diff options
Diffstat (limited to 'docs/htmldocs/Samba3-ByExample/small.html')
| -rw-r--r-- | docs/htmldocs/Samba3-ByExample/small.html | 308 |
1 files changed, 154 insertions, 154 deletions
diff --git a/docs/htmldocs/Samba3-ByExample/small.html b/docs/htmldocs/Samba3-ByExample/small.html index 36a600861e..d16a51543a 100644 --- a/docs/htmldocs/Samba3-ByExample/small.html +++ b/docs/htmldocs/Samba3-ByExample/small.html @@ -1,4 +1,4 @@ -<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id2555439">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2555462">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2555522">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2555570">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2555768">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2555790">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2557337">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2557985">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2558010">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2558084">Questions and Answers</a></span></dt></dl></div><p> +<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 2. Small Office Networking"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id327308">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327326">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327371">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327416">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id327588">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327606">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id329058">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id329633">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id329652">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id329716">Questions and Answers</a></span></dt></dl></div><p> <a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a> focused on the basics of simple yet effective network solutions. Network administrators who take pride in their work (that's most of us, right?) take care to deliver what our users want, @@ -8,7 +8,7 @@ operates. Some creativity is helpful, but keep it under control good advice that the following two scenarios illustrate. </p><p> - <a class="indexterm" name="id2555395"></a> + <a class="indexterm" name="id327280"></a> In one case the network administrator of a mid-sized company spent three months building a new network to replace an old Netware server. What he delivered had all the bells and whistles he could muster. There were a @@ -33,10 +33,10 @@ features, and yet he had happy users. Months later he was still adding new innovations. He always asked the users if a particular feature was what they wanted. He asked his boss for a raise - and got it. He often told me, “<span class="quote">Always keep a few new tricks up your - sleeves for when you need them.</span>” Was he smart? You decide. Let's + and got it. He often told me, <span class="quote">“<span class="quote">Always keep a few new tricks up your + sleeves for when you need them.</span>”</span> Was he smart? You decide. Let's get on with our next exercise. - </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555439"></a>Introduction</h2></div></div></div><p> + </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id327308"></a>Introduction</h2></div></div></div><p> Abmas Accounting has grown. Mr. Meany likes you and says he knew you were the right person for the job. That's why he asked you to install the new server. The past few months have been hard work. You advised Mr. Meany @@ -47,8 +47,8 @@ Some of the Windows clients are nearly past their use-by date. You found damaged and unusable software on some of the workstations that came with the acquired business and found some machines in need of both hardware and software maintenance. - </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555462"></a>Assignment Tasks</h3></div></div></div><p> - <a class="indexterm" name="id2555469"></a> + </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id327326"></a>Assignment Tasks</h3></div></div></div><p> + <a class="indexterm" name="id327333"></a> Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure that the business is running efficiently. Many of the new staff want notebook computers. They visit customer business premises and need to use local network @@ -80,28 +80,28 @@ Mr. Meany also asked if it would be possible for one of the staff to manage user accounts from the Windows desktop. That person will be responsible for basic operations. - </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555522"></a>Dissection and Discussion</h2></div></div></div><p> + </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id327371"></a>Dissection and Discussion</h2></div></div></div><p> What are the key requirements in this business example? A quick review indicates a need for - </p><div class="itemizedlist"><ul type="disc"><li><p> + </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> Scalability, from 52 to over 100 users in 12 months - </p></li><li><p> + </p></li><li class="listitem"><p> Mobile computing capability - <a class="indexterm" name="id2555543"></a> - </p></li><li><p> + <a class="indexterm" name="id327391"></a> + </p></li><li class="listitem"><p> Improved reliability and usability - </p></li><li><p> + </p></li><li class="listitem"><p> Easier administration </p></li></ul></div><p> In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server (as in <a class="link" href="simple.html#AccountingOffice" title="Accounting Office">“Accounting Office”</a>). - </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555570"></a>Technical Issues</h3></div></div></div><p> - <a class="indexterm" name="id2555577"></a> - <a class="indexterm" name="id2555584"></a> - <a class="indexterm" name="id2555590"></a> - <a class="indexterm" name="id2555596"></a> - <a class="indexterm" name="id2555602"></a> + </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id327416"></a>Technical Issues</h3></div></div></div><p> + <a class="indexterm" name="id327424"></a> + <a