diff options
Diffstat (limited to 'docs/htmldocs/Samba3-ByExample/happy.html')
| -rw-r--r-- | docs/htmldocs/Samba3-ByExample/happy.html | 970 |
1 files changed, 485 insertions, 485 deletions
diff --git a/docs/htmldocs/Samba3-ByExample/happy.html b/docs/htmldocs/Samba3-ByExample/happy.html index 1105d80890..41cd3b5a67 100644 --- a/docs/htmldocs/Samba3-ByExample/happy.html +++ b/docs/htmldocs/Samba3-ByExample/happy.html @@ -1,12 +1,12 @@ -<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Making Happy Users</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="Big500users.html" title="Chapter 4. The 500-User Office"><link rel="next" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Making Happy Users</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Big500users.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="2000users.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 5. Making Happy Users"><div class="titlepage"><div><div><h2 class="title"><a name="happy"></a>Chapter 5. Making Happy Users</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="happy.html#id2577106">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2577248">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2577346">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2577483">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2577941">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2579819">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2579834">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2580015">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582912">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2586862">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2586882">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2586977">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2587221">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2587332">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2587466">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2588220">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2588536">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2588716">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2589218">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2589254">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2589288">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2589403">Questions and Answers</a></span></dt></dl></div><p> - It is said that <span class="quote">“<span class="quote">a day that is without troubles is not fulfilling. Rather, give - me a day of troubles well handled so that I can be content with my achievements.</span>”</span> +<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Making Happy Users</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="Big500users.html" title="Chapter 4. The 500-User Office"><link rel="next" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Making Happy Users</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Big500users.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="2000users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="happy"></a>Chapter 5. Making Happy Users</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="happy.html#id2571021">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2571163">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2571261">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2571398">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2571856">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2573734">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2573749">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2573929">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576827">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2580776">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2580797">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2580892">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2581136">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2581247">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2581381">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582135">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582451">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582630">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2583133">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2583169">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2583203">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2583318">Questions and Answers</a></span></dt></dl></div><p> + It is said that “<span class="quote">a day that is without troubles is not fulfilling. Rather, give + me a day of troubles well handled so that I can be content with my achievements.</span>” </p><p> In the world of computer networks, problems are as varied as the people who create them or experience them. The design of the network implemented in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a> may create problems for some network users. The following lists some of the problems that may occur: - </p><a class="indexterm" name="id2576684"></a><a class="indexterm" name="id2576691"></a><a class="indexterm" name="id2576700"></a><a class="indexterm" name="id2576707"></a><a class="indexterm" name="id2576714"></a><div class="caution" title="Caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p> + </p><a class="indexterm" name="id2570599"></a><a class="indexterm" name="id2570606"></a><a class="indexterm" name="id2570615"></a><a class="indexterm" name="id2570621"></a><a class="indexterm" name="id2570628"></a><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p> A significant number of network administrators have responded to the guidance given here. It should be noted that there are sites that have a single PDC for many hundreds of concurrent network clients. Network bandwidth, network bandwidth utilization, and server load @@ -19,8 +19,8 @@ be found (when you know it exists), that may be an indication that the domain co overloaded or network bandwidth is overloaded. The guidance given for PDC/BDC ratio to Windows clients is conservative and if followed will minimize problems but it is not absolute. </p></div><div class="variablelist"><dl><dt><span class="term">Users experiencing difficulty logging onto the network</span></dt><dd><p> - <a class="indexterm" name="id2576759"></a> - <a class="indexterm" name="id2576768"></a> + <a class="indexterm" name="id2570674"></a> + <a class="indexterm" name="id2570683"></a> When a Windows client logs onto the network, many data packets are exchanged between the client and the server that is providing the network logon services. Each request between the client and the server must complete within a specific @@ -30,9 +30,9 @@ clients is conservative and if followed will minimize problems but it is not ab 30 to 150 clients. The actual limits are determined by network operational characteristics. </p><p> - <a class="indexterm" name="id2576788"></a> - <a class="indexterm" name="id2576795"></a> - <a class="indexterm" name="id2576801"></a> + <a class="indexterm" name="id2570703"></a> + <a class="indexterm" name="id2570709"></a> + <a class="indexterm" name="id2570716"></a> If the domain controller provides only network logon services and all file and print activity is handled by domain member servers, one domain controller per 150 clients on a single network segment may suffice. In any @@ -46,42 +46,42 @@ clients is conservative and if followed will minimize problems but it is not ab that can be supported is limited by the CPU speed, memory and the workload on the Samba server as well as network bandwidth utilization. </p></dd><dt><span class="term">Slow logons and log-offs</span></dt><dd><p> - <a class="indexterm" name="id2576835"></a> + <a class="indexterm" name="id2570750"></a> Slow logons and log-offs may be caused by many factors that include: - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> - <a class="indexterm" name="id2576848"></a> - <a class="indexterm" name="id2576860"></a> + </p><div class="itemizedlist"><ul type="disc"><li><p> + <a class="indexterm" name="id2570763"></a> + <a class="indexterm" name="id2570775"></a> Excessive delays in the resolution of a NetBIOS name to its IP address. This may be observed when an overloaded domain controller is also the WINS server. Another cause may be the failure to use a WINS server (this assumes that there is a single network segment). - </p></li><li class="listitem"><p> - <a class="indexterm" name="id2576879"></a> - <a class="indexterm" name="id2576886"></a> - <a class="indexterm" name="id2576892"></a> + </p></li><li><p> + <a class="indexterm" name="id2570793"></a> + <a class="indexterm" name="id2570800"></a> + <a class="indexterm" name="id2570807"></a> Network traffic collisions due to overloading of the network segment. One short-term workaround to this may be to replace network HUBs with Ethernet switches. - </p></li><li class="listitem"><p> - <a class="indexterm" name="id2576907"></a> + </p></li><li><p> + <a class="indexterm" name="id2570822"></a> Defective networking hardware. Over the past few years, we have seen on the Samba mailing list a significant increase in the number of problems that were traced to a defective network interface controller, a defective HUB or Ethernet switch, or defective cabling. In most cases, it was the erratic nature of the problem that ultimately pointed to the cause of the problem. - </p></li><li class="listitem"><p> - <a class="indexterm" name="id2576927"></a> - <a class="indexterm" name="id2576936"></a> + </p></li><li><p> + <a class="indexterm" name="id2570842"></a> + <a class="indexterm" name="id2570851"></a> Excessively large roaming profiles. This type of problem is typically the result of poor user education as well as poor network management. It can be avoided by users not storing huge quantities of email in MS Outlook PST files as well as by not storing files on the desktop. These are old bad habits that require much discipline and vigilance on the part of network management. - </p></li><li class="listitem"><p> - <a class="indexterm" name="id2576957"></a> + </p></li><li><p> + <a class="indexterm" name="id2570872"></a> You should verify that the Windows XP WebClient service is not running. The use of the WebClient service has been implicated in many Windows networking-related problems. @@ -89,27 +89,27 @@ clients is conservative and if followed will minimize problems but it is not ab </p></dd><dt><span class="term">Loss of access to network drives and printer resources</span></dt><dd><p> Loss of access to network resources during client operation may be caused by a number of factors, including: - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> - <a class="indexterm" name="id2576989"></a> + </p><div class="itemizedlist"><ul type="disc"><li><p> + <a class="indexterm" name="id2570904"></a> Network overload (typically indicated by a high network collision rate) - </p></li><li class="listitem"><p> + </p></li><li><p> Server overload - </p></li><li class="listitem"><p> - <a class="indexterm" name="id2577009"></a> + </p></li><li><p> + <a class="indexterm" name="id2570924"></a> Timeout causing the client to close a connection that is in use but has been latent (no traffic) for some time (5 minutes or more) - </p></li><li class="listitem"><p> - <a class="indexterm" name="id2577025"></a> + </p></li><li><p> + <a class="indexterm" name="id2570940"></a> Defective networking hardware </p></li></ul></div><p> - <a class="indexterm" name="id2577039"></a> + <a class="indexterm" name="id2570954"></a> No matter what the cause, a sudden loss of access to network resources can result in BSOD (blue screen of death) situations that necessitate rebooting of the client workstation. In the case of a mild problem, retrying to access the network drive of the printer may restore operations, but in any case this is a serious problem that may lead to the next problem, data corruption. </p></dd><dt><span class="term">Potential data corruption</span></dt><dd><p> - <a class="indexterm" name="id2577073"></a> + <a class="indexterm" name="id2570988"></a> Data corruption is one of the most serious problems. It leads to uncertainty, anger, and frustration, and generally precipitates immediate corrective demands. Management response to this type of problem may be rational, as well as highly irrational. There have been @@ -123,48 +123,48 @@ clients is conservative and if followed will minimize problems but it is not ab anticipate and combat network performance issues. You can work through complex and thorny methods to improve the reliability of your network environment, but be warned that all such steps demand the price of complexity. - </p><div class="sect1" title="Regarding LDAP Directories and Windows Computer Accounts"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2577106"></a>Regarding LDAP Directories and Windows Computer Accounts</h2></div></div></div><p> - <a class="indexterm" name="id2577115"></a> + </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2571021"></a>Regarding LDAP Directories and Windows Computer Accounts</h2></div></div></div><p> + <a class="indexterm" name="id2571029"></a> Computer (machine) accounts can be placed wherever you like in an LDAP directory subject to some constraints that are described in this section. </p><p> - <a class="indexterm" name="id2577130"></a> - <a class="indexterm" name="id2577136"></a> - <a class="indexterm" name="id2577143"></a> - <a class="indexterm" name="id2577150"></a> + <a class="indexterm" name="id2571044"></a> + <a class="indexterm" name="id2571051"></a> + <a class="indexterm" name="id2571058"></a> + <a class="indexterm" name="id2571065"></a> The POSIX and SambaSAMAccount components of computer (machine) accounts are both used by Samba. That is, machine accounts are treated inside Samba in the same way that Windows NT4/200X treats them. A user account and a machine account are indistinguishable from each other, except that the machine account ends in a $ character, as do trust accounts. </p><p> - <a class="indexterm" name="id2577167"></a> - <a class="indexterm" name="id2577173"></a> + <a class="indexterm" name="id2571081"></a> + <a class="indexterm" name="id2571088"></a> The need for Windows user, group, machine, trust, and other such accounts to be tied to a valid UNIX UID is a design decision that was made a long way back in the history of Samba development. It is unlikely that this decision will be reversed or changed during the remaining life of the Samba-3.x series. </p><p> - <a class="indexterm" name="id2577188"></a> - <a class="indexterm" name="id2577195"></a> + <a class="indexterm" name="id2571103"></a> + <a class="indexterm" name="id2571110"></a> The resolution of a UID from the Windows SID is achieved within Samba through a mechanism that must refer back to the host operating system on which Samba is running. The name service switch (NSS) is the preferred mechanism that shields applications (like Samba) from the need to know everything about every host OS it runs on. </p><p> - Samba asks the host OS to provide a UID via the <span class="quote">“<span class="quote">passwd</span>”</span>, <span class="quote">“<span class="quote">shadow</span>”</span> - and <span class="quote">“<span class="quote">group</span>”</span> facilities in the NSS control (configuration) file. The best tool + Samba asks the host OS to provide a UID via the “<span class="quote">passwd</span>”, “<span class="quote">shadow</span>” + and “<span class="quote">group</span>” facilities in the NSS control (configuration) file. The best tool for achieving this is left up to the UNIX administrator to determine. It is not imposed by Samba. Samba provides winbindd together with its support libraries as one method. It is possible to do this via LDAP, and for that Samba provides the appropriate hooks so that all account entities can be located in an LDAP directory. </p><p> - <a class="indexterm" name="id2577232"></a> + <a class="indexterm" name="id2571147"></a> For many the weapon of choice is to use the PADL nss_ldap utility. This utility must be configured so that computer accounts can be resolved to a POSIX/UNIX account UID. That is fundamentally an LDAP design question. The information provided on the Samba list and in the documentation is directed at providing working examples only. The design of an LDAP directory is a complex subject that is beyond the scope of this documentation. - </p></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2577248"></a>Introduction</h2></div></div></div><p> + </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2571163"></a>Introduction</h2></div></div></div><p> You just opened an email from Christine that reads: </p><p> Good morning, @@ -193,8 +193,8 @@ clients is conservative and if followed will minimize problems but it is not ab regain control of our vital IT operations. </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Christine</span></td></tr></table></div><p> </p><p> - <a class="indexterm" name="id2577310"></a> - <a class="indexterm" name="id2577318"></a> + <a class="indexterm" name="id2571225"></a> + <a class="indexterm" name="id2571232"></a> Every compromise has consequences. Having a large routed (i.e., multisegment) network with only a single domain controller is a poor design that has obvious operational effects that may frustrate users. Here is your reply: @@ -204,56 +204,56 @@ clients is conservative and if followed will minimize problems but it is not ab boost staff morale. Please go ahead with your plans. If you have any problems, please let me know. Please let Stan know what the estimated cost will be so I can approve the expense. Do not wait for approval; I appreciate the urgency. - </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Bob</span></td></tr></table></div><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id2577346"></a>Assignment Tasks</h3></div></div></div><p> + </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Bob</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2571261"></a>Assignment Tasks</h3></div></div></div><p> The priority of assigned tasks in this chapter is: - </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p> - <a class="indexterm" name="id2577366"></a> - <a class="indexterm" name="id2577375"></a> - <a class="indexterm" name="id2577382"></a> - <a class="indexterm" name="id2577389"></a><a class="indexterm" name="id2577394"></a> + </p><div class="orderedlist"><ol type="1"><li><p> + <a class="indexterm" name="id2571281"></a> + <a class="indexterm" name="id2571290"></a> + <a class="indexterm" name="id2571297"></a> + <a class="indexterm" name="id2571304"></a><a class="indexterm" name="id2571309"></a> Implement Backup Domain Controllers (BDCs) in each building. This involves a change from a <span class="emphasis"><em>tdbsam</em></span> backend that was used in the previous chapter to an LDAP-based backend. </p><p> You can implement a single central LDAP server for this purpose. - </p></li><li class="listitem"><p> - <a class="indexterm" name="id2577417"></a> - <a class="indexterm" name="id2577424"></a> - <a class="indexterm" name="id2577430"></a> - <a class="indexterm" name="id2577437"></a> + </p></li><li><p> + <a class="indexterm" name="id2571332"></a> + <a class="indexterm" name="id2571338"></a> + <a class="indexterm" name="id2571345"></a> + <a class="indexterm" name="id2571352"></a> Rectify the problem of excessive logon times. This involves redirection of folders to network shares as well as modification of all user desktops to exclude the redirected folders from being loaded at login time. You can also create a new default profile that can be used for all new users. </p></li></ol></div><p> - <a class="indexterm" name="id2577456"></a> + <a class="indexterm" name="id2571371"></a> You configure a new MS Windows XP Professional workstation disk image that you roll out to all desktop users. The instructions you have created are followed on a staging machine from which all changes can be carefully tested before inflicting them on your network users. </p><p> - <a class="indexterm" name="id2577471"></a> + <a class="indexterm" name="id2571386"></a> This is the last network example in which specific mention of printing is made. The example again makes use of the CUPS printing system. - </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2577483"></a>Dissection and Discussion</h2></div></div></div><p> - <a class="indexterm" name="id2577491"></a> - <a class="indexterm" name="id2577498"></a> - <a class="indexterm" name="id2577505"></a> + </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2571398"></a>Dissection and Discussion</h2></div></div></div><p> + <a class="indexterm" name="id2571406"></a> + <a class="indexterm" name="id2571413"></a> + <a class="indexterm" name="id2571420"></a> The implementation of Samba BDCs necessitates the installation and configuration of LDAP. For this site, you use OpenLDAP, the open source software LDAP server platform. Commercial LDAP servers in current use with Samba-3 include: - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> - <a class="indexterm" name="id2577522"></a> + </p><div class="itemizedlist"><ul type="disc"><li><p> + <a class="indexterm" name="id2571437"></a> Novell <a class="ulink" href="http://www.novell.com/products/edirectory/" target="_top">eDirectory</a> is being successfully used by some sites. Information on how to use eDirectory can be obtained from the Samba mailing lists or from Novell. - </p></li><li class="listitem"><p> - <a class="indexterm" name="id2577542"></a> + </p></li><li><p> + <a class="indexterm" name="id2571457"></a> IBM <a class="ulink" href="http://www-306.ibm.com/software/tivoli/products/directory-server/" target="_top">Tivoli Directory Server</a> can be used to provide the Samba LDAP backend. Example schema files are provided in the Samba source code tarball under the directory <code class="filename">~samba/example/LDAP.