diff options
Diffstat (limited to 'docs/htmldocs/Samba3-ByExample/secure.html')
| -rw-r--r-- | docs/htmldocs/Samba3-ByExample/secure.html | 566 |
1 files changed, 283 insertions, 283 deletions
diff --git a/docs/htmldocs/Samba3-ByExample/secure.html b/docs/htmldocs/Samba3-ByExample/secure.html index 5d35d364ce..8e935e9e15 100644 --- a/docs/htmldocs/Samba3-ByExample/secure.html +++ b/docs/htmldocs/Samba3-ByExample/secure.html @@ -1,4 +1,4 @@ -<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id2558582">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2558634">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2558867">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2558882">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2559309">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2559348">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2560202">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2564663">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2564725">Questions and Answers</a></span></dt></dl></div><p> +<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 3. Secure Office Networking"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id2564639">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2564691">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2564924">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2564939">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2565367">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2565406">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2566260">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2570721">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2570783">Questions and Answers</a></span></dt></dl></div><p> Congratulations, your Samba networking skills are developing nicely. You started out with three simple networks in <a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a>, and then in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a> you designed and built a network that provides a high degree of flexibility, integrity, @@ -11,7 +11,7 @@ so caution is advised for anyone who tries to use Samba-2.2.x with the guidance here given. To avoid confusion, this book is all about Samba-3. Let's get the exercises in this chapter underway. - </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558582"></a>Introduction</h2></div></div></div><p> + </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2564639"></a>Introduction</h2></div></div></div><p> You have made Mr. Meany a very happy man. Recently he paid you a fat bonus for work well done. It is one year since the last network upgrade. You have been quite busy. Two months ago Mr. Meany gave approval to hire Christine Roberson, who has taken over @@ -40,7 +40,7 @@ Occasionally she wants to work with you on a challenging problem. When you told her about your move, she almost resigned, although she was reassured that a new manager would be hired to run Information Technology, and she would be responsible only for operations. - </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558634"></a>Assignment Tasks</h3></div></div></div><p> + </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id2564691"></a>Assignment Tasks</h3></div></div></div><p> You promised the staff Internet services including Web browsing, electronic mail, virus protection, and a company Web site. Christine is eager to help turn the vision into reality. Let's see how close you can get to the promises made. @@ -83,13 +83,13 @@ of users had to share a PC while waiting for new machines to arrive. This presented some problems with desktop computers and software installation into the new users' desktop profiles. - </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558867"></a>Dissection and Discussion</h2></div></div></div><p> + </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2564924"></a>Dissection and Discussion</h2></div></div></div><p> Many of the conclusions you draw here are obvious. Some requirements are not very clear or may simply be your means of drawing the most out of Samba-3. Much can be done more simply than you will demonstrate here, but keep in mind that the network must scale to at least 500 users. This means that some functionality will be overdesigned for the current 130-user environment. - </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558882"></a>Technical Issues</h3></div></div></div><p> + </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id2564939"></a>Technical Issues</h3></div></div></div><p> In this exercise we use a 24-bit subnet mask for the two local networks. This, of course, limits our network to a maximum of 253 usable IP addresses. The network address range chosen is one assigned by RFC1918 for private networks. @@ -97,14 +97,14 @@ addresses, it is a good idea to switch to a network address specified in RFC1918 in the 172.16.0.0/16 range. This is done in subsequent chapters. </p><p> - <a class="indexterm" name="id2558901"></a> - <a class="indexterm" name="id2558907"></a> + <a class="indexterm" name="id2564958"></a> + <a class="indexterm" name="id2564964"></a> The high growth rates projected are a good reason to use the <code class="constant">tdbsam</code> passdb backend. The use of <code class="constant">smbpasswd</code> for the backend may result in performance problems. The <code class="constant">tdbsam</code> passdb backend offers features that are not available with the older, flat ASCII-based <code class="constant">smbpasswd</code> database. </p><p> - <a class="indexterm" name="id2558933"></a> + <a class="indexterm" name="id2564991"></a> The proposed network design uses a single server to act as an Internet services host for electronic mail, Web serving, remote administrative access via SSH, Samba-based file and print services. This design is often chosen by sites that feel @@ -117,10 +117,10 @@ Samba will be configured to specifically not operate on the Ethernet interface that is directly connected to the Internet. </p><p> - <a class="indexterm" name="id2558959"></a> - <a class="indexterm" name="id2558965"></a> - <a class="indexterm" name="id2558971"></a> - <a class="indexterm" name="id2558980"></a> + <a class="indexterm" name="id2565016"></a> + <a class="indexterm" name="id2565023"></a> + <a class="indexterm" name="id2565029"></a> + <a class="indexterm" name="id2565037"></a> You know that your ISP is providing full firewall services, but you cannot rely on that. Always assume that human error will occur, so be prepared by using Linux firewall facilities based on <code class="literal">iptables</code> to effect NAT. Block all @@ -131,7 +131,7 @@ generic antivirus handling are beyond the scope of this book and therefore are not covered except insofar as this affects Samba-3. </p><p> - <a class="indexterm" name="id2559009"></a> + <a class="indexterm" name="id2565066"></a> Notebook computers are configured to use a network login when in the office and a local account to log in while away from the office. Users store all work done in transit (away from the office) by using a local share for work files. Standard procedures @@ -141,26 +141,26 @@ This is a preventative measure to protect client information as well as private business records. </p><p> - <a class="indexterm" name="id2559039"></a> + <a class="indexterm" name="id2565097"></a> All applications are served from the central server from a share called <code class="constant">apps</code>. Microsoft Office XP Professional and OpenOffice 1.1.0 will be installed using a network (or administrative) installation. Accounting and financial management software can also be run only from the central application server. Notebook users are provided with locally installed applications on a need-to-have basis only. </p><p> - <a class="indexterm" name="id2559059"></a> + <a class="indexterm" name="id2565117"></a> The introduction of roaming profiles support means that users can move between desktop computer systems without constraint while retaining full access to their data. The desktop travels with them as they move. </p><p> - <a class="indexterm" name="id2559072"></a> + <a class="indexterm" name="id2565130"></a> The DNS server implementation must now address both internal and external needs. You forward DNS lookups to your ISP-provided server as well as the <code class="constant">abmas.us</code> external secondary DNS server. </p><p> - <a class="indexterm" name="id2559088"></a> - <a class="indexterm" name="id2559094"></a> - <a class="indexterm" name="id2559103"></a> + <a class="indexterm" name="id2565146"></a> + <a class="indexterm" name="id2565152"></a> + <a class="indexterm" name="id2565161"></a> Compared with the DHCP server configuration in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a>, <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>, the configuration used in this example has to deal with the presence of an Internet connection. The scope set for it ensures that no DHCP services will be offered on the external @@ -184,8 +184,8 @@ a problem because Christine is to install and configure one single workstation and then clone that configuration, using Norton Ghost, to all workstations. Each machine is identical, so this should pose no problem. - </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2559155"></a>Hardware Requirements</h4></div></div></div><p> - <a class="indexterm" name="id2559162"></a> + </p><div class="sect3" title="Hardware Requirements"><div class="titlepage"><div><div><h4 class="title"><a name="id2565213"></a>Hardware Requirements</h4></div></div></div><p> + <a class="indexterm" name="id2565220"></a> This server runs a considerable number of services. From similarly configured Linux installations, the approximate calculated memory requirements are as shown in <a class="link" href="secure.html#ch4memoryest" title="Example 3.1. Estimation of Memory Requirements">“Estimation of Memory Requirements”</a>. @@ -213,7 +213,7 @@ Basic OS 256.0 256 256 as the system load builds up. Given the low cost of memory, it does not make sense to compromise in this area. </p><p> - <a class="indexterm" name="id2559214"></a> + <a class="indexterm" name="id2565272"></a> Aggregate input/output loads should be considered for sizing network configuration as well as disk subsystems. For network bandwidth calculations, one would typically use an estimate of 0.1 MB/sec per user. This suggests that 100-Base-T (approx. 