class="indexterm" name="id327430"></a> + <a class="indexterm" name="id327436"></a> + <a class="indexterm" name="id327443"></a> + <a class="indexterm" name="id327449"></a> It is time to implement a domain security environment. You will use the <code class="constant"> smbpasswd</code> (default) backend. You should implement a DHCP server. There is no need to run DNS at this time, but the system will use WINS. The domain name will be <code class="constant"> @@ -110,7 +110,7 @@ All printers will be configured as DHCP clients. The DHCP server will assign the printer a fixed IP address by way of its Ethernet interface (MAC) address. See <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>. - </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> + </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> The <code class="filename">smb.conf</code> file you are creating in this exercise can be used with equal effectiveness with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is possible to start with the installation that you have created here, migrate it @@ -122,7 +122,7 @@ Later on, when the Internet connection is implemented, you will add DNS as well as other enhancements. It is important that you plan accordingly. </p><p> - <a class="indexterm" name="id2555662"></a> + <a class="indexterm" name="id327498"></a> You have split the network into two separate areas. Each has its own Ethernet switch. There are 20 users on the accounting network and 32 users on the financial services network. The server has two network interfaces, one serving each network. The @@ -137,8 +137,8 @@ Given that DNS will not be used, you will configure WINS name resolution for UNIX hostname name resolution. </p><p> - <a class="indexterm" name="id2555692"></a> - <a class="indexterm" name="id2555700"></a> + <a class="indexterm" name="id327521"></a> + <a class="indexterm" name="id327530"></a> It is necessary to map Windows Domain Groups to UNIX groups. It is advisable to also map Windows Local Groups to UNIX groups. Additionally, the two key staff groups in the firm are accounting staff and financial services staff. @@ -155,10 +155,10 @@ <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 11, Section 11.3.1, Example 11.1, for more information. </p><p> - <a class="indexterm" name="id2555755"></a> + <a class="indexterm" name="id327576"></a> Vendor-supplied printer drivers will be installed on each client. The CUPS print spooler on the UNIX host will be operated in <code class="constant">raw</code> mode. - </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555768"></a>Political Issues</h3></div></div></div><p> + </p></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id327588"></a>Political Issues</h3></div></div></div><p> Mr. Meany is an old-school manager. He sets the rules and wants to see compliance. He is willing to spend money on things he believes are of value. You need more time to convince him of real priorities. @@ -166,8 +166,8 @@ Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be supplied with antivirus software? Above all, demonstrate good purchase value and remember to make your users happy. - </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555790"></a>Implementation</h2></div></div></div><p> - <a class="indexterm" name="id2555797"></a> + </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id327606"></a>Implementation</h2></div></div></div><p> + <a class="indexterm" name="id327614"></a> In this example, the assumption is made that this server is being configured from a clean start. The alternate approach could be to demonstrate the migration of the system that is documented in <a class="link" href="simple.html#AcctgNet" title="Implementation">“Implementation”</a> to meet the new requirements. The decision to treat this case, as with @@ -175,25 +175,25 @@ the migration steps from the information provided in <a class="link" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3">“Migrating NT4 Domain to Samba-3”</a>. Additionally, a fresh installation makes the example easier to follow. </p><p> - <a class="indexterm" name="id2555823"></a> + <a class="indexterm" name="id327636"></a> Each user will be given a home directory on the UNIX system, which will be available as a private share. Two additional shares will be created, one for the accounting department and the other for the financial services department. Network users will be given access to these shares by way of group membership. </p><p> - <a class="indexterm" name="id2555838"></a> + <a class="indexterm" name="id327648"></a> UNIX group membership is the primary mechanism by which Windows Domain users will be granted rights and privileges within the Windows environment. </p><p> - <a class="indexterm" name="id2555852"></a> + <a class="indexterm" name="id327661"></a> The user <code class="literal">alanm</code> will be made the owner of all files. This will be preserved by setting the sticky bit (set UID/GID) on the top-level directories. </p><p> </p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure 2.1. Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><p><br class="figure-break"> -</p><div class="procedure"><a name="id2555910"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol type="1"><li><p> +</p><div class="procedure" title="Procedure 2.1. Server Installation Steps"><a name="id327717"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> Using UNIX/Linux system tools, name the server <code class="constant">sleeth</code>. - </p></li><li><p> - <a class="indexterm" name="id2555931"></a> + </p></li><li class="step" title="Step 2"><p> + <a class="indexterm" name="id327737"></a> Place an entry for the machine <code class="constant">sleeth</code> in the <code class="filename">/etc/hosts</code>. The printers are network attached, so there should be entries for the network printers also. An example <code class="filename">/etc/hosts</code> file is shown here: @@ -204,15 +204,15 @@ 192.168.1.11 hplj4 192.168.2.10 qms </pre><p> - </p></li><li><p> + </p></li><li class="step" title="Step 3"><p> Install the Samba-3 binary RPM from the