</code> - </p></li><li class="listitem"><p> - <a class="indexterm" name="id2577570"></a> + </p></li><li><p> + <a class="indexterm" name="id2571484"></a> Sun <a class="ulink" href="http://www.sun.com/software/software/products/identity_srvr/home_identity.xml" target="_top">ONE Identity Server product suite</a> provides an LDAP server that can be used for Samba. Example schema files are provided in the Samba source code tarball under the directory @@ -264,19 +264,19 @@ clients is conservative and if followed will minimize problems but it is not ab initialize the LDAP directory database. OpenLDAP itself has only command-line tools to help you to get OpenLDAP and Samba-3 running as required, albeit with some learning curve challenges. </p><p> - <a class="indexterm" name="id2577607"></a> + <a class="indexterm" name="id2571522"></a> For most sites, the deployment of Microsoft Active Directory from the shrink-wrapped installation is quite adequate. If you are migrating from Microsoft Active Directory, be warned that OpenLDAP does not include GUI-based directory management tools. Even a simple task such as adding users to the OpenLDAP database requires an understanding of what you are doing, why you are doing it, and the tools that you must use. </p><p> - <a class="indexterm" name="id2577624"></a> - <a class="indexterm" name="id2577631"></a> - <a class="indexterm" name="id2577638"></a> - <a class="indexterm" name="id2577647"></a> - <a class="indexterm" name="id2577657"></a> - <a class="indexterm" name="id2577663"></a> - <a class="indexterm" name="id2577673"></a> + <a class="indexterm" name="id2571539"></a> + <a class="indexterm" name="id2571546"></a> + <a class="indexterm" name="id2571553"></a> + <a class="indexterm" name="id2571562"></a> + <a class="indexterm" name="id2571571"></a> + <a class="indexterm" name="id2571578"></a> + <a class="indexterm" name="id2571587"></a> When installed and configured, an OpenLDAP Identity Management backend for Samba functions well. High availability operation may be obtained through directory replication/synchronization and master/slave server configurations. OpenLDAP is a mature platform to host the organizational @@ -286,10 +286,10 @@ clients is conservative and if followed will minimize problems but it is not ab contents with greater ability to back up, restore, and modify the directory than is generally possible with Microsoft Active Directory. </p><p> - <a class="indexterm" name="id2577698"></a> - <a class="indexterm" name="id2577707"></a> - <a class="indexterm" name="id2577714"></a> - <a class="indexterm" name="id2577721"></a> + <a class="indexterm" name="id2571612"></a> + <a class="indexterm" name="id2571622"></a> + <a class="indexterm" name="id2571629"></a> + <a class="indexterm" name="id2571636"></a> A comparison of OpenLDAP with Microsoft Active Directory does not do justice to either. OpenLDAP is an LDAP directory tool-set. Microsoft Active Directory Server is an implementation of an LDAP server that is largely preconfigured for a specific task orientation. It comes with a set of administrative tools that is entirely customized @@ -300,8 +300,8 @@ clients is conservative and if followed will minimize problems but it is not ab MS ADAM</a> that provides more generic LDAP services, yet it does not have the vanilla-like services of OpenLDAP. </p><p> - <a class="indexterm" name="id2577751"></a> - <a class="indexterm" name="id2577760"></a> + <a class="indexterm" name="id2571666"></a> + <a class="indexterm" name="id2571675"></a> You may wish to consider outsourcing the development of your OpenLDAP directory to an expert, particularly if you find the challenge of learning about LDAP directories, schemas, configuration, and management tools and the creation of shell and Perl scripts a bit @@ -309,7 +309,7 @@ clients is conservative and if followed will minimize problems but it is not ab many ready-to-use schemas. Samba-3 provides an OpenLDAP schema file that is required for use as a passdb backend. </p><p> - <a class="indexterm" name="id2577778"></a> + <a class="indexterm" name="id2571693"></a> For those who are willing to brave the process of installing and configuring LDAP and Samba-3 interoperability, there are a few nice Web-based tools that may help you to manage your users and groups more effectively. The Web-based tools you might like to consider include the @@ -323,7 +323,7 @@ clients is conservative and if followed will minimize problems but it is not ab LDAP <a class="ulink" href="http://www.iit.edu/~gawojar/ldap/" target="_top">Browser/Editor</a> <a class="ulink" href="http://www.jxplorer.org/" target="_top">; JXplorer</a> (by Computer Associates); and <a class="ulink" href="http://phpldapadmin.sourceforge.net/" target="_top">phpLDAPadmin</a>. - </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> + </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> The following prescriptive guidance is not an LDAP tutorial. The LDAP implementation expressly uses minimal security controls. No form of secure LDAP communications is attempted. The LDAP configuration information provided is considered to consist of the barest essentials only. You are strongly encouraged to learn more about @@ -334,10 +334,10 @@ clients is conservative and if followed will minimize problems but it is not ab <a class="ulink" href="http://www.oreilly.com/catalog/ldapsa/index.html" target="_top"><span class="emphasis"><em>LDAP System Administration</em></span>,</a> by Jerry Carter quite useful. </p><p> - <a class="indexterm" name="id2577876"></a> - <a class="indexterm" name="id2577882"></a> - <a class="indexterm" name="id2577892"></a> - <a class="indexterm" name="id2577898"></a> + <a class="indexterm" name="id2571791"></a> + <a class="indexterm" name="id2571797"></a> + <a class="indexterm" name="id2571806"></a> + <a class="indexterm" name="id2571813"></a> Mary's problems are due to two factors. First, the absence of a domain controller on the local network is the main cause of the errors that result in blue screen crashes. Second, Mary has a large profile that must be loaded over the WAN connection. The addition of BDCs on each network segment significantly @@ -345,31 +345,31 @@ clients is conservative and if followed will minimize problems but it is not ab user desktops, and this must be done in a way that wins their support and does not cause further loss of staff morale. The following procedures solve this problem. </p><p> - <a class="indexterm" name="id2577921"></a> + <a class="indexterm" name="id2571836"></a> There is also an opportunity to implement smart printing features. You add this to the Samba configuration so that future printer changes can be managed without need to change desktop configurations. </p><p> You add the ability to automatically download new printer drivers, even if they are not installed in the default desktop profile. Only one example of printing configuration is given. It is assumed that you can extrapolate the principles and use them to install all printers that may be needed. - </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id2577941"></a>Technical Issues</h3></div></div></div><p> - <a class="indexterm" name="id2577949"></a> - <a class="indexterm" name="id2577958"></a> - <a class="indexterm" name="id2577967"></a> + </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2571856"></a>Technical Issues</h3></div></div></div><p> + <a class="indexterm" name="id2571863"></a> + <a class="indexterm" name="id2571873"></a> + <a class="indexterm" name="id2571882"></a> The solution provided is a minimal approach to getting OpenLDAP running as an identity management directory server for UNIX system accounts as well as for Samba. From the OpenLDAP perspective, UNIX system accounts are stored POSIX schema extensions. Samba provides its own schema to permit storage of account attributes Samba needs. Samba-3 can use the LDAP backend to store: - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Windows Networking User Accounts</p></li><li class="listitem"><p>Windows NT Group Accounts</p></li><li class="listitem"><p>Mapping Information between UNIX Groups and Windows NT Groups</p></li><li class="listitem"><p>ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)</p></li></ul></div><p> - <a class="indexterm" name="id2578008"></a> - <a class="indexterm" name="id2578015"></a> - <a class="indexterm" name="id2578022"></a> - <a class="indexterm" name="id2578028"></a> - <a class="indexterm" name="id2578035"></a> - <a class="indexterm" name="id2578042"></a> - <a class="indexterm" name="id2578051"></a> - <a class="indexterm" name="id2578058"></a> - <a class="indexterm" name="id2578064"></a> + </p><div class="itemizedlist"><ul type="disc"><li><p>Windows Networking User Accounts</p></li><li><p>Windows NT Group Accounts</p></li><li><p>Mapping Information between UNIX Groups and Windows NT Groups</p></li><li><p>ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)</p></li></ul></div><p> + <a class="indexterm" name="id2571922"></a> + <a class="indexterm" name="id2571929"></a> + <a class="indexterm" name="id2571936"></a> + <a class="indexterm" name="id2571943"></a> + <a class="indexterm" name="id2571950"></a> + <a class="indexterm" name="id2571957"></a> + <a class="indexterm" name="id2571966"></a> + <a class="indexterm" name="id2571972"></a> + <a class="indexterm" name="id2571979"></a> The use of LDAP with Samba-3 makes it necessary to store UNIX accounts as well as Windows Networking accounts in the LDAP backend. This implies the need to use the <a class="ulink" href="http://www.padl.com/Contents/OpenSourceSoftware.html" target="_top">PADL LDAP tools</a>. The resolution @@ -378,16 +378,16 @@ clients is conservative and if followed will minimize problems but it is not ab that integrates with the NSS. The same requirements exist for resolution of the UNIX username to the UID. The relationships are demonstrated in <a class="link" href="happy.html#sbehap-LDAPdiag" title="Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts">“The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts”</a>. </p><div class="figure"><a name="sbehap-LDAPdiag"></a><p class="title"><b>Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UNIX-Samba-and-LDAP.png" width="270" alt="The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts"></div></div></div><br class="figure-break"><p> - <a class="indexterm" name="id2578150"></a> - <a class="indexterm" name="id2578157"></a> + <a class="indexterm" name="id2572065"></a> + <a class="indexterm" name="id2572072"></a> You configure OpenLDAP so that it is operational. Before deploying the OpenLDAP, you really ought to learn how to configure secure communications over LDAP so that site security is not at risk. This is not covered in the following guidance. </p><p> - <a class="indexterm" name="id2578173"></a> - <a class="indexterm" name="id2578180"></a> - <a class="indexterm" name="id2578189"></a> - <a class="indexterm" name="id2578196"></a> + <a class="indexterm" name="id2572088"></a> + <a class="indexterm" name="id2572095"></a> + <a class="indexterm" name="id2572104"></a> + <a class="indexterm" name="id2572111"></a> When OpenLDAP has been made operative, you configure the PDC called <code class="constant">MASSIVE</code>. You initialize the Samba <code class="filename">secrets.tdb<sub></sub></code> file. Then you create the LDAP Interchange Format (LDIF) file from which the LDAP database can be initialized. @@ -395,27 +395,27 @@ clients is conservative and if followed will minimize problems but it is not ab You can also find on the enclosed CD-ROM, in the <code class="filename">Chap06</code> directory, a few tools that help to manage user and group configuration. </p><p> - <a class="indexterm" name="id2578230"></a> - <a class="indexterm" name="id2578237"></a> - <a class="indexterm" name="id2578244"></a> + <a class="indexterm" name="id2572145"></a> + <a class="indexterm" name="id2572152"></a> + <a class="indexterm" name="id2572158"></a> In order to effect folder redirection and to add robustness to the implementation, create a network default profile. All network users workstations are configured to use the new profile. Roaming profiles will automatically be deleted from the workstation when the user logs off. </p><p> - <a class="indexterm" name="id2578263"></a> + <a class="indexterm" name="id2572178"></a> The profile is configured so that users cannot change the appearance of their desktop. This is known as a mandatory profile. You make certain that users are able to use their computers efficiently. </p><p> - <a class="indexterm" name="id2578277"></a> + <a class="indexterm" name="id2572192"></a> A network logon script is used to deliver flexible but consistent network drive connections. - </p><div class="sect3" title="Addition of Machines to the Domain"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-ppc"></a>Addition of Machines to the Domain</h4></div></div></div><p> - <a class="indexterm" name="id2578299"></a> - <a class="indexterm" name="id2578304"></a> - <a class="indexterm" name="id2578309"></a> - <a class="indexterm" name="id2578315"></a> + </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-ppc"></a>Addition of Machines to the Domain</h4></div></div></div><p> + <a class="indexterm" name="id2572213"></a> + <a class="indexterm" name="id2572219"></a> + <a class="indexterm" name="id2572224"></a> + <a class="indexterm" name="id2572230"></a> Samba versions prior to 3.0.11 necessitated the use of a domain administrator account that maps to the UNIX UID=0. The UNIX operating system permits only the <code class="constant">root</code> user to add user and group accounts. Samba 3.0.11 introduced a new facility known as @@ -425,13 +425,13 @@ clients is conservative and if followed will minimize problems but it is not ab In this network example use is made of one of the supported privileges purely to demonstrate how any user can now be given the ability to add machines to the domain using a normal user account that has been given the appropriate privileges. - </p></div><div class="sect3" title="Roaming Profile Background"><div class="titlepage"><div><div><h4 class="title"><a name="id2578452"></a>Roaming Profile Background</h4></div></div></div><p> + </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2572367"></a>Roaming Profile Background</h4></div></div></div><p> As XP roaming profiles grow, so does the amount of time it takes to log in and out. </p><p> - <a class="indexterm" name="id2578465"></a> - <a class="indexterm" name="id2578472"></a> - <a class="indexterm" name="id2578479"></a> - <a class="indexterm" name="id2578486"></a> + <a class="indexterm" name="id2572380"></a> + <a class="indexterm" name="id2572387"></a> + <a class="indexterm" name="id2572394"></a> + <a class="indexterm" name="id2572401"></a> An XP roaming profile consists of the <code class="constant">HKEY_CURRENT_USER</code> hive file <code class="filename">NTUSER.DAT</code> and a number of folders (My Documents, Application Data, Desktop, Start Menu, Templates, NetHood, Favorites, and so on). When a user logs onto the @@ -453,20 +453,20 @@ clients is conservative and if followed will minimize problems but it is not ab user to not place large files on the desktop and to use his or her mapped home directory instead of the <code class="filename">My Documents</code> folder for saving documents. </p><p> - <a class="indexterm" name="id2578565"></a> + <a class="indexterm" name="id2572480"></a> Using a folder other than <code class="filename">My Documents</code> is a nuisance for some users, since many applications use it by default. </p><p> - <a class="indexterm" name="id2578583"></a> - <a class="indexterm" name="id2578590"></a> - <a class="indexterm" name="id2578597"></a> + <a class="indexterm" name="id2572498"></a> + <a class="indexterm" name="id2572505"></a> + <a class="indexterm" name="id2572512"></a> The secret to rapid loading of roaming profiles is to prevent unnecessary data from being copied back and forth, without losing any functionality. This is not difficult; it can be done by making changes to the Local Group Policy on each client as well as changing some paths in each user's <code class="filename">NTUSER.DAT</code> hive. </p><p> - <a class="indexterm" name="id2578618"></a> - <a class="indexterm" name="id2578625"></a> + <a class="indexterm" name="id2572533"></a> + <a class="indexterm" name="id2572540"></a> Every user profile has its own <code class="filename">NTUSER.DAT</code> file. This means you need to edit every user's profile, unless a better method can be followed. Fortunately, with the right preparations, this is not difficult. @@ -474,11 +474,11 @@ clients is conservative and if followed will minimize problems but it is not ab user's profile. Then just create a Network Default Profile. Of course, it is necessary to copy all files from redirected folders to the network share to which they are redirected. - </p></div><div class="sect3" title="The Local Group Policy"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-locgrppol"></a>The Local Group Policy</h4></div></div></div><p> - <a class="indexterm" name="id2578665"></a> - <a class="indexterm" name="id2578672"></a> - <a class="indexterm" name="id2578679"></a> - <a class="indexterm" name="id2578686"></a> + </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-locgrppol"></a>The Local Group Policy</h4></div></div></div><p> + <a class="indexterm" name="id2572580"></a> + <a class="indexterm" name="id2572587"></a> + <a class="indexterm" name="id2572594"></a> + <a class="indexterm" name="id2572600"></a> Without an Active Directory PDC, you cannot take full advantage of Group Policy Objects. However, you can still make changes to the Local Group Policy by using the Group Policy editor (<code class="literal">gpedit.msc</code>). @@ -487,31 +487,31 @@ clients is conservative and if followed will minimize problems but it is not ab be found under <span class="guimenu">User Configuration</span> → <span class="guimenuitem">Administrative Templates</span> → <span class="guimenuitem">System</span> → <span class="guimenuitem">User Profiles</span>. By default this setting contains - <span class="quote">“<span class="quote">Local Settings; Temporary Internet Files; History; Temp</span>”</span>. + “<span class="quote">Local Settings; Temporary Internet Files; History; Temp</span>”. </p><p> Simply add the folders you do not wish to be copied back and forth to this semicolon-separated list. Note that this change must be made on all clients that are using roaming profiles. - </p></div><div class="sect3" title="Profile Changes"><div class="titlepage"><div><div><h4 class="title"><a name="id2578753"></a>Profile Changes</h4></div></div></div><p> - <a class="indexterm" name="id2578761"></a> - <a class="indexterm" name="id2578768"></a> + </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2572668"></a>Profile Changes</h4></div></div></div><p> + <a class="indexterm" name="id2572676"></a> + <a class="indexterm" name="id2572682"></a> There are two changes that should be done to each user's profile. Move each of the directories that you have excluded from being copied back and forth out of the usual profile path. Modify each user's <code class="filename">NTUSER.DAT</code> file to point to the new paths that are shared over the network instead of to the default path (<code class="filename">C:\Documents and Settings\%USERNAME%</code>). </p><p> - <a class="indexterm" name="id2578795"></a> - <a class="indexterm" name="id2578802"></a> + <a class="indexterm" name="id2572710"></a> + <a class="indexterm" name="id2572717"></a> The above modifies existing user profiles. So that newly created profiles have these settings, you need to modify the <code class="filename">NTUSER.DAT</code> in the <code class="filename">C:\Documents and Settings\Default User</code> folder on each client machine, changing the same registry keys. You could do this by copying <code class="filename">NTUSER.DAT</code> to a Linux box and using <code class="literal">regedt32</code>. The basic method is described under <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a>. - </p></div><div class="sect3" title="Using a Network Default User Profile"><div class="titlepage"><div><div><h4 class="title"><a name="id2578847"></a>Using a Network Default User Profile</h4></div></div></div><p> - <a class="indexterm" name="id2578855"></a> - <a class="indexterm" name="id2578862"></a> + </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2572762"></a>Using a Network Default User Profile</h4></div></div></div><p> + <a class="indexterm" name="id2572770"></a> + <a class="indexterm" name="id2572777"></a> If you are using Samba as your PDC, you should create a file share called <code class="constant">NETLOGON</code> and within that create a directory called <code class="filename">Default User</code>, which is a copy of the desired default user @@ -520,20 +520,20 @@ clients is conservative and if followed will minimize problems but it is not ab the first login from a new account pulls its configuration from it. See also <a class="ulink" href="http://isg.ee.ethz.ch/tools/realmen/det/skel.en.html" target="_top"> the Real Men Don't Click</a> Web site. - </p></div><div class="sect3" title="Installation of Printer Driver Auto-Download"><div class="titlepage"><div><div><h4 class="title"><a name="id2578906"></a>Installation of Printer Driver Auto-Download</h4></div></div></div><p> - <a class="indexterm" name="id2578914"></a> - <a class="indexterm" name="id2578923"></a> - <a class="indexterm" name="id2578930"></a> + </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2572820"></a>Installation of Printer Driver Auto-Download</h4></div></div></div><p> + <a class="indexterm" name="id2572829"></a> + <a class="indexterm" name="id2572838"></a> + <a class="indexterm" name="id2572845"></a> The subject of printing is quite topical. Printing problems run second place to name resolution issues today. So far in this book, you have experienced only what is generally - known as <span class="quote">“<span class="quote">dumb</span>”</span> printing. Dumb printing is the arrangement by which all drivers + known as “<span class="quote">dumb</span>” printing. Dumb printing is the arrangement by which all drivers are manually installed on each client and the printing subsystems perform no filtering or intelligent processing. Dumb printing is easily understood. It usually works without many problems, but it has its limitations also. Dumb printing is better known as <code class="literal">Raw-Print-Through</code> printing. </p><p> - <a class="indexterm" name="id2578959"></a> - <a class="indexterm" name="id2578968"></a> + <a class="indexterm" name="id2572874"></a> + <a class="indexterm" name="id2572883"></a> Samba permits the configuration of <code class="literal">smart</code> printing using the Microsoft Windows point-and-click (also called drag-and-drop) printing. What this provides is essentially the ability to print to any printer. If the local client does not yet have a @@ -547,9 +547,9 @@ clients is conservative and if followed will minimize problems but it is not ab then invokes a suitable print filter to convert the incoming data stream into a format suited to the printer to which the job is dispatched. </p><p> - <a class="indexterm" name="id2579015"></a> - <a class="indexterm" name="id2579022"></a> - <a class="indexterm" name="id2579029"></a> + <a class="indexterm" name="id2572930"></a> + <a class="indexterm" name="id2572937"></a> + <a class="indexterm" name="id2572944"></a> The CUPS printing subsystem is capable of intelligent printing. It has the capacity to detect the data format and apply a print filter. This means that it is feasible to install on all Windows clients a single printer driver for use with all printers that are routed @@ -566,7 +566,7 @@ clients is conservative and if followed will minimize problems but it is not ab This book is about Samba-3, so you can confine the printing style to just the smart style of installation. Those interested in further information regarding intelligent printing should review documentation on the Easy Software Products Web site. - </p></div><div class="sect3" title="Avoiding Failures: Solving Problems Before They Happen"><div class="titlepage"><div><div><h4 class="title"><a name="sbeavoid"></a>Avoiding Failures: Solving Problems Before They Happen</h4></div></div></div><p> + </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbeavoid"></a>Avoiding Failures: Solving Problems Before They Happen</h4></div></div></div><p> It has often been said that there are three types of people in the world: those who have sharp minds and those who forget things. Please do not ask what the third group is like! Well, it seems that many of us have company in the second group. There must @@ -574,12 +574,12 @@ clients is conservative and if followed will minimize problems but it is not ab simple problems efficiently and effectively. </p><p> Here are some diagnostic guidelines that can be referred to when things go wrong: - </p><div class="sect4" title="Preliminary Advice: Dangers Can Be Avoided"><div class="titlepage"><div><div><h5 class="title"><a name="id2579096"></a>Preliminary Advice: Dangers Can Be Avoided</h5></div></div></div><p> - The best advice regarding how to mend a broken leg is <span class="quote">“<span class="quote">Never break a leg!</span>”</span> + </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573011"></a>Preliminary Advice: Dangers Can Be Avoided</h5></div></div></div><p> + The best advice regarding how to mend a broken leg is “<span class="quote">Never break a leg!</span>” </p><p> - <a class="indexterm" name="id2579112"></a> + <a class="indexterm" name="id2573027"></a> Newcomers to Samba and LDAP seem to struggle a great deal at first. If you want advice - regarding the best way to remedy LDAP and Samba problems: <span class="quote">“<span class="quote">Avoid them like the plague!</span>”</span> + regarding the best way to remedy LDAP and Samba problems: “<span class="quote">Avoid them like the plague!</span>” </p><p> If you are now asking yourself how problems can be avoided, the best advice is to start out your learning experience with a <span class="emphasis"><em>known-good configuration.