10 MB/sec) @@ -222,8 +222,8 @@ Basic OS 256.0 256 256 to a 1 Gb Ethernet switch that provides connectivity to an expandable array of 100-Base-T switched ports. </p><p> - <a class="indexterm" name="id2559233"></a> - <a class="indexterm" name="id2559239"></a> + <a class="indexterm" name="id2565290"></a> + <a class="indexterm" name="id2565297"></a> Considering the choice of 1 Gb Ethernet interfaces for the two local network segments, the aggregate network I/O capacity will be 2100 Mb/sec (about 230 MB/sec), an I/O demand that would require a fast disk storage I/O capability. Peak disk throughput is @@ -255,10 +255,10 @@ Given 500 Users and 2 years: Add 50% buffer 303 GBytes Recommended Storage: 908 GBytes </pre></div></div><p><br class="example-break"> - <a class="indexterm" name="id2559296"></a> + <a class="indexterm" name="id2565354"></a> The preferred storage capacity should be approximately 1 Terabyte. Use of RAID level 5 with two hot spare drives would require an 8-drive by 200 GB capacity per drive array. - </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2559309"></a>Political Issues</h3></div></div></div><p> + </p></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id2565367"></a>Political Issues</h3></div></div></div><p> Your industry is coming under increasing accountability pressures. Increased paranoia is necessary so you can demonstrate that you have acted with due diligence. You must not trust your Internet connection. @@ -267,12 +267,12 @@ Given 500 Users and 2 years: an application server, your primary reason for the decision to implement this is that it gives you greater control over software licensing. </p><p> - <a class="indexterm" name="id2559331"></a> + <a class="indexterm" name="id2565388"></a> You are well aware that the current configuration results in some performance issues as the size of the desktop profile grows. Given that users use Microsoft Outlook Express, you know that the storage implications of the <code class="constant">.PST</code> file is something that needs to be addressed later. - </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2559348"></a>Implementation</h2></div></div></div><p> + </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2565406"></a>Implementation</h2></div></div></div><p> <a class="link" href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a> demonstrates the overall design of the network that you will implement. </p><p> The information presented here assumes that you are already familiar with many basic steps. @@ -283,49 +283,49 @@ Given 500 Users and 2 years: here, there are many other good reference books on these subjects. </p><p> The <code class="filename">smb.conf</code> file has the following noteworthy features: - </p><div class="itemizedlist"><ul type="disc"><li><p> + </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> The NetBIOS name of the Samba server is set to <code class="constant">DIAMOND</code>. - </p></li><li><p> + </p></li><li class="listitem"><p> The Domain name is set to <code class="constant">PROMISES</code>. - </p></li><li><p> - <a class="indexterm" name="id2559406"></a> - <a class="indexterm" name="id2559412"></a> - <a class="indexterm" name="id2559418"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id2565463"></a> + <a class="indexterm" name="id2565470"></a> + <a class="indexterm" name="id2565476"></a> Ethernet interface <code class="constant">eth0</code> is attached to the Internet connection and is externally exposed. This interface is explicitly not available for Samba to use. Samba listens on this interface for broadcast messages but does not broadcast any information on <code class="constant">eth0</code>, nor does it accept any connections from it. This is achieved by way of the <em class="parameter"><code>interfaces</code></em> parameter and the <em class="parameter"><code>bind interfaces only</code></em> entry. - </p></li><li><p> - <a class="indexterm" name="id2559451"></a> - <a class="indexterm" name="id2559457"></a> - <a class="indexterm" name="id2559463"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id2565509"></a> + <a class="indexterm" name="id2565515"></a> + <a class="indexterm" name="id2565521"></a> The <em class="parameter"><code>passdb backend</code></em> parameter specifies the creation and use of the <code class="constant">tdbsam</code> password backend. This is a binary database that has excellent scalability for a large number of user account entries. - </p></li><li><p> - <a class="indexterm" name="id2559486"></a> - <a class="indexterm" name="id2559492"></a> - <a class="indexterm" name="id2559498"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id2565543"></a> + <a class="indexterm" name="id2565550"></a> + <a class="indexterm" name="id2565556"></a> WINS serving is enabled by the <a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = Yes</a>, and name resolution is set to use it by means of the <a class="link" href="smb.conf.5.html#NAMERESOLVEORDER" target="_top">name resolve order = wins bcast hosts</a> entry. - </p></li><li><p> - <a class="indexterm" name="id2559528"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id2565585"></a> The Samba server is configured for use by Windows clients as a time server. - </p></li><li><p> - <a class="indexterm" name="id2559540"></a> - <a class="indexterm" name="id2559546"></a> - <a class="indexterm" name="id2559552"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id2565597"></a> + <a class="indexterm" name="id2565604"></a> + <a class="indexterm" name="id2565610"></a> Samba is configured to directly interface with CUPS via the direct internal interface that is provided by CUPS libraries. This is achieved with the <a class="link" href="smb.conf.5.html#PRINTING" target="_top">printing = CUPS</a> as well as the <a class="link" href="smb.conf.5.html#PRINTCAPNAME" target="_top">printcap name = CUPS</a> entries. - </p></li><li><p> - <a class="indexterm" name="id2559583"></a> - <a class="indexterm" name="id2559589"></a> - <a class="indexterm" name="id2559595"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id2565640"></a> + <a class="indexterm" name="id2565647"></a> + <a class="indexterm" name="id2565653"></a> External interface scripts are provided to enable Samba to interface smoothly to essential operating system functions for user and group management. This is important to enable workstations to join the Domain and is also important so that you can use @@ -333,20 +333,20 @@ Given 500 Users and 2 years: are provided as part of the <code class="filename">SRVTOOLS.EXE</code> toolkit that can be downloaded from the Microsoft FTP <a class="ulink" href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">site</a>. - </p></li><li><p> - <a class="indexterm" name="id2559625"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id2565682"></a> The <code class="filename">smb.conf</code> file specifies that the Samba server will operate in (default) <em class="parameter"><code> - security = user</code></em> mode<sup>[<a name="id2559643" href="#ftn.id2559643" class="footnote">5</a>]</sup> + security = user</code></em> mode<sup>[<a name="id2565700" href="#ftn.id2565700" class="footnote">5</a>]</sup> (User Mode). - </p></li><li><p> - <a class="indexterm" name="id2559659"></a> - <a class="indexterm" name="id2559665"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id2565717"></a> + <a class="indexterm" name="id2565723"></a> Domain logon services as well as a Domain logon script are specified. The logon script will be used to add robustness to the overall network configuration. - </p></li><li><p> - <a class="indexterm" name="id2559679"></a> - <a class="indexterm" name="id2559685"></a> - <a class="indexterm" name="id2559691"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id2565736"></a> + <a class="indexterm" name="id2565743"></a> + <a class="indexterm" name="id2565749"></a> Roaming profiles are enabled through the specification of the parameter, <a class="link" href="smb.conf.5.html#LOGONPATH" target="_top">logon path = \\%L\profiles\%U</a>. The value of this parameter translates the <code class="constant">%L</code> to the name by which the Samba server is called by the client (for this @@ -355,42 +355,42 @@ Given 500 Users and 2 years: It is the administrator's responsibility to ensure there is a directory in the root of the profile share for each user. This directory must be owned by the user also. An exception to this requirement is when a profile is created for group use. - </p></li><li><p> - <a class="indexterm" name="id2559731"></a> - <a class="indexterm" name="id2559738"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id2565789"></a> + <a class="indexterm" name="id2565795"></a> Precautionary veto is effected for particular Windows file names that have been targeted by virus-related activity. Additionally, Microsoft Office files are vetoed from opportunistic locking controls. This should help to prevent lock contention-related file access problems. - </p></li><li><p> + </p></li><li class="listitem"><p> Every user has a private home directory on the UNIX/Linux host. This is mapped to a network drive that is the same for all users. </p></li></ul></div><p> The configuration of the server is the most complex so far. The following steps are used: - </p><div class="orderedlist"><ol type="1"><li><p> + </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p> Basic System Configuration - </p></li><li><p> + </p></li><li class="listitem"><p> Samba Configuration - </p></li><li><p> + </p></li><li class="listitem"><p> DHCP and DNS Server Configuration - </p></li><li><p> + </p></li><li class="listitem"><p> Printer Configuration - </p></li><li><p> + </p></li><li class="listitem"><p> Process Start-up Configuration - </p></li><li><p> + </p></li><li class="listitem"><p> Validation - </p></li><li><p> + </p></li><li class="listitem"><p> Application Share Configuration - </p></li><li><p> + </p></li><li class="listitem"><p> Windows Client Configuration </p></li></ol></div><p> The following sections cover each step in logical and defined detail. - </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4bsc"></a>Basic System Configuration</h3></div></div></div><p> - <a class="indexterm" name="id2559823"></a> + </p><div class="sect2" title="Basic System Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch4bsc"></a>Basic System Configuration</h3></div></div></div><p> + <a class="indexterm" name="id2565881"></a> The preparation in this section assumes that your SUSE Enterprise Linux Server 8.0 system has been freshly installed. It prepares basic files so that the system is ready for comprehensive operation in line with the network diagram shown in <a class="link" href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a>. - </p><div class="procedure"><a name="id2559839"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol type="1"><li><p> - <a class="indexterm" name="id2559850"></a> + </p><div class="procedure" title="Procedure 3.1. Server Configuration Steps"><a name="id2565897"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + <a class="indexterm" name="id2565908"></a> Using the UNIX/Linux system tools, name the server <code class="constant">server.abmas.us</code>. Verify that your hostname is correctly set by running: </p><pre class="screen"> @@ -402,9 +402,9 @@ server <code class="prompt">root# </code> hostname -f server.abmas.us </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2559890"></a> - <a class="indexterm" name="id2559896"></a> + </p></li><li class="step" title="Step 2"><p> + <a class="indexterm" name="id2565948"></a> + <a class="indexterm" name="id2565954"></a> Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses of all network interfaces that are on the host server. This is necessary so that during startup the system can resolve all its own names to the IP address prior to @@ -425,15 +425,15 @@ server.abmas.us 192.168.2.20 qmsf.abmas.biz qmsf 192.168.2.30 hplj6f.abmas.biz hplj6f </pre><p> - <a class="indexterm" name="id2559948"></a> - <a class="indexterm" name="id2559954"></a> - <a class="indexterm" name="id2559960"></a> + <a class="indexterm" name="id2566005"></a> + <a class="indexterm" name="id2566012"></a> + <a class="indexterm" name="id2566018"></a> The printer entries are not necessary if <code class="literal">named</code> is started prior to startup of <code class="literal">cupsd</code>, the CUPS daemon. - </p></li><li><p> - <a class="indexterm" name="id2559985"></a> - <a class="indexterm" name="id2559991"></a> - <a class="indexterm" name="id2559997"></a> + </p></li><li class="step" title="Step 3"><p> + <a class="indexterm" name="id2566042"></a> + <a class="indexterm" name="id2566049"></a> + <a class="indexterm" name="id2566055"></a> The host server is acting as a router between the two internal network segments as well as for all Internet access. This necessitates that IP forwarding be enabled. This can be achieved by adding to the <code class="filename">/etc/rc.d/boot.local</code> an entry as follows: @@ -442,10 +442,10 @@ echo 1 > /proc/sys/net/ipv4/ip_forward </pre><p> To ensure that your kernel is capable of IP forwarding during configuration, you may wish to execute that command manually also. This setting permits the Linux system to - act as a router.