model with that of the Unix host upon which Samba runs. This will be 2210discussed further in <a href="ch09.html">Chapter 9</a>. <a name="INDEX-145"/></p> 2211 2212 2213</div> 2214 2215 2216</div> 2217 2218 2219<div class="sect2"><a name="samba2-CHP-1-SECT-5.2"/> 2220 2221<h3 class="head2">Windows NT Domains</h3> 2222 2223<p><a name="INDEX-146"/>The 2224peer-to-peer networking model of 2225<a name="INDEX-147"/>workgroups functions fairly well as long as 2226the number of computers on the network is small and there is a 2227close-knit community of users. However, in larger networks the 2228simplicity of workgroups becomes a limiting factor. Workgroups offer 2229only the most basic level of security, and because each resource can 2230have its own password, it is inconvenient (to say the least) for 2231users to remember the password for each resource in a large network. 2232Even if that were not a problem, many people find it frustrating to 2233have to interrupt their creative workflow to enter a shared password 2234into a dialog box every time another network resource is accessed.</p> 2235 2236<p>To support the needs of larger networks, such as those found in 2237departmental computing environments, Microsoft introduced domains 2238with Windows NT 3.51. A <em class="firstterm">Windows NT domain</em> is 2239essentially a workgroup of SMB computers that has one addition: a 2240server acting as a <em class="firstterm">domain 2241controller</em><a name="INDEX-148"/> (see <a href="ch01.html#samba2-CHP-1-FIG-12">Figure 1-12</a>).</p> 2242 2243<div class="figure"><a name="samba2-CHP-1-FIG-12"/><img src="figs/sam2_0112.gif"/></div><h4 class="head4">Figure 1-12. A simple Windows domain</h4> 2244 2245 2246<div class="sect3"><a name="samba2-CHP-1-SECT-5.2.1"/> 2247 2248<h3 class="head3">Domain controllers</h3> 2249 2250<p>A domain controller in a Windows NT domain functions much like a 2251<a name="INDEX-149"/><a name="INDEX-150"/>Network 2252Information Service (NIS) server in a Unix network, maintaining a 2253domain-wide database of user and group information, as well as 2254performing related services. The responsibilities of a domain 2255controller are mainly centered around security, including 2256<em class="firstterm">authentication</em><a name="INDEX-151"/>, 2257the process of granting or denying a user access to the resources of 2258the domain. This is typically done through the use of a username and 2259password. The service that maintains the database on the domain 2260controllers is called the <a name="INDEX-152"/><a name="INDEX-153"/>Security Account Manager (SAM).</p> 2261 2262<p>The <a name="INDEX-154"/>Windows NT security model revolves 2263around <em class="firstterm">security 2264identifiers</em><a name="INDEX-155"/><a name="INDEX-156"/> (SIDs) and <em class="firstterm">access 2265control lists</em><a name="INDEX-157"/><a name="INDEX-158"/> 2266(ACLs). Security identifiers are used to represent objects in the 2267domain, which include (but are not limited to) users, groups, 2268computers, and processes. SIDs are commonly written in ASCII form as 2269hyphen-separated fields, like this:</p> 2270 2271<blockquote><pre class="code">S-1-5-21-1638239387-7675610646-9254035128-545</pre></blockquote> 2272 2273<p>The part of the SID starting with the 2274"S" and leading up to the rightmost 2275hyphen identifies a domain. The number after the rightmost hyphen is 2276called a <a name="INDEX-159"/>relative identifier (RID) and is a unique 2277number within the domain that identifies the user, group, computer, 2278or other object. The RID is the analog of a <a name="INDEX-160"/>user ID (UID) or 2279<a name="INDEX-161"/>group ID 2280(GID) on a Unix system or within an NIS domain.</p> 2281 2282<p>ACLs supply the same function as 2283"rwx" 2284<a name="INDEX-162"/><a name="INDEX-163"/><a name="INDEX-164"/><a name="INDEX-165"/><a name="INDEX-166"/>file permissions that are common in Unix 2285systems. However, ACLs are more versatile. Unix file permissions only 2286set permissions for the owner and group to which the file belongs, 2287and "other," meaning everyone else. 2288Windows NT/2000/XP ACLs allow permissions to be set individually for 2289any number of arbitrary users and/or groups. ACLs are made up of one 2290or more <em class="firstterm">access control 2291entries</em><a name="INDEX-167"/> (ACEs), each of which contains an SID 2292and the access rights associated with it.</p> 2293 2294<p>ACL support has been added as a standard feature for some Unix 2295variants and is available as an add-on for others. Samba supports 2296mappings between Windows and Unix ACLs, and this will be covered in 2297<a href="ch08.html">Chapter 8</a>.