</em></span> After @@ -589,11 +589,11 @@ clients is conservative and if followed will minimize problems but it is not ab The examples in this chapter (also in the book as a whole) are known to work. That means that they could serve as the kick-off point for your journey through fields of knowledge. Use this resource carefully; we hope it serves you well. - </p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> + </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> Do not be lulled into thinking that you can easily adopt the examples in this book and adapt them without first working through the examples provided. A little thing overlooked can cause untold pain and may permanently tarnish your experience. - </p></div></div><div class="sect4" title="The Name Service Caching Daemon"><div class="titlepage"><div><div><h5 class="title"><a name="id2579156"></a>The Name Service Caching Daemon</h5></div></div></div><p> + </p></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573071"></a>The Name Service Caching Daemon</h5></div></div></div><p> The name service caching daemon (nscd) is a primary cause of difficulties with name resolution, particularly where <code class="literal">winbind</code> is used. Winbind does its own caching, thus nscd causes double caching which can lead to peculiar problems during @@ -660,17 +660,17 @@ clients is conservative and if followed will minimize problems but it is not ab <code class="prompt">root# </code> chkconfig nscd off <code class="prompt">root# </code> rcnscd off </pre><p> - </p></div><div class="sect4" title="Debugging LDAP"><div class="titlepage"><div><div><h5 class="title"><a name="id2579330"></a>Debugging LDAP</h5></div></div></div><p> - <a class="indexterm" name="id2579338"></a> - <a class="indexterm" name="id2579345"></a> - <a class="indexterm" name="id2579351"></a> + </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573244"></a>Debugging LDAP</h5></div></div></div><p> + <a class="indexterm" name="id2573252"></a> + <a class="indexterm" name="id2573259"></a> + <a class="indexterm" name="id2573266"></a> In the example <code class="filename">/etc/openldap/slapd.conf</code> control file (see <a class="link" href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">“LDAP DB_CONFIG File”</a>) there is an entry for <code class="constant">loglevel 256</code>. To enable logging via the syslog infrastructure, it is necessary to uncomment this parameter and restart <code class="literal">slapd</code>. </p><p> - <a class="indexterm" name="id2579387"></a> - <a class="indexterm" name="id2579394"></a> + <a class="indexterm" name="id2573302"></a> + <a class="indexterm" name="id2573309"></a> LDAP log information can be directed into a file that is separate from the normal system log files by changing the <code class="filename">/etc/syslog.conf</code> file so it has the following contents: @@ -689,7 +689,7 @@ local4.* -/var/log/ldaplogs local site needs. The configuration used later in this chapter reflects such customization with the intent that LDAP log files will be stored at a location that meets local site needs and wishes more fully. - </p></div><div class="sect4" title="Debugging NSS_LDAP"><div class="titlepage"><div><div><h5 class="title"><a name="id2579436"></a>Debugging NSS_LDAP</h5></div></div></div><p> + </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573351"></a>Debugging NSS_LDAP</h5></div></div></div><p> The basic mechanism for diagnosing problems with the nss_ldap utility involves adding to the <code class="filename">/etc/ldap.conf</code> file the following parameters: </p><pre class="screen"> @@ -702,7 +702,7 @@ logdir /data/logs </pre><p> </p><p> The diagnostic process should follow these steps: - </p><div class="procedure" title="Procedure 5.1. NSS_LDAP Diagnostic Steps"><a name="id2579479"></a><p class="title"><b>Procedure 5.1. NSS_LDAP Diagnostic Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="id2573394"></a><p class="title"><b>Procedure 5.1. NSS_LDAP Diagnostic Steps</b></p><ol type="1"><li><p> Verify the <code class="constant">nss_base_passwd, nss_base_shadow, nss_base_group</code> entries in the <code class="filename">/etc/ldap.conf</code> file and compare them closely with the directory tree location that was chosen when the directory was first created. @@ -739,7 +739,7 @@ nss_base_passwd dc=abmas,dc=biz?sub will be evaluated sequentially. Let us consider an example of use where the following DIT has been implemented: </p><p> - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>User accounts are stored under the DIT: ou=Users, dc=abmas, dc=biz</p></li><li class="listitem"><p>User login accounts are under the DIT: ou=People, ou-Users, dc=abmas, dc=biz</p></li><li class="listitem"><p>Computer accounts are under the DIT: ou=Computers, ou=Users, dc=abmas, dc=biz</p></li></ul></div><p> + </p><div class="itemizedlist"><ul type="disc"><li><p>User accounts are stored under the DIT: ou=Users, dc=abmas, dc=biz</p></li><li><p>User login accounts are under the DIT: ou=People, ou-Users, dc=abmas, dc=biz</p></li><li><p>Computer accounts are under the DIT: ou=Computers, ou=Users, dc=abmas, dc=biz</p></li></ul></div><p> </p><p> The appropriate multiple entry for the <code class="constant">nss_base_passwd</code> directive in the <code class="filename">/etc/ldap.conf</code> file may be: @@ -747,7 +747,7 @@ nss_base_passwd dc=abmas,dc=biz?sub nss_base_passwd ou=People,ou=Users,dc=abmas,dc=org?one nss_base_passwd ou=Computers,ou=Users,dc=abmas,dc=org?one </pre><p> - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> Perform lookups such as: </p><pre class="screen"> <code class="prompt">root# </code> getent passwd @@ -755,7 +755,7 @@ nss_base_passwd ou=Computers,ou=Users,dc=abmas,dc=org?one Each such lookup will create an entry in the <code class="filename">/data/log</code> directory for each such process executed. The contents of each file created in this directory may provide a hint as to the cause of the a problem that is under investigation. - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> For additional diagnostic information, check the contents of the <code class="filename">/var/log/messages</code> to see what error messages are being generated as a result of the LDAP lookups. Here is an example of a successful lookup: @@ -788,11 +788,11 @@ nentries=2 text= slapd[12164]: conn=1 fd=10 closed </pre><p> - </p></li><li class="step" title="Step 4"><p> + </p></li><li><p> Check that the bindpw entry in the <code class="filename">/etc/ldap.conf</code> or in the <code class="filename">/etc/ldap.secrets</code> file is correct, as specified in the <code class="filename">/etc/openldap/slapd.conf</code> file. - </p></li></ol></div></div><div class="sect4" title="Debugging Samba"><div class="titlepage"><div><div><h5 class="title"><a name="id2579730"></a>Debugging Samba</h5></div></div></div><p> + </p></li></ol></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573645"></a>Debugging Samba</h5></div></div></div><p> The following parameters in the <code class="filename">smb.conf</code> file can be useful in tracking down Samba-related problems: </p><pre class="screen"> [global] @@ -822,17 +822,17 @@ slapd[12164]: conn=1 fd=10 closed </p><p> Search for hints of what may have failed by looking for the words <span class="emphasis"><em>fail</em></span> and <span class="emphasis"><em>error</em></span>. - </p></div><div class="sect4" title="Debugging on the Windows Client"><div class="titlepage"><div><div><h5 class="title"><a name="id2579801"></a>Debugging on the Windows Client</h5></div></div></div><p> + </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573716"></a>Debugging on the Windows Client</h5></div></div></div><p> MS Windows 2000 Professional and Windows XP Professional clients can be configured to create a netlogon.log file that can be very helpful in diagnosing network logon problems. Search the Microsoft knowledge base for detailed instructions. The techniques vary a little with each version of MS Windows. - </p></div></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id2579819"></a>Political Issues</h3></div></div></div><p> + </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2573734"></a>Political Issues</h3></div></div></div><p> MS Windows network users are generally very sensitive to limits that may be imposed when confronted with locked-down workstation configurations. The challenge you face must be promoted as a choice between reliable, fast network operation and a constant flux of problems that result in user irritation. - </p></div><div class="sect2" title="Installation Checklist"><div class="titlepage"><div><div><h3 class="title"><a name="id2579834"></a>Installation Checklist</h3></div></div></div><p> + </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2573749"></a>Installation Checklist</h3></div></div></div><p> You are starting a complex project. Even though you went through the installation of a complex network in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>, this network is a bigger challenge because of the large number of complex applications that must be configured before the first few steps @@ -840,18 +840,18 @@ slapd[12164]: conn=1 fd=10 closed frequently review the steps ahead while making at least a mental note of what has already been completed. The following task list may help you to keep track of the task items that are covered: - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Samba-3 PDC Server Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>DHCP and DNS servers</p></li><li class="listitem"><p>OpenLDAP server</p></li><li class="listitem"><p>PAM and NSS client tools</p></li><li class="listitem"><p>Samba-3 PDC</p></li><li class="listitem"><p>Idealx smbldap scripts</p></li><li class="listitem"><p>LDAP initialization</p></li><li class="listitem"><p>Create user and group accounts</p></li><li class="listitem"><p>Printers</p></li><li class="listitem"><p>Share point directory roots</p></li><li class="listitem"><p>Profile directories</p></li><li class="listitem"><p>Logon scripts</p></li><li class="listitem"><p>Configuration of user rights and privileges</p></li></ol></div></li><li class="listitem"><p>Samba-3 BDC Server Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>DHCP and DNS servers</p></li><li class="listitem"><p>PAM and NSS client tools</p></li><li class="listitem"><p>Printers</p></li><li class="listitem"><p>Share point directory roots</p></li><li class="listitem"><p>Profiles directories</p></li></ol></div></li><li class="listitem"><p>Windows XP Client Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Default profile folder redirection</p></li><li class="listitem"><p>MS Outlook PST file relocation</p></li><li class="listitem"><p>Delete roaming profile on logout</p></li><li class="listitem"><p>Upload printer drivers to Samba servers</p></li><li class="listitem"><p>Install software</p></li><li class="listitem"><p>Creation of roll-out images</p></li></ol></div></li></ul></div></div></div><div class="sect1" title="Samba Server Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2580015"></a>Samba Server Implementation</h2></div></div></div><p> - <a class="indexterm" name="id2580023"></a> - <a class="indexterm" name="id2580030"></a> + </p><div class="itemizedlist"><ul type="disc"><li><p>Samba-3 PDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>OpenLDAP server</p></li><li><p>PAM and NSS client tools</p></li><li><p>Samba-3 PDC</p></li><li><p>Idealx smbldap scripts</p></li><li><p>LDAP initialization</p></li><li><p>Create user and group accounts</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profile directories</p></li><li><p>Logon scripts</p></li><li><p>Configuration of user rights and privileges</p></li></ol></div></li><li><p>Samba-3 BDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>PAM and NSS client tools</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profiles directories</p></li></ol></div></li><li><p>Windows XP Client Configuration</p><div class="orderedlist"><ol type="1"><li><p>Default profile folder redirection</p></li><li><p>MS Outlook PST file relocation</p></li><li><p>Delete roaming profile on logout</p></li><li><p>Upload printer drivers to Samba servers</p></li><li><p>Install software</p></li><li><p>Creation of roll-out images</p></li></ol></div></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2573929"></a>Samba Server Implementation</h2></div></div></div><p> + <a class="indexterm" name="id2573937"></a> + <a class="indexterm" name="id2573944"></a> The network design shown in <a class="link" href="happy.html#chap6net" title="Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend">“Network Topology 500 User Network Using ldapsam passdb backend”</a> is not comprehensive. It is assumed that you will install additional file servers and possibly additional BDCs. </p><div class="figure"><a name="chap6net"></a><p class="title"><b>Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap6-net.png" width="270" alt="Network Topology 500 User Network Using ldapsam passdb backend"></div></div></div><br class="figure-break"><p> - <a class="indexterm" name="id2580092"></a> - <a class="indexterm" name="id2580099"></a> + <a class="indexterm" name="id2574007"></a> + <a class="indexterm" name="id2574014"></a> All configuration files and locations are shown for SUSE Linux 9.2 and are equally valid for SUSE Linux Enterprise Server 9. The file locations for Red Hat Linux are similar. You may need to adjust the locations for your particular Linux system distribution/implementation. - </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> + </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> The following information applies to Samba-3.0.20 when used with the Idealx smbldap-tools scripts version 0.9.1. If using a different version of Samba or of the smbldap-tools tarball, please verify that the versions you are about to use are matching. The smbldap-tools package @@ -867,23 +867,23 @@ They could just as well be located under the rdn <code class="constant">cn=NextF have completed the network implementation shown in that chapter. If you are starting with newly installed Linux servers, you must complete the steps shown in <a class="link" href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">“Installation of DHCP, DNS, and Samba Control Files”</a> before commencing at <a class="link" href="happy.html#ldapsetup" title="OpenLDAP Server Configuration">“OpenLDAP Server Configuration”</a>. - </p><div class="sect2" title="OpenLDAP Server Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ldapsetup"></a>OpenLDAP Server Configuration</h3></div></div></div><p> - <a class="indexterm" name="id2580181"></a> - <a class="indexterm" name="id2580187"></a> - <a class="indexterm" name="id2580194"></a> + </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ldapsetup"></a>OpenLDAP Server Configuration</h3></div></div></div><p> + <a class="indexterm" name="id2574096"></a> + <a class="indexterm" name="id2574102"></a> + <a class="indexterm" name="id2574109"></a> Confirm that the packages shown in <a class="link" href="happy.html#oldapreq" title="Table 5.2. Required OpenLDAP Linux Packages">“Required OpenLDAP Linux Packages”</a> are installed on your system. </p><div class="table"><a name="oldapreq"></a><p class="title"><b>Table 5.2. Required OpenLDAP Linux Packages</b></p><div class="table-contents"><table summary="Required OpenLDAP Linux Packages" border="1"><colgroup><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="center">SUSE Linux 8.x</th><th align="center">SUSE Linux 9.x</th><th align="center">Red Hat Linux</th></tr></thead><tbody><tr><td align="left">nss_ldap</td><td align="left">nss_ldap</td><td align="left">nss_ldap</td></tr><tr><td align="left">pam_ldap</td><td align="left">pam_ldap</td><td align="left">pam_ldap</td></tr><tr><td align="left">openldap2</td><td align="left">openldap2</td><td align="left">openldap</td></tr><tr><td align="left">openldap2-client</td><td align="left">openldap2-client</td><td align="left"> </td></tr></tbody></table></div></div><br class="table-break"><p> Samba-3 and OpenLDAP will have a degree of interdependence that is unavoidable. The method for bootstrapping the LDAP and Samba-3 configuration is relatively straightforward. If you follow these guidelines, the resulting system should work fine. - </p><div class="procedure" title="Procedure 5.2. OpenLDAP Server Configuration Steps"><a name="id2580326"></a><p class="title"><b>Procedure 5.2. OpenLDAP Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> - <a class="indexterm" name="id2580338"></a> + </p><div class="procedure"><a name="id2574241"></a><p class="title"><b>Procedure 5.2. OpenLDAP Server Configuration Steps</b></p><ol type="1"><li><p> + <a class="indexterm" name="id2574253"></a> Install the file shown in <a class="link" href="happy.html#sbehap-slapdconf" title="Example 5.2. LDAP Master Configuration File /etc/openldap/slapd.conf Part A">“LDAP Master Configuration File /etc/openldap/slapd.conf Part A”</a> in the directory <code class="filename">/etc/openldap</code>. - </p></li><li class="step" title="Step 2"><p> - <a class="indexterm" name="id2580366"></a> - <a class="indexterm" name="id2580373"></a> - <a class="indexterm" name="id2580380"></a> + </p></li><li><p> + <a class="indexterm" name="id2574281"></a> + <a class="indexterm" name="id2574287"></a> + <a class="indexterm" name="id2574294"></a> Remove all files from the directory <code class="filename">/data/ldap</code>, making certain that the directory exists with permissions: </p><pre class="screen"> @@ -891,19 +891,19 @@ They could just as well be located under the rdn <code class="constant">cn=NextF drwx------ 2 ldap ldap 48 Dec 15 22:11 ldap </pre><p> This may require you to add a user and a group account for LDAP if they do not exist. - </p></li><li class="step" title="Step 3"><p> - <a class="indexterm" name="id2580415"></a> + </p></li><li><p> + <a class="indexterm" name="id2574330"></a> Install the file shown in <a class="link" href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">“LDAP DB_CONFIG File”</a> in the directory <code class="filename">/data/ldap</code>. In the event that this file is added after <code class="constant">ldap</code> has been started, it is possible to cause the new settings to take effect by shutting down the <code class="constant">LDAP</code> server, executing the <code class="literal">db_recover</code> command inside the <code class="filename">/data/ldap</code> directory, and then restarting the <code class="constant">LDAP</code> server. - </p></li><li class="step" title="Step 4"><p> - <a class="indexterm" name="id2580468"></a> + </p></li><li><p> + <a class="indexterm" name="id2574383"></a> Performance logging can be enabled and should preferably be sent to a file on a file system that is large enough to handle significantly sized logs. To enable the logging at a verbose level to permit detailed analysis, uncomment the entry in - the <code class="filename">/etc/openldap/slapd.conf</code> shown as <span class="quote">“<span class="quote">loglevel 256</span>”</span>. + the <code class="filename">/etc/openldap/slapd.conf</code> shown as “<span class="quote">loglevel 256</span>”. </p><p> Edit the <code class="filename">/etc/syslog.conf</code> file to add the following at the end of the file: @@ -974,32 +974,32 @@ index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub -</pre></div></div><br class="example-break"></div><div class="sect2" title="PAM and NSS Client Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-PAM-NSS"></a>PAM and NSS Client Configuration</h3></div></div></div><p> - <a class="indexterm" name="id2580627"></a> - <a class="indexterm" name="id2580634"></a> - <a class="indexterm" name="id2580640"></a> +</pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-PAM-NSS"></a>PAM and NSS Client Configuration</h3></div></div></div><p> + <a class="indexterm" name="id2574542"></a> + <a class="indexterm" name="id2574549"></a> + <a class="indexterm" name="id2574555"></a> The steps that follow involve configuration of LDAP, NSS LDAP-based resolution of users and groups. Also, so that LDAP-based accounts can log onto the system, the steps ahead configure the Pluggable Authentication Modules (PAM) to permit LDAP-based authentication. </p><p> - <a class="indexterm" name="id2580655"></a> - <a class="indexterm" name="id2580664"></a> + <a class="indexterm" name="id2574570"></a> + <a class="indexterm" name="id2574579"></a> Since you have chosen to put UNIX user and group accounts into the LDAP database, it is likely that you may want to use them for UNIX system (Linux) local machine logons. This necessitates correct configuration of PAM. The <code class="literal">pam_ldap</code> open source package provides the PAM modules that most people would use. On SUSE Linux systems, the <code class="literal">pam_unix2.so</code> module also has the ability to redirect authentication requests through LDAP. </p><p> - <a class="indexterm" name="id2580693"></a> - <a class="indexterm" name="id2580699"></a> - <a class="indexterm" name="id2580706"></a> - <a class="indexterm" name="id2580713"></a> + <a class="indexterm" name="id2574607"></a> + <a class="indexterm" name="id2574614"></a> + <a class="indexterm" name="id2574621"></a> + <a class="indexterm" name="id2574628"></a> You have chosen to configure these services by directly editing the system files, but of course, you know that this configuration can be done using system tools provided by the Linux system vendor. SUSE Linux has a facility in YaST (the system admin tool) through <span class="guimenu">yast</span> → <span class="guimenuitem">system</span> → <span class="guimenuitem">ldap-client</span> that permits configuration of SUSE Linux as an LDAP client. Red Hat Linux provides the <code class="literal">authconfig</code> tool for this. - </p><div class="procedure" title="Procedure 5.3. PAM and NSS Client Configuration Steps"><a name="id2580753"></a><p class="title"><b>Procedure 5.3. PAM and NSS Client Configuration Steps</b></p><div class="example"><a name="sbehap-nss01"></a><p class="title"><b>Example 5.4. Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen"> + </p><div class="procedure"><a name="id2574668"></a><p class="title"><b>Procedure 5.3. PAM and NSS Client Configuration Steps</b></p><div class="example"><a name="sbehap-nss01"></a><p class="title"><b>Example 5.4. Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen"> host 127.0.0.1 base dc=abmas,dc=biz @@ -1041,23 +1041,23 @@ nss_base_shadow ou=People,dc=abmas,dc=biz?one nss_base_group ou=Groups,dc=abmas,dc=biz?one ssl off -</pre></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> - <a class="indexterm" name="id2580764"></a> - <a class="indexterm" name="id2580772"></a> - <a class="indexterm" name="id2580778"></a> +</pre></div></div><br class="example-break"><ol type="1"><li><p> + <a class="indexterm" name="id2574679"></a> + <a class="indexterm" name="id2574686"></a> + <a class="indexterm" name="id2574693"></a> Execute the following command to find where the <code class="filename">nss_ldap</code> module expects to find its control file: </p><pre class="screen"> <code class="prompt">root# </code> strings /lib/libnss_ldap.so.2 | grep conf </pre><p> The preferred and usual location is <code class="filename">/etc/ldap.conf</code>. - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> On the server <code class="constant">MASSIVE</code>, install the file shown in <a class="link" href="happy.html#sbehap-nss01" title="Example 5.4. Configuration File for NSS LDAP Support /etc/ldap.conf">“Configuration File for NSS LDAP Support /etc/ldap.conf”</a> into the path that was obtained from the step above. On the servers called <code class="constant">BLDG1</code> and <code class="constant">BLDG2</code>, install the file shown in <a class="link" href="happy.html#sbehap-nss02" title="Example 5.5. Configuration File for NSS LDAP Clients Support /etc/ldap.conf">“Configuration File for NSS LDAP Clients Support /etc/ldap.conf”</a> into the path that was obtained from the step above. - </p></li><li class="step" title="Step 3"><p> - <a class="indexterm" name="id2580912"></a> + </p></li><li><p> + <a class="indexterm" name="id2574827"></a> Edit the NSS control file (<code class="filename">/etc/nsswitch.conf</code>) so that the lines that control user and group resolution will obtain information from the normal system files as well as from <code class="literal">ldap</code>: @@ -1071,7 +1071,7 @@ hosts: files dns wins added, you can validate resolution of the LDAP resolver process. The inclusion of WINS-based hostname resolution is deliberate so that all MS Windows client hostnames can be resolved to their IP addresses, whether or not they are DHCP clients. - </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> + </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> Some Linux systems (Novell SUSE Linux in particular) add entries to the <code class="filename">nsswitch.conf</code> file that may cause operational problems with the configuration methods adopted in this book. It is advisable to comment out the entries <code class="constant">passwd_compat</code> and <code class="constant">group_compat</code> @@ -1079,8 +1079,8 @@ hosts: files dns wins </p></div><p> Even at the risk of overstating the issue, incorrect and inappropriate configuration of the <code class="filename">nsswitch.conf</code> file is a significant cause of operational problems with LDAP. - </p></li><li class="step" title="Step 4"><p> - <a class="indexterm" name="id2580988"></a> + </p></li><li><p> + <a class="indexterm" name="id2574902"></a> For PAM LDAP configuration on this SUSE Linux 9.0 system, the simplest solution is to edit the following files in the <code class="filename">/etc/pam.d</code> directory: <code class="literal">login</code>, <code class="literal">password</code>, <code class="literal">samba</code>, <code class="literal">sshd</code>. In each file, locate every entry that has the @@ -1102,7 +1102,7 @@ session required pam_unix2.so none use_ldap # debug or trace session required pam_limits.so </pre><p> </p><p> - <a class="indexterm" name="id2581067"></a> + <a class="indexterm" name="id2574982"></a> On other Linux systems that do not have an LDAP-enabled <code class="literal">pam_unix2.so</code> module, you must edit these files by adding the <code class="literal">pam_ldap.so</code> modules as shown here: </p><pre class="screen"> @@ -1125,15 +1125,15 @@ session optional pam_mail.so demonstrates the use of the <code class="literal">pam_ldap.so</code> module. You can use either implementation, but if the <code class="literal">pam_unix2.so</code> on your system supports LDAP, you probably want to use it rather than add an additional module. - </p></li></ol></div></div><div class="sect2" title="Samba-3 PDC Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-massive"></a>Samba-3 PDC Configuration</h3></div></div></div><p> - <a class="indexterm" name="id2581150"></a> + </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-massive"></a>Samba-3 PDC Configuration</h3></div></div></div><p> + <a class="indexterm" name="id2575065"></a> Verify that the Samba-3.0.20 (or later) packages are installed on each SUSE Linux server before following the steps below. If Samba-3.0.20 (or later) is not installed, you have the choice to either build your own or obtain the packages from a dependable source. Packages for SUSE Linux 8.x, 9.x, and SUSE Linux Enterprise Server 9, as well as for Red Hat Fedora Core and Red Hat Enterprise Linux Server 3 and 4, are included on the CD-ROM that is included with this book. - </p><div class="procedure" title="Procedure 5.4. Configuration of PDC Called MASSIVE"><a name="id2581166"></a><p class="title"><b>Procedure 5.4. Configuration of PDC Called <code class="constant">MASSIVE</code></b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="id2575080"></a><p class="title"><b>Procedure 5.4. Configuration of PDC Called <code class="constant">MASSIVE</code></b></p><ol type="1"><li><p> Install the files in <a class="link" href="happy.html#sbehap-massive-smbconfa" title="Example 5.6. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A">“LDAP Based smb.conf File, Server: MASSIVE global Section: Part A”</a>, <a class="link" href="happy.html#sbehap-massive-smbconfb" title="Example 5.7. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B">“LDAP Based smb.conf File, Server: MASSIVE global Section: Part B”</a>, <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, and <a class="link" href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">“LDAP Based smb.conf File, Shares Section Part B”</a> into the <code class="filename">/etc/samba/</code> @@ -1142,8 +1142,8 @@ session optional pam_mail.so <code class="filename">smb.conf.master</code> and then to perform all file edits on the master file. The operational <code class="filename">smb.conf</code> is then generated as shown in the next step. - </p></li><li class="step" title="Step 2"><p> - <a class="indexterm" name="id2581242"></a> + </p></li><li><p> + <a class="indexterm" name="id2575157"></a> Create and verify the contents of the <code class="filename">smb.conf</code> file that is generated by: </p><pre class="screen"> <code class="prompt">root# </code> testparm -s smb.conf.master > smb.conf @@ -1170,7 +1170,7 @@ Loaded services file OK. Server role: ROLE_DOMAIN_PDC Press enter to see a dump of your service definitions </pre><p> - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> Delete all runtime files from prior Samba operation by executing (for SUSE Linux): </p><pre class="screen"> @@ -1179,9 +1179,9 @@ Press enter to see a dump of your service definitions <code class="prompt">root# </code> rm /var/lib/samba/*dat <code class="prompt">root# </code> rm /var/log/samba/* </pre><p> - </p></li><li class="step" title="Step 4"><p> - <a class="indexterm" name="id2581342"></a> - <a class="indexterm" name="id2581348"></a> + </p></li><li><p> + <a class="indexterm" name="id2575256"></a> + <a class="indexterm" name="id2575263"></a> Samba-3 communicates with the LDAP server. The password that it uses to authenticate to the LDAP server must be stored in the <code class="filename">secrets.tdb</code> file. Execute the following to create the new <code class="filename">secrets.tdb</code> files @@ -1193,9 +1193,9 @@ Press enter to see a dump of your service definitions </p><pre class="screen"> Setting stored password for "cn=Manager,dc=abmas,dc=biz" in secrets.tdb </pre><p> - </p></li><li class="step" title="Step 5"><p> - <a class="indexterm" name="id2581397"></a> - <a class="indexterm" name="id2581404"></a> + </p></li><li><p> + <a class="indexterm" name="id2575312"></a> + <a class="indexterm" name="id2575319"></a> Samba-3 generates a Windows Security Identifier (SID) only when <code class="literal">smbd</code> has been started. For this reason, you start Samba. After a few seconds delay, execute: @@ -1226,13 +1226,13 @@ SID for domain MASSIVE is: S-1-5-21-3504140859-1010554828-2431957765 may be misconfigured. In this case, carefully check the <code class="filename">smb.conf</code> file for typographical errors (the most common problem). The use of the <code class="literal">testparm</code> is highly recommended to validate the contents of this file. - </p></li><li class="step" title="Step 6"><p> + </p></li><li><p> When a positive domain SID has been reported, stop Samba. - </p></li><li class="step" title="Step 7"><p> - <a class="indexterm" name="id2581516"></a> - <a class="indexterm" name="id2581523"></a> - <a class="indexterm" name="id2581530"></a> - <a class="indexterm" name="id2581536"></a> + </p></li><li><p> + <a class="indexterm" name="id2575431"></a> + <a class="indexterm" name="id2575438"></a> + <a class="indexterm" name="id2575444"></a> + <a class="indexterm" name="id2575451"></a> Configure the NFS server for your Linux system. So you can complete the steps that follow, enter into the <code class="filename">/etc/exports</code> the following entry: </p><pre class="screen"> @@ -1250,8 +1250,8 @@ SID for domain MASSIVE is: S-1-5-21-3504140859-1010554828-2431957765 </p></li></ol></div><p> Your Samba-3 PDC is now ready to communicate with the LDAP password backend. Let's get on with configuration of the LDAP server. - </p><div class="example"><a name="sbehap-massive-smbconfa"></a><p class="title"><b>Example 5.6. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2581623"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2581635"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2581646"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2581658"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2581670"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581682"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2581694"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581706"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2581718"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2581730"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2581741"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2581753"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2581765"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2581776"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2581788"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581800"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2581812"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2581824"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2581836"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2581849"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2581861"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2581874"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2581887"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2581900"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2581913"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-massive-smbconfb"></a><p class="title"><b>Example 5.7. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2581950"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2581962"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2581974"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2581986"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581997"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2582009"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2582021"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2582033"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2582045"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2582057"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2582069"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2582081"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2582093"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2582105"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2582117"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2582129"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2582141"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2582152"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="Install and Configure Idealx smbldap-tools Scripts"><div class="titlepage"><div><div><h3 class="title"><a name="sbeidealx"></a>Install and Configure Idealx smbldap-tools Scripts</h3></div></div></div><p> - <a class="indexterm" name="id2582178"></a> + </p><div class="example"><a name="sbehap-massive-smbconfa"></a><p class="title"><b>Example 5.6. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2575538"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2575549"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2575561"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2575573"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2575585"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575597"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2575609"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575621"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2575633"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2575644"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2575656"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2575668"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2575680"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2575691"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2575703"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575715"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2575727"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2575739"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2575751"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2575764"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2575776"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2575789"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2575802"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2575815"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2575827"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-massive-smbconfb"></a><p class="title"><b>Example 5.7. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2575865"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2575877"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2575889"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2575900"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575912"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575924"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575936"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2575948"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2575960"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2575972"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2575984"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2575996"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2576008"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2576020"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2576032"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2576044"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2576055"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2576067"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbeidealx"></a>Install and Configure Idealx smbldap-tools Scripts</h3></div></div></div><p> + <a class="indexterm" name="id2576093"></a> The Idealx scripts, or equivalent, are necessary to permit Samba-3 to manage accounts on the LDAP server. You have chosen the Idealx scripts because they are the best-known LDAP configuration scripts. The use of these scripts will help avoid the necessity @@ -1261,16 +1261,16 @@ SID for domain MASSIVE is: S-1-5-21-3504140859-1010554828-2431957765 from this site also. Alternatively, you may obtain the <a class="ulink" href="http://samba.idealx.org/dist/smbldap-tools-0.9.1-1.src.rpm" target="_top">smbldap-tools-0.9.1-1.src.rpm</a> file that may be used to build an installable RPM package for your Linux system. - </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> + </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> The smbldap-tools scripts can be installed in any convenient directory of your choice, in which case you must change the path to them in your <code class="filename">smb.conf</code> file on the PDC (<code class="constant">MASSIVE</code>). </p></div><p> The smbldap-tools are located in <code class="filename">/opt/IDEALX/sbin</code>. The scripts are not needed on BDC machines because all LDAP updates are handled by the PDC alone. - </p><div class="sect3" title="Installation of smbldap-tools from the Tarball"><div class="titlepage"><div><div><h4 class="title"><a name="id2582245"></a>Installation of smbldap-tools from the Tarball</h4></div></div></div><p> + </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2576160"></a>Installation of smbldap-tools from the Tarball</h4></div></div></div><p> To perform a manual installation of the smbldap-tools scripts, the following procedure may be used: - </p><div class="procedure" title="Procedure 5.5. Unpacking and Installation Steps for the smbldap-tools Tarball"><a name="idealxscript"></a><p class="title"><b>Procedure 5.5. Unpacking and Installation Steps for the <code class="constant">smbldap-tools</code> Tarball</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="idealxscript"></a><p class="title"><b>Procedure 5.5. Unpacking and Installation Steps for the <code class="constant">smbldap-tools</code> Tarball</b></p><ol type="1"><li><p> Create the <code class="filename">/opt/IDEALX/sbin</code> directory, and set its permissions and ownership as shown here: </p><pre class="screen"> @@ -1281,11 +1281,11 @@ change the path to them in your <code class="filename">smb.conf</code> file on t <code class="prompt">root# </code> chown root:root /etc/smbldap-tools <code class="prompt">root# </code> chmod 755 /etc/smbldap-tools </pre><p> - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> If you wish to use the downloaded tarball, unpack the smbldap-tools in a suitable temporary location. Change into either the directory extracted from the tarball or the smbldap-tools directory in your <code class="filename">/usr/share/doc/packages</code> directory tree. - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> Copy all the <code class="filename">smbldap-*</code> and the <code class="filename">configure.pl</code> files into the <code class="filename">/opt/IDEALX/sbin</code> directory, as shown here: </p><pre class="screen"> @@ -1297,7 +1297,7 @@ change the path to them in your <code class="filename">smb.conf</code> file on t <code class="prompt">root# </code> chmod 640 /etc/smbldap-tools/smbldap.conf <code class="prompt">root# </code> chmod 600 /etc/smbldap-tools/smbldap_bind.conf </pre><p> - </p></li><li class="step" title="Step 4"><p> + </p></li><li><p> The smbldap-tools scripts master control file must now be configured. Change to the <code class="filename">/opt/IDEALX/sbin</code> directory, then edit the <code class="filename">smbldap_tools.pm</code> to affect the changes @@ -1310,7 +1310,7 @@ my $smbldap_conf="/etc/smbldap-tools/smbldap.conf"; my $smbldap_bind_conf="/etc/smbldap-tools/smbldap_bind.conf"; ... </pre><p> - </p></li><li class="step" title="Step 5"><p> + </p></li><li><p> To complete the configuration of the smbldap-tools, set the permissions and ownership by executing the following commands: </p><pre class="screen"> @@ -1320,15 +1320,15 @@ my $smbldap_bind_conf="/etc/smbldap-tools/smbldap_bind.conf"; </pre><p> The smbldap-tools scripts are now ready for the configuration step outlined in <a class="link" href="happy.html#smbldap-init" title="Configuration of smbldap-tools">“Configuration of smbldap-tools”</a>. - </p></li></ol></div></div><div class="sect3" title="Installing smbldap-tools from the RPM Package"><div class="titlepage"><div><div><h4 class="title"><a name="id2582498"></a>Installing smbldap-tools from the RPM Package</h4></div></div></div><p> + </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2576412"></a>Installing smbldap-tools from the RPM Package</h4></div></div></div><p> In the event that you have elected to use the RPM package provided by Idealx, download the source RPM <code class="filename">smbldap-tools-0.9.1-1.src.rpm</code>, then follow this procedure: - </p><div class="procedure" title="Procedure 5.6. Installation Steps for smbldap-tools RPM's"><a name="id2582516"></a><p class="title"><b>Procedure 5.6. Installation Steps for <code class="constant">smbldap-tools</code> RPM's</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="id2576431"></a><p class="title"><b>Procedure 5.6. Installation Steps for <code class="constant">smbldap-tools</code> RPM's</b></p><ol type="1"><li><p> Install the source RPM that has been downloaded as follows: </p><pre class="screen"> <code class="prompt">root# </code> rpm -i smbldap-tools-0.9.1-1.src.rpm </pre><p> - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> Change into the directory in which the SPEC files are located. On SUSE Linux: </p><pre class="screen"> <code class="prompt">root# </code> cd /usr/src/packages/SPECS @@ -1337,7 +1337,7 @@ my $smbldap_bind_conf="/etc/smbldap-tools/smbldap_bind.conf"; </p><pre class="screen"> <code class="prompt">root# </code> cd /usr/src/redhat/SPECS </pre><p> - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> Edit the <code class="filename">smbldap-tools.spec</code> file to change the value of the <code class="constant">_sysconfig</code> macro as shown here: </p><pre class="screen"> @@ -1345,14 +1345,14 @@ my $smbldap_bind_conf="/etc/smbldap-tools/smbldap_bind.conf"; %define _sysconfdir /etc </pre><p> Note: Any suitable directory can be specified. - </p></li><li class="step" title="Step 4"><p> + </p></li><li><p> Build the package by executing: </p><pre class="screen"> <code class="prompt">root# </code> rpmbuild -ba -v smbldap-tools.spec </pre><p> A build process that has completed without error will place the installable binary files in the directory <code class="filename">../RPMS/noarch</code>. - </p></li><li class="step" title="Step 5"><p> + </p></li><li><p> Install the binary package by executing: </p><pre class="screen"> <code class="prompt">root# </code> rpm -Uvh ../RPMS/noarch/smbldap-tools-0.9.1-1.noarch.rpm @@ -1360,7 +1360,7 @@ my $smbldap_bind_conf="/etc/smbldap-tools/smbldap_bind.conf"; </p></li></ol></div><p> The Idealx scripts should now be ready for configuration using the steps outlined in <a class="link" href="happy.html#smbldap-init" title="Configuration of smbldap-tools">Configuration of smbldap-tools</a>. - </p></div><div class="sect3" title="Configuration of smbldap-tools"><div class="titlepage"><div><div><h4 class="title"><a name="smbldap-init"></a>Configuration of smbldap-tools</h4></div></div></div><p> + </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="smbldap-init"></a>Configuration of smbldap-tools</h4></div></div></div><p> Prior to use, the smbldap-tools must be configured to match the settings in the <code class="filename">smb.conf</code> file and to match the settings in the <code class="filename">/etc/openldap/slapd.conf</code> file. The assumption is made that the <code class="filename">smb.conf</code> file has correct contents. The following procedure ensures that @@ -1368,12 +1368,12 @@ my $smbldap_bind_conf="/etc/smbldap-tools/smbldap_bind.conf"; </p><p> The smbldap-tools require that the NetBIOS name (machine name) of the Samba server be included in the <code class="filename">smb.conf</code> file. - </p><div class="procedure" title="Procedure 5.7. Configuration Steps for smbldap-tools to Enable Use"><a name="id2582711"></a><p class="title"><b>Procedure 5.7. Configuration Steps for <code class="constant">smbldap-tools</code> to Enable Use</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="id2576625"></a><p class="title"><b>Procedure 5.7. Configuration Steps for <code class="constant">smbldap-tools</code> to Enable Use</b></p><ol type="1"><li><p> Change into the directory that contains the <code class="filename">configure.pl</code> script. </p><pre class="screen"> <code class="prompt">root# </code> cd /opt/IDEALX/sbin </pre><p> - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> Execute the <code class="filename">configure.pl</code> script as follows: </p><pre class="screen"> <code class="prompt">root# </code> ./configure.pl @@ -1469,12 +1469,12 @@ writing new configuration file: Since a slave LDAP server has not been configured, it is necessary to specify the IP address of the master LDAP server for both the master and the slave configuration prompts. - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> Change to the directory that contains the <code class="filename">smbldap.conf</code> file, then verify its contents. </p></li></ol></div><p> The smbldap-tools are now ready for use. - </p></div></div><div class="sect2" title="LDAP Initialization and Creation of User and Group Accounts"><div class="titlepage"><div><div><h3 class="title"><a name="id2582912"></a>LDAP Initialization and Creation of User and Group Accounts</h3></div></div></div><p> + </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2576827"></a>LDAP Initialization and Creation of User and Group Accounts</h3></div></div></div><p> The LDAP database must be populated with well-known Windows domain user accounts and domain group accounts before Samba can be used. The following procedures step you through the process. </p><p> @@ -1486,13 +1486,13 @@ writing new configuration file: does not need to ask LDAP. </p><p> Addition of an account to the LDAP backend can be done in two ways: - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> - <a class="indexterm" name="id2582946"></a> - <a class="indexterm" name="id2582953"></a> - <a class="indexterm" name="id2582960"></a> - <a class="indexterm" name="id2582966"></a> - <a class="indexterm" name="id2582973"></a> - <a class="indexterm" name="id2582980"></a> + </p><div class="itemizedlist"><ul type="disc"><li><p> + <a class="indexterm" name="id2576861"></a> + <a class="indexterm" name="id2576868"></a> + <a class="indexterm" name="id2576874"></a> + <a class="indexterm" name="id2576881"></a> + <a class="indexterm" name="id2576888"></a> + <a class="indexterm" name="id2576895"></a> If you always have a user account in the <code class="filename">/etc/passwd</code> on every server or in a NIS(+) backend, it is not necessary to add POSIX accounts for them in LDAP. In this case, you can add Windows domain user accounts using the @@ -1503,27 +1503,27 @@ writing new configuration file: expects the POSIX account to be in LDAP also. It is possible to use the PADL account migration tool to migrate all system accounts from either the <code class="filename">/etc/passwd</code> files, or from NIS, to LDAP. - </p></li><li class="listitem"><p> + </p></li><li><p> If you decide that it is probably a good idea to add both the PosixAccount attributes as well as the SambaSamAccount attributes for each user, then a suitable script is needed. In the example system you are installing in this exercise, you are making use of the Idealx smbldap-tools scripts. A copy of these tools, preconfigured for this system, is included on the enclosed CD-ROM under <code class="filename">Chap06/Tools.