<sup>[<a name="id2560023" href="#ftn.id2560023" class="footnote">6</a>]</sup> - </p></li><li><p> - <a class="indexterm" name="id2560036"></a> - <a class="indexterm" name="id2560042"></a> + act as a router.<sup>[<a name="id2566081" href="#ftn.id2566081" class="footnote">6</a>]</sup> + </p></li><li class="step" title="Step 4"><p> + <a class="indexterm" name="id2566094"></a> + <a class="indexterm" name="id2566100"></a> Installation of a basic firewall and NAT facility is necessary. The following script can be installed in the <code class="filename">/usr/local/sbin</code> directory. It is executed from the <code class="filename">/etc/rc.d/boot.local</code> startup @@ -497,7 +497,7 @@ $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE echo "1" > /proc/sys/net/ipv4/ip_forward echo -e "\nNAT firewall done.\n" </pre></div></div><p><br class="example-break"> - </p></li><li><p> + </p></li><li class="step" title="Step 5"><p> Execute the following to make the script executable: </p><pre class="screen"> <code class="prompt">root# </code> chmod 755 /usr/local/sbin/abmas-natfw.sh @@ -524,15 +524,15 @@ echo -e "\nNAT firewall done.\n" /usr/local/sbin/abmas-natfw.sh </pre><p> </p></li></ol></div><p> - <a class="indexterm" name="id2560182"></a> + <a class="indexterm" name="id2566239"></a> The server is now ready for Samba configuration. During the validation step, you remove the entry for the Samba server <code class="constant">diamond</code> from the <code class="filename">/etc/hosts</code> file. This is done after you are satisfied that DNS-based name resolution is functioning correctly. - </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2560202"></a>Samba Configuration</h3></div></div></div><p> + </p></div><div class="sect2" title="Samba Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id2566260"></a>Samba Configuration</h3></div></div></div><p> When you have completed this section, the Samba server is ready for testing and validation; however, testing and validation have to wait until DHCP, DNS, and printing (CUPS) services have been configured. - </p><div class="procedure"><a name="id2560215"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol type="1"><li><p> + </p><div class="procedure" title="Procedure 3.2. Samba Configuration Steps"><a name="id2566272"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> Install the Samba-3 binary RPM from the Samba-Team FTP site. Assuming that the binary RPM file is called <code class="filename">samba-3.0.20-1.i386.rpm</code>, one way to install this file is as follows: @@ -542,18 +542,18 @@ echo -e "\nNAT firewall done.\n" This operation must be performed while logged in as the <code class="literal">root</code> user. Successful operation is clearly indicated. If this installation should fail for any reason, refer to the operating system manufacturer's documentation for guidance. - </p></li><li><p> + </p></li><li class="step" title="Step 2"><p> Install the <code class="filename">smb.conf</code> file shown in <a class="link" href="secure.html#promisnet" title="Example 3.4. 130 User Network with tdbsam [globals] Section">“130 User Network with tdbsam [globals] Section”</a>, <a class="link" href="secure.html#promisnetsvca" title="Example 3.5. 130 User Network with tdbsam Services Section Part A">“130 User Network with tdbsam Services Section Part A”</a>, and <a class="link" href="secure.html#promisnetsvcb" title="Example 3.6. 130 User Network with tdbsam Services Section Part B">“130 User Network with tdbsam Services Section Part B”</a>. Concatenate (join) all three files to make a single <code class="filename">smb.conf</code> file. The final, fully qualified path for this file should be <code class="filename">/etc/samba/smb.conf</code>. -</p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2560320"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id2560331"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id2560341"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2560352"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560362"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2560372"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560383"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id2560393"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2560405"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2560416"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560426"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2560437"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2560447"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2560458"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2560469"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2560479"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2560490"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560501"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2560511"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560522"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560533"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560545"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2560556"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2560567"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560579"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560590"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2560602"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2560613"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2560624"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2560635"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2560646"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2560656"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560666"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560677"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560687"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560698"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560708"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2560718"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id2560729"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2560740"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break"> +</p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2566378"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id2566388"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id2566399"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2566409"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566420"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2566430"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566440"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id2566451"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2566463"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2566474"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566484"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2566495"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2566505"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2566516"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2566526"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2566537"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2566548"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566558"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2566569"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2566580"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2566591"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2566602"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2566614"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2566625"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2566636"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2566648"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2566660"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2566671"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2566682"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2566693"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2566703"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2566714"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566724"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566734"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566745"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566755"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566766"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2566776"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id2566786"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2566798"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break"> -</p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2560779"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2560789"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2560800"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560810"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2560829"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2560839"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2560850"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560860"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560871"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560881"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560891"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2560910"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2560921"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2560932"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560942"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2560961"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2560971"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2560982"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560993"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2561012"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561022"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2561032"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break"> +</p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2566837"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2566847"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2566858"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2566868"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2566887"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2566897"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2566908"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566918"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566928"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566939"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2566949"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2566968"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2566978"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2566989"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2567000"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2567019"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2567029"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2567040"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2567050"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2567069"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2567080"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2567090"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break"> -</p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2561071"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561081"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2561092"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2561110"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561121"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2561132"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2561151"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561161"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2561171"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561182"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break"> - </p></li><li><p> - <a