Samba-Team FTP site. - </p></li><li><p> + </p></li><li class="step" title="Step 4"><p> Install the ISC DHCP server using the UNIX/Linux system tools available to you. - </p></li><li><p> - <a class="indexterm" name="id2555982"></a> - <a class="indexterm" name="id2555988"></a> - <a class="indexterm" name="id2555995"></a> - <a class="indexterm" name="id2556001"></a> + </p></li><li class="step" title="Step 5"><p> + <a class="indexterm" name="id327784"></a> + <a class="indexterm" name="id327791"></a> + <a class="indexterm" name="id327797"></a> + <a class="indexterm" name="id327803"></a> Because Samba will be operating over two network interfaces and clients on each side may want to be able to reach clients on the other side, it is imperative that IP forwarding is enabled. Use the system tool of your choice to enable IP forwarding. In the @@ -222,12 +222,12 @@ echo 1 > /proc/sys/net/ipv4/ip_forward </pre><p> This causes the Linux kernel to forward IP packets so that it acts as a router. - </p></li><li><p> + </p></li><li class="step" title="Step 6"><p> Install the <code class="filename">smb.conf</code> file as shown in <a class="link" href="small.html#acct2conf" title="Example 2.3. Accounting Office Network smb.conf File [globals] Section">“Accounting Office Network smb.conf File [globals] Section”</a> and <a class="link" href="small.html#acct3conf" title="Example 2.4. Accounting Office Network smb.conf File Services and Shares Section">“Accounting Office Network smb.conf File Services and Shares Section”</a>. Combine these two examples to form a single <code class="filename">/etc/samba/smb.conf</code> file. - </p></li><li><p> - <a class="indexterm" name="id2556060"></a> + </p></li><li class="step" title="Step 7"><p> + <a class="indexterm" name="id327856"></a> Add the user <code class="literal">root</code> to the Samba password backend: </p><pre class="screen"> <code class="prompt">root# </code> smbpasswd -a root @@ -235,13 +235,13 @@ New SMB password: XXXXXXX Retype new SMB password: XXXXXXX <code class="prompt">root# </code> </pre><p> - <a class="indexterm" name="id2556089"></a> + <a class="indexterm" name="id327884"></a> This is the Windows Domain Administrator password. Never delete this account from the password backend after Windows Domain Groups have been initialized. If you delete this account, your system is crippled. You cannot restore this account, and your Samba server can no longer be administered. - </p></li><li><p> - <a class="indexterm" name="id2556107"></a> + </p></li><li class="step" title="Step 8"><p> + <a class="indexterm" name="id327899"></a> Create the username map file to permit the <code class="constant">root</code> account to be called <code class="constant">Administrator</code> from the Windows network environment. To do this, create the file <code class="filename">/etc/samba/smbusers</code> with the following contents: @@ -267,14 +267,14 @@ root = Administrator # End of File #### </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2556147"></a> + </p></li><li class="step" title="Step 9"><p> + <a class="indexterm" name="id327933"></a> Create and map Windows Domain Groups to UNIX groups. A sample script is provided in <a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours <code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed, and then execute the script. Sample output should be as follows: -</p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id2556176"></a><pre class="screen"> +</p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id327958"></a><pre class="screen"> #!/bin/bash # # initGrps.sh @@ -323,31 +323,31 @@ Replicators (S-1-5-32-552) -> -1 System Operators (S-1-5-32-549) -> -1 Users (S-1-5-32-545) -> -1 </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2556254"></a> - <a class="indexterm" name="id2556260"></a> - <a class="indexterm" name="id2556268"></a> + </p></li><li class="step" title="Step 10"><p> + <a class="indexterm" name="id328022"></a> + <a class="indexterm" name="id328029"></a> + <a class="indexterm" name="id328037"></a> For each user who needs to be given a Windows Domain account, make an entry in the <code class="filename">/etc/passwd</code> file as well as in the Samba password backend. Use the system tool of your choice to create the UNIX system accounts, and use the Samba <code class="literal">smbpasswd</code> program to create the Domain user accounts. </p><p> - <a class="indexterm" name="id2556293"></a> - <a class="indexterm" name="id2556300"></a> - <a class="indexterm" name="id2556306"></a> + <a class="indexterm" name="id328059"></a> + <a class="indexterm" name="id328066"></a> + <a class="indexterm" name="id328072"></a> There are a number of tools for user management under UNIX, such as <code class="literal">useradd</code> and <code class="literal">adduser</code>, as well as a plethora of custom tools. With the tool of your choice, create a home directory for each user. - </p></li><li><p> + </p></li><li class="step" title="Step 11"><p> Using the preferred tool for your UNIX system, add each user to the UNIX groups created previously, as necessary. File system access control will be based on UNIX group membership. - </p></li><li><p> + </p></li><li class="step" title="Step 12"><p> Create the directory mount point for the disk subsystem that is mounted to provide data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code> file is <code class="filename">/data</code>. Format the file system as required, mount the formatted file system partition using <code class="literal">mount</code>, and make the appropriate changes in <code class="filename">/etc/fstab</code>. - </p></li><li><p> + </p></li><li class="step" title="Step 13"><p> Create the top-level file storage directories are follows: </p><pre class="screen"> <code class="prompt">root# </code> mkdir -p /data/{accounts,finsvcs} @@ -359,42 +359,42 @@ Users (S-1-5-32-545) -> -1 Each department is responsible for creating its own directory structure within its share. The directory root of the <code class="literal">accounts</code> share is <code class="filename">/data/accounts</code>. The