</code> </p></li></ul></div><p> - <a class="indexterm" name="id2583040"></a> + <a class="indexterm" name="id2576955"></a> If you wish to have more control over how the LDAP database is initialized or if you don't want to use the Idealx smbldap-tools, you should refer to <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#altldapcfg" title="Alternative LDAP Database Initialization">“Alternative LDAP Database Initialization”</a>. </p><p> - <a class="indexterm" name="id2583067"></a> + <a class="indexterm" name="id2576982"></a> The following steps initialize the LDAP database, and then you can add user and group accounts that Samba can use. You use the <code class="literal">smbldap-populate</code> to seed the LDAP database. You then manually add the accounts shown in <a class="link" href="happy.html#sbehap-bigacct" title="Table 5.3. Abmas Network Users and Groups">“Abmas Network Users and Groups”</a>. The list of users does not cover all 500 network users; it provides examples only. - </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> - <a class="indexterm" name="id2583097"></a> - <a class="indexterm" name="id2583106"></a> - <a class="indexterm" name="id2583115"></a> + </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> + <a class="indexterm" name="id2577012"></a> + <a class="indexterm" name="id2577021"></a> + <a class="indexterm" name="id2577030"></a> In the following examples, as the LDAP database is initialized, we do create a container for Computer (machine) accounts. In the Samba-3 <code class="filename">smb.conf</code> files, specific use is made of the People container, not the Computers container, for domain member accounts. This is not a @@ -1540,15 +1540,15 @@ writing new configuration file: can be found. Alternatively, by placing all machine accounts in the People container, we are able to sidestep this limitation. This is the simpler solution that has been adopted in this chapter. - </p></div><div class="table"><a name="sbehap-bigacct"></a><p class="title"><b>Table 5.3. Abmas Network Users and Groups</b></p><div class="table-contents"><table summary="Abmas Network Users and Groups" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="center">Account Name</th><th align="center">Type</th><th align="center">ID</th><th align="center">Password</th></tr></thead><tbody><tr><td align="left">Robert Jordan</td><td align="left">User</td><td align="left">bobj</td><td align="left">n3v3r2l8</td></tr><tr><td align="left">Stanley Soroka</td><td align="left">User</td><td align="left">stans</td><td align="left">impl13dst4r</td></tr><tr><td align="left">Christine Roberson</td><td align="left">User</td><td align="left">chrisr</td><td align="left">S9n0nw4ll</td></tr><tr><td align="left">Mary Vortexis</td><td align="left">User</td><td align="left">maryv</td><td align="left">kw13t0n3</td></tr><tr><td align="left">Accounts</td><td align="left">Group</td><td align="left">Accounts</td><td align="left"> </td></tr><tr><td align="left">Finances</td><td align="left">Group</td><td align="left">Finances</td><td align="left"> </td></tr><tr><td align="left">Insurance</td><td align="left">Group</td><td align="left">PIOps</td><td align="left"> </td></tr></tbody></table></div></div><br class="table-break"><div class="procedure" title="Procedure 5.8. LDAP Directory Initialization Steps"><a name="creatacc"></a><p class="title"><b>Procedure 5.8. LDAP Directory Initialization Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p></div><div class="table"><a name="sbehap-bigacct"></a><p class="title"><b>Table 5.3. Abmas Network Users and Groups</b></p><div class="table-contents"><table summary="Abmas Network Users and Groups" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="center">Account Name</th><th align="center">Type</th><th align="center">ID</th><th align="center">Password</th></tr></thead><tbody><tr><td align="left">Robert Jordan</td><td align="left">User</td><td align="left">bobj</td><td align="left">n3v3r2l8</td></tr><tr><td align="left">Stanley Soroka</td><td align="left">User</td><td align="left">stans</td><td align="left">impl13dst4r</td></tr><tr><td align="left">Christine Roberson</td><td align="left">User</td><td align="left">chrisr</td><td align="left">S9n0nw4ll</td></tr><tr><td align="left">Mary Vortexis</td><td align="left">User</td><td align="left">maryv</td><td align="left">kw13t0n3</td></tr><tr><td align="left">Accounts</td><td align="left">Group</td><td align="left">Accounts</td><td align="left"> </td></tr><tr><td align="left">Finances</td><td align="left">Group</td><td align="left">Finances</td><td align="left"> </td></tr><tr><td align="left">Insurance</td><td align="left">Group</td><td align="left">PIOps</td><td align="left"> </td></tr></tbody></table></div></div><br class="table-break"><div class="procedure"><a name="creatacc"></a><p class="title"><b>Procedure 5.8. LDAP Directory Initialization Steps</b></p><ol type="1"><li><p> Start the LDAP server by executing: </p><pre class="screen"> <code class="prompt">root# </code> rcldap start Starting ldap-server done </pre><p> - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> Change to the <code class="filename">/opt/IDEALX/sbin</code> directory. - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> Execute the script that will populate the LDAP database as shown here: </p><pre class="screen"> <code class="prompt">root# </code> ./smbldap-populate -a root -k 0 -m 0 @@ -1579,7 +1579,7 @@ adding new entry: cn=Print Operators,ou=Groups,dc=abmas,dc=biz adding new entry: cn=Backup Operators,ou=Groups,dc=abmas,dc=biz adding new entry: cn=Replicators,ou=Groups,dc=abmas,dc=biz </pre><p> - </p></li><li class="step" title="Step 4"><p> + </p></li><li><p> Edit the <code class="filename">/etc/smbldap-tools/smbldap.conf</code> file so that the following information is changed from: </p><pre class="screen"> @@ -1592,15 +1592,15 @@ sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}" #sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}" sambaUnixIdPooldn="sambaDomainName=MEGANET2,dc=abmas,dc=biz" </pre><p> - </p></li><li class="step" title="Step 5"><p> + </p></li><li><p> It is necessary to restart the LDAP server as shown here: </p><pre class="screen"> <code class="prompt">root# </code> rcldap restart Shutting down ldap-server done Starting ldap-server done </pre><p> - </p></li><li class="step" title="Step 6"><p> - <a class="indexterm" name="id2583535"></a> + </p></li><li><p> + <a class="indexterm" name="id2577450"></a> So that we can use a global IDMAP repository, the LDAP directory must have a container object for IDMAP data. There are several ways you can check that your LDAP database is able to receive IDMAP information. One of the simplest is to execute: @@ -1609,7 +1609,7 @@ Starting ldap-server done dn: ou=Idmap,dc=abmas,dc=biz ou: idmap </pre><p> - <a class="indexterm" name="id2583558"></a> + <a class="indexterm" name="id2577473"></a> If the execution of this command does not return IDMAP entries, you need to create an LDIF template file (see <a class="link" href="happy.html#sbehap-ldifadd" title="Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">“LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF”</a>). You can add the required entries using the following command: @@ -1618,8 +1618,8 @@ ou: idmap -w not24get < /etc/openldap/idmap.LDIF </pre><p> Samba automatically populates this LDAP directory container when it needs to. - </p></li><li class="step" title="Step 7"><p> - <a class="indexterm" name="id2583598"></a> + </p></li><li><p> + <a class="indexterm" name="id2577513"></a> It looks like all has gone well, as expected. Let's confirm that this is the case by running a few tests. First we check the contents of the database directly by running <code class="literal">slapcat</code> as follows (the output has been cut down): @@ -1656,8 +1656,8 @@ modifiersName: cn=Manager,dc=abmas,dc=biz modifyTimestamp: 20031217234206Z </pre><p> This looks good so far. - </p></li><li class="step" title="Step 8"><p> - <a class="indexterm" name="id2583649"></a> + </p></li><li><p> + <a class="indexterm" name="id2577564"></a> The next step is to prove that the LDAP server is running and responds to a search request. Execute the following as shown (output has been cut to save space): </p><pre class="screen"> @@ -1701,8 +1701,8 @@ result: 0 Success # numEntries: 19 </pre><p> Good. It is all working just fine. - </p></li><li class="step" title="Step 9"><p> - <a class="indexterm" name="id2583706"></a> + </p></li><li><p> + <a class="indexterm" name="id2577621"></a> You must now make certain that the NSS resolver can interrogate LDAP also. Execute the following commands: </p><pre class="screen"> @@ -1715,16 +1715,16 @@ Domain Users:x:513: Domain Guests:x:514: Domain Computers:x:553: </pre><p> - <a class="indexterm" name="id2583736"></a> + <a class="indexterm" name="id2577651"></a> This demonstrates that the <code class="literal">nss_ldap</code> library is functioning as it should. If these two steps fail to produce this information, refer to <a class="link" href="happy.html#sbeavoid" title="Avoiding Failures: Solving Problems Before They Happen">“Avoiding Failures: Solving Problems Before They Happen”</a> for diagnostic procedures that can be followed to isolate the cause of the problem. Proceed to the next step only when the previous steps have been successfully completed. - </p></li><li class="step" title="Step 10"><p> - <a class="indexterm" name="id2583766"></a> - <a class="indexterm" name="id2583773"></a> - <a class="indexterm" name="id2583780"></a> + </p></li><li><p> + <a class="indexterm" name="id2577681"></a> + <a class="indexterm" name="id2577688"></a> + <a class="indexterm" name="id2577695"></a> Our database is now ready for the addition of network users. For each user for whom an account must be created, execute the following: </p><pre class="screen"> @@ -1739,8 +1739,8 @@ New SMB password: XXXXXXXX Retype new SMB password: XXXXXXXX </pre><p> where <code class="constant">username</code> is the login ID for each user. - </p></li><li class="step" title="Step 11"><p> - <a class="indexterm" name="id2583841"></a> + </p></li><li><p> + <a class="indexterm" name="id2577756"></a> Now verify that the UNIX (POSIX) accounts can be resolved via NSS by executing the following: </p><pre class="screen"> @@ -1756,7 +1756,7 @@ chrisr:x:1002:513:System User:/home/chrisr:/bin/bash maryv:x:1003:513:System User:/home/maryv:/bin/bash </pre><p> This demonstrates that user account resolution via LDAP is working. - </p></li><li class="step" title="Step 12"><p> + </p></li><li><p> This step will determine whether or not identity resolution is working correctly. Do not procede is this step fails, rather find the cause of the failure. The <code class="literal">id</code> command may be used to validate your configuration so far, @@ -1767,8 +1767,8 @@ uid=1002(chrisr) gid=513(Domain Users) groups=513(Domain Users) </pre><p> This confirms that the UNIX (POSIX) user account information can be resolved from LDAP by system tools that make a getentpw() system call. - </p></li><li class="step" title="Step 13"><p> - <a class="indexterm" name="id2583907"></a> + </p></li><li><p> + <a class="indexterm" name="id2577822"></a> The root account must have UID=0; if not, this means that operations conducted from a Windows client using tools such as the Domain User Manager fails under UNIX because the management of user and group accounts requires that the UID=0. Additionally, it is @@ -1779,7 +1779,7 @@ uid=1002(chrisr) gid=513(Domain Users) groups=513(Domain Users) <code class="prompt">root# </code> cd /opt/IDEALX/sbin <code class="prompt">root# </code> ./smbldap-usermod -u 0 -d /root -s /bin/bash root </pre><p> - </p></li><li class="step" title="Step 14"><p> + </p></li><li><p> Verify that the changes just made to the <code class="constant">root</code> account were accepted by executing: </p><pre class="screen"> @@ -1788,7 +1788,7 @@ root:x:0:0:root:/root:/bin/bash root:x:0:512:Netbios Domain Administrator:/root:/bin/bash </pre><p> This demonstrates that the changes were accepted. - </p></li><li class="step" title="Step 15"><p> + </p></li><li><p> Make certain that a home directory has been created for every user by listing the directories in <code class="filename">/home</code> as follows: </p><pre class="screen"> @@ -1801,9 +1801,9 @@ drwx------ 7 maryv Domain Users 568 Dec 17 01:27 maryv/ drwx------ 7 stans Domain Users 568 Dec 17 01:43 stans/ </pre><p> This is precisely what we want to see. - </p></li><li class="step" title="Step 16"><p> - <a class="indexterm" name="id2584006"></a> - <a class="indexterm" name="id2584013"></a> + </p></li><li><p> + <a class="indexterm" name="id2577921"></a> + <a class="indexterm" name="id2577928"></a> The final validation step involves making certain that Samba-3 can obtain the user accounts from the LDAP ldapsam passwd backend. Execute the following command as shown: </p><pre class="screen"> @@ -1833,8 +1833,8 @@ Bad password count : 0 Logon hours : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF </pre><p> This looks good. Of course, you fully expected that it would all work, didn't you? - </p></li><li class="step" title="Step 17"><p> - <a class="indexterm" name="id2584058"></a> + </p></li><li><p> + <a class="indexterm" name="id2577973"></a> Now you add the group accounts that are used on the Abmas network. Execute the following exactly as shown: </p><pre class="screen"> @@ -1844,8 +1844,8 @@ Logon hours : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF </pre><p> The addition of groups does not involve keyboard interaction, so the lack of console output is of no concern. - </p></li><li class="step" title="Step 18"><p> - <a class="indexterm" name="id2584100"></a> + </p></li><li><p> + <a class="indexterm" name="id2578015"></a> You really do want to confirm that UNIX group resolution from LDAP is functioning as it should. Let's do this as shown here: </p><pre class="screen"> @@ -1861,8 +1861,8 @@ PIOps:x:1002: </pre><p> The well-known special accounts (Domain Admins, Domain Users, Domain Guests), as well as our own site-specific group accounts, are correctly listed. This is looking good. - </p></li><li class="step" title="Step 19"><p> - <a class="indexterm" name="id2584133"></a> + </p></li><li><p> + <a class="indexterm" name="id2578048"></a> The final step we need to validate is that Samba can see all the Windows domain groups and that they are correctly mapped to the respective UNIX group account. To do this, just execute the following command: @@ -1879,7 +1879,7 @@ PIOps (S-1-5-21-3504140859-1010554828-2431957765-3005) -> PIOps This is looking good. Congratulations it works! Note that in the above output the lines were shortened by replacing the middle value (1010554828) of the SID with the ellipsis (...). - </p></li><li class="step" title="Step 20"><p> + </p></li><li><p> The server you have so carefully built is now ready for another important step. You start the Samba-3 server and validate its operation. Execute the following to render all the processes needed fully operative so that, on system reboot, they are automatically @@ -1895,7 +1895,7 @@ PIOps (S-1-5-21-3504140859-1010554828-2431957765-3005) -> PIOps <code class="prompt">root# </code> rcsmb start <code class="prompt">root# </code> rcwinbind start </pre><p> - </p></li><li class="step" title="Step 21"><p> + </p></li><li><p> The next step might seem a little odd at this point, but take note that you are about to start <code class="literal">winbindd</code>, which must be able to authenticate to the PDC via the localhost interface with the <code class="literal">smbd</code> process. This account can be @@ -1910,14 +1910,14 @@ PIOps (S-1-5-21-3504140859-1010554828-2431957765-3005) -> PIOps Joined domain MEGANET2. </pre><p> This indicates that the domain security account for the PDC has been correctly created. - </p></li><li class="step" title="Step 22"><p> + </p></li><li><p> At this time it is necessary to restart <code class="literal">winbindd</code> so that it can correctly authenticate to the PDC. The following command achieves that: </p><pre class="screen"> <code class="prompt">root# </code> rcwinbind restart </pre><p> - </p></li><li class="step" title="Step 23"><p> - <a class="indexterm" name="id2584348"></a> + </p></li><li><p> + <a class="indexterm" name="id2578263"></a> You may now check Samba-3 operation as follows: </p><pre class="screen"> <code class="prompt">root# </code> smbclient -L massive -U% @@ -1943,7 +1943,7 @@ Joined domain MEGANET2. MEGANET2 MASSIVE </pre><p> This shows that an anonymous connection is working. - </p></li><li class="step" title="Step 24"><p> + </p></li><li><p> For your finale, let's try an authenticated connection: </p><pre class="screen"> <code class="prompt">root# </code> smbclient //massive/bobj -Ubobj%n3v3r2l8 @@ -1962,47 +1962,47 @@ smb: \> q Well done. All is working fine. </p></li></ol></div><p> The server <code class="constant">MASSIVE</code> is now configured, and it is time to move onto the next task. - </p></div><div class="sect2" title="Printer Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-ptrcfg"></a>Printer Configuration</h3></div></div></div><p> - <a class="indexterm" name="id2584459"></a> + </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-ptrcfg"></a>Printer Configuration</h3></div></div></div><p> + <a class="indexterm" name="id2578374"></a> The configuration for Samba-3 to enable CUPS raw-print-through printing has already been taken care of in the <code class="filename">smb.conf</code> file. The only preparation needed for <code class="constant">smart</code> printing to be possible involves creation of the directories in which Samba-3 stores Windows printing driver files. - </p><div class="procedure" title="Procedure 5.9. Printer Configuration Steps"><a name="id2584481"></a><p class="title"><b>Procedure 5.9. Printer Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="id2578396"></a><p class="title"><b>Procedure 5.9. Printer Configuration Steps</b></p><ol type="1"><li><p> Configure all network-attached printers to have a fixed IP address. - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> Create an entry in the DNS database on the server <code class="constant">MASSIVE</code> in both the forward lookup database for the zone <code class="constant">abmas.biz.hosts</code> and in the reverse lookup database for the network segment that the printer is to be located in. Example configuration files for similar zones were presented in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a>, <a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a> and in <a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a>. - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> Follow the instructions in the printer manufacturers' manuals to permit printing to port 9100. Use any other port the manufacturer specifies for direct mode, raw printing. This allows the CUPS spooler to print using raw mode protocols. - <a class="indexterm" name="id2584542"></a> - <a class="indexterm" name="id2584549"></a> - </p></li><li class="step" title="Step 4"><p> - <a class="indexterm" name="id2584563"></a> - <a class="indexterm" name="id2584569"></a> + <a class="indexterm" name="id2578457"></a> + <a class="indexterm" name="id2578464"></a> + </p></li><li><p> + <a class="indexterm" name="id2578477"></a> + <a class="indexterm" name="id2578484"></a> Only on the server to which the printer is attached, configure the CUPS Print Queues as follows: </p><pre class="screen"> <code class="prompt">root# </code> lpadmin -p <em class="parameter"><code>printque</code></em> -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E </pre><p> - <a class="indexterm" name="id2584605"></a> + <a class="indexterm" name="id2578520"></a> This step creates the necessary print queue to use no assigned print filter. This is ideal for raw printing, that is, printing without use of filters. The name <em class="parameter"><code>printque</code></em> is the name you have assigned for the particular printer. - </p></li><li class="step" title="Step 5"><p> + </p></li><li><p> Print queues may not be enabled at creation. Make certain that the queues you have just created are enabled by executing the following: </p><pre class="screen"> <code class="prompt">root# </code> /usr/bin/enable <em class="parameter"><code>printque</code></em> </pre><p> - </p></li><li class="step" title="Step 6"><p> + </p></li><li><p> Even though your print queue may be enabled, it is still possible that it may not accept print jobs. A print queue will service incoming printing requests only when configured to do so. Ensure that your print queue is @@ -2010,27 +2010,27 @@ smb: \> q </p><pre class="screen"> <code class="prompt">root# </code> /usr/bin/accept <em class="parameter"><code>printque</code></em> </pre><p> - </p></li><li class="step" title="Step 7"><p> - <a class="indexterm" name="id2584686"></a> - <a class="indexterm" name="id2584693"></a> - <a class="indexterm" name="id2584700"></a> + </p></li><li><p> + <a class="indexterm" name="id2578601"></a> + <a class="indexterm" name="id2578608"></a> + <a class="indexterm" name="id2578615"></a> Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: </p><pre class="screen"> application/octet-stream application/vnd.cups-raw 0 - </pre><p> - </p></li><li class="step" title="Step 8"><p> - <a class="indexterm" name="id2584729"></a> + </p></li><li><p> + <a class="indexterm" name="id2578643"></a> Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: </p><pre class="screen"> application/octet-stream </pre><p> - </p></li><li class="step" title="Step 9"><p> + </p></li><li><p> Refer to the CUPS printing manual for instructions regarding how to configure CUPS so that print queues that reside on CUPS servers on remote networks route print jobs to the print server that owns that queue. The default setting on your CUPS server may automatically discover remotely installed printers and may permit this functionality without requiring specific configuration. - </p></li><li class="step" title="Step 10"><p> + </p></li><li><p> The following action creates the necessary directory subsystem. Follow these steps to printing heaven: </p><pre class="screen"> @@ -2038,17 +2038,17 @@ application/octet-stream <code class="prompt">root# </code> chown -R root:root /var/lib/samba/drivers <code class="prompt">root# </code> chmod -R ug=rwx,o=rx /var/lib/samba/drivers </pre><p> - </p></li></ol></div></div></div><div class="sect1" title="Samba-3 BDC Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sbehap-bldg1"></a>Samba-3 BDC Configuration</h2></div></div></div><div class="procedure" title="Procedure 5.10. Configuration of BDC Called: BLDG1"><a name="id2584812"></a><p class="title"><b>Procedure 5.10. Configuration of BDC Called: <code class="constant">BLDG1</code></b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sbehap-bldg1"></a>Samba-3 BDC Configuration</h2></div></div></div><div class="procedure"><a name="id2578727"></a><p class="title"><b>Procedure 5.10. Configuration of BDC Called: <code class="constant">BLDG1</code></b></p><ol type="1"><li><p> Install the files in <a class="link" href="happy.html#sbehap-bldg1-smbconf" title="Example 5.8. LDAP Based smb.conf File, Server: BLDG1">“LDAP Based smb.conf File, Server: BLDG1”</a>, <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, and <a class="link" href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">“LDAP Based smb.conf File, Shares Section Part B”</a> into the <code class="filename">/etc/samba/</code> directory. The three files should be added together to form the <code class="filename">smb.conf</code> file. - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> Verify the <code class="filename">smb.conf</code> file as in step 2 of <a class="link" href="happy.html#sbehap-massive" title="Samba-3 PDC Configuration">“Samba-3 PDC Configuration”</a>. - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> Carefully follow the steps outlined in <a class="link" href="happy.html#sbehap-PAM-NSS" title="PAM and NSS Client Configuration">“PAM and NSS Client Configuration”</a>, taking particular note to install the correct <code class="filename">ldap.conf</code>. - </p></li><li class="step" title="Step 4"><p> + </p></li><li><p> Verify that the NSS resolver is working. You may need to cycle the run level to 1 and back to 5 before the NSS LDAP resolver functions. Follow these commands: @@ -2080,8 +2080,8 @@ vaioboss$:x:1005:553:vaioboss$:/dev/null:/bin/false bldg1$:x:1006:553:bldg1$:/dev/null:/bin/false </pre><p> This is the correct output. If the accounts that have UIDs above 512 are not shown, there is a problem. - </p></li><li class="step" title="Step 5"><p> - <a class="indexterm" name="id2584972"></a> + </p></li><li><p> + <a class="indexterm" name="id2578887"></a> The next step in the verification process involves testing the operation of UNIX group resolution via the NSS LDAP resolver. Execute these commands: </p><pre class="screen"> @@ -2110,15 +2110,15 @@ PIOps:x:1002: </pre><p> This is also the correct and desired output, because it demonstrates that the LDAP client is able to communicate correctly with the LDAP server (<code class="constant">MASSIVE</code>). - </p></li><li class="step" title="Step 6"><p> - <a class="indexterm" name="id2585013"></a> + </p></li><li><p> + <a class="indexterm" name="id2578928"></a> You must now set the LDAP administrative password into the Samba-3 <code class="filename">secrets.tdb</code> file by executing this command: </p><pre class="screen"> <code class="prompt">root# </code> smbpasswd -w not24get Setting stored password for "cn=Manager,dc=abmas,dc=biz" in secrets.tdb </pre><p> - </p></li><li class="step" title="Step 7"><p> + </p></li><li><p> Now you must obtain the domain SID from the PDC and store it into the <code class="filename">secrets.tdb</code> file also. This step is not necessary with an LDAP passdb backend because Samba-3 obtains the domain SID from the @@ -2135,15 +2135,15 @@ Storing SID S-1-5-21-3504140859-1010554828-2431957765 \ domain controller that is running on the localhost and must be able to authenticate, thus requiring that the BDC should be joined to the domain. The process of joining the domain creates the necessary authentication accounts. - </p></li><li class="step" title="Step 8"><p> + </p></li><li><p> To join the Samba BDC to the domain, execute the following: </p><pre class="screen"> <code class="prompt">root# </code> net rpc join -U root%not24get Joined domain MEGANET2. </pre><p> This indicates that the domain security account for the BDC has been correctly created. - </p></li><li class="step" title="Step 9"><p> - <a class="indexterm" name="id2585114"></a> + </p></li><li><p> + <a class="indexterm" name="id2579029"></a> Verify that user and group account resolution works via Samba-3 tools as follows: </p><pre class="screen"> <code class="prompt">root# </code> pdbedit -L @@ -2169,7 +2169,7 @@ Finances (S-1-5-21-3504140859-1010554828-2431957765-3003) -> Finances PIOps (S-1-5-21-3504140859-1010554828-2431957765-3005) -> PIOps </pre><p> These results show that all things are in order. - </p></li><li class="step" title="Step 10"><p> + </p></li><li><p> The server you have so carefully built is now ready for another important step. Now start the Samba-3 server and validate its operation. Execute the following to render all the processes needed fully operative so that, upon system reboot, they are automatically @@ -2185,7 +2185,7 @@ PIOps (S-1-5-21-3504140859-1010554828-2431957765-3005) -> PIOps <code class="prompt">root# </code> rcwinbind start </pre><p> Samba-3 should now be running and is ready for a quick test. But not quite yet! - </p></li><li class="step" title="Step 11"><p> + </p></li><li><p> Your new <code class="constant">BLDG1, BLDG2</code> servers do not have home directories for users. To rectify this using the SUSE yast2 utility or by manually editing the <code class="filename">/etc/fstab</code> file, add a mount entry to mount the <code class="constant">home</code> directory that has been exported @@ -2205,7 +2205,7 @@ massive.abmas.biz:/home /home nfs rw 0 0 <code class="prompt">root# </code> df | grep home massive:/home 29532988 283388 29249600 1% /home </pre><p> - </p></li><li class="step" title="Step 12"><p> + </p></li><li><p> Implement a quick check using one of the users that is in the LDAP database. Here you go: </p><pre class="screen"> <code class="prompt">root# </code> smbclient //bldg1/bobj -Ubobj%n3v3r2l8 @@ -2224,26 +2224,26 @@ smb: \> q </p></li></ol></div><p> Now that the first BDC (<code class="constant">BDLG1</code>) has been configured it is time to build and configure the second BDC server (<code class="constant">BLDG2</code>) as follows: - </p><div class="procedure" title="Procedure 5.11. Configuration of BDC Called BLDG2"><a name="sbehap-bldg2"></a><p class="title"><b>Procedure 5.11. Configuration of BDC Called <code class="constant">BLDG2</code></b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="sbehap-bldg2"></a><p class="title"><b>Procedure 5.11. Configuration of BDC Called <code class="constant">BLDG2</code></b></p><ol type="1"><li><p> Install the files in <a class="link" href="happy.html#sbehap-bldg2-smbconf" title="Example 5.9. LDAP Based smb.conf File, Server: BLDG2">“LDAP Based smb.conf File, Server: BLDG2”</a>, <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, and <a class="link" href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">“LDAP Based smb.conf File, Shares Section Part B”</a> into the <code class="filename">/etc/samba/</code> directory. The three files should be added together to form the <code class="filename">smb.conf</code> file. - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> Follow carefully the steps shown in <a class="link" href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">“Samba-3 BDC Configuration”</a>, starting at step 2. - </p></li></ol></div><div class="example"><a name="sbehap-bldg1-smbconf"></a><p class="title"><b>Example 5.8. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2585460"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2585472"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2585484"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2585496"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2585508"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2585520"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2585532"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2585543"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2585555"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2585567"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2585578"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2585590"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2585602"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2585614"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2585626"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2585638"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2585650"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2585662"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2585673"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2585685"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2585697"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2585709"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2585721"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2585733"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2585745"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2585757"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2585769"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2585781"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2585793"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2585804"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2585816"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-bldg2-smbconf"></a><p class="title"><b>Example 5.9. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2585863"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2585874"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2585886"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id2585898"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2585910"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2585922"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2585934"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2585946"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2585957"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2585969"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2585981"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2585992"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2586005"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2586016"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2586029"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2586041"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2586052"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2586064"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586076"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2586088"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2586099"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2586111"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2586123"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2586135"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2586147"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2586159"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2586171"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2586184"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2586195"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2586207"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2586219"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfa"></a><p class="title"><b>Example 5.10. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2586265"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2586277"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2586288"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2586309"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2586320"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2586332"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2586353"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2586365"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2586376"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2586397"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2586408"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2586420"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2586432"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2586452"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2586464"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2586476"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586487"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586499"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfb"></a><p class="title"><b>Example 5.11. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2586545"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2586557"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2586568"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id2586580"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2586600"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2586612"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2586624"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586635"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2586656"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2586668"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2586680"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2586691"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2586712"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2586724"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2586736"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2586747"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2586768"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2586780"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2586791"></a><em class="parameter"><code>browseable = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586803"></a><em class="parameter"><code>guest ok = no</code></em></td></tr><tr><td><a class="indexterm" name="id2586815"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586826"></a><em class="parameter"><code>write list = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-ldifadd"></a><p class="title"><b>Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen"> + </p></li></ol></div><div class="example"><a name="sbehap-bldg1-smbconf"></a><p class="title"><b>Example 5.8. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2579375"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2579387"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2579398"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2579410"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579423"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579434"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2579446"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2579458"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2579470"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2579481"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2579493"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2579505"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2579517"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2579529"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2579541"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2579553"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2579565"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2579576"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579588"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2579600"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2579612"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579623"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2579635"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2579647"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2579659"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2579671"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579684"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579696"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2579708"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2579719"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2579731"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-bldg2-smbconf"></a><p class="title"><b>Example 5.9. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2579777"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2579789"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2579801"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id2579813"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579825"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579837"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2579849"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2579861"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2579872"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2579884"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2579896"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2579907"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2579919"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2579931"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2579943"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2579955"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2579967"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2579979"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579991"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580002"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2580014"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580026"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2580038"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2580050"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2580062"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2580074"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580086"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580098"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2580110"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2580122"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2580133"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfa"></a><p class="title"><b>Example 5.10. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2580180"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580192"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2580203"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2580223"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580235"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2580247"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2580268"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580279"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2580291"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2580312"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2580323"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2580335"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580346"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2580367"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2580379"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2580390"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580402"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580414"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfb"></a><p class="title"><b>Example 5.11. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2580460"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580471"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2580483"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id2580494"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2580515"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2580527"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2580539"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580550"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2580571"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2580582"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2580594"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580606"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2580627"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2580638"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2580650"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580662"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2580683"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2580694"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2580706"></a><em class="parameter"><code>browseable = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580718"></a><em class="parameter"><code>guest ok = no</code></em></td></tr><tr><td><a class="indexterm" name="id2580729"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580741"></a><em class="parameter"><code>write list = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-ldifadd"></a><p class="title"><b>Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen"> dn: ou=Idmap,dc=abmas,dc=biz objectClass: organizationalUnit ou: idmap structuralObjectClass: organizationalUnit -</pre></div></div><br class="example-break"></div><div class="sect1" title="Miscellaneous Server Preparation Tasks"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2586862"></a>Miscellaneous Server Preparation Tasks</h2></div></div></div><p> - My father would say, <span class="quote">“<span class="quote">Dinner is not over until the dishes have been done.</span>”</span> +</pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2580776"></a>Miscellaneous Server Preparation Tasks</h2></div></div></div><p> + My father would say, “<span class="quote">Dinner is not over until the dishes have been done.</span>” The makings of a great network environment take a lot of effort and attention to detail. So far, you have completed most of the complex (and to many administrators, the interesting part of server configuration) steps, but remember to tie it all together. Here are a few more steps that must be completed so that your network runs like a well-rehearsed orchestra. - </p><div class="sect2" title="Configuring Directory Share Point Roots"><div class="titlepage"><div><div><h3 class="title"><a name="id2586882"></a>Configuring Directory Share Point Roots</h3></div></div></div><p> + </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2580797"></a>Configuring Directory Share Point Roots</h3></div></div></div><p> In your <code class="filename">smb.conf</code> file, you have specified Windows shares. Each has a <em class="parameter"><code>path</code></em> parameter. Even though it is obvious to all, one of the common Samba networking problems is caused by forgetting to verify that every such share root directory actually exists and that it @@ -2261,7 +2261,7 @@ structuralObjectClass: organizationalUnit <code class="prompt">root# </code> chmod -R ug+rwxs,o-rwx /data <code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /apps </pre><p> - </p></div><div class="sect2" title="Configuring Profile Directories"><div class="titlepage"><div><div><h3 class="title"><a name="id2586977"></a>Configuring Profile Directories</h3></div></div></div><p> + </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2580892"></a>Configuring Profile Directories</h3></div></div></div><p> You made a conscious decision to do everything it would take to improve network client performance. One of your decisions was to implement folder redirection. This means that Windows user desktop profiles are now made up of two components: a dynamically loaded part and a set of file @@ -2286,17 +2286,17 @@ structuralObjectClass: organizationalUnit <code class="prompt">root# </code> chmod -R 750 <span class="emphasis"><em>username</em></span> </pre><p> </p><p> - <a class="indexterm" name="id2587093"></a> - <a class="indexterm" name="id2587100"></a> + <a class="indexterm" name="id2581008"></a> + <a class="indexterm" name="id2581015"></a> You have three options insofar as the dynamically loaded portion of the roaming profile is concerned: - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>You may permit the user to obtain a default profile.</p></li><li class="listitem"><p>You can create a mandatory profile.</p></li><li class="listitem"><p>You can create a group profile (which is almost always a mandatory profile).</p></li></ul></div><p> + </p><div class="itemizedlist"><ul type="disc"><li><p>You may permit the user to obtain a default profile.</p></li><li><p>You can create a mandatory profile.</p></li><li><p>You can create a group profile (which is almost always a mandatory profile).</p></li></ul></div><p> Mandatory profiles cannot be overwritten by a user. The change from a user profile to a mandatory profile is effected by renaming the <code class="filename">NTUSER.DAT</code> to <code class="filename">NTUSER.MAN</code>, that is, just by changing the filename extension. </p><p> - <a class="indexterm" name="id2587150"></a> - <a class="indexterm" name="id2587156"></a> + <a class="indexterm" name="id2581064"></a> + <a class="indexterm" name="id2581071"></a> The location of the profile that a user can obtain is set in the user's account in the LDAP passdb backend. You can manage this using the Idealx smbldap-tools or using the <a class="ulink" href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">Windows NT4 Domain User Manager</a>. @@ -2309,8 +2309,8 @@ structuralObjectClass: organizationalUnit /var/lib/samba/profiles/<span class="emphasis"><em>username</em></span> <code class="prompt">root# </code> chmod 700 /var/lib/samba/profiles/<span class="emphasis"><em>username</em></span> </pre><p> - </p></div><div class="sect2" title="Preparation of Logon Scripts"><div class="titlepage"><div><div><h3 class="title"><a name="id2587221"></a>Preparation of Logon Scripts</h3></div></div></div><p> - <a class="indexterm" name="id2587229"></a> + </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2581136"></a>Preparation of Logon Scripts</h3></div></div></div><p> + <a class="indexterm" name="id2581144"></a> The use of a logon script with Windows XP Professional is an option that every site should consider. Unless you have locked down the desktop so the user cannot change anything, there is risk that a vital network drive setting may be broken or that printer connections may be lost. Logon scripts @@ -2335,7 +2335,7 @@ structuralObjectClass: organizationalUnit You should research the options for logon script implementation by referring to <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 24, Section 24.4. A quick Web search will bring up a host of options. One of the most popular logon facilities in use today is called <a class="ulink" href="http://www.kixtart.org" target="_top">KiXtart</a>. - </p></div><div class="sect2" title="Assigning User Rights and Privileges"><div class="titlepage"><div><div><h3 class="title"><a name="id2587332"></a>Assigning User Rights and Privileges</h3></div></div></div><p> + </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2581247"></a>Assigning User Rights and Privileges</h3></div></div></div><p> The ability to perform tasks such as joining Windows clients to the domain can be assigned to normal user accounts. By default, only the domain administrator account (<code class="constant">root</code> on UNIX systems because it has UID=0) can add accounts. New to Samba 3.0.11 is the ability to grant @@ -2347,9 +2347,9 @@ structuralObjectClass: organizationalUnit Samba limits privileges on a per-server basis. This is a deliberate limitation so that users who are granted rights can be restricted to particular machines. It is left to the network administrator to determine which rights should be provided and to whom. - </p><div class="procedure" title="Procedure 5.12. Steps for Assignment of User Rights and Privileges"><a name="id2587368"></a><p class="title"><b>Procedure 5.12. Steps for Assignment of User Rights and Privileges</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="id2581283"></a><p class="title"><b>Procedure 5.12. Steps for Assignment of User Rights and Privileges</b></p><ol type="1"><li><p> Log onto the PDC as the <code class="constant">root</code> account. - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> Execute the following command to grant the <code class="constant">Domain Admins</code> group all rights and privileges: </p><pre class="screen"> @@ -2361,7 +2361,7 @@ Successfully granted rights. </pre><p> Repeat this step on each domain controller, in each case substituting the name of the server (e.g., BLDG1, BLDG2) in place of the PDC called MASSIVE. - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> In this step the privilege will be granted to Bob Jordan (bobj) to add Windows workstations to the domain. Execute the following only on the PDC. It is not necessary to do this on BDCs or on DMS machines because machine accounts are only ever added by the PDC: @@ -2370,7 +2370,7 @@ Successfully granted rights. "MEGANET2\bobj" SeMachineAccountPrivilege Successfully granted rights. </pre><p> - </p></li><li class="step" title="Step 4"><p> + </p></li><li><p> Verify that privilege assignments have been correctly applied by executing: </p><pre class="screen"> net rpc rights list accounts -Uroot%not24get @@ -2405,8 +2405,8 @@ SeAddUsersPrivilege SeRemoteShutdownPrivilege SeDiskOperatorPrivilege </pre><p> - </p></li></ol></div></div></div><div class="sect1" title="Windows Client Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2587466"></a>Windows Client Configuration</h2></div></div></div><p> - <a class="indexterm" name="id2587474"></a> + </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2581381"></a>Windows Client Configuration</h2></div></div></div><p> + <a class="indexterm" name="id2581389"></a> In the next few sections, you can configure a new Windows XP Professional disk image on a staging machine. You will configure all software, printer settings, profile and policy handling, and desktop default profile settings on this system. When it is complete, you copy the contents of the @@ -2418,60 +2418,60 @@ SeDiskOperatorPrivilege "<a class="ulink" href="http://support.microsoft.com/default.aspx?scid=kb;EN-US;168475" target="_top">How to Create a Base Profile for All Users."</a> - </p><div class="sect2" title="Configuration of Default Profile with Folder Redirection"><div class="titlepage"><div><div><h3 class="title"><a name="redirfold"></a>Configuration of Default Profile with Folder Redirection</h3></div></div></div><p> - <a class="indexterm" name="id2587524"></a> + </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="redirfold"></a>Configuration of Default Profile with Folder Redirection</h3></div></div></div><p> + <a class="indexterm" name="id2581439"></a> Log onto the Windows XP Professional workstation as the local <code class="constant">Administrator</code>. It is necessary to expose folders that are generally hidden to provide access to the <code class="constant">Default User</code> folder. - </p><div class="procedure" title="Procedure 5.13. Expose Hidden Folders"><a name="id2587542"></a><p class="title"><b>Procedure 5.13. Expose Hidden Folders</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="id2581457"></a><p class="title"><b>Procedure 5.13. Expose Hidden Folders</b></p><ol type="1"><li><p> Launch the Windows Explorer by clicking <span class="guimenu">Start</span> → <span class="guimenuitem">My Computer</span> → <span class="guimenuitem">Tools</span> → <span class="guimenuitem">Folder Options</span> → <span class="guimenuitem">View Tab</span>. Select <span class="guilabel">Show hidden files and folders</span>, and click <span class="guibutton">OK</span>. Exit Windows Explorer. - </p></li><li class="step" title="Step 2"><p> - <a class="indexterm" name="id2587609"></a> + </p></li><li><p> + <a class="indexterm" name="id2581523"></a> Launch the Registry Editor. Click <span class="guimenu">Start</span> → <span class="guimenuitem">Run</span>. Key in <code class="literal">regedt32</code>, and click <span class="guibutton">OK</span>. </p></li></ol></div><p> - </p><div class="procedure" title="Procedure 5.14. Redirect Folders in Default System User Profile"><a name="sbehap-rdrfldr"></a><p class="title"><b>Procedure 5.14. Redirect Folders in Default System User Profile</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> - <a class="indexterm" name="id2587667"></a> - <a class="indexterm" name="id2587673"></a> + </p><div class="procedure"><a name="sbehap-rdrfldr"></a><p class="title"><b>Procedure 5.14. Redirect Folders in Default System User Profile</b></p><ol type="1"><li><p> + <a class="indexterm" name="id2581581"></a> + <a class="indexterm" name="id2581588"></a> Give focus to <code class="constant">HKEY_LOCAL_MACHINE</code> hive entry in the left panel. Click <span class="guimenu">File</span> → <span class="guimenuitem">Load Hive...</span> → <span class="guimenuitem">Documents and Settings</span> → <span class="guimenuitem">Default User</span> → <span class="guimenuitem">NTUSER</span> → <span class="guimenuitem">Open</span>. In the dialog box that opens, enter the key name <code class="constant">Default</code> and click <span class="guibutton">OK</span>. - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> Browse inside the newly loaded Default folder to: </p><pre class="screen"> HKEY_LOCAL_MACHINE\Default\Software\Microsoft\Windows\ CurrentVersion\Explorer\User Shell Folders\ </pre><p> The right panel reveals the contents as shown in <a class="link" href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">“Windows XP Professional User Shared Folders”</a>. - </p></li><li class="step" title="Step 3"><p> - <a class="indexterm" name="id2587766"></a> - <a class="indexterm" name="id2587773"></a> + </p></li><li><p> + <a class="indexterm" name="id2581681"></a> + <a class="indexterm" name="id2581688"></a> You edit hive keys. Acceptable values to replace the <code class="constant">%USERPROFILE%</code> variable includes: - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>A drive letter such as <code class="constant">U:</code></p></li><li class="listitem"><p>A direct network path such as - <code class="constant">\\MASSIVE\profdata</code></p></li><li class="listitem"><p>A network redirection (UNC name) that contains a macro such as </p><p><code class="constant">%LOGONSERVER%\profdata\</code></p></li></ul></div><p> - </p></li><li class="step" title="Step 4"><p> - <a class="indexterm" name="id2587820"></a> + </p><div class="itemizedlist"><ul type="disc"><li><p>A drive letter such as <code class="constant">U:</code></p></li><li><p>A direct network path such as + <code class="constant">\\MASSIVE\profdata</code></p></li><li><p>A network redirection (UNC name) that contains a macro such as </p><p><code class="constant">%LOGONSERVER%\profdata\</code></p></li></ul></div><p> + </p></li><li><p> + <a class="indexterm" name="id2581735"></a> Set the registry keys as shown in <a class="link" href="happy.html#proffold" title="Table 5.4. Default Profile Redirections">“Default Profile Redirections”</a>. Your implementation makes the assumption that users have statically located machines. Notebook computers (mobile users) need to be accommodated using local profiles. This is not an uncommon assumption. - </p></li><li class="step" title="Step 5"><p> + </p></li><li><p> Click back to the root of the loaded hive <code class="constant">Default</code>. Click <span class="guimenu">File</span> → <span class="guimenuitem">Unload Hive...</span> → <span class="guimenuitem">Yes</span>. - </p></li><li class="step" title="Step 6"><p> - <a class="indexterm" name="id2587875"></a> + </p></li><li><p> + <a class="indexterm" name="id2581790"></a> Click <span class="guimenu">File</span> → <span class="guimenuitem">Exit</span>. This exits the Registry Editor. - </p></li><li class="step" title="Step 7"><p> + </p></li><li><p> Now follow the procedure given in <a class="link" href="happy.html#sbehap-locgrppol" title="The Local Group Policy">“The Local Group Policy”</a>. Make sure that each folder you have redirected is in the exclusion list. - </p></li><li class="step" title="Step 8"><p> - You are now ready to copy<sup>[<a name="id2587919" href="#ftn.id2587919" class="footnote">11</a>]</sup> + </p></li><li><p> + You are now ready to copy<sup>[<a name="id2581834" href="#ftn.id2581834" class="footnote">11</a>]</sup> the Default User profile to the Samba domain controllers. Launch Microsoft Windows Explorer, and use it to copy the full contents of the directory <code class="filename">Default User</code> that is in the <code class="filename">C:\Documents and Settings</code> to the root directory of the @@ -2482,14 +2482,14 @@ HKEY_LOCAL_MACHINE\Default\Software\Microsoft\Windows\ Before punching out new desktop images for the client workstations, it is perhaps a good idea that desktop behavior should be returned to the original Microsoft settings. The following steps achieve that ojective: - </p><div class="procedure" title="Procedure 5.15. Reset Folder Display to Original Behavior"><a name="id2587986"></a><p class="title"><b>Procedure 5.15. Reset Folder Display to Original Behavior</b></p><ul class="procedure"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="id2581901"></a><p class="title"><b>Procedure 5.15. Reset Folder Display to Original Behavior</b></p><ul><li><p> To launch the Windows Explorer, click <span class="guimenu">Start</span> → <span class="guimenuitem">My Computer</span> → <span class="guimenuitem">Tools</span> → <span class="guimenuitem">Folder Options</span> → <span class="guimenuitem">View Tab</span>. Deselect <span class="guilabel">Show hidden files and folders</span>, and click <span class="guibutton">OK</span>. Exit Windows Explorer. - </p></li></ul></div><div class="figure"><a name="XP-screen001"></a><p class="title"><b>Figure 5.3. Windows XP Professional User Shared Folders</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/XP-screen001.png" width="351" alt="Windows XP Professional User Shared Folders"></div></div></div><br class="figure-break"><div class="table"><a name="proffold"></a><p class="title"><b>Table 5.4. Default Profile Redirections</b></p><div class="table-contents"><table summary="Default Profile Redirections" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Registry Key</th><th align="left">Redirected Value</th></tr></thead><tbody><tr><td align="left">Cache</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</td></tr><tr><td align="left">Cookies</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Cookies</td></tr><tr><td align="left">History</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\AppData</td></tr><tr><td align="left">Local Settings</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</td></tr><tr><td align="left">My Pictures</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyPictures</td></tr><tr><td align="left">Personal</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</td></tr><tr><td align="left">Recent</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Recent</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" title="Configuration of MS Outlook to Relocate PST File"><div class="titlepage"><div><div><h3 class="title"><a name="id2588220"></a>Configuration of MS Outlook to Relocate PST File</h3></div></div></div><p> - <a class="indexterm" name="id2588229"></a> - <a class="indexterm" name="id2588238"></a> + </p></li></ul></div><div class="figure"><a name="XP-screen001"></a><p class="title"><b>Figure 5.3. Windows XP Professional User Shared Folders</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/XP-screen001.png" width="351" alt="Windows XP Professional User Shared Folders"></div></div></div><br class="figure-break"><div class="table"><a name="proffold"></a><p class="title"><b>Table 5.4. Default Profile Redirections</b></p><div class="table-contents"><table summary="Default Profile Redirections" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Registry Key</th><th align="left">Redirected Value</th></tr></thead><tbody><tr><td align="left">Cache</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</td></tr><tr><td align="left">Cookies</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Cookies</td></tr><tr><td align="left">History</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\AppData</td></tr><tr><td align="left">Local Settings</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</td></tr><tr><td align="left">My Pictures</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyPictures</td></tr><tr><td align="left">Personal</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</td></tr><tr><td align="left">Recent</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Recent</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2582135"></a>Configuration of MS Outlook to Relocate PST File</h3></div></div></div><p> + <a class="indexterm" name="id2582144"></a> + <a class="indexterm" name="id2582153"></a> Microsoft Outlook can store a Personal Storage file, generally known as a PST file. It is the nature of email storage that this file grows, at times quite rapidly. So that users' email is available to them at every workstation they may log onto, @@ -2498,19 +2498,19 @@ HKEY_LOCAL_MACHINE\Default\Software\Microsoft\Windows\ </p><p> To redirect the Outlook PST file in Outlook 2003 (older versions of Outlook behave slightly differently), follow these steps: - </p><div class="procedure" title="Procedure 5.16. Outlook PST File Relocation"><a name="id2588260"></a><p class="title"><b>Procedure 5.16. Outlook PST File Relocation</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="id2582175"></a><p class="title"><b>Procedure 5.16. Outlook PST File Relocation</b></p><ol type="1"><li><p> Close Outlook if it is open. - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> From the <span class="guimenu">Control Panel</span>, launch the Mail icon. - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> Click <span class="guimenu">Email Accounts.</span> - </p></li><li class="step" title="Step 4"><p> + </p></li><li><p> Make a note of the location of the PST file(s). From this location, move the files to the desired new target location. The most desired new target location may well be the users' home directory. - </p></li><li class="step" title="Step 5"><p> + </p></li><li><p> Add a new data file, selecting the PST file in the new desired target location. - Give this entry (not the filename) a new name such as <span class="quote">“<span class="quote">Personal Mail Folders.</span>”</span> + Give this entry (not the filename) a new name such as “<span class="quote">Personal Mail Folders.</span>” </p><p> Note: If MS Outlook has been configured to use an IMAP account configuration there may be problems following these instructions. Feedback from users suggests that where IMAP is used the PST @@ -2518,21 +2518,21 @@ HKEY_LOCAL_MACHINE\Default\Software\Microsoft\Windows\ MS Outlook's Send/Receive button. If anyone has sucessfully relocated PST files where IMAP is used please email <code class="literal">jht@samba.org</code> with useful tips and suggestions so that this warning can be removed or modified. - </p></li><li class="step" title="Step 6"><p> + </p></li><li><p> Close the <span class="guimenu">Date Files</span> windows, then click <span class="guimenu">Email Accounts</span>. - </p></li><li class="step" title="Step 7"><p> + </p></li><li><p> Select <span class="guimenu">View of Change</span> exiting email accounts, click <span class="guibutton">Next.</span> - </p></li><li class="step" title="Step 8"><p> + </p></li><li><p> Change the <span class="guimenu">Mail Delivery Location</span> so as to use the data file in the new target location. - </p></li><li class="step" title="Step 9"><p> + </p></li><li><p> Go back to the <span class="guimenu">Data Files</span> window, then delete the old data file entry. - </p></li></ol></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> - <a class="indexterm" name="id2588410"></a> + </p></li></ol></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> + <a class="indexterm" name="id2582325"></a> You may have to remove and reinstall the Outlook Address Book (Contacts) entries, otherwise the user may be not be able to retrieve contacts when addressing a new email message. - </p></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> - <a class="indexterm" name="id2588425"></a> + </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> + <a class="indexterm" name="id2582340"></a> Outlook Express is not at all like MS OutLook. It stores file very differently also. Outlook Express storage files can not be redirected to network shares. The options panel will not permit this, but they can be moved to folders outside of the user's profile. They can also be excluded @@ -2541,34 +2541,34 @@ HKEY_LOCAL_MACHINE\Default\Software\Microsoft\Windows\ While it is possible to redirect the data stores for Outlook Express data stores by editing the registry, experience has shown that data corruption and loss of email messages will result. </p><p> - <a class="indexterm" name="id2588448"></a> - <a class="indexterm" name="id2588454"></a> + <a class="indexterm" name="id2582362"></a> + <a class="indexterm" name="id2582369"></a> In the same vane as MS Outlook, Outlook Express data stores can become very large. When used with roaming profiles this can result in excruciatingly long login and logout behavior will files are synchronized. For this reason, it is highly recommended not to use Outlook Express where roaming profiles are used. </p></div><p> - <a class="indexterm" name="id2588470"></a> + <a class="indexterm" name="id2582385"></a> Microsoft does not support storing PST files on network shares, although the practice does appear to be rather popular. Anyone who does relocation the PST file to a network resource should refer the Microsoft <a class="ulink" href="http://support.microsoft.com/kb/297019/" target="_top">reference</a> to better understand the issues. </p><p> - <a class="indexterm" name="id2588491"></a> + <a class="indexterm" name="id2582406"></a> Apart from manually moving PST files to a network share, it is possible to set the default PST location for new accounts by following the instructions at the WindowsITPro <a class="ulink" href="http://www.windowsitpro.com/Windows/Article/ArticleID/48228/48228.html" target="_top">web</a> site. </p><p> - <a class="indexterm" name="id2588511"></a> + <a class="indexterm" name="id2582426"></a> User feedback suggests that disabling of oplocks on PST files will significantly improve network performance by reducing locking overheads. One way this can be done is to add to the <code class="filename">smb.conf</code> file stanza for the share the PST file the following: </p><pre class="screen"> veto oplock files = /*.pdf/*.PST/ </pre><p> - </p></div><div class="sect2" title="Configure Delete Cached Profiles on Logout"><div class="titlepage"><div><div><h3 class="title"><a name="id2588536"></a>Configure Delete Cached Profiles on Logout</h3></div></div></div><p> + </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2582451"></a>Configure Delete Cached Profiles on Logout</h3></div></div></div><p> Configure the Windows XP Professional client to auto-delete roaming profiles on logout: </p><p> - <a class="indexterm" name="id2588549"></a> + <a class="indexterm" name="id2582464"></a> Click <span class="guimenu">Start</span> → <span class="guimenuitem">Run</span>. In the dialog box, enter <code class="literal">MMC</code> and click <span class="guibutton">OK</span>. </p><p> @@ -2576,94 +2576,94 @@ veto oplock files = /*.pdf/*.PST/ profiles are deleted as network users log out of the system. Click <span class="guimenu">File</span> → <span class="guimenuitem">Add/Remove Snap-in</span> → <span class="guimenuitem">Add</span> → <span class="guimenuitem">Group Policy</span> → <span class="guimenuitem">Add</span> → <span class="guimenuitem">Finish</span> → <span class="guimenuitem">Close</span> → <span class="guimenuitem">OK</span>. </p><p> - <a class="indexterm" name="id2588645"></a> + <a class="indexterm" name="id2582560"></a> The Microsoft Management Console now shows the <span class="guimenu">Group Policy</span> utility that enables you to set the policies needed. In the left panel, click <span class="guimenuitem">Local Computer Policy</span> → <span class="guimenuitem">Administrative Templates</span> → <span class="guimenuitem">System</span> → <span class="guimenuitem">User Profiles</span>. In the right panel, set the properties shown here by double-clicking on each item as shown: - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Do not check for user ownership of Roaming Profile Folders = Enabled</p></li><li class="listitem"><p>Delete cached copies of roaming profiles = Enabled</p></li></ul></div><p> + </p><div class="itemizedlist"><ul type="disc"><li><p>Do not check for user ownership of Roaming Profile Folders = Enabled</p></li><li><p>Delete cached copies of roaming profiles = Enabled</p></li></ul></div><p> Close the Microsoft Management Console. The settings take immediate effect and persist onto all image copies made of this system to deploy the new standard desktop system. - </p></div><div class="sect2" title="Uploading Printer Drivers to Samba Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id2588716"></a>Uploading Printer Drivers to Samba Servers</h3></div></div></div><p> - <a class="indexterm" name="id2588724"></a> + </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2582630"></a>Uploading Printer Drivers to Samba Servers</h3></div></div></div><p> + <a class="indexterm" name="id2582639"></a> Users want to be able to use network printers. You have a vested interest in making it easy for them to print. You have chosen to install the printer drivers onto the Samba servers and to enable point-and-click (drag-and-drop) printing. This process results in Samba being able to automatically provide the Windows client with the driver necessary to print to the printer chosen. The following procedure must be followed for every network printer: - </p><div class="procedure" title="Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers"><a name="id2588742"></a><p class="title"><b>Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + </p><div class="procedure"><a name="id2582657"></a><p class="title"><b>Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers</b></p><ol type="1"><li><p> Join your Windows XP Professional workstation (the staging machine) to the <code class="constant">MEGANET2</code> domain. If you are not sure of the procedure, follow the guidance given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. - </p></li><li class="step" title="Step 2"><p> + </p></li><li><p> After the machine has rebooted, log onto the workstation as the domain <code class="constant">root</code> (this is the Administrator account for the operating system that is the host platform for this implementation of Samba. - </p></li><li class="step" title="Step 3"><p> + </p></li><li><p> Launch MS Windows Explorer. Navigate in the left panel. Click <span class="guimenu">My Network Places</span> → <span class="guimenuitem">Entire Network</span> → <span class="guimenuitem">Microsoft Windows Network</span> → <span class="guimenuitem">Meganet2</span> → <span class="guimenuitem">Massive</span>. Click on <span class="guimenu">Massive</span> <span class="guimenu">Printers and Faxes</span>. - </p></li><li class="step" title="Step 4"><p> + </p></li><li><p> Identify a printer that is shown in the right panel. Let us assume the printer is called <code class="constant">ps01-color</code>. Right-click on the <span class="guimenu">ps01-color</span> icon and select the <span class="guimenu">Properties</span> entry. This opens a dialog box that indicates - that <span class="quote">“<span class="quote">The printer driver is not installed on this computer. Some printer properties + that “<span class="quote">The printer driver is not installed on this computer. Some printer properties will not be accessible unless you install the printer driver. Do you want to install the - driver now?</span>”</span> It is important at this point you answer <span class="guimenu">No</span>. - </p></li><li class="step" title="Step 5"><p> + driver now?</span>” It is important at this point you answer <span class="guimenu">No</span>. + </p></li><li><p> The printer properties panel for the <span class="guimenu">ps01-color</span> printer on the server <code class="constant">MASSIVE</code> is displayed. Click the <span class="guimenu">Advanced</span> tab. Note that the box labeled <span class="guimenu">Driver</span> is empty. Click the <span class="guimenu">New Driver</span> - button that is next to the <span class="guimenu">Driver</span> box. This launches the <span class="quote">“<span class="quote">Add Printer Wizard</span>”</span>. - </p></li><li class="step" title="Step 6"><p> - <a class="indexterm" name="id2588931"></a> - <a class="indexterm" name="id2588940"></a> - The <span class="quote">“<span class="quote">Add Printer Driver Wizard on <code class="constant">MASSIVE</code></span>”</span> panel + button that is next to the <span class="guimenu">Driver</span> box. This launches the “<span class="quote">Add Printer Wizard</span>”. + </p></li><li><p> + <a class="indexterm" name="id2582846"></a> + <a class="indexterm" name="id2582855"></a> + The “<span class="quote">Add Printer Driver Wizard on <code class="constant">MASSIVE</code></span>” panel is now presented. Click <span class="guimenu">Next</span> to continue. From the left panel, select the printer manufacturer. In your case, you are adding a driver for a printer manufactured by Lexmark. In the right panel, select the printer (Lexmark Optra Color 40 PS). Click <span class="guimenu">Next</span>, and then <span class="guimenu">Finish</span> to commence driver upload. A progress bar appears and instructs you as each file is being uploaded and that it is being directed at the network server <code class="constant">\\massive\ps01-color</code>. - </p></li><li class="step" title="Step 7"><p> - <a class="indexterm" name="id2588989"></a> - <a class="indexterm" name="id2588998"></a> - <a class="indexterm" name="id2589007"></a> - <a class="indexterm" name="id2589016"></a> - <a class="indexterm" name="id2589025"></a> - <a class="indexterm" name="id2589035"></a> + </p></li><li><p> + <a class="indexterm" name="id2582904"></a> + <a class="indexterm" name="id2582913"></a> + <a class="indexterm" name="id2582922"></a> + <a class="indexterm" name="id2582931"></a> + <a class="indexterm" name="id2582940"></a> + <a class="indexterm" name="id2582950"></a> The driver upload completes in anywhere from a few seconds to a few minutes. When it completes, you are returned to the <span class="guimenu">Advanced</span> tab in the <span class="guimenu">Properties</span> panel. You can set the Location (under the <span class="guimenu">General</span> tab) and Security settings (under the <span class="guimenu">Security</span> tab). Under the <span class="guimenu">Sharing</span> tab it is possible to - load additional printer drivers; there is also a check-box in this tab called <span class="quote">“<span class="quote">List in the - directory</span>”</span>. When this box is checked, the printer will be published in Active Directory + load additional printer drivers; there is also a check-box in this tab called “<span class="quote">List in the + directory</span>”. When this box is checked, the printer will be published in Active Directory (Applicable to Active Directory use only.) - </p></li><li class="step" title="Step 8"><p> - <a class="indexterm" name="id2589090"></a> + </p></li><li><p> + <a class="indexterm" name="id2583004"></a> Click <span class="guimenu">OK</span>. It will take a minute or so to upload the settings to the server. You are now returned to the <span class="guimenu">Printers and Faxes on Massive</span> monitor. Right-click on the printer, click <span class="guimenu">Properties</span> → <span class="guimenuitem">Device Settings</span>. Now change the settings to suit your requirements. BE CERTAIN TO CHANGE AT LEAST ONE SETTING and apply the changes even if you need to reverse the changes back to their original settings. - </p></li><li class="step" title="Step 9"><p> + </p></li><li><p> This is necessary so that the printer settings are initialized in the Samba printers database. Click <span class="guimenu">Apply</span> to commit your settings. Revert any settings you changed just to initialize the Samba printers database entry for this printer. If you need to revert a setting, click <span class="guimenu">Apply</span> again. - </p></li><li class="step" title="Step 10"><p> - <a class="indexterm" name="id2589163"></a> + </p></li><li><p> + <a class="indexterm" name="id2583078"></a> Verify that all printer settings are at the desired configuration. When you are satisfied that they are, click the <span class="guimenu">General</span> tab. Now click the <span class="guimenu">Print Test Page</span> button. A test page should print. Verify that it has printed correctly. Then click <span class="guimenu">OK</span> in the panel that is newly presented. Click <span class="guimenu">OK</span> on the <span class="guimenu">ps01-color on massive Properties</span> panel. - </p></li><li class="step" title="Step 11"><p> + </p></li><li><p> You must repeat this process for all network printers (i.e., for every printer on each server). When you have finished uploading drivers to all printers, close all applications. The next task is to install software your users require to do their work. - </p></li></ol></div></div><div class="sect2" title="Software Installation"><div class="titlepage"><div><div><h3 class="title"><a name="id2589218"></a>Software Installation</h3></div></div></div><p> + </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583133"></a>Software Installation</h3></div></div></div><p> Your network has both fixed desktop workstations as well as notebook computers. As a general rule, it is a good idea to not tamper with the operating system that is provided by the notebook computer manufacturer. Notebooks require special handling that is beyond the scope of this chapter. @@ -2678,7 +2678,7 @@ veto oplock files = /*.pdf/*.PST/ When you believe that the overall configuration is complete, be sure to create a shared group profile and migrate that to the Samba server for later reuse when creating custom mandatory profiles, just in case a user may have specific needs you had not anticipated. - </p></div><div class="sect2" title="Roll-out Image Creation"><div class="titlepage"><div><div><h3 class="title"><a name="id2589254"></a>Roll-out Image Creation</h3></div></div></div><p> + </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583169"></a>Roll-out Image Creation</h3></div></div></div><p> The final steps before preparing the distribution Norton Ghost image file you might follow are: </p><div class="blockquote"><blockquote class="blockquote"><p> Unjoin the domain Each workstation requires a unique name and must be independently @@ -2687,7 +2687,7 @@ veto oplock files = /*.pdf/*.PST/ Defragment the hard disk While not obvious to the uninitiated, defragmentation results in better performance and often significantly reduces the size of the compressed disk image. That also means it will take less time to deploy the image onto 500 workstations. - </p></blockquote></div></div></div><div class="sect1" title="Key Points Learned"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2589288"></a>Key Points Learned</h2></div></div></div><p> + </p></blockquote></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2583203"></a>Key Points Learned</h2></div></div></div><p> This chapter introduced many new concepts. Is it a sad fact that the example presented deliberately avoided any consideration of security. Security does not just happen; you must design it into your total network. Security begins with a systems design and implementation that anticipates hostile behavior from @@ -2696,8 +2696,8 @@ veto oplock files = /*.pdf/*.PST/ practices, you must not deploy the design presented in this book in an environment where there is risk of compromise. </p><p> - <a class="indexterm" name="id2589309"></a> - <a class="indexterm" name="id2589319"></a> + <a class="indexterm" name="id2583224"></a> + <a class="indexterm" name="id2583234"></a> As a minimum, the LDAP server must be protected by way of Access Control Lists (ACLs), and it must be configured to use secure protocols for all communications over the network. Of course, secure networking does not result just from systems design and implementation but involves constant user education @@ -2708,53 +2708,53 @@ veto oplock files = /*.pdf/*.PST/ as well as security considerations. </p><p> The substance of this chapter that has been deserving of particular attention includes: - </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> + </p><div class="itemizedlist"><ul type="disc"><li><p> Implementation of an OpenLDAP-based passwd backend, necessary to support distributed domain control. - </p></li><li class="listitem"><p> + </p></li><li><p> Implementation of Samba primary and secondary domain controllers with a common LDAP backend for user and group accounts that is shared with the UNIX system through the PADL nss_ldap and pam_ldap tool-sets. - </p></li><li class="listitem"><p> + </p></li><li><p> Use of the Idealx smbldap-tools scripts for UNIX (POSIX) account management as well as to manage Samba Windows user and group accounts. - </p></li><li class="listitem"><p> + </p></li><li><p> The basics of implementation of Group Policy controls for Windows network clients. - </p></li><li class="listitem"><p> + </p></li><li><p> Control over roaming profiles, with particular focus on folder redirection to network drives. - </p></li><li class="listitem"><p> + </p></li><li><p> Use of the CUPS printing system together with Samba-based printer driver auto-download. - </p></li></ul></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2589403"></a>Questions and Answers</h2></div></div></div><p> + </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2583318"></a>Questions and Answers</h2></div></div></div><p> Well, here we are at the end of this chapter and we have only ten questions to help you to remember so much. There are bound to be some sticky issues here. - </p><div class="qandaset" title="Frequently Asked Questions"><a name="id2589415"></a><dl><dt> <a href="happy.html#id2589422"> + </p><div class="qandaset"><dl><dt> <a href="happy.html#id2583337"> Why did you not cover secure practices? Isn't it rather irresponsible to instruct network administrators to implement insecure solutions? - </a></dt><dt> <a href="happy.html#id2589466"> + </a></dt><dt> <a href="happy.html#id2583381"> You have focused much on SUSE Linux and little on the market leader, Red Hat. Do you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant to the Linux I might be using? - </a></dt><dt> <a href="happy.html#id2589527"> + </a></dt><dt> <a href="happy.html#id2583442"> You did not use SWAT to configure Samba. Is there something wrong with it? - </a></dt><dt> <a href="happy.html#id2589566"> + </a></dt><dt> <a href="happy.html#id2583481"> You have exposed a well-used password not24get. Is that not irresponsible? - </a></dt><dt> <a href="happy.html#id2589591"> + </a></dt><dt> <a href="happy.html#id2583506"> The Idealx smbldap-tools create many domain group accounts that are not used. Is that a good thing? - </a></dt><dt> <a href="happy.html#id2589618"> + </a></dt><dt> <a href="happy.html#id2583532"> Can I use LDAP just for Samba accounts and not for UNIX system accounts? - </a></dt><dt> <a href="happy.html#id2589643"> + </a></dt><dt> <a href="happy.html#id2583558"> Why are the Windows domain RID portions not the same as the UNIX UID? - </a></dt><dt> <a href="happy.html#id2589678"> + </a></dt><dt> <a href="happy.html#id2583593"> Printer configuration examples all show printing to the HP port 9100. Does this mean that I must have HP printers for these solutions to work? - </a></dt><dt> <a href="happy.html#id2589708"> + </a></dt><dt> <a href="happy.html#id2583622"> Is folder redirection dangerous? I've heard that you can lose your data that way. - </a></dt><dt> <a href="happy.html#id2589735"> + </a></dt><dt> <a href="happy.html#id2583650"> Is it really necessary to set a local Group Policy to exclude the redirected folders from the roaming profile? - </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id2589422"></a><a name="id2589424"></a></td><td align="left" valign="top"><p> + </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2583337"></a><a name="id2583339"></a></td><td align="left" valign="top"><p> Why did you not cover secure practices? Isn't it rather irresponsible to instruct network administrators to implement insecure solutions? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> @@ -2773,7 +2773,7 @@ veto oplock files = /*.pdf/*.PST/ This book makes little mention of backup techniques. Does that mean that I am recommending that you should implement a network without provision for data recovery and for disaster management? Back to our focus: The deployment of Samba has been clearly demonstrated. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2589466"></a><a name="id2589468"></a></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2583381"></a><a name="id2583383"></a></td><td align="left" valign="top"><p> You have focused much on SUSE Linux and little on the market leader, Red Hat. Do you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant to the Linux I might be using? @@ -2800,7 +2800,7 @@ veto oplock files = /*.pdf/*.PST/ of open source software. I favor neither and respect both. I like particular features of both products (companies also). No bias in presentation is intended. Oh, before I forget, I particularly like Debian Linux; that is my favorite playground. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2589527"></a><a name="id2589529"></a></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2583442"></a><a name="id2583444"></a></td><td align="left" valign="top"><p> You did not use SWAT to configure Samba. Is there something wrong with it? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> That is a good question. As it is, the <code class="filename">smb.conf</code> file configurations are presented @@ -2811,14 +2811,14 @@ veto oplock files = /*.pdf/*.PST/ There are people in the Linux and open source community who feel that SWAT is dangerous and insecure. Many will not touch it with a barge-pole. By not introducing SWAT, I hope to have brought their interests on board. SWAT is well covered is <span class="emphasis"><em>TOSHARG2</em></span>. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2589566"></a><a name="id2589568"></a></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2583481"></a><a name="id2583483"></a></td><td align="left" valign="top"><p> You have exposed a well-used password <span class="emphasis"><em>not24get</em></span>. Is that not irresponsible? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> Well, I had to use a password of some sort. At least this one has been consistently used throughout. I guess you can figure out that in a real deployment it would make sense to use a more secure and original password. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2589591"></a><a name="id2589593"></a></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2583506"></a><a name="id2583508"></a></td><td align="left" valign="top"><p> The Idealx smbldap-tools create many domain group accounts that are not used. Is that a good thing? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> @@ -2826,7 +2826,7 @@ veto oplock files = /*.pdf/*.PST/ Let's give Idealx some credit for the contribution they have made. I appreciate their work and, besides, it does no harm to create accounts that are not now used at some time Samba may well use them. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2589618"></a><a name="id2589620"></a></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2583532"></a><a name="id2583535"></a></td><td align="left" valign="top"><p> Can I use LDAP just for Samba accounts and not for UNIX system accounts? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> Yes, you can do that for user accounts only. Samba requires there to be a POSIX (UNIX) @@ -2834,7 +2834,7 @@ veto oplock files = /*.pdf/*.PST/ the system password account, how do you plan to keep all domain controller system password files in sync? I think that having everything in LDAP makes a lot of sense for the UNIX administrator who is still learning the craft and is migrating from MS Windows. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2589643"></a><a name="id2589645"></a></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2583558"></a><a name="id2583560"></a></td><td align="left" valign="top"><p> Why are the Windows domain RID portions not the same as the UNIX UID? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> Samba uses a well-known public algorithm for assigning RIDs from UIDs and GIDs. @@ -2843,7 +2843,7 @@ veto oplock files = /*.pdf/*.PST/ assignment used the calculation: RID = UID x 2 + 1000. Of course, Samba does permit you to override that to some extent. See the <code class="filename">smb.conf</code> man page entry for <em class="parameter"><code>algorithmic rid base</code></em>. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2589678"></a><a name="id2589681"></a></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2583593"></a><a name="id2583596"></a></td><td align="left" valign="top"><p> Printer configuration examples all show printing to the HP port 9100. Does this mean that I must have HP printers for these solutions to work? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> @@ -2853,7 +2853,7 @@ veto oplock files = /*.pdf/*.PST/ inkjet printer. Use the appropriate device URI (Universal Resource Interface) argument to the <code class="constant">lpadmin -v</code> option that is right for your printer. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2589708"></a><a name="id2589710"></a></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2583622"></a><a name="id2583625"></a></td><td align="left" valign="top"><p> Is folder redirection dangerous? I've heard that you can lose your data that way. </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> The only loss of data I know of that involved folder redirection was caused by @@ -2863,13 +2863,13 @@ veto oplock files = /*.pdf/*.PST/ he declined to move the data because he thought it was still in the local profile folder. That was not the case, so by declining to move the data back, he wiped out the data. You cannot hold the tool responsible for that. Caveat emptor still applies. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2589735"></a><a name="id2589737"></a></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2583650"></a><a name="id2583652"></a></td><td align="left" valign="top"><p> Is it really necessary to set a local Group Policy to exclude the redirected folders from the roaming profile? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> Yes. If you do not do this, the data will still be copied from the network folder (share) to the local cached copy of the profile. - </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2587919" href="#id2587919" class="para">11</a>] </sup> + </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2581834" href="#id2581834" class="para">11</a>] </sup> There is an alternate method by which a default user profile can be added to the <code class="constant">NETLOGON</code> share. This facility in the Windows System tool permits profiles to be exported. The export target may be a particular user or |