class="indexterm" name="id2561200"></a><a class="indexterm" name="id2561205"></a> +</p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2567128"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2567139"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2567149"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2567168"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2567179"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2567190"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2567208"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2567219"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2567229"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2567240"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break"> + </p></li><li class="step" title="Step 3"><p> + <a class="indexterm" name="id2567257"></a><a class="indexterm" name="id2567262"></a> Add the <code class="constant">root</code> user to the password backend as follows: </p><pre class="screen"> <code class="prompt">root# </code> smbpasswd -a root @@ -565,8 +565,8 @@ Retype new SMB password: XXXXXXXX This account is essential in the regular maintenance of your Samba server. It must never be deleted. If for any reason the account is deleted, you may not be able to recreate this account without considerable trouble. - </p></li><li><p> - <a class="indexterm" name="id2561249"></a> + </p></li><li class="step" title="Step 4"><p> + <a class="indexterm" name="id2567306"></a> Create the username map file to permit the <code class="constant">root</code> account to be called <code class="constant">Administrator</code> from the Windows network environment. To do this, create the file <code class="filename">/etc/samba/smbusers</code> with the following contents: @@ -592,17 +592,17 @@ root = Administrator # End of File #### </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2561290"></a> - <a class="indexterm" name="id2561297"></a> - <a class="indexterm" name="id2561307"></a> - <a class="indexterm" name="id2561318"></a> + </p></li><li class="step" title="Step 5"><p> + <a class="indexterm" name="id2567348"></a> + <a class="indexterm" name="id2567354"></a> + <a class="indexterm" name="id2567365"></a> + <a class="indexterm" name="id2567376"></a> Create and map Windows Domain Groups to UNIX groups. A sample script is provided in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a>, <a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours <code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed, and then execute the script. Sample output should be as follows: -</p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id2561355"></a><pre class="screen"> +</p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id2567413"></a><pre class="screen"> #!/bin/bash # # initGrps.sh @@ -654,14 +654,14 @@ Replicators (S-1-5-32-552) -> -1 System Operators (S-1-5-32-549) -> -1 Users (S-1-5-32-545) -> -1 </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2561428"></a> - <a class="indexterm" name="id2561434"></a> - <a class="indexterm" name="id2561441"></a> - <a class="indexterm" name="id2561447"></a> - <a class="indexterm" name="id2561453"></a> - <a class="indexterm" name="id2561460"></a> - <a class="indexterm" name="id2561468"></a> + </p></li><li class="step" title="Step 6"><p> + <a class="indexterm" name="id2567486"></a> + <a class="indexterm" name="id2567492"></a> + <a class="indexterm" name="id2567498"></a> + <a class="indexterm" name="id2567505"></a> + <a class="indexterm" name="id2567511"></a> + <a class="indexterm" name="id2567517"></a> + <a class="indexterm" name="id2567526"></a> There is one preparatory step without which you will not have a working Samba network environment. You must add an account for each network user. For each user who needs to be given a Windows Domain account, make an entry in the @@ -685,19 +685,19 @@ Retype new SMB password: XXXXXXXX Added user <em class="parameter"><code>username</code></em>. </pre><p> You do of course use a valid user login ID in place of <em class="parameter"><code>username</code></em>. - </p></li><li><p> - <a class="indexterm" name="id2561572"></a> - <a class="indexterm" name="id2561581"></a> - <a class="indexterm" name="id2561589"></a> + </p></li><li class="step" title="Step 7"><p> + <a class="indexterm" name="id2567630"></a> + <a class="indexterm" name="id2567638"></a> + <a class="indexterm" name="id2567647"></a> Using the preferred tool for your UNIX system, add each user to the UNIX groups created previously as necessary. File system access control will be based on UNIX group membership. - </p></li><li><p> + </p></li><li class="step" title="Step 8"><p> Create the directory mount point for the disk subsystem that can be mounted to provide data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code> file is <code class="filename">/data</code>. Format the file system as required, and mount the formatted file system partition using appropriate system tools. - </p></li><li><p> - <a class="indexterm" name="id2561628"></a> + </p></li><li class="step" title="Step 9"><p> + <a class="indexterm" name="id2567686"></a> Create the top-level file storage directories for data and applications as follows: </p><pre class="screen"> <code class="prompt">root# </code> mkdir -p /data/{accounts,finsrvcs} @@ -714,7 +714,7 @@ Added user <em class="parameter"><code>username</code></em>. The directory root of the <code class="literal">finsvcs</code> share is <code class="filename">/data/finsvcs</code>. The <code class="filename">/apps</code> directory is the root of the <code class="constant">apps</code> share that provides the application server infrastructure. - </p></li><li><p> + </p></li><li class="step" title="Step 10"><p> The <code class="filename">smb.conf</code> file specifies an infrastructure to support roaming profiles and network logon services. You can now create the file system infrastructure to provide the locations on disk that these services require. Adequate planning is essential, @@ -737,10 +737,10 @@ Added user <em class="parameter"><code>username</code></em>. <code class="prompt">root# </code> chown 'username':users /var/lib/samba/profiles/'username' <code class="prompt">root# </code> chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username' </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2561822"></a> - <a class="indexterm" name="id2561828"></a> - <a class="indexterm" name="id2561835"></a> + </p></li><li class="step" title="Step 11"><p> + <a class="indexterm" name="id2567880"></a> + <a class="indexterm" name="id2567886"></a> + <a class="indexterm" name="id2567892"></a> Create a logon script. It is important that each line is correctly terminated with a carriage return and line-feed combination (i.e., DOS encoding). The following procedure works if the right tools (<code class="constant">unix2dos</code> and <code class="constant">dos2unix</code>) are installed. @@ -756,12 +756,12 @@ net use p: \\diamond\apps <code class="prompt">root# </code> unix2dos < /var/lib/samba/netlogon/scripts/logon.bat.unix \ > /var/lib/samba/netlogon/scripts/logon.bat </pre><p> - </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4dhcpdns"></a>Configuration of DHCP and DNS Servers</h3></div></div></div><p> + </p></li></ol></div></div><div class="sect2" title="Configuration of DHCP and DNS Servers"><div class="titlepage"><div><div><h3 class="title"><a name="ch4dhcpdns"></a>Configuration of DHCP and DNS Servers</h3></div></div></div><p> DHCP services are a basic component of the entire network client installation. DNS operation is foundational to Internet access as well as to trouble-free operation of local networking. When you have completed this section, the server should be ready for solid duty operation. - </p><div class="procedure"><a name="id2561905"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol type="1"><li><p> - <a class="indexterm" name="id2561916"></a> + </p><div class="procedure" title="Procedure 3.3. DHCP and DNS Server Configuration Steps"><a name="id2567964"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + <a class="indexterm" name="id2567975"></a> Create a file called <code class="filename">/etc/dhcpd.conf</code> with the contents as shown in <a class="link" href="secure.html#prom-dhcp" title="Example 3.8. DHCP Server Configuration File /etc/dhcpd.conf">“DHCP Server Configuration File /etc/dhcpd.conf”</a>. @@ -811,19 +811,19 @@ subnet 127.0.0.0 netmask 255.0.0.0 { subnet 123.45.67.64 netmask 255.255.255.252 { } </pre></div></div><p><br class="example-break"> - </p></li><li><p> - <a class="indexterm" name="id2561991"></a> + </p></li><li class="step" title="Step 2"><p> + <a class="indexterm" name="id2568050"></a> Create a file called <code class="filename">/etc/named.conf</code> that has the combined contents of the <a class="link" href="secure.html#ch4namedcfg" title="Example 3.9. DNS Master Configuration File /etc/named.conf Master Section">“DNS Master Configuration File /etc/named.conf Master Section”</a>, <a class="link" href="secure.html#ch4namedvarfwd" title="Example 3.10. DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section">“DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section”</a>, and <a class="link" href="secure.html#ch4namedvarrev" title="Example 3.11. DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section">“DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section”</a> files that are concatenated (merged) in this specific order. - </p></li><li><p> + </p></li><li class="step" title="Step 3"><p> Create the files shown in their respective directories as shown in <a class="link" href="secure.html#namedrscfiles" title="Table 3.2. DNS (named) Resource Files">DNS (named) Resource Files</a>. </p><div class="table"><a name="namedrscfiles"></a><p class="title"><b>Table 3.2. DNS (named) Resource Files</b></p><div class="table-contents"><table summary="DNS (named) Resource Files" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Reference</th><th align="left">File Location</th></tr></thead><tbody><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left">/var/lib/named/localhost.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left">/var/lib/named/127.0.0.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left">/var/lib/named/root.hint</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a></td><td align="left">/var/lib/named/master/abmas.biz.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasus" title="Example 3.15. DNS Abmas.us Forward Zone File">“DNS Abmas.us Forward Zone File”</a></td><td align="left">/var/lib/named/abmas.us.