directory root of the <code class="literal">finsvcs</code> share is <code class="filename">/data/finsvcs</code>. - </p></li><li><p> + </p></li><li class="step" title="Step 14"><p> Configure the printers with the IP addresses as shown in <a class="link" href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>. Follow the instructions in the manufacturers' manuals to permit printing to port 9100. This allows the CUPS spooler to print using raw mode protocols. - <a class="indexterm" name="id2556450"></a> - <a class="indexterm" name="id2556456"></a> - </p></li><li><p> - <a class="indexterm" name="id2556468"></a> - <a class="indexterm" name="id2556477"></a> + <a class="indexterm" name="id328203"></a> + <a class="indexterm" name="id328209"></a> + </p></li><li class="step" title="Step 15"><p> + <a class="indexterm" name="id328222"></a> + <a class="indexterm" name="id328230"></a> Configure the CUPS Print Queues as follows: </p><pre class="screen"> <code class="prompt">root# </code> lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E <code class="prompt">root# </code> lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E <code class="prompt">root# </code> lpadmin -p qms -v socket://192.168.2.10:9100 -E </pre><p> - <a class="indexterm" name="id2556508"></a> + <a class="indexterm" name="id328257"></a> This creates the necessary print queues with no assigned print filter. - </p></li><li><p> - <a class="indexterm" name="id2556522"></a> - <a class="indexterm" name="id2556528"></a> - <a class="indexterm" name="id2556534"></a> + </p></li><li class="step" title="Step 16"><p> + <a class="indexterm" name="id328270"></a> + <a class="indexterm" name="id328277"></a> + <a class="indexterm" name="id328283"></a> Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: </p><pre class="screen"> application/octet-stream application/vnd.cups-raw 0 - </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2556558"></a> + </p></li><li class="step" title="Step 17"><p> + <a class="indexterm" name="id328306"></a> Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: </p><pre class="screen"> application/octet-stream </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2556581"></a> + </p></li><li class="step" title="Step 18"><p> + <a class="indexterm" name="id328329"></a> Using your favorite system editor, create an <code class="filename">/etc/dhcpd.conf</code> with the contents as shown in <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>. -</p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id2556614"></a><pre class="screen"> +</p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id328359"></a><pre class="screen"> default-lease-time 86400; max-lease-time 172800; default-lease-time 86400; @@ -438,15 +438,15 @@ subnet 192.168.2.0 netmask 255.255.255.0 { subnet 127.0.0.0 netmask 255.0.0.0 { } </pre></div></div><p><br class="example-break"> - </p></li><li><p> + </p></li><li class="step" title="Step 19"><p> Use the standard system tool to start Samba and CUPS and configure them to start automatically at every system reboot. For example, </p><p> - <a class="indexterm" name="id2556658"></a> - <a class="indexterm" name="id2556664"></a> - <a class="indexterm" name="id2556670"></a> - <a class="indexterm" name="id2556676"></a> - <a class="indexterm" name="id2556683"></a> + <a class="indexterm" name="id328392"></a> + <a class="indexterm" name="id328398"></a> + <a class="indexterm" name="id328404"></a> + <a class="indexterm" name="id328411"></a> + <a class="indexterm" name="id328417"></a> </p><pre class="screen"> <code class="prompt">root# </code> chkconfig dhcp on <code class="prompt">root# </code> chkconfig smb on @@ -455,13 +455,13 @@ subnet 127.0.0.0 netmask 255.0.0.0 { <code class="prompt">root# </code> /etc/rc.d/init.d/smb restart <code class="prompt">root# </code> /etc/rc.d/init.d/cups restart </pre><p> - </p></li><li><p> - <a class="indexterm" name="id2556733"></a> - <a class="indexterm" name="id2556739"></a> - <a class="indexterm" name="id2556748"></a> - <a class="indexterm" name="id2556754"></a> - <a class="indexterm" name="id2556760"></a> - <a class="indexterm" name="id2556766"></a> + </p></li><li class="step" title="Step 20"><p> + <a class="indexterm" name="id328466"></a> + <a class="indexterm" name="id328472"></a> + <a class="indexterm" name="id328480"></a> + <a class="indexterm" name="id328487"></a> + <a class="indexterm" name="id328493"></a> + <a class="indexterm" name="id328499"></a> Configure the name service switch (NSS) to handle WINS-based name resolution. Since this system does not use a DNS server, it is safe to remove this option from the NSS configuration. Edit the <code class="filename">/etc/nsswitch.conf</code> file so that @@ -469,11 +469,11 @@ subnet 127.0.0.0 netmask 255.0.0.0 { </p><pre class="screen"> hosts: files wins </pre><p> - </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2556824"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id2556834"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2556846"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2556857"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2556867"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2556878"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2556889"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2556900"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556911"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556922"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2556934"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2556945"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556956"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556968"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2556979"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id2556990"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2557000"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557011"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557021"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557031"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2557072"