</p> 2298 2299 2300</div> 2301 2302 2303 2304<div class="sect3"><a name="samba2-CHP-1-SECT-5.2.2"/> 2305 2306<h3 class="head3">Primary and backup domain controllers</h3> 2307 2308<p>You've already read about master and backup 2309browsers. Domain controllers are similar in that a domain has a 2310<em class="firstterm">primary domain 2311controller</em><a name="INDEX-168"/><a name="INDEX-169"/><a name="INDEX-170"/> (PDC) and can have 2312one or more <em class="firstterm">backup domain 2313controllers</em><a name="INDEX-171"/> (BDCs) as well. If the PDC fails or 2314becomes inaccessible, its duties are automatically taken over by one 2315of the BDCs. BDCs frequently synchronize their SAM data with the PDC 2316so if the need arises, any one of them can immediately begin 2317performing domain-controller services without impacting the clients. 2318However, note that BDCs have read-only copies of the SAM database; 2319they can update their data only by synchronizing with a PDC. A server 2320in a Windows domain can use the SAM of any PDC or BDC to authenticate 2321a user who attempts to access its resources and log on to the domain.</p> 2322 2323<p>All recent versions of Windows can log on to a domain as clients to 2324access the resources of the domain servers. The systems that are 2325considered members of the domain are a more exclusive class, composed 2326of the PDC and BDCs, as well as domain member servers, which are 2327systems that have joined a domain as members, and are known to the 2328domain controllers by having a computer account in the SAM database.</p> 2329 2330 2331</div> 2332 2333 2334 2335<div class="sect3"><a name="samba2-CHP-1-SECT-5.2.3"/> 2336 2337<h3 class="head3">Authentication</h3> 2338 2339<p><a name="INDEX-172"/>When 2340a user logs on to a Windows domain by typing in a username and 2341password, a secure challenge and response protocol is invoked between 2342the client computer and a domain controller to verify that the 2343username and password are valid. Then the domain controller sends a 2344SID back to the client, which uses it to create a 2345<a name="INDEX-173"/>Security Access Token (SAT) that is valid 2346only for that system, to be used for further authentication. This 2347access token has information about the user coded into it, including 2348the username, the group, and the rights the user has within the 2349domain. At this point, the user is logged on to the domain.</p> 2350 2351<p>Subsequently, when the client attempts to access a shared resource 2352within the domain, the client system enters into a secure challenge 2353and response exchange with the server of the resource. The server 2354then enters into another secure challenge and response conversation 2355with a domain controller to check that the client is valid. (What 2356actually happens is that the server uses information it gets from the 2357client to pretend to be the client and authenticate itself with the 2358domain controller. If the domain controller validates the 2359credentials, it sends an SID back to the server, which uses the SID 2360to create its own SAT for the client to enable access to its local 2361resources on the client's behalf.) At this point, 2362the client is authenticated for resources on the server and is 2363allowed to access them. The server then uses the SID in the access 2364token to determine what permissions the client has to use and modify 2365the requested resource by comparing them to entries in the ACL of the 2366resource.</p> 2367 2368<p>Although this method of authentication might seem overly complicated, 2369it allows clients to authenticate without having plain-text passwords 2370travel through the network, and it is much more difficult to crack 2371than the relatively weak workgroup security we described earlier.</p> 2372 2373 2374</div> 2375 2376 2377 2378<div class="sect3"><a name="samba2-CHP-1-SECT-5.2.4"/> 2379 2380<h3 class="head3">Name service with WINS and DNS</h3> 2381 2382<p>The <a name="INDEX-174"/><a name="INDEX-175"/>Windows 2383Internet Name Service (WINS) is Microsoft's 2384implementation of a NetBIOS name server (NBNS). As such, WINS 2385inherits much of NetBIOS's characteristics. First, 2386WINS is flat; you can have only simple machine names such as 2387<tt class="literal">inca</tt>, <tt class="literal">mixtec</tt>, or 2388<tt class="literal">navaho</tt>, and workgroups such as PERU, MEXICO, or 2389USA. In addition, WINS is dynamic: when a client first comes online, 2390it is required to report its hostname, its address, and its workgroup 2391to the local WINS server. This WINS server will retain the 2392information so long as the client periodically refreshes its WINS 2393registration, which indicates that it's still 2394connected to the network. Note that WINS servers are not workgroup- 2395or domain-specific; they can contain information for multiple domains 2396and/or workgroups, which might exist on more than one subnet.