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#eth1zone" title="Example 3.12. DNS 192.168.1 Reverse Zone File">“DNS 192.168.1 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.1.0.rev</td></tr><tr><td align="left"><a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.2.0.rev</td></tr></tbody></table></div></div><p><br class="table-break"> -</p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id2562202"></a><pre class="screen"> +</p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id2568260"></a><pre class="screen"> ### # Abmas Biz DNS Control File ### @@ -1007,8 +1007,8 @@ mail CNAME server dns CNAME server </pre></div></div><p><br class="example-break"> - </p></li><li><p> - <a class="indexterm" name="id2562415"></a><a class="indexterm" name="id2562421"></a> + </p></li><li class="step" title="Step 4"><p> + <a class="indexterm" name="id2568474"></a><a class="indexterm" name="id2568479"></a> All DNS name resolution should be handled locally. To ensure that the server is configured correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> to have the following content: @@ -1017,13 +1017,13 @@ search abmas.us abmas.biz nameserver 127.0.0.1 nameserver 123.45.54.23 </pre><p> - <a class="indexterm" name="id2562446"></a> + <a class="indexterm" name="id2568504"></a> This instructs the name resolver function (when configured correctly) to ask the DNS server that is running locally to resolve names to addresses. In the event that the local name server is not available, ask the name server provided by the ISP. The latter, of course, does not resolve purely local names to IP addresses. - </p></li><li><p> - <a class="indexterm" name="id2562467"></a> + </p></li><li class="step" title="Step 5"><p> + <a class="indexterm" name="id2568525"></a> The final step is to edit the <code class="filename">/etc/nsswitch.conf</code> file. This file controls the operation of the various resolver libraries that are part of the Linux Glibc libraries. Edit this file so that it contains the following entries: @@ -1035,24 +1035,24 @@ hosts: files dns wins there are a few more steps along the road. First, configure the print spooling and print processing system. Then you can configure the server so that all services start automatically on reboot. You must also manually start all services prior to validation testing. - </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4ptrcfg"></a>Printer Configuration</h3></div></div></div><p> + </p></div><div class="sect2" title="Printer Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch4ptrcfg"></a>Printer Configuration</h3></div></div></div><p> Network administrators who are new to CUPS based-printing typically experience some difficulty mastering its powerful features. The steps outlined in this section are designed to navigate around the distractions of learning CUPS. Instead of implementing smart features and capabilities, our approach is to use it as a transparent print queue that performs no filtering, and only minimal handling of each print job that is submitted to it. In other words, our configuration turns CUPS into a raw-mode print queue. This means that the correct printer driver must be installed on all clients. - </p><div class="procedure"><a name="id2562525"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol type="1"><li><p> + </p><div class="procedure" title="Procedure 3.4. Printer Configuration Steps"><a name="id2568584"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> Configure each printer to be a DHCP client, carefully following the manufacturer's guidelines. - </p></li><li><p> + </p></li><li class="step" title="Step 2"><p> Follow the instructions in the printer manufacturer's manuals to permit printing to port 9100. Use any other port the manufacturer specifies for direct-mode raw printing, and adjust the port as necessary in the following example commands. This allows the CUPS spooler to print using raw mode protocols. - <a class="indexterm" name="id2562551"></a> - <a class="indexterm" name="id2562558"></a> - </p></li><li><p> - <a class="indexterm" name="id2562571"></a><a class="indexterm" name="id2562579"></a> + <a class="indexterm" name="id2568610"></a> + <a class="indexterm" name="id2568616"></a> + </p></li><li class="step" title="Step 3"><p> + <a class="indexterm" name="id2568630"></a><a class="indexterm" name="id2568638"></a> Configure the CUPS Print Queues as follows: </p><pre class="screen"> <code class="prompt">root# </code> lpadmin -p qmsa -v socket://qmsa.abmas.biz:9100 -E @@ -1060,9 +1060,9 @@ hosts: files dns wins <code class="prompt">root# </code> lpadmin -p qmsf -v socket://qmsf.abmas.biz:9100 -E <code class="prompt">root# </code> lpadmin -p hplj6f -v socket://hplj6f.abmas.biz:9100 -E </pre><p> - <a class="indexterm" name="id2562622"></a> + <a class="indexterm" name="id2568681"></a> This creates the necessary print queues with no assigned print filter. - </p></li><li><p><a class="indexterm" name="id2562637"></a> + </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id2568696"></a> Print queues may not be enabled at creation. Use <code class="literal">lpc stat</code> to check the status of the print queues and, if necessary, make certain that the queues you have just created are enabled by executing the following: @@ -1072,7 +1072,7 @@ hosts: files dns wins <code class="prompt">root# </code> /usr/bin/enable qmsf <code class="prompt">root# </code> /usr/bin/enable hplj6f </pre><p> - </p></li><li><p><a class="indexterm" name="id2562692"></a> + </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id2568750"></a> Even though your print queues may be enabled, it is still possible that they are not accepting print jobs. A print queue services incoming printing requests only when configured to do so. Ensure that your print queues are @@ -1083,29 +1083,29 @@ hosts: files dns wins <code class="prompt">root# </code> /usr/sbin/accept qmsf <code class="prompt">root# </code> /usr/sbin/accept hplj6f </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2562743"></a> - <a class="indexterm" name="id2562750"></a> - <a class="indexterm" name="id2562757"></a> + </p></li><li class="step" title="Step 6"><p> + <a class="indexterm" name="id2568801"></a> + <a class="indexterm" name="id2568808"></a> + <a class="indexterm" name="id2568815"></a> Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: </p><pre class="screen"> application/octet-stream application/vnd.cups-raw 0 - </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2562784"></a> + </p></li><li class="step" title="Step 7"><p> + <a class="indexterm" name="id2568843"></a> Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: </p><pre class="screen"> application/octet-stream </pre><p> - </p></li><li><p> + </p></li><li class="step" title="Step 8"><p> Printing drivers are installed on each network client workstation. </p></li></ol></div><p> Note: If the parameter <em class="parameter"><code>cups options = Raw</code></em> is specified in the <code class="filename">smb.conf</code> file, the last two steps can be omitted with CUPS version 1.1.18, or later. </p><p> The UNIX system print queues have been configured and are ready for validation testing. - </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="procstart"></a>Process Startup Configuration</h3></div></div></div><p> - <a class="indexterm" name="id2562850"></a> + </p></div><div class="sect2" title="Process Startup Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="procstart"></a>Process Startup Configuration</h3></div></div></div><p> + <a class="indexterm" name="id2568908"></a> There are two essential steps to process startup configuration. First, the process must be configured so that it automatically restarts each time the server is rebooted. This step involves use of the <code class="literal">chkconfig</code> tool that @@ -1114,11 +1114,11 @@ application/octet-stream directories. Links are created so that when the system run level is changed, the necessary start or kill script is run. </p><p> - <a class="indexterm" name="id2562885"></a> - <a class="indexterm" name="id2562892"></a> - <a class="indexterm" name="id2562899"></a> - <a class="indexterm" name="id2562906"></a> - <a class="indexterm" name="id2562912"></a> + <a class="indexterm" name="id2568944"></a> + <a class="indexterm" name="id2568950"></a> + <a class="indexterm" name="id2568957"></a> + <a class="indexterm" name="id2568964"></a> + <a class="indexterm" name="id2568971"></a> In the event that a service is not run as a daemon, but via the internetworking super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code> tool makes the necessary entries in the <code class="filename">/etc/xinetd.d</code> directory @@ -1126,20 +1126,20 @@ application/octet-stream re-read its control files. </p><p> Last, each service must be started to permit system validation to proceed. - </p><div class="procedure"><ol type="1"><li><p> + </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> Use the standard system tool to configure each service to restart automatically at every system reboot. For example, - <a class="indexterm" name="id2562964"></a> + <a class="indexterm" name="id2569022"></a> </p><pre class="screen"> <code class="prompt">root# </code> chkconfig dhpcd on <code class="prompt">root# </code> chkconfig named on <code class="prompt">root# </code> chkconfig cups on <code class="prompt">root# </code> chkconfig smb on </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2563008"></a> - <a class="indexterm" name="id2563015"></a> - <a class="indexterm" name="id2563022"></a> + </p></li><li class="step" title="Step 2"><p> + <a class="indexterm" name="id2569066"></a> + <a class="indexterm" name="id2569073"></a> + <a class="indexterm" name="id2569080"></a> Now start each service to permit the system to be validated. Execute each of the following in the sequence shown: @@ -1149,8 +1149,8 @@ application/octet-stream <code class="prompt">root# </code> /etc/rc.d/init.d/cups restart <code class="prompt">root# </code> /etc/rc.d/init.d/smb restart </pre><p> - </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4valid"></a>Validation</h3></div></div></div><p> - <a class="indexterm" name="id2563076"></a> + </p></li></ol></div></div><div class="sect2" title="Validation"><div class="titlepage"><div><div><h3 class="title"><a name="ch4valid"></a>Validation</h3></div></div></div><p> + <a class="indexterm" name="id2569134"></a> Complex networking problems are most often caused by simple things that are poorly or incorrectly configured. The validation process adopted here should be followed carefully; it is the result of the experience gained from years of making and correcting the most common mistakes. Shortcuts often lead to basic errors. You should @@ -1160,8 +1160,8 @@ application/octet-stream days. A well debugged network is a foundation for happy network users and network administrators. Later in this book you learn how to make users happier. For now, it is enough to learn to validate. Let's get on with it. - </p><div class="procedure"><a name="id2563098"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol type="1"><li><p> - <a class="indexterm" name="id2563110"></a> + </p><div class="procedure" title="Procedure 3.5. Server Validation Steps"><a name="id2569157"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + <a class="indexterm" name="id2569168"></a> One of the most important facets of Samba configuration is to ensure that name resolution functions correctly. You can check name resolution with a few simple tests. The most basic name resolution is provided from the @@ -1186,8 +1186,8 @@ rtt min/avg/max/mdev = 0.131/0.173/0.192/0.026 ms </pre><p> This proves