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2557082"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2557093"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2557103"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2557122"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2557132"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2557143"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557153"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557163"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557174"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2557193"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2557204"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2557214"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2557224"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2557243"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2557254"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2557264"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2557274"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsrvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id2557293"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id2557304"></a><em class="parameter"><code>path = /data/finsrvcs</code></em></td></tr><tr><td><a class="indexterm" name="id2557315"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2557325"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2557337"></a>Validation</h3></div></div></div><p> + </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id328555"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id328565"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id328576"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id328587"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id328597"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id328607"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id328618"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id328628"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328639"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328649"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id328659"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id328670"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328681"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328692"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id328702"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id328713"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id328723"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328734"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328744"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328754"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id328794"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id328805"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id328815"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id328825"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id328844"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id328855"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id328865"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328875"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328886"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328896"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id328915"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id328925"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id328936"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id328946"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id328965"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id328975"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id328986"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id328996"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsrvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id329015"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id329025"></a><em class="parameter"><code>path = /data/finsrvcs</code></em></td></tr><tr><td><a class="indexterm" name="id329036"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id329046"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" title="Validation"><div class="titlepage"><div><div><h3 class="title"><a name="id329058"></a>Validation</h3></div></div></div><p> Does everything function as it ought? That is the key question at this point. Here are some simple steps to validate your Samba server configuration. - </p><div class="procedure"><a name="id2557348"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol type="1"><li><p> - <a class="indexterm" name="id2557358"></a> + </p><div class="procedure" title="Procedure 2.2. Validation Steps"><a name="id329068"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> + <a class="indexterm" name="id329078"></a> If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba to refuse to start. The first step should always be to validate the contents of this file by running: @@ -519,11 +519,11 @@ Unknown parameter encountered: "dogbert" Ignoring unknown parameter "dogbert" </pre><p> Clear away all errors before proceeding, and start or restart samba as necessary. - </p></li><li><p> - <a class="indexterm" name="id2557438"></a> - <a class="indexterm" name="id2557444"></a> - <a class="indexterm" name="id2557450"></a> - <a class="indexterm" name="id2557457"></a> + </p></li><li class="step" title="Step 2"><p> + <a class="indexterm" name="id329135"></a> + <a class="indexterm" name="id329141"></a> + <a class="indexterm" name="id329148"></a> + <a class="indexterm" name="id329154"></a> Check that the Samba server is running: </p><pre class="screen"> <code class="prompt">root# </code> ps ax | grep mbd @@ -539,8 +539,8 @@ $rootprompt; ps ax | grep winbind two instances of it. For more information regarding <code class="literal">winbindd</code>, see <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 23, Section 23.3. The single instance of <code class="literal">smbd</code> is normal. - </p></li><li><p> - <a