</p> 2397 2398<p>Multiple <a name="INDEX-176"/>WINS 2399servers can be set to synchronize with each other. This allows 2400entries for computers that come online and go offline in the network 2401to propagate from one WINS server to another. While in theory this 2402seems efficient, it can quickly become cumbersome if several WINS 2403servers are covering a network. Because WINS services can cross 2404multiple subnets (you'll either hardcode the address 2405of a WINS server in each of your clients or obtain it via DHCP), it 2406is often more efficient to have each Windows client, regardless of 2407the number of Windows domains, point themselves to the same WINS 2408server. That way, only one authoritative WINS server will have the 2409correct information, instead of several WINS servers continually 2410struggling to synchronize themselves with the most recent changes.</p> 2411 2412<p>The currently active WINS server is known as the <em class="firstterm">primary 2413WINS server</em><a name="INDEX-177"/><a name="INDEX-178"/>. You can also install a secondary WINS 2414server, which will take over if the primary WINS server fails or 2415becomes inaccessible. Both the primary and any other WINS servers 2416will synchronize their address databases on a periodic basis.</p> 2417 2418<p>In the Windows family of operating systems, only a server edition of 2419Windows NT/2000 can act as a WINS server. Samba 2.2 can function as a 2420primary WINS server, but cannot <a name="INDEX-179"/><a name="INDEX-180"/>synchronize 2421its database with other WINS servers. It therefore cannot act as a 2422secondary WINS server or as a primary WINS server for a Windows 2423secondary WINS server.</p> 2424 2425<p>WINS handles name service by default, although Microsoft added DNS 2426starting with Windows NT 4 Server. It is compatible with DNS that is 2427standard on virtually every Unix system, and a Unix server (such as 2428the Samba host) can also be used for DNS.</p> 2429 2430 2431</div> 2432 2433 2434 2435<div class="sect3"><a name="samba2-CHP-1-SECT-5.2.5"/> 2436 2437<h3 class="head3">Trust relationships</h3> 2438 2439<p>One additional aspect of Windows NT domains not yet supported in 2440Samba 2.2 is that it is possible to set up a <em class="emphasis">trust 2441relationship</em><a name="INDEX-181"/><a name="INDEX-182"/><a name="INDEX-183"/> between domains, allowing clients 2442within one domain to access the resources within another without the 2443user having to go through additional authentication. The protocol 2444that is followed is called <em class="emphasis">pass-through authentication</em>, 2445<a name="INDEX-184"/><a name="INDEX-185"/>in which the 2446user's credentials are passed from the client system 2447in the first domain to the server in the second domain, which 2448consults a domain controller in the first (trusted) domain to check 2449that the user is valid before granting access to the resource.</p> 2450 2451<p>Note that in many aspects, the behaviors of a Windows workgroup and a 2452Windows NT domain overlap. For example, the master and backup 2453browsers in a domain are always the PDC and BDC, respectively. 2454Let's update our Windows domain diagram to include 2455both a local master and local backup browser. The result is shown in 2456<a href="ch01.html#samba2-CHP-1-FIG-13">Figure 1-13</a>.</p> 2457 2458<div class="figure"><a name="samba2-CHP-1-FIG-13"/><a name="INDEX-186"/><img src="figs/sam2_0113.gif"/></div><h4 class="head4">Figure 1-13. A Windows domain with a local master and local backup browser</h4> 2459 2460<p>The similarity between workgroups and NT domains is not accidental 2461because the concept of Windows domains did not evolve until Windows 2462NT 3.5 was introduced, and Windows domains were forced to remain 2463backward-compatible with the workgroups present in Windows for 2464Workgroups.</p> 2465 2466<p>Samba can function as a primary domain controller for Windows 246795/98/Me and Windows NT/2000/XP clients with the limitation that it 2468can act as a PDC only, and not as a BDC.</p> 2469 2470<p>Samba can also function as a <em class="firstterm">domain member 2471server</em><a name="INDEX-187"/><a name="INDEX-188"/>, meaning that it has a computer account 2472in the PDC's account database and is therefore 2473recognized as being part of the domain. A domain member server does 2474not authenticate users logging on to the domain, but still handles 2475security functions (such as file permissions) for domain users 2476accessing its resources.</p> 2477 2478 2479</div> 2480 2481 2482</div> 2483 2484 2485<div class="sect2"><a name="samba2-CHP-1-SECT-5.3"/> 2486 2487<h3 class="head2">Active Directory Domains</h3> 2488 2489<p>Starting with Windows 2000, Microsoft has introduced 2490<a name="INDEX-189"/><a name="INDEX-190"/>Active 2491Directory, the next step beyond Windows NT domains. We 2492won't go into much detail concerning Active 2493Directory because it is a huge topic. <a name="INDEX-191"/>Samba 2.2 doesn't 2494support Active Directory at all, and support in Samba 3.0 is limited 2495to acting as a client. For now, be aware that with Active Directory, 2496the authentication model is centered around 2497<a name="INDEX-192"/>Lightweight Directory 2498Access Protocol (LDAP), and name service is provided by DNS instead 2499of WINS. Domains in Active Directory can be organized in a 2500hierarchical tree structure, in which each domain controller operates 2501as a peer, with no distinction between primary and backup controllers 2502as in Windows NT domains.</p> 2503 2504<p>Windows 2000/XP systems can be set up as simple workgroup or Windows 2505NT domain clients (which will function with Samba). The server 2506editions of Windows 2000 can be set up to run Active Directory and 2507support Windows NT domains for backward compatibility 2508(<em class="firstterm">mixed mode</em>). In this case, Samba 2.2 works 2509with Windows 2000 servers in the same way it works with Windows NT 25104.0 servers. When set up to operate in <em class="firstterm">native mode, 2511</em><a name="INDEX-193"/>Windows 2000 servers support only 2512Active Directory. Even so, <a name="INDEX-194"/>Samba 2.2 can operate as a server 2513in a domain hosted by a native-mode Windows 2000 server, using the 2514<a name="INDEX-195"/>Windows 2000 server's 2515<em class="firstterm">PDC emulation mode</em>. However, it is not 2516possible for Samba 2.2 or 3.0 to operate as a domain controller in a 2517Windows 2000 Active Directory domain.</p> 2518 2519<p>If you want to know more about Active Directory, we encourage you to 2520obtain a copy of the O'Reilly book, 2521<em class="emphasis">Windows 2000 Active Directory</em>. <a name="INDEX-196"/></p> 2522 2523 2524</div> 2525 2526 2527<div class="sect2"><a name="samba2-CHP-1-SECT-5.4"/> 2528 2529<h3 class="head2">Can a Windows Workgroup Span Multiple Subnets?</h3> 2530 2531<p><a name="INDEX-197"/><a name="INDEX-198"/>Yes, but most people who have 2532done it have had their share of headaches. Spanning multiple subnets 2533was not part of the initial design of Windows NT 3.5 or Windows for 2534Workgroups. As a result, a Windows domain that spans two or more 2535subnets is, in reality, the 2536"gluing" together of two or more 2537workgroups that share an identical name. The good news is that you 2538can still use a PDC to control authentication across each subnet. The 2539bad news is that things are not as simple with browsing.</p> 2540 2541<p>As mentioned previously, each subnet must have its own local master 2542browser. When a Windows domain spans multiple subnets, a system 2543administrator will have to assign one of the computers as the 2544<em class="firstterm">domain master 2545browser</em><a name="INDEX-199"/><a name="INDEX-200"/>. The domain master browser will keep a 2546browse list for the entire Windows domain. This browse list is 2547created by periodically synchronizing the browse lists of each local 2548master browser with the browse list of the domain master browser. 2549After the synchronization, the local master browser and the domain 2550master browser should contain identical entries. See <a href="ch01.html#samba2-CHP-1-FIG-14">Figure 1-14</a> for an illustration.</p> 2551 2552<div class="figure"><a name="samba2-CHP-1-FIG-14"/><img src="figs/sam2_0114.gif"/></div><h4 class="head4">Figure 1-14. A workgroup that spans more than one subnet</h4> 2553 2554<p>Sound good? <a name="INDEX-201"/>Well, it's not quite 2555nirvana for the following reasons:</p> 2556 2557<ul><li> 2558<p>If it exists, a PDC always plays the role of the domain master 2559browser. By Microsoft design, the two always share the NetBIOS 2560resource type <tt class="literal"><1B></tt> and (unfortunately) 2561cannot be separated.</p> 2562</li><li> 2563<p>Windows 95/98/Me computers cannot become <em class="emphasis">or</em> 2564<em class="emphasis">even contact</em> a domain master browser. This means 2565that it is necessary to have at least one Windows NT/2000/XP system 2566(or Samba server) on each subnet of a multisubnet workgroup.</p> 2567</li></ul> 2568<p>Each subnet's local master browser continues to 2569maintain the browse list for its subnet, for which it becomes 2570authoritative. So if a computer wants to see a list of servers within 2571its own subnet, the local master browser of that subnet will be 2572queried. If a computer wants to see a list of servers outside the 2573subnet, it can still go only as far as the local master browser. This 2574works because at appointed intervals, the authoritative browse list 2575of a subnet's local master browser is synchronized 2576with the domain master browser, which is synchronized with the local 2577master browser of the other subnets in the domain. This is called 2578<em class="firstterm">browse list propagation</em>.</p> 2579 2580<p>Samba can act as a domain master browser in a Windows NT domain, or 2581it can act as a local master browser for a subnet, synchronizing its 2582browse list with the domain master browser.</p> 2583 2584 2585</div> 2586 2587 2588</div> 2589 2590 2591 2592<div class="sect1"><a name="samba2-CHP-1-SECT-6"/> 2593 2594<h2 class="head1">What's New in Samba 2.2?</h2> 2595 2596<p><a name="INDEX-202"/><a name="INDEX-203"/>In 2597Version 2.2, Samba has more advanced support for Windows networking, 2598including the ability to perform the more important tasks necessary 2599for acting in a Windows NT domain. In addition, Samba 2.2 has some 2600support for technologies that Microsoft introduced in Windows 2000, 2601although the Samba team has saved Active Directory support for 2602Version 3.0.</p> 2603 2604 2605<div class="sect2"><a name="samba2-CHP-1-SECT-6.1"/> 2606 2607<h3 class="head2">PDC Support for Windows 2000/XP Clients</h3> 2608 2609<p>Samba previously could act as a PDC to authenticate Windows 95/98/Me 2610and Windows NT 4 systems. This functionality has been extended in 2611Release 2.2 to include Windows 2000 and Windows XP. Thus, it is 2612possible to have a Samba server supporting domain logons for a 2613network of Windows clients, including the most recent releases from 2614Microsoft. This can result in a very stable, high-performance, and 2615more secure network, and gives you the added benefit of not having to 2616purchase per-seat Windows CALs from Microsoft.</p> 2617 2618 2619</div> 2620 2621 2622<div class="sect2"><a name="samba2-CHP-1-SECT-6.2"/> 2623 2624<h3 class="head2">Microsoft Dfs Support</h3> 2625 2626<p><a name="INDEX-204"/>Microsoft Dfs allows shared resources that 2627are dispersed among a number of servers in the network to be gathered 2628together and appear to users as if they all exist in a single 2629directory tree on one server. This method of organization makes life 2630much simpler for users. Instead of having to browse around the 2631network on a treasure hunt to locate the resource they want to use, 2632they can go directly to the Dfs server and grab what they want. Samba 26332.2 offers support for serving Dfs, so a Windows server is no longer 2634needed for this purpose.</p> 2635 2636 2637</div> 2638 2639 2640<div class="sect2"><a name="samba2-CHP-1-SECT-6.3"/> 2641 2642<h3 class="head2">Windows NT/2000/XP Printing Support</h3> 2643 2644<p>Windows NT/2000/XP has a different Remote Procedure Call (RPC)-based 2645printer interface than Windows 95/98/Me does. In Samba 2.2, the 2646Windows NT/2000/XP interface is supported. Along with this, the Samba 2647team has been adding support for automatically downloading the 2648printer driver from the Samba server while adding a new printer to a 2649Windows client.</p> 2650 2651 2652</div> 2653 2654 2655<div class="sect2"><a name="samba2-CHP-1-SECT-6.4"/> 2656 2657<h3 class="head2">ACLs</h3> 2658 2659<p>Samba now supports 2660<a name="INDEX-205"/>ACLs on its Unix host for Unix variants 2661that support them. The list includes Solaris 2.6, 7, and 8, Irix, 2662AIX, Linux (with either the ACL patch for the 2663<a name="INDEX-206"/>ext2/ext3 filesystem from <a href="http://acl.bestbits.at">http://acl.bestbits.at</a> or when using the 2664<a name="INDEX-207"/>XFS 2665filesystem), and FreeBSD (Version 5.0 and later). When using ACL 2666support, Samba translates between Unix ACLs and Windows NT/2000/XP 2667ACLs, making the Samba host look and act more like a Windows 2668NT/2000/XP server from the point of view of Windows clients.</p> 2669 2670 2671</div> 2672 2673 2674<div class="sect2"><a name="samba2-CHP-1-SECT-6.5"/> 2675 2676<h3 class="head2">Support for Windows Client Administration Tools</h3> 2677 2678<p>Windows comes with tools that can be used from a client to manage 2679shared resources remotely on a Windows server. Samba 2.2 allows these 2680tools to operate on shares on the Samba server as well.</p> 2681 2682 2683</div> 2684 2685 2686<div class="sect2"><a name="samba2-CHP-1-SECT-6.6"/> 2687 2688<h3 class="head2">Integration with Winbind</h3> 2689 2690<p><a name="INDEX-208"/>Winbind is a 2691facility that allows users whose account information is stored in a 2692Windows domain database to authenticate on a Unix system. The result 2693is a unified logon environment, in which a user account can be kept 2694on either the Unix system or a Windows NT/2000 domain controller. 2695This greatly facilitates account management because administrators no 2696longer need to keep the two systems synchronized, and it is possible 2697for users whose accounts are held in a Windows domain to authenticate 2698when accessing Samba shares.</p> 2699 2700 2701</div> 2702 2703 2704<div class="sect2"><a name="samba2-CHP-1-SECT-6.7"/> 2705 2706<h3 class="head2">Unix CIFS Extensions</h3> 2707 2708<p>The <a name="INDEX-209"/><a name="INDEX-210"/>Unix CIFS extensions were developed 2709at Hewlett-Packard and introduced in Samba 2.2.4. They allow Samba 2710servers to support Unix filesystem attributes, such as links and 2711permissions, when sharing files with other Unix systems. This allows 2712Samba to be used as an alternative to network file sharing (NFS) for 2713Unix-to-Unix file sharing. An advantage of using Samba is that it 2714authenticates individual users, whereas NFS authenticates only 2715clients (based on their IP addresses, which is a poor security 2716model). This gives Samba an edge in the area of security, along with 2717its much greater configurability. See <a href="ch05.html">Chapter 5</a> 2718for information on how to operate Unix systems as Samba clients.</p> 2719 2720 2721</div> 2722 2723 2724<div class="sect2"><a name="samba2-CHP-1-SECT-6.8"/> 2725 2726<h3 class="head2">And More...</h3> 2727 2728<p>As usual, the code has numerous improvements that do not show up at 2729the administrative level in an immediate or obvious way. Samba now 2730functions better on systems that employ <a name="INDEX-211"/>PAM 2731(Pluggable Authentication Modules), and there is new support for 2732profiling. Samba's support for oplocks has been 2733strengthened, offering better integration with NFS server-terminated 2734leases (currently on Irix and Linux only) and in the local filesystem 2735with SMB locks mapped to POSIX locks (which is dependent on each Unix 2736variant's implementation of POSIX locks). And of 2737course there have been the usual bug fixes.</p> 2738 2739 2740</div> 2741 2742 2743</div> 2744 2745 2746 2747<div class="sect1"><a name="samba2-CHP-1-SECT-7"/> 2748 2749<h2 class="head1">What's New in Samba 3.0?</h2> 2750 2751<p>The main distinguishing feature of <a name="INDEX-212"/><a name="INDEX-213"/>Samba 3.0 2752is that it includes support for <a name="INDEX-214"/>Kerberos 5 authentication and 2753<a name="INDEX-215"/>LDAP, which are 2754required to act as clients in an Active Directory domain. Another 2755feature that appeared in Samba 3.0 is support for Unicode, which 2756greatly simplifies supporting international languages.</p> 2757 2758<p>In later Version 3 releases, the Samba team plans to develop support 2759for 2760<a name="INDEX-216"/>WINS 2761replication, allowing Samba to act as a secondary WINS server or as a 2762primary WINS server with Windows or Samba secondary WINS servers. 2763Also planned are support for acting as a Windows NT BDC and support 2764for Windows NT domain trust relationships.</p> 2765 2766 2767</div> 2768 2769 2770 2771<div class="sect1"><a name="samba2-CHP-1-SECT-8"/> 2772 2773<h2 class="head1">What Can Samba Do?</h2> 2774 2775<p>Now let's wrap up by showing where Samba can help 2776out and where it is limited. <a href="ch01.html#samba2-CHP-1-TABLE-9">Table 1-9</a> summarizes 2777which roles Samba can and cannot play in a Windows NT or Active 2778Directory domain or a Windows workgroup. Many of the Windows domain 2779protocols are proprietary and have not been documented by Microsoft 2780and therefore must be reverse-engineered by the Samba team before 2781Samba can support them. As of Version 3.0, Samba cannot act as a 2782backup in most roles and does not yet fully support Active Directory.</p> 2783 2784<a name="samba2-CHP-1-TABLE-9"/><h4 class="head4">Table 1-9. Samba roles (as of Version 3.0)</h4><table border="1"> 2785 2786 2787 2788<tr> 2789<th> 2790<p>Role</p> 2791</th> 2792<th> 2793<p>Can perform?</p> 2794</th> 2795</tr> 2796 2797 2798<tr> 2799<td> 2800<p><a name="INDEX-217"/>File server</p> 2801</td> 2802<td> 2803<p>Yes</p> 2804</td> 2805</tr> 2806<tr> 2807<td> 2808<p>Printer server</p> 2809</td> 2810<td> 2811<p>Yes</p> 2812</td> 2813</tr> 2814<tr> 2815<td> 2816<p>Microsoft Dfs server</p> 2817</td> 2818<td> 2819<p>Yes</p> 2820</td> 2821</tr> 2822<tr> 2823<td> 2824<p>Primary domain controller</p> 2825</td> 2826<td> 2827<p>Yes</p> 2828</td> 2829</tr> 2830<tr> 2831<td> 2832<p>Backup domain controller</p> 2833</td> 2834<td> 2835<p>No</p> 2836</td> 2837</tr> 2838<tr> 2839<td> 2840<p>Active Directory domain controller</p> 2841</td> 2842<td> 2843<p>No</p> 2844</td> 2845</tr> 2846<tr> 2847<td> 2848<p>Windows 95/98/Me authentication</p> 2849</td> 2850<td> 2851<p>Yes</p> 2852</td> 2853</tr> 2854<tr> 2855<td> 2856<p>Windows NT/2000/XP authentication</p> 2857</td> 2858<td> 2859<p>Yes</p> 2860</td> 2861</tr> 2862<tr> 2863<td> 2864<p>Local master browser</p> 2865</td> 2866<td> 2867<p>Yes</p> 2868</td> 2869</tr> 2870<tr> 2871<td> 2872<p>Local backup browser</p> 2873</td> 2874<td> 2875<p>Yes</p> 2876</td> 2877</tr> 2878<tr> 2879<td> 2880<p>Domain master browser</p> 2881</td> 2882<td> 2883<p>Yes</p> 2884</td> 2885</tr> 2886<tr> 2887<td> 2888<p>Primary WINS server</p> 2889</td> 2890<td> 2891<p>Yes</p> 2892</td> 2893</tr> 2894<tr> 2895<td> 2896<p>Secondary WINS server</p> 2897</td> 2898<td> 2899<p>No</p> 2900</td> 2901</tr> 2902 2903</table> 2904 2905 2906</div> 2907 2908 2909 2910<div class="sect1"><a name="samba2-CHP-1-SECT-9"/> 2911 2912<h2 class="head1">An Overview of the Samba Distribution</h2> 2913 2914<p><a name="INDEX-218"/>As mentioned earlier, Samba actually 2915contains several programs that serve different but related purposes. 2916These programs are documented more fully in <a href="appc.html">Appendix C</a>. For now, we will introduce each of them 2917briefly and describe how they work together.</p> 2918 2919<p>The majority of the programs that come with Samba center on its two 2920daemons. Let's take a refined look at the 2921responsibilities of each daemon:</p> 2922 2923<dl> 2924<dt><b><em class="emphasis">nmbd</em></b></dt> 2925<dd> 2926<p>The <em class="emphasis">nmbd</em><a name="INDEX-219"/> daemon is a simple name server that 2927supplies WINS functionality. This daemon listens for name-server 2928requests and provides the appropriate IP addresses when called upon. 2929It also provides browse lists for the Network Neighborhood and 2930participates in browsing elections.</p> 2931</dd> 2932 2933 2934 2935<dt><b><em class="emphasis">smbd</em></b></dt> 2936<dd> 2937<p>The <em class="emphasis">smbd</em><a name="INDEX-220"/> daemon manages the shared resources 2938between the Samba server and its clients. It provides file, print, 2939and browse services to <span class="acronym">SMB</span> clients across one or 2940more networks and handles all notifications between the Samba server 2941and the network clients. In addition, it is responsible for user 2942authentication, resource locking, and data sharing through the 2943<span class="acronym">SMB</span> protocol.</p> 2944</dd> 2945 2946</dl> 2947 2948<p>New with Version 2.2, there is an additional daemon:</p> 2949 2950<dl> 2951<dt><b><a name="INDEX-221"/><em class="emphasis">winbindd</em></b></dt> 2952<dd> 2953<p>This daemon is used along with the name service switch to get 2954information on users and groups from a Windows NT server and allows 2955Samba to authorize users through a Windows NT/2000 server.</p> 2956</dd> 2957 2958</dl> 2959 2960<p>The Samba distribution also comes with a small set of Unix 2961command-line tools:</p> 2962 2963<dl> 2964<dt><b><em class="emphasis">findsmb</em><a name="INDEX-222"/></b></dt> 2965<dd> 2966<p>A program that searches the local network for computers that respond 2967to SMB protocol and prints information on them.</p> 2968</dd> 2969 2970 2971 2972<dt><b><em class="emphasis">make_smbcodepage</em><a name="INDEX-223"/></b></dt> 2973<dd> 2974<p>A program used when working with Samba's 2975internationalization features for telling Samba how to convert 2976between upper- and lowercase in different character sets.</p> 2977</dd> 2978 2979 2980 2981<dt><b><em class="emphasis">make_unicodemap</em><a name="INDEX-224"/></b></dt> 2982<dd> 2983<p>Another internationalization program used with Samba for compiling 2984Unicode map files that Samba uses to translate DOS codepages or Unix 2985character sets into 16-bit unicode.</p> 2986</dd> 2987 2988 2989 2990<dt><b><a name="INDEX-225"/><em class="emphasis">net</em></b></dt> 2991<dd> 2992<p>A new program distributed with Samba 3.0 that can be used to perform 2993remote administration of servers.</p> 2994</dd> 2995 2996 2997 2998<dt><b><em class="emphasis">nmblookup</em><a name="INDEX-226"/></b></dt> 2999<dd> 3000<p>A program that provides NBT name lookups to find a 3001computer's IP address when given its machine name.</p> 3002</dd> 3003 3004 3005 3006<dt><b><a name="INDEX-227"/><em class="emphasis">pdbedit</em></b></dt> 3007<dd> 3008<p>A new program distributed with Samba 3.0 that is helpful for managing 3009user accounts held in SAM databases.</p> 3010</dd> 3011 3012 3013 3014<dt><b><em class="emphasis">rpcclient</em><a name="INDEX-228"/></b></dt> 3015<dd> 3016<p>A program that can be used to run MS-RPC functions on Windows clients.</p> 3017</dd> 3018 3019 3020 3021<dt><b><em class="emphasis">smbcacls</em><a name="INDEX-229"/></b></dt> 3022<dd> 3023<p>A program that is used to set or show ACLs on Windows NT filesystems.</p> 3024</dd> 3025 3026 3027 3028<dt><b><em class="emphasis">smbclient</em><a name="INDEX-230"/></b></dt> 3029<dd> 3030<p>An <em class="emphasis">ftp</em>-like Unix client that can be used to connect to 3031SMB shares and operate on them. The <em class="emphasis">smbclient</em> 3032command is discussed in detail in <a href="ch05.html">Chapter 5</a>.</p> 3033</dd> 3034 3035 3036 3037<dt><b><em class="emphasis">smbcontrol</em><a name="INDEX-231"/></b></dt> 3038<dd> 3039<p>A simple administrative utility that sends messages to <em class="emphasis">nmbd</em> 3040or <em class="emphasis">smbd</em>.</p> 3041</dd> 3042 3043 3044 3045<dt><b><a name="INDEX-232"/><em class="emphasis">smbgroupedit</em></b></dt> 3046<dd> 3047<p>A command that can be used to define mappings between Windows NT 3048groups and Unix groups. It is new in Samba 3.0.</p> 3049</dd> 3050 3051 3052 3053<dt><b><em class="emphasis">smbmnt</em><a name="INDEX-233"/></b></dt> 3054<dd> 3055<p>A helper utility used along with <em class="emphasis">smbmount.</em></p> 3056</dd> 3057 3058 3059 3060<dt><b><em class="emphasis">smbmount</em><a name="INDEX-234"/></b></dt> 3061<dd> 3062<p>A program that mounts an smbfs filesystem, allowing remote SMB shares 3063to be mounted in the filesystem of the Samba host.</p> 3064</dd> 3065 3066 3067 3068<dt><b><em class="emphasis">smbpasswd</em><a name="INDEX-235"/></b></dt> 3069<dd> 3070<p>A program that allows an administrator to change the passwords used 3071by Samba.</p> 3072</dd> 3073 3074 3075 3076<dt><b><em class="emphasis">smbsh</em><a name="INDEX-236"/></b></dt> 3077<dd> 3078<p>A tool that functions like a command shell to allow access to a 3079remote SMB filesystem and allow Unix utilities to operate on it. This 3080command is covered in <a href="ch05.html">Chapter 5</a>.</p> 3081</dd> 3082 3083 3084 3085<dt><b><em class="emphasis">smbspool</em><a name="INDEX-237"/></b></dt> 3086<dd> 3087<p>A print-spooling program used to send files to remote printers that 3088are shared on the SMB network.</p> 3089</dd> 3090 3091 3092 3093<dt><b><em class="emphasis">smbstatus</em><a name="INDEX-238"/></b></dt> 3094<dd> 3095<p>A program that reports the current network connections to the shares 3096on a Samba server.</p> 3097</dd> 3098 3099 3100 3101<dt><b><em class="emphasis">smbtar</em><a name="INDEX-239"/></b></dt> 3102<dd> 3103<p>A program similar to the Unix <em class="filename">tar</em> command, for 3104backing up data in SMB shares.</p> 3105</dd> 3106 3107 3108 3109<dt><b><em class="emphasis">smbumount</em><a name="INDEX-240"/></b></dt> 3110<dd> 3111<p>A program that works along with <em class="emphasis">smbmount</em> to unmount 3112smbfs filesystems.</p> 3113</dd> 3114 3115 3116 3117<dt><b><em class="emphasis">testparm</em><a name="INDEX-241"/></b></dt> 3118<dd> 3119<p>A simple program for checking the Samba configuration file.</p> 3120</dd> 3121 3122 3123 3124<dt><b><em class="emphasis">testprns</em><a name="INDEX-242"/></b></dt> 3125<dd> 3126<p>A program that tests whether printers on the Samba host are 3127recognized by the <em class="filename">smbd</em> daemon.</p> 3128</dd> 3129 3130 3131 3132<dt><b><em class="emphasis">wbinfo</em><a name="INDEX-243"/></b></dt> 3133<dd> 3134<p>A utility used to query the <em class="filename">winbindd 3135</em><a name="INDEX-244"/>daemon.</p> 3136</dd> 3137 3138</dl> 3139 3140<p>Each major release of Samba goes through an exposure test before 3141it's announced. In addition, it is quickly updated 3142afterward if problems or unwanted side effects are found. The latest 3143stable distribution as of this writing is Samba 2.2.6, and this book 3144focuses mainly on the functionality supported in Samba 2.2.6, as 3145opposed to older versions of Samba.</p> 3146 3147 3148</div> 3149 3150 3151 3152<div class="sect1"><a name="samba2-CHP-1-SECT-10"/> 3153 3154<h2 class="head1">How Can I Get Samba?</h2> 3155 3156<p><a name="INDEX-245"/><a name="INDEX-246"/>Source 3157and binary distributions of Samba are available from mirror sites 3158across the Internet. The primary web site for Samba is located at 3159<a href="http://www.samba.org/">http://www.samba.org/</a>. From there, you 3160can select a mirror site that is geographically near you.</p> 3161 3162<p>Most Linux and many Unix vendors provide binary packages. These can 3163be more convenient to install and maintain than the Samba 3164team's source or binary packages, due to the 3165vendor's efforts to supply a package that matches 3166its specific products. <a name="INDEX-247"/></p> 3167 3168 3169</div> 3170 3171<hr/><h4 class="head4">Footnotes</h4><blockquote><a name="FOOTNOTE-1"/> <p><a href="#FNPTR-1">[1]</a> You 3172can also right-click the shared resource in the Network Neighborhood 3173and then select the Map Network Drive menu item.</p> <a name="FOOTNOTE-2"/> <p><a href="#FNPTR-2">[2]</a> Be 3174warned that many end-user license agreements forbid installing a 3175program on a network so that multiple clients can access it. Check 3176the legal agreements that accompany the product to be absolutely 3177sure.</p> <a name="FOOTNOTE-3"/> <p><a href="#FNPTR-3">[3]</a> You 3178might also see the abbreviation NetBT, which is common in Microsoft 3179literature.</p> <a name="FOOTNOTE-4"/> 3180<p><a href="#FNPTR-4">[4]</a> See 3181<a href="http://www.samba.org/cifs/docs/what-is-smb.html">http://www.samba.org/cifs/docs/what-is-smb.html</a> 3182for Richard's excellent summary of 3183<a name="INDEX-93"/>SMB.</p> <a name="FOOTNOTE-5"/> <p><a href="#FNPTR-5">[5]</a> This 3184was originally called <a name="INDEX-126"/><a name="INDEX-127"/><a name="INDEX-128"/>Network Neighborhood in Windows 95/98/NT, 3185but Microsoft has changed the name to My Network Places in the more 3186recent Windows Me/2000/XP. We will continue to call it Network 3187Neighborhood, and if you're using a new version of 3188Windows, be aware that My Network Places can act a little differently 3189in some ways.</p> </blockquote> 3190 3191 3192<hr/><h4 class="head4"><a href="toc.html">TOC</a></h4> 3193</body></html> 3194