that name resolution via the <code class="filename">/etc/hosts</code> file is working. - </p></li><li><p> - <a class="indexterm" name="id2563179"></a> + </p></li><li class="step" title="Step 2"><p> + <a class="indexterm" name="id2569237"></a> So far, your installation is going particularly well. In this step we validate DNS server and name resolution operation. Using your favorite UNIX system editor, change the <code class="filename">/etc/nsswitch.conf</code> file so that the @@ -1195,8 +1195,8 @@ rtt min/avg/max/mdev = 0.131/0.173/0.192/0.026 ms </p><pre class="screen"> hosts: dns </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2563212"></a> + </p></li><li class="step" title="Step 3"><p> + <a class="indexterm" name="id2569270"></a> Before you test DNS operation, it is a good idea to verify that the DNS server is running by executing the following: </p><pre class="screen"> @@ -1210,7 +1210,7 @@ hosts: dns 2552 pts/2 S 0:00 grep named </pre><p> This means that we are ready to check DNS operation. Do so by executing: - <a class="indexterm" name="id2563242"></a> + <a class="indexterm" name="id2569300"></a> </p><pre class="screen"> <code class="prompt">root# </code> ping diamond PING sleeth1.abmas.biz (192.168.1.1) 56(84) bytes of data. @@ -1226,12 +1226,12 @@ rtt min/avg/max/mdev = 0.156/0.169/0.183/0.018 ms <code class="prompt">root# </code> host -f diamond.abmas.biz sleeth1.abmas.biz has address 192.168.1.1 </pre><p> - <a class="indexterm" name="id2563280"></a> + <a class="indexterm" name="id2569339"></a> You may now remove the entry called <code class="constant">diamond</code> from the <code class="filename">/etc/hosts</code> file. It does not hurt to leave it there, but its removal reduces the number of administrative steps for this name. - </p></li><li><p> - <a class="indexterm" name="id2563306"></a> + </p></li><li class="step" title="Step 4"><p> + <a class="indexterm" name="id2569365"></a> WINS is a great way to resolve NetBIOS names to their IP address. You can test the operation of WINS by starting <code class="literal">nmbd</code> (manually or by way of the Samba startup method shown in <a class="link" href="secure.html#procstart" title="Process Startup Configuration">“Process Startup Configuration”</a>). You must edit @@ -1250,7 +1250,7 @@ PING diamond (192.168.1.1) 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.094 ms 64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.479 ms </pre><p> - <a class="indexterm" name="id2563398"></a> + <a class="indexterm" name="id2569456"></a> Now that you can relax with the knowledge that all three major forms of name resolution to IP address resolution are working, edit the <code class="filename">/etc/nsswitch.conf</code> again. This time you add all three forms of name resolution to this file. @@ -1259,7 +1259,7 @@ PING diamond (192.168.1.1) 56(84) bytes of data. hosts: files dns wins </pre><p> The system is looking good. Let's move on. - </p></li><li><p> + </p></li><li class="step" title="Step 5"><p> It would give you peace of mind to know that the DHCP server is running and available for service. You can validate DHCP services by running: @@ -1270,8 +1270,8 @@ hosts: files dns wins </pre><p> This shows that the server is running. The proof of whether or not it is working comes when you try to add the first DHCP client to the network. - </p></li><li><p> - <a class="indexterm" name="id2563458"></a> + </p></li><li class="step" title="Step 6"><p> + <a class="indexterm" name="id2569516"></a> This is a good point at which to start validating Samba operation. You are content that name resolution is working for basic TCP/IP needs. Let's move on. If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba @@ -1342,11 +1342,11 @@ Loaded services file OK. ### Remainder cut to save space ### </pre><p> Clear away all errors before proceeding. - </p></li><li><p> - <a class="indexterm" name="id2563559"></a> - <a class="indexterm" name="id2563565"></a> - <a class="indexterm" name="id2563572"></a> - <a class="indexterm" name="id2563579"></a> + </p></li><li class="step" title="Step 7"><p> + <a class="indexterm" name="id2569617"></a> + <a class="indexterm" name="id2569624"></a> + <a class="indexterm" name="id2569630"></a> + <a class="indexterm" name="id2569637"></a> Check that the Samba server is running: </p><pre class="screen"> <code class="prompt">root# </code> ps ax | grep mbd @@ -1359,10 +1359,10 @@ $rootprompt; ps ax | grep winbind 14295 ? S 0:00 /usr/sbin/winbindd -D </pre><p> The <code class="literal">winbindd</code> daemon is running in split mode (normal), so there are also - two instances<sup>[<a name="id2563610" href="#ftn.id2563610" class="footnote">7</a>]</sup> of it. - </p></li><li><p> - <a class="indexterm" name="id2563640"></a> - <a class="indexterm" name="id2563648"></a> + two instances<sup>[<a name="id2569669" href="#ftn.id2569669" class="footnote">7</a>]</sup> of it. + </p></li><li class="step" title="Step 8"><p> + <a class="indexterm" name="id2569699"></a> + <a class="indexterm" name="id2569706"></a> Check that an anonymous connection can be made to the Samba server: </p><pre class="screen"> <code class="prompt">root# </code> smbclient -L localhost -U% @@ -1393,10 +1393,10 @@ $rootprompt; ps ax | grep winbind of browsing the server from a Windows client to obtain a list of shares on the server. The <code class="constant">-U%</code> argument means to send a <code class="constant">NULL</code> username and a <code class="constant">NULL</code> password. - </p></li><li><p> - <a class="indexterm" name="id2563705"></a> - <a class="indexterm" name="id2563712"></a> - <a class="indexterm" name="id2563719"></a> + </p></li><li class="step" title="Step 9"><p> + <a class="indexterm" name="id2569764"></a> + <a class="indexterm" name="id2569771"></a> + <a class="indexterm" name="id2569778"></a> Verify that each printer has the IP address assigned in the DHCP server configuration file. The easiest way to do this is to ping the printer name. Immediately after the ping response has been received, execute <code class="literal">arp -a</code> to find the MAC address of the printer @@ -1411,12 +1411,12 @@ PING hplj6a (192.168.1.30) 56(84) bytes of data. <code class="prompt">root# </code> arp -a hplj6a (192.168.1.30) at 00:03:47:CB:81:E0 [ether] on eth0 </pre><p> - <a class="indexterm" name="id2563766"></a> + <a class="indexterm" name="id2569824"></a> The MAC address <code class="constant">00:03:47:CB:81:E0</code> matches that specified for the IP address from which the printer has responded and with the entry for it in the <code class="filename">/etc/dhcpd.conf</code> file. Repeat this for each printer configured. - </p></li><li><p> - <a class="indexterm" name="id2563795"></a> + </p></li><li class="step" title="Step 10"><p> + <a class="indexterm" name="id2569853"></a> Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: </p><pre class="screen"> <code class="prompt">root# </code> smbclient //diamond/accounts -U gholmes @@ -1434,8 +1434,8 @@ smb: \> dir 55974 blocks of size 65536. 33968 blocks available smb: \> q </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2563852"></a> + </p></li><li class="step" title="Step 11"><p> + <a class="indexterm" name="id2569910"></a> Your new server is connected to an Internet-accessible connection. Before you start your firewall, you should run a port scanner against your system. You should repeat that after the firewall has been started. This helps you understand to what extent the @@ -1509,9 +1509,9 @@ Port State Service Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds </pre><p> - </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4appscfg"></a>Application Share Configuration</h3></div></div></div><p> - <a class="indexterm" name="id2563955"></a> - <a class="indexterm" name="id2563962"></a> + </p></li></ol></div></div><div class="sect2" title="Application Share Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch4appscfg"></a>Application Share Configuration</h3></div></div></div><p> + <a class="indexterm" name="id2570013"></a> + <a class="indexterm" name="id2570020"></a> The use of an application server is a key mechanism by which desktop administration overheads can be reduced. Check the application manual for your software to identify how best to create an administrative installation. @@ -1519,20 +1519,20 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds Some Windows software will only run locally on the desktop computer. Such software is typically not suited for administrative installation. Administratively installed software permits one or more of the following installation choices: - </p><div class="itemizedlist"><ul type="disc"><li><p> + </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> Install software fully onto a workstation, storing data files on the same workstation. - </p></li><li><p> + </p></li><li class="listitem"><p> Install software fully onto a workstation with central network data file storage. - </p></li><li><p> + </p></li><li class="listitem"><p> Install software to run off a central application server with data files stored on the local workstation. This is often called a minimum installation, or a network client installation. - </p></li><li><p> + </p></li><li class="listitem"><p> Install software to run off a central application server with data files stored on a central network share. This type of installation often prevents storage of work files on the local workstation. </p></li></ul></div><p> - <a class="indexterm" name="id2564014"></a> + <a class="indexterm" name="id2570072"></a> A common application deployed in this environment is an office suite. Enterprise editions of Microsoft Office XP Professional can be administratively installed by launching the installation from a command shell. The command that achieves this is @@ -1549,8 +1549,8 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds A network workstation (minimum) installation requires typically 10 MB to 15 MB of local disk space. In the latter case, when the applications are used, they load over the network. </p><p> - <a class="indexterm" name="id2564051"></a> - <a class="indexterm" name="id2564058"></a> + <a class="indexterm" name="id2570109"></a> + <a class="indexterm" name="id2570116"></a> Microsoft Office Service Packs can be unpacked to update an administrative share. This makes it possible to update MS Office XP Professional for all users from a single installation of the service pack and generally circumvents the need to run updates on each network @@ -1559,7 +1559,7 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds The default location for MS Office XP Professional data files can be set through registry editing or by way of configuration options inside each Office XP Professional application. </p><p> - <a class="indexterm" name="id2564080"></a> + <a class="indexterm" name="id2570138"></a> OpenOffice.Org OpenOffice Version 1.1.0 can be installed locally. It can also be installed to run off a network share. The latter is a most desirable solution for office-bound network users and for administrative staff alike. It permits quick and easy updates @@ -1572,7 +1572,7 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds prompted on screen for the target installation location. This is the administrative share point. The full administrative OpenOffice share takes approximately 150 MB of disk space. - </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2564111"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p> + </p><div class="sect3" title="Comments Regarding Software Terms of Use"><div class="titlepage"><div><div><h4 class="title"><a name="id2570170"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p> Many single-user products can be installed into an administrative share, but personal versions of products such as Microsoft Office XP Professional do not permit this. Many people do not like terms of use typical with commercial products, so a few comments @@ -1596,142 +1596,142 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds also. Whatever the licensing terms may be, if you do not approve of the terms of use, please do not use the software. </p><p> - <a class="indexterm" name="id2564159"></a> + <a class="indexterm" name="id2570218"></a> Samba is provided under the terms of the GNU GPL Version 2, a copy of which is provided with the source code. - </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4wincfg"></a>Windows Client Configuration</h3></div></div></div><p> + </p></div></div><div class="sect2" title="Windows Client Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch4wincfg"></a>Windows Client Configuration</h3></div></div></div><p> Christine needs to roll out 130 new desktop systems. There is no doubt that she also needs to reinstall many of the notebook computers that will be recycled for use with the new network configuration. The smartest way to handle the challenge of the roll-out program is to build a staged system for each type of target machine, and then use an image replication tool such as Norton Ghost (enterprise edition) to replicate the staged machine to its target desktops. The same can be done with notebook computers as long as they are identical or sufficiently similar. - </p><div class="procedure"><a name="sbewinclntprep"></a><p class="title"><b>Procedure 3.6. Windows Client Configuration Procedure</b></p><ol type="1"><li><p> - <a class="indexterm" name="id2564210"></a> - <a class="indexterm" name="id2564217"></a> + </p><div class="procedure" title="Procedure 3.6. Windows Client Configuration Procedure"><a name="sbewinclntprep"></a><p class="title"><b>Procedure 3.6. Windows Client Configuration Procedure</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + <a class="indexterm" name="id2570268"></a> + <a class="indexterm" name="id2570275"></a> Install MS Windows XP Professional. During installation, configure the client to use DHCP for TCP/IP protocol configuration. DHCP configures all Windows clients to use the WINS Server address that has been defined for the local subnet. - </p></li><li><p> + </p></li><li class="step" title="Step 2"><p> Join the Windows Domain <code class="constant">PROMISES</code>. Use the Domain Administrator username <code class="constant">root</code> and the SMB password you assigned to this account. A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to a Windows Domain is given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. Reboot the machine as prompted and then log on using the Domain Administrator account (<code class="constant">root</code>). - </p></li><li><p> + </p></li><li class="step" title="Step 3"><p> Verify <code class="constant">DIAMOND</code> is visible in <span class="guimenu">My Network Places</span>, that it is possible to connect to it and see the shares <span class="guimenuitem">accounts</span>, <span class="guimenuitem">apps</span>, and <span class="guimenuitem">finsvcs</span>, and that it is possible to open each share to reveal its contents. - </p></li><li><p> + </p></li><li class="step" title="Step 4"><p> Create a drive mapping to the <code class="constant">apps</code> share on the server <code class="constant">DIAMOND</code>. - </p></li><li><p> + </p></li><li class="step" title="Step 5"><p> Perform an administrative installation of each application to be used. Select the options that you wish to use. Of course, you can choose to run applications over the network, correct? - </p></li><li><p> + </p></li><li class="step" title="Step 6"><p> Now install all applications to be installed locally. Typical tools include Adobe Acrobat, NTP-based time synchronization software, drivers for specific local devices such as fingerprint scanners, and the like. Probably the most significant application for local installation is antivirus software. - </p></li><li><p> + </p></li><li class="step" title="Step 7"><p> Now install all four printers onto the staging system. The printers you install include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers. You will also configure identical printers that are located in the financial services department. Install printers on each machine following the steps shown in the Windows client printer preparation procedure below. - </p></li><li><p> - <a class="indexterm" name="id2564354"></a> + </p></li><li class="step" title="Step 8"><p> + <a class="indexterm" name="id2570413"></a> When you are satisfied that the staging systems are complete, use the appropriate procedure to remove the client from the domain. Reboot the system and then log on as the local administrator and clean out all temporary files stored on the system. Before shutting down, use the disk defragmentation tool so that the file system is in optimal condition before replication. - </p></li><li><p> + </p></li><li class="step" title="Step 9"><p> Boot the workstation using the Norton (Symantec) Ghosting diskette (or CD-ROM) and image the machine to a network share on the server. - </p></li><li><p> - <a class="indexterm" name="id2564384"></a> - <a class="indexterm" name="id2564393"></a> + </p></li><li class="step" title="Step 10"><p> + <a class="indexterm" name="id2570442"></a> + <a class="indexterm" name="id2570452"></a> You may now replicate the image to the target machines using the appropriate Norton Ghost procedure. Make sure to use the procedure that ensures each machine has a unique Windows security identifier (SID). When the installation of the disk image has completed, boot the PC. - </p></li><li><p> + </p></li><li class="step" title="Step 11"><p> Log on to the machine as the local Administrator (the only option), and join the machine to the Domain, following the procedure set out in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. The system is now ready for the user to log on, provided you have created a network logon account for that user, of course. - </p></li><li><p> + </p></li><li class="step" title="Step 12"><p> Instruct all users to log on to the workstation using their assigned username and password. - </p></li></ol></div><div class="procedure"><a name="sbewinclntptrprep"></a><p class="title"><b>Procedure 3.7. Windows Client Printer Preparation Procedure</b></p><ol type="1"><li><p> + </p></li></ol></div><div class="procedure" title="Procedure 3.7. Windows Client Printer Preparation Procedure"><a name="sbewinclntptrprep"></a><p class="title"><b>Procedure 3.7. Windows Client Printer Preparation Procedure</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. Ensure that <span class="guimenuitem">Local printer</span> is selected. - </p></li><li><p> + </p></li><li class="step" title="Step 2"><p> Click <span class="guibutton">Next</span>. In the <span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>. In the <span class="guimenuitem">Printers:</span> panel, select the printer called <code class="constant">HP LaserJet 6</code>. Click <span class="guibutton">Next</span>. - </p></li><li><p> + </p></li><li class="step" title="Step 3"><p> In the <span class="guimenuitem">Available ports:</span> panel, select <code class="constant">FILE:</code>. Accept the default printer name by clicking - <span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a - test page?,</span>” click <span class="guimenuitem">No</span>. Click + <span class="guibutton">Next</span>. When asked, <span class="quote">“<span class="quote">Would you like to print a + test page?,</span>”</span> click <span class="guimenuitem">No</span>. Click <span class="guibutton">Finish</span>. - </p></li><li><p> + </p></li><li class="step" title="Step 4"><p> You may be prompted for the name of a file to print to. If so, close the dialog panel. Right-click <span class="guiicon">HP LaserJet 6</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>. - </p></li><li><p> + </p></li><li class="step" title="Step 5"><p> In the <span class="guimenuitem">Network</span> panel, enter the name of the print queue on the Samba server as follows: <code class="constant">\\DIAMOND\hplj6a</code>. Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation. - </p></li><li><p> + </p></li><li class="step" title="Step 6"><p> Repeat the printer installation steps above for both HP LaserJet 6 printers as well as for both QMS Magicolor laser printers. - </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2564663"></a>Key Points Learned</h3></div></div></div><p> + </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id2570721"></a>Key Points Learned</h3></div></div></div><p> How do you feel? You have built a capable network, a truly ambitious project. Future network updates can be handled by your staff. You must be a satisfied manager. Let's review the achievements. - </p><div class="itemizedlist"><ul type="disc"><li><p> + </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> A simple firewall has been configured to protect the server in the event that the ISP firewall service should fail. - </p></li><li><p> + </p></li><li class="listitem"><p> The Samba configuration uses measures to ensure that only local network users can connect to SMB/CIFS services. - </p></li><li><p> + </p></li><li class="listitem"><p> Samba uses the new <code class="constant">tdbsam</code> passdb backend facility. Considerable complexity was added to Samba functionality. - </p></li><li><p> + </p></li><li class="listitem"><p> A DHCP server was configured to implement dynamic DNS (DDNS) updates to the DNS server. - </p></li><li><p> + </p></li><li class="listitem"><p> The DNS server was configured to permit DDNS only for local network clients. This server also provides primary DNS services for the company Internet presence. - </p></li><li><p> + </p></li><li class="listitem"><p> You introduced an application server as well as the concept of cloning a Windows client in order to effect improved standardization of desktops and to reduce the costs of network management. - </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2564725"></a>Questions and Answers</h2></div></div></div><p> - </p><div class="qandaset"><dl><dt>1. <a href="secure.html#id2564741"> + </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2570783"></a>Questions and Answers</h2></div></div></div><p> + </p><div class="qandaset" title="Frequently Asked Questions"><a name="id2570793"></a><dl><dt>1. <a href="secure.html#id2570799"> What is the maximum number of account entries that the tdbsam passdb backend can handle? - </a></dt><dt>2. <a href="secure.html#id2564809"> + </a></dt><dt>2. <a href="secure.html#id2570868"> Would Samba operate any better if the OS level is set to a value higher than 35? - </a></dt><dt>3. <a href="secure.html#id2564831"> + </a></dt><dt>3. <a href="secure.html#id2570890"> Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? - </a></dt><dt>4. <a href="secure.html#id2564854"> + </a></dt><dt>4. <a href="secure.html#id2570913"> Why has a path been specified in the IPC$ share? - </a></dt><dt>5. <a href="secure.html#id2564882"> + </a></dt><dt>5. <a href="secure.html#id2570941"> Why does the smb.conf file in this exercise include an entry for smb ports? - </a></dt><dt>6. <a href="secure.html#id2564929"> + </a></dt><dt>6. <a href="secure.html#id2570988"> What is the difference between a print queue and a printer? - </a></dt><dt>7. <a href="secure.html#id2564965"> + </a></dt><dt>7. <a href="secure.html#id2571024"> Can all MS Windows application software be installed onto an application server share? - </a></dt><dt>8. <a href="secure.html#id2564990"> + </a></dt><dt>8. <a href="secure.html#id2571048"> Why use dynamic DNS (DDNS)? - </a></dt><dt>9. <a href="secure.html#id2565009"> + </a></dt><dt>9. <a href="secure.html#id2571068"> Why would you use WINS as well as DNS-based name resolution? - </a></dt><dt>10. <a href="secure.html#id2565094"> + </a></dt><dt>10. <a href="secure.html#id2571153"> What are the major benefits of using an application server? - </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2564741"></a><a name="id2564743"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> + </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question" title="1."><td align="left" valign="top"><a name="id2570799"></a><a name="id2570801"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> What is the maximum number of account entries that the <em class="parameter"><code>tdbsam</code></em> passdb backend can handle? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> @@ -1757,26 +1757,26 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds at which most networks tend to want backup domain controllers (BDCs). Samba-3 does not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The limitation of 250 users per tdbsam is predicated only on the need for replication, - not on the limits<sup>[<a name="id2564799" href="#ftn.id2564799" class="footnote">8</a>]</sup> of the tdbsam backend itself. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564809"></a><a name="id2564812"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> + not on the limits<sup>[<a name="id2570857" href="#ftn.id2570857" class="footnote">8</a>]</sup> of the tdbsam backend itself. + </p></td></tr><tr class="question" title="2."><td align="left" valign="top"><a name="id2570868"></a><a name="id2570870"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> Would Samba operate any better if the OS level is set to a value higher than 35? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> No. MS Windows workstations and servers do not use a value higher than 33. Setting this to a value of 35 already assures Samba of precedence over MS Windows products in browser elections. There is no gain to be had from setting this higher. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564831"></a><a name="id2564833"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="3."><td align="left" valign="top"><a name="id2570890"></a><a name="id2570892"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> At this time, Samba has the capacity to use only Domain Groups mappings. It is possible that at a later date Samba may make use of Windows Local Groups, as well as of the Active Directory special Groups. Proper operation requires Domain Groups to be mapped to valid UNIX groups. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564854"></a><a name="id2564856"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="4."><td align="left" valign="top"><a name="id2570913"></a><a name="id2570915"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> Why has a path been specified in the <em class="parameter"><code>IPC$</code></em> share? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> This is done so that in the event that a software bug may permit a client connection to the IPC$ share to obtain access to the file system, it does so at a location that presents least risk. Under normal operation this type of paranoid step should not be necessary. The use of this parameter should not be necessary. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564882"></a><a name="id2564885"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="5."><td align="left" valign="top"><a name="id2570941"></a><a name="id2570943"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> Why does the <code class="filename">smb.conf</code> file in this exercise include an entry for <a class="link" href="smb.conf.5.html#SMBPORTS" target="_top">smb ports</a>? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> The default order by which Samba-3 attempts to communicate with MS Windows clients is via port 445 (the TCP port @@ -1785,7 +1785,7 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds specifying the use of only port 139, the intent is to reduce unsuccessful service connection attempts. The result of this is improved network performance. Where Samba-3 is installed as an Active Directory Domain member, the default behavior is highly beneficial and should not be changed. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564929"></a><a name="id2564931"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="6."><td align="left" valign="top"><a name="id2570988"></a><a name="id2570990"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> What is the difference between a print queue and a printer? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> A printer is a physical device that is connected either directly to the network or to a computer @@ -1799,7 +1799,7 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds print requests. When the data stream has been fully received, the input stream is closed, and the job is then submitted to a sequential print queue where the job is stored until the printer is ready to receive the job. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564965"></a><a name="id2564967"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="7."><td align="left" valign="top"><a name="id2571024"></a><a name="id2571026"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> Can all MS Windows application software be installed onto an application server share? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> Much older Windows software is not compatible with installation to and execution from @@ -1807,21 +1807,21 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds be installed to an application server. Retail consumer versions of Microsoft Office XP Professional do not permit installation to an application server share and can be installed and used only to/from a local workstation hard disk. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2564990"></a><a name="id2564992"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="8."><td align="left" valign="top"><a name="id2571048"></a><a name="id2571050"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> Why use dynamic DNS (DDNS)? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> When DDNS records are updated directly from the DHCP server, it is possible for network clients that are not NetBIOS-enabled, and thus cannot use WINS, to locate Windows clients via DNS. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2565009"></a><a name="id2565011"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="9."><td align="left" valign="top"><a name="id2571068"></a><a name="id2571070"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> Why would you use WINS as well as DNS-based name resolution? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> WINS is to NetBIOS names as DNS is to fully qualified domain names (FQDN). The FQDN is - a name like “<span class="quote">myhost.mydomain.tld</span>” where <em class="parameter"><code>tld</code></em> + a name like <span class="quote">“<span class="quote">myhost.mydomain.tld</span>”</span> where <em class="parameter"><code>tld</code></em> means <code class="constant">top-level domain</code>. A FQDN is a longhand but easy-to-remember expression that may be up to 1024 characters in length and that represents an IP address. A NetBIOS name is always 16 characters long. The 16<sup>th</sup> character - is a name type indicator. A specific name type is registered<sup>[<a name="id2565047" href="#ftn.id2565047" class="footnote">9</a>]</sup> for each + is a name type indicator. A specific name type is registered<sup>[<a name="id2571106" href="#ftn.id2571106" class="footnote">9</a>]</sup> for each type of service that is provided by the Windows server or client and that may be registered where a WINS server is in use. </p><p> @@ -1836,24 +1836,24 @@ Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds which it has control. </p><p> Windows 200x Active Directory requires the registration in the DNS zone for the domain it - controls of service locator<sup>[<a name="id2565081" href="#ftn.id2565081" class="footnote">10</a>]</sup> records + controls of service locator<sup>[<a name="id2571140" href="#ftn.id2571140" class="footnote">10</a>]</sup> records that Windows clients and servers will use to locate Kerberos and LDAP services. ADS also requires the registration of special records that are called global catalog (GC) entries and site entries by which domain controllers and other essential ADS servers may be located. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2565094"></a><a name="id2565096"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="10."><td align="left" valign="top"><a name="id2571153"></a><a name="id2571155"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> What are the major benefits of using an application server? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> The use of an application server can significantly reduce application update maintenance. By providing a centralized application share, software updates need be applied to only one location for all major applications used. This results in faster update roll-outs and significantly better application usage control. - </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2559643" href="#id2559643" class="para">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3. + </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2565700" href="#id2565700" class="para">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3. This is necessary so that Samba can act as a Domain Controller (PDC); see - <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2560023" href="#id2560023" class="para">6</a>] </sup>You may want to do the echo command last and include - "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2563610" href="#id2563610" class="para">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>, + <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2566081" href="#id2566081" class="para">6</a>] </sup>You may want to do the echo command last and include + "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2569669" href="#id2569669" class="para">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 23, Section 23.3. The single instance of <code class="literal">smbd</code> is normal. One additional <code class="literal">smbd</code> slave process is spawned for each SMB/CIFS client - connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2564799" href="#id2564799" class="para">8</a>] </sup>Bench tests have shown that tdbsam is a very + connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2570857" href="#id2570857" class="para">8</a>] </sup>Bench tests have shown that tdbsam is a very effective database technology. There is surprisingly little performance loss even - with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2565047" href="#id2565047" class="para">9</a>] </sup> - See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2565081" href="#id2565081" class="para">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html> + with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2571106" href="#id2571106" class="para">9</a>] </sup> + See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2571140" href="#id2571140" class="para">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html> |