class="indexterm" name="id2557508"></a> + </p></li><li class="step" title="Step 3"><p> + <a class="indexterm" name="id329199"></a> Check that an anonymous connection can be made to the Samba server: </p><pre class="screen"> <code class="prompt">root# </code> smbclient -L localhost -U% @@ -568,10 +568,10 @@ $rootprompt; ps ax | grep winbind of browsing the server from a Windows client to obtain a list of shares on the server. The <code class="constant">-U%</code> argument means to send a <code class="constant">NULL</code> username and a <code class="constant">NULL</code> password. - </p></li><li><p> - <a class="indexterm" name="id2557558"></a> - <a class="indexterm" name="id2557564"></a> - <a class="indexterm" name="id2557571"></a> + </p></li><li class="step" title="Step 4"><p> + <a class="indexterm" name="id329241"></a> + <a class="indexterm" name="id329247"></a> + <a class="indexterm" name="id329254"></a> Verify that the printers have the IP addresses assigned in the DHCP server configuration file. The easiest way to do this is to ping the printer name. Immediately after the ping response has been received, execute <code class="literal">arp -a</code> to find the MAC address of the printer @@ -589,8 +589,8 @@ hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0 The MAC address <code class="constant">08:00:46:7A:35:E4</code> matches that specified for the IP address from which the printer has responded and the entry for it in the <code class="filename">/etc/dhcpd.conf</code> file. - </p></li><li><p> - <a class="indexterm" name="id2557631"></a> + </p></li><li class="step" title="Step 5"><p> + <a class="indexterm" name="id329307"></a> Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: </p><pre class="screen"> <code class="prompt">root# </code> smbclient //sleeth/accounts -U alanm @@ -607,53 +607,53 @@ smb: \> dir 65387 blocks of size 65536. 28590 blocks available smb: \> q </pre><p> - </p></li></ol></div></div><div class="procedure"><a name="id2557680"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol type="1"><li><p> + </p></li></ol></div></div><div class="procedure" title="Procedure 2.3. Windows XP Professional Client Configuration"><a name="id329344"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> Configure clients to the network settings shown in <a class="link" href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>. All clients use DHCP for TCP/IP protocol stack configuration. - <a class="indexterm" name="id2557698"></a> - <a class="indexterm" name="id2557704"></a> + <a class="indexterm" name="id329359"></a> + <a class="indexterm" name="id329366"></a> DHCP configures all Windows clients to use the WINS Server address <code class="constant">192.168.1.1</code>. - </p></li><li><p> + </p></li><li class="step" title="Step 2"><p> Join the Windows Domain called <code class="constant">BILLMORE</code>. Use the Domain Administrator username <code class="constant">root</code> and the SMB password you assigned to this account. A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to a Windows Domain is given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. Reboot the machine as prompted and then log on using a Domain User account. - </p></li><li><p> + </p></li><li class="step" title="Step 3"><p> Verify on each client that the machine called <code class="constant">SLEETH</code> is visible in <span class="guimenu">My Network Places</span>, that it is possible to connect to it and see the shares <span class="guimenuitem">accounts</span> and <span class="guimenuitem">finsvcs</span>, and that it is possible to open that share to reveal its contents. - </p></li><li><p> + </p></li><li class="step" title="Step 4"><p> Instruct all users to log onto the workstation using their assigned username and password. - </p></li><li><p> + </p></li><li class="step" title="Step 5"><p> Install a printer on each using the following steps: - </p><div class="procedure"><ol type="1"><li><p> + </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 5.1"><p> Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. Ensure that <span class="guimenuitem">Local printer</span> is selected. - </p></li><li><p> + </p></li><li class="step" title="Step 5.2"><p> Click <span class="guibutton">Next</span>. In the <span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>. In the <span class="guimenuitem">Printers:</span> panel, select the printer called <code class="constant">HP LaserJet 4</code>. Click <span class="guibutton">Next</span>. - </p></li><li><p> + </p></li><li class="step" title="Step 5.3"><p> In the <span class="guimenuitem">Available ports:</span> panel, select <code class="constant">FILE:</code>. Accept the default printer name by clicking - <span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a - test page?</span>”, click <span class="guimenuitem">No</span>. Click + <span class="guibutton">Next</span>. When asked, <span class="quote">“<span class="quote">Would you like to print a + test page?</span>”</span>, click <span class="guimenuitem">No</span>. Click <span class="guibutton">Finish</span>. - </p></li><li><p> + </p></li><li class="step" title="Step 5.4"><p> You may be prompted for the name of a file to print to. If so, close the dialog panel. Right-click <span class="guiicon">HP LaserJet 4</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>. - </p></li><li><p> + </p></li><li class="step" title="Step 5.5"><p> In the <span class="guimenuitem">Network</span> panel, enter the name of the print queue on the Samba server as follows: <code class="constant">\\SERVER\hplj4</code>. Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation. - </p></li><li><p> + </p></li><li class="step" title="Step 5.6"><p> Repeat the printer installation steps above for the HP LaserJet 6 printer as well as for the QMS Magicolor XXXX laser printer. - </p></li></ol></div></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2557985"></a>Notebook Computers: A Special Case</h3></div></div></div><p> + </p></li></ol></div></li></ol></div><div class="sect2" title="Notebook Computers: A Special Case"><div class="titlepage"><div><div><h3 class="title"><a name="id329633"></a>Notebook Computers: A Special Case</h3></div></div></div><p> As a network administrator, you already know how to create local machine accounts for Windows 200x/XP Professional systems. This is the preferred solution to provide continuity of work for notebook users so that absence from the office network environment does not become a barrier to productivity. @@ -663,56 +663,56 @@ smb: \> q transparently access network resources as if logged onto the domain itself. There are some trade-offs that mean that as the network is more tightly secured, it becomes necessary to modify Windows client configuration somewhat. - </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558010"></a>Key Points Learned</h3></div></div></div><p> + </p></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id329652"></a>Key Points Learned</h3></div></div></div><p> In this network design and implementation exercise, you created a Windows NT4-style Domain Controller using Samba-3.0.20. Following these guidelines, you experienced and implemented several important aspects of Windows networking. In the next chapter, you build on the experience. These are the highlights from this chapter: - </p><div class="itemizedlist"><ul type="disc"><li><p> - <a class="indexterm" name="id2558030"></a> + </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> + <a class="indexterm" name="id329669"></a> You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary network configuration settings from this server. - </p></li><li><p> - <a class="indexterm" name="id2558043"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id329681"></a> You created a Windows Domain Controller. You were able to use the network logon service and successfully joined Windows 200x/XP Professional clients to the Domain. - </p></li><li><p> - <a class="indexterm" name="id2558057"></a> + </p></li><li class="listitem"><p> + <a class="indexterm" name="id329693"></a> You created raw print queues in the CUPS printing system. You maintained a simple printing system so that all users can share centrally managed printers. You installed native printer drivers on the Windows clients. - </p></li><li><p> + </p></li><li class="listitem"><p> You experienced the benefits of centrally managed user accounts on the server. - </p></li><li><p> + </p></li><li class="listitem"><p> You offered Mobile notebook users a solution that allows them to continue to work while away from the office and not connected to the corporate network. - </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558084"></a>Questions and Answers</h2></div></div></div><p> + </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id329716"></a>Questions and Answers</h2></div></div></div><p> Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that may help. - </p><div class="qandaset"><dl><dt>1. <a href="small.html#id2558097"> + </p><div class="qandaset" title="Frequently Asked Questions"><a name="id329726"></a><dl><dt>1. <a href="small.html#id329728"> What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? - </a></dt><dt>2. <a href="small.html#id2558124"> + </a></dt><dt>2. <a href="small.html#id329750"> Are there any DHCP server configuration parameters in the /etc/dhcpd.conf that should be noted in particular? - </a></dt><dt>3. <a href="small.html#id2558155"> + </a></dt><dt>3. <a href="small.html#id329776"> Is it possible to create a Windows Domain account that is specifically called Administrator? - </a></dt><dt>4. <a href="small.html#id2558192"> + </a></dt><dt>4. <a href="small.html#id329810"> Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0? - </a></dt><dt>5. <a href="small.html#id2558230"> + </a></dt><dt>5. <a href="small.html#id329843"> One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him root access. How can we do this? - </a></dt><dt>6. <a href="small.html#id2558270"> + </a></dt><dt>6. <a href="small.html#id329878"> Why must I map Windows Domain Groups to UNIX groups? - </a></dt><dt>7. <a href="small.html#id2558306"> + </a></dt><dt>7. <a href="small.html#id329912"> I deleted my root account and now I cannot add it back! What can I do? - </a></dt><dt>8. <a href="small.html#id2558373"> + </a></dt><dt>8. <a href="small.html#id329978"> When I run net groupmap list, it reports a group called Administrators as well as Domain Admins. What is the difference between them? - </a></dt><dt>9. <a href="small.html#id2558418"> + </a></dt><dt>9. <a href="small.html#id330018"> What is the effect of changing the name of a Samba server or of changing the Domain name? - </a></dt><dt>10. <a href="small.html#id2558467"> + </a></dt><dt>10. <a href="small.html#id330060"> How can I manage user accounts from my Windows XP Professional workstation? - </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2558097"></a><a name="id2558099"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> + </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question" title="1."><td align="left" valign="top"><a name="id329728"></a><a name="id329730"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> First and foremost, portability. It means that notebook users can move between @@ -721,7 +721,7 @@ smb: \> q either using DHCP assigned addressing or when using dial-up networking, settings such as default routes and DNS server addresses that apply only to the Abmas office environment do not interfere with remote operations. This is an extremely important feature of DHCP. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558124"></a><a name="id2558126"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="2."><td align="left" valign="top"><a name="id329750"></a><a name="id329752"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> Are there any DHCP server configuration parameters in the <code class="filename">/etc/dhcpd.conf</code> that should be noted in particular? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> @@ -730,14 +730,14 @@ smb: \> q with the WINS server, and then instructs the client to first query the WINS server when a NetBIOS machine name needs to be resolved to an IP Address. This configuration results in far lower UDP broadcast traffic than would be the case if WINS was not used. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558155"></a><a name="id2558157"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="3."><td align="left" valign="top"><a name="id329776"></a><a name="id329778"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> Is it possible to create a Windows Domain account that is specifically called <code class="constant">Administrator</code>? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> You can surely create a Windows Domain account called <code class="constant">Administrator</code>. It is also possible to map that account so that it has the effective UNIX UID of 0. This way it isn't necessary to use the <em class="parameter"><code>username map</code></em> facility to map this account to the UNIX account called <code class="constant">root</code>. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558192"></a><a name="id2558194"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="4."><td align="left" valign="top"><a name="id329810"></a><a name="id329812"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> Why is it necessary to give the Windows Domain <code class="constant">Administrator</code> a UNIX UID of 0? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> The Windows Domain <code class="constant">Administrator</code> account is the most privileged account that @@ -747,7 +747,7 @@ smb: \> q Administrator to manage accounts as well as permissions, privileges, and security settings within the Domain and on the Samba server, equivalent rights must be assigned. This is achieved with the <code class="constant">root</code> UID equal to 0. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558230"></a><a name="id2558232"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="5."><td align="left" valign="top"><a name="id329843"></a><a name="id329845"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him <code class="constant">root</code> access. How can we do this? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> @@ -756,25 +756,25 @@ smb: \> q (or the equivalent <code class="constant">wheel</code> on some UNIX systems) that has a GID of 0. This must be the primary GID of the account of the user who is a member of the Windows <code class="constant"> Domain Admins</code> account. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558270"></a><a name="id2558272"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="6."><td align="left" valign="top"><a name="id329878"></a><a name="id329880"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> Why must I map Windows Domain Groups to UNIX groups? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are <span class="guimenu">Domain Guests</span>, <span class="guimenu">Domain Users</span>, and <span class="guimenu">Domain Admins</span>. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558306"></a><a name="id2558308"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="7."><td align="left" valign="top"><a name="id329912"></a><a name="id329914"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> I deleted my <code class="constant">root</code> account and now I cannot add it back! What can I do? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> This is a nasty problem. Fortunately, there is a solution. - </p><div class="procedure"><ol type="1"><li><p> + </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> Back up your existing configuration files in case you need to restore them. - </p></li><li><p> + </p></li><li class="step" title="Step 2"><p> Rename the <code class="filename">group_mapping.tdb</code> file. - </p></li><li><p> + </p></li><li class="step" title="Step 3"><p> Use the <code class="literal">smbpasswd</code> to add the root account. - </p></li><li><p> + </p></li><li class="step" title="Step 4"><p> Restore the <code class="filename">group_mapping.tdb</code> file. - </p></li></ol></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558373"></a><a name="id2558375"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> + </p></li></ol></div></td></tr><tr class="question" title="8."><td align="left" valign="top"><a name="id329978"></a><a name="id329980"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> When I run <code class="literal">net groupmap list</code>, it reports a group called <span class="guimenu">Administrators</span> as well as <span class="guimenu">Domain Admins</span>. What is the difference between them? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> @@ -782,7 +782,7 @@ smb: \> q present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This may change at some later date. These accounts are provided only so that security objects are correctly shown. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558418"></a><a name="id2558420"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="9."><td align="left" valign="top"><a name="id330018"></a><a name="id330020"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> What is the effect of changing the name of a Samba server or of changing the Domain name? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> If you elect to change the name of the Samba server, on restarting <code class="literal">smbd</code>, @@ -794,7 +794,7 @@ smb: \> q SID before the change is made. You can back up the SID using the <code class="literal">net getlocalsid</code> (Samba-3) or the <code class="literal">smbpasswd</code> (Samba-2.2.x). To change the SID, you use the same tool. Be sure to check the man page for this command for detailed instructions regarding the steps involved. - </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558467"></a><a name="id2558469"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> + </p></td></tr><tr class="question" title="10."><td align="left" valign="top"><a name="id330060"></a><a name="id330062"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> How can I manage user accounts from my Windows XP Professional workstation? </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot |