Samba3-ByExample/SBE-500UserNetwork.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <chapter id="Big500users">
   4   <title>The 500-User Office</title>
   5
   6         <para>
   7         The Samba-3 networking you explored in <link linkend="secure"/> covers the finer points of
   8         configuration of peripheral services such as DHCP and DNS, and WINS. You experienced
   9         implementation of a simple configuration of the services that are important adjuncts
  10         to successful deployment of Samba.
  11         </para>
  12
  13         <para>
  14         An analysis of the history of postings to the Samba mailing list easily demonstrates
  15         that the two most prevalent Samba problem areas are
  16         </para>
  17
  18         <itemizedlist>
  19                 <listitem><para>
  20                 Defective resolution of a NetBIOS name to its IP address
  21                 </para></listitem>
  22
  23                 <listitem><para>
  24                 Printing problems
  25                 </para></listitem>
  26
  27         </itemizedlist>
  28
  29         <para>
  30         The exercises
  31         so far in this book have focused on implementation of the simplest printing processes
  32         involving  no print job processing intelligence. In this chapter, you maintain
  33         that same approach to printing, but <link linkend="happy"/> presents an opportunity
  34         to make printing more complex for the administrator while making it easier for the user.
  35         </para>
  36
  37         <para>
  38         <indexterm><primary>WINS server</primary></indexterm>
  39         <indexterm><primary>tdbsam</primary></indexterm>
  40         <indexterm><primary>passdb backend</primary></indexterm>
  41         <link linkend="secure"/> demonstrates operation of a DHCP server and a DNS server
  42         as well as a central WINS server. You validated the operation of these services and
  43         saw an effective implementation of a Samba domain controller using the
  44         <parameter>tdbsam</parameter> passdb backend.
  45         </para>
  46
  47         <para>
  48         The objective of this chapter is to introduce more complex techniques that can be used to
  49         improve manageability of Samba as networking needs grow. In this chapter, you implement
  50         a distributed DHCP server environment, a distributed DNS server arrangement, a centralized
  51         WINS server, and a centralized Samba domain controller.
  52         </para>
  53
  54         <para>
  55         A note of caution is important regarding the Samba configuration that is used in this
  56         chapter. The use of a single domain controller on a routed, multisegment network is
  57         a poor design choice that leads to potential network user complaints.
  58         This chapter demonstrates some successful
  59         techniques in deployment and configuration management. This should be viewed as a
  60         foundation chapter for complex Samba deployments.
  61         </para>
  62
  63         <para>
  64         As you master the techniques presented here, you may find much better methods to
  65         improve network management and control while reducing human resource overheads.
  66         You should take the opportunity to innovate and expand on the methods presented
  67         here and explore them to the fullest.
  68         </para>
  69
  70 <sect1>
  71         <title>Introduction</title>
  72
  73         <para>
  74         Business continues to go well for Abmas. Mr. Meany is driving your success and the
  75         network continues to grow thanks to the hard work Christine has done. You recently
  76         hired Stanley Soroka as manager of information systems. Christine recommended Stan
  77         to the role. She told you Stan is so good at handling Samba that he can make a cast
  78         iron rocking horse that is embedded in concrete kick like a horse at a rodeo. You
  79         need skills like his. Christine and Stan get along just fine. Let's see what
  80         you can get out of this pair as they plot the next-generation networks.
  81         </para>
  82
  83         <para>
  84         Ten months ago Abmas closed an acquisition of a property insurance business. The
  85         founder lost interest in the business and decided to sell it to Mr. Meany.  Because
  86         they were former university classmates, the purchase was concluded with mutual assent.
  87         The acquired business is located at the other end of town in much larger facilities.
  88         The old Abmas building has become too small. Located on the same campus as the newly
  89         acquired business are two empty buildings that are ideal to provide Abmas with
  90         opportunity for growth.
  91         </para>
  92
  93         <para>
  94         Abmas has now completed the purchase of the two empty buildings, and you are
  95         to install a new network and relocate staff in nicely furnished new facilities.
  96         The new network is to be used to fully integrate company operations. You have
  97         decided to locate the new network operations control center in the larger building
  98         in which the insurance group is located to take advantage of an ideal floor space
  99         and to allow Stan and Christine to fully stage the new network and test it before
 100         it is rolled out. Your strategy is to complete the new network so that it
 101         is ready for operation when the old office moves into the new premises.
 102         </para>
 103
 104         <sect2>
 105                 <title>Assignment Tasks</title>
 106
 107                 <para>
 108                 The acquired business had 280 network users. The old Abmas building housed
 109                 220 network users in unbelievably cramped conditions. The network that
 110                 initially served 130 users now handles 220 users quite well.
 111                 </para>
 112
 113                 <para>
 114                 The two businesses will be fully merged to create a single campus company.
 115                 The Property Insurance Group (PIG) houses 300 employees, the new Accounting
 116                 Services Group (ASG) will be in a small building (BLDG1) that houses 50
 117                 employees, and the Financial Services Group (FSG) will be housed in a large
 118                 building that has capacity for growth (BLDG2). Building 2 houses 150 network
 119                 users.
 120                 </para>
 121
 122                 <para>
 123                 You have decided to connect the building using fiber optic links between new
 124                 routers. As a backup, the buildings are interconnected using line-of-sight
 125                 high-speed infrared facilities. The infrared connection provides a
 126                 secondary route to be used during periods of high demand for network
 127                 bandwidth.
 128                 </para>
 129
 130                 <para>
 131                 The Internet gateway is upgraded to 15 Mb/sec service. Your ISP
 132                 provides on your premises a fully managed Cisco PIX firewall. You no longer need
 133                 to worry about firewall facilities on your network.
 134                 </para>
 135
 136                 <para>
 137                 Stanley and Christine have purchased new server hardware. Christine wants to
 138                 roll out a network that has whistles and bells. Stan wants to start off with
 139                 a simple to manage, not-too-complex network. He believes that network
 140                 users need to be gradually introduced to new features and capabilities and not
 141                 rushed into an environment that may cause disorientation and loss of productivity.
 142                 </para>
 143
 144                 <para>
 145                 Your intrepid network team has decided to implement a network configuration
 146                 that closely mirrors the successful system you installed in the old Abmas building.
 147                 The new network infrastructure is owned by Abmas, but all desktop systems
 148                 are being procured through a new out-source services and leasing company. Under
 149                 the terms of a deal with Mr. M. Proper (CEO), DirectPointe, Inc., provides
 150                 all desktop systems and includes full level-one help desk support for
 151                 a flat per-machine monthly fee. The deal allows you to add workstations on demand.
 152                 This frees Stan and Christine to deal with deeper issues as they emerge and
 153                 permits Stan to work on creating new future value-added services.
 154                 </para>
 155
 156                 <para>
 157                 DirectPointe Inc. receives from you a new standard desktop configuration
 158                 every four months. They automatically roll that out to each desktop system.
 159                 You must keep DirectPointe informed of all changes.
 160                 </para>
 161
 162         <para><indexterm>
 163             <primary>PDC</primary>
 164           </indexterm>
 165                 The new network has a single Samba Primary Domain Controller (PDC) located in the
 166                 Network Operation Center (NOC). Buildings 1 and 2 each have a local server
 167                 for local application servicing. It is a domain member. The new system
 168                 uses the <parameter>tdbsam</parameter> passdb backend.
 169                 </para>
 170
 171                 <para>
 172                 Printing is based on raw pass-through facilities just as it has been used so far.
 173                 All printer drivers are installed on the desktop and notebook computers.
 174                 </para>
 175
 176         </sect2>
 177 </sect1>
 178
 179 <sect1>
 180         <title>Dissection and Discussion</title>
 181
 182         <para>
 183         <indexterm><primary>network load factors</primary></indexterm>
 184         The example you are building in this chapter is of a network design that works, but this
 185         does not make it a design that is recommended. As a general rule, there should be at least
 186         one Backup Domain Controller (BDC) per 150 Windows network clients. The principle behind
 187         this recommendation is that correct operation of MS Windows clients requires rapid
 188         network response to all SMB/CIFS requests. The same rule says that if there are more than
 189         50 clients per domain controller, they are too busy to service requests. Let's put such
 190         rules aside and recognize that network load affects the integrity of domain controller
 191         responsiveness. This network will have 500 clients serviced by one central domain
 192         controller. This is not a good omen for user satisfaction. You, of course, address this
 193         very soon (see <link linkend="happy"/>).
 194         </para>
 195
 196         <sect2>
 197                 <title>Technical Issues</title>
 198
 199                 <para>
 200                 Stan has talked you into a horrible compromise, but it is addressed. Just make
 201                 certain that the performance of this network is well validated before going live.
 202                 </para>
 203
 204                 <para>
 205                 Design decisions made in this design include the following:
 206                 </para>
 207
 208                 <itemizedlist>
 209                         <listitem><para>
 210                         <indexterm><primary>PDC</primary></indexterm>
 211                         <indexterm><primary>LDAP</primary></indexterm>
 212                         <indexterm><primary>identity management</primary></indexterm>
 213                         A single PDC is being implemented. This limitation is based on the choice not to
 214                         use LDAP. Many network administrators fear using LDAP because of the perceived
 215                         complexity of implementation and management of an LDAP-based backend for all user
 216                         identity management as well as to store network access credentials.
 217                         </para></listitem>
 218
 219                         <listitem><para>
 220                         <indexterm><primary>BDC</primary></indexterm>
 221                         <indexterm><primary>machine secret password</primary></indexterm>
 222                         Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the
 223                         only choice that makes sense with 500 users is to use the tdbsam passwd backend.
 224                         This type of backend is not receptive to replication to BDCs.  If the tdbsam
 225                         <filename>passdb.tdb</filename> file is replicated to BDCs using
 226                         <command>rsync</command>, there are two potential problems: (1) data that is in
 227                         memory but not yet written to disk will not be replicated, and (2) domain member
 228                         machines periodically change the secret machine password. When this happens, there
 229                         is no mechanism to return the changed password to the PDC.
 230                         </para></listitem>
 231
 232                         <listitem><para>
 233                         All domain user, group, and machine accounts are managed on the PDC. This makes
 234                         for a simple mode of operation but has to be balanced with network performance and
 235                         integrity of operations considerations.
 236                         </para></listitem>
 237
 238                         <listitem><para>
 239                         <indexterm><primary>WINS</primary></indexterm>
 240                         A single central WINS server is being used. The PDC is also the WINS server.
 241                         Any attempt to operate a routed network without a WINS server while using NetBIOS
 242                         over TCP/IP protocols does not work unless on each client the name resolution
 243                         entries for the PDC are added to the <filename>LMHOSTS</filename>. This file is
 244                         normally located on the Windows XP Professional client in the
 245                         <filename>C:\WINDOWS\SYSTEM32\ETC\DRIVERS</filename> directory.
 246                         </para></listitem>
 247
 248                         <listitem><para>
 249                         At this time the Samba WINS database cannot be replicated. That is
 250                         why a single WINS server is being implemented. This should work without a problem.
 251                         </para></listitem>
 252
 253                         <listitem><para>
 254                         <indexterm><primary>winbindd</primary></indexterm>
 255                         BDCs make use of <command>winbindd</command> to provide
 256                         access to domain security credentials for file system access and object storage.
 257                         </para></listitem>
 258
 259                         <listitem><para>
 260                         <indexterm><primary>DHCP</primary><secondary>relay</secondary></indexterm>
 261                         <indexterm><primary>DHCP</primary><secondary>requests</secondary></indexterm>
 262                         Configuration of Windows XP Professional clients is achieved using DHCP. Each
 263                         subnet has its own DHCP server. Backup DHCP serving is provided by one
 264                         alternate DHCP server. This necessitates enabling of the DHCP Relay agent on
 265                         all routers. The DHCP Relay agent must be programmed to pass DHCP Requests from the
 266                         network directed at the backup DHCP server.
 267                         </para></listitem>
 268
 269                         <listitem><para>
 270                         All network users are granted the ability to print to any printer that is
 271                         network-attached. All printers are available from each server. Print jobs that
 272                         are spooled to a printer that is not on the local network segment are automatically
 273                         routed to the print spooler that is in control of that printer. The specific details
 274                         of how this might be done are demonstrated for one example only.
 275                         </para></listitem>
 276
 277                         <listitem><para>
 278                         The network address and subnetmask chosen provide 1022 usable IP addresses in
 279                         each subnet. If in the future more addresses are required, it would make sense
 280                         to add further subnets rather than change addressing.
 281                         </para></listitem>
 282
 283                 </itemizedlist>
 284
 285         </sect2>
 286
 287
 288         <sect2>
 289                 <title>Political Issues</title>
 290
 291                 <para>
 292                 This case gets close to the real world. You and I know the right way to implement
 293                 domain control. Politically, we have to navigate a minefield. In this case, the need is to
 294                 get the PDC rolled out in compliance with expectations and also to be ready to save the day
 295                 by having the real solution ready before it is needed. That real solution is presented in
 296                 <link linkend="happy"/>.
 297                 </para>
 298
 299         </sect2>
 300
 301 </sect1>
 302
 303 <sect1>
 304         <title>Implementation</title>
 305
 306         <para>
 307         The following configuration process begins following installation of Red Hat Fedora Core2 on the
 308         three servers shown in the network topology diagram in <link linkend="chap05net"/>. You have
 309         selected hardware that is appropriate to the task.
 310         </para>
 311
 312         <figure id="chap05net">
 313                 <title>Network Topology &smbmdash; 500 User Network Using tdbsam passdb backend.</title>
 314                 <imagefile scale="50">chap5-net</imagefile>
 315         </figure>
 316
 317         <sect2 id="ch5-dnshcp-setup">
 318         <title>Installation of DHCP, DNS, and Samba Control Files</title>
 319
 320         <para>
 321         Carefully install the configuration files into the correct locations as shown in
 322         <link linkend="ch5-filelocations"/>. You should validate that the full file path is
 323         correct as shown.
 324         </para>
 325
 326         <para>
 327         The abbreviation shown in this table as <constant>{VLN}</constant> refers to
 328         the directory location beginning with <filename>/var/lib/named</filename>.
 329         </para>
 330
 331
 332         <table id="ch5-filelocations"><title>Domain: <constant>MEGANET</constant>, File Locations for Servers</title>
 333                 <tgroup cols="5">
 334                         <colspec colname='c1' align="left"/>
 335                         <colspec colname='c2' align="left"/>
 336                         <colspec colname='c3' align="center"/>
 337                         <colspec colname='c4' align="center"/>
 338                         <colspec colname='c5' align="center"/>
 339                         <thead>
 340                                 <row>
 341                                         <entry align="center" namest='c1' nameend='c2'>File Information</entry>
 342                                         <entry align="center" namest="c3" nameend="c5">Server Name</entry>
 343                                 </row>
 344                                 <row>
 345                                         <entry align="center">Source</entry>
 346                                         <entry align="center">Target Location</entry>
 347                                         <entry align="center">MASSIVE</entry>
 348                                         <entry align="center">BLDG1</entry>
 349                                         <entry align="center">BLDG2</entry>
 350                                 </row>
 351                         </thead>
 352                         <tbody>
 353                                 <row>
 354                                         <entry><link linkend="ch5-massivesmb"/></entry>
 355                                         <entry><filename>/etc/samba/smb.conf</filename></entry>
 356                                         <entry>Yes</entry>
 357                                         <entry>No</entry>
 358                                         <entry>No</entry>
 359                                 </row>
 360                                 <row>
 361                                         <entry><link linkend="ch5-dc-common"/></entry>
 362                                         <entry><filename>/etc/samba/dc-common.conf</filename></entry>
 363                                         <entry>Yes</entry>
 364                                         <entry>No</entry>
 365                                         <entry>No</entry>
 366                                 </row>
 367                                 <row>
 368                                         <entry><link linkend="ch5-commonsmb"/></entry>
 369                                         <entry><filename>/etc/samba/common.conf</filename></entry>
 370                                         <entry>Yes</entry>
 371                                         <entry>Yes</entry>
 372                                         <entry>Yes</entry>
 373                                 </row>
 374                                 <row>
 375                                         <entry><link linkend="ch5-bldg1-smb"/></entry>
 376                                         <entry><filename>/etc/samba/smb.conf</filename></entry>
 377                                         <entry>No</entry>
 378                                         <entry>Yes</entry>
 379                                         <entry>No</entry>
 380                                 </row>
 381                                 <row>
 382                                         <entry><link linkend="ch5-bldg2-smb"/></entry>
 383                                         <entry><filename>/etc/samba/smb.conf</filename></entry>
 384                                         <entry>No</entry>
 385                                         <entry>No</entry>
 386                                         <entry>Yes</entry>
 387                                 </row>
 388                                 <row>
 389                                         <entry><link linkend="ch5-dommem-smb"/></entry>
 390                                         <entry><filename>/etc/samba/dommem.conf</filename></entry>
 391                                         <entry>No</entry>
 392                                         <entry>Yes</entry>
 393                                         <entry>Yes</entry>
 394                                 </row>
 395                                 <row>
 396                                         <entry><link linkend="massive-dhcp"/></entry>
 397                                         <entry><filename>/etc/dhcpd.conf</filename></entry>
 398                                         <entry>Yes</entry>
 399                                         <entry>No</entry>
 400                                         <entry>No</entry>
 401                                 </row>
 402                                 <row>
 403                                         <entry><link linkend="bldg1dhcp"/></entry>
 404                                         <entry><filename>/etc/dhcpd.conf</filename></entry>
 405                                         <entry>No</entry>
 406                                         <entry>Yes</entry>
 407                                         <entry>No</entry>
 408                                 </row>
 409                                 <row>
 410                                         <entry><link linkend="bldg2dhcp"/></entry>
 411                                         <entry><filename>/etc/dhcpd.conf</filename></entry>
 412                                         <entry>No</entry>
 413                                         <entry>No</entry>
 414                                         <entry>Yes</entry>
 415                                 </row>
 416                                 <row>
 417                                         <entry><link linkend="massive-nameda"/></entry>
 418                                         <entry><filename>/etc/named.conf (part A)</filename></entry>
 419                                         <entry>Yes</entry>
 420                                         <entry>No</entry>
 421                                         <entry>No</entry>
 422                                 </row>
 423                                 <row>
 424                                         <entry><link linkend="massive-namedb"/></entry>
 425                                         <entry><filename>/etc/named.conf (part B)</filename></entry>
 426                                         <entry>Yes</entry>
 427                                         <entry>No</entry>
 428                                         <entry>No</entry>
 429                                 </row>
 430                                 <row>
 431                                         <entry><link linkend="massive-namedc"/></entry>
 432                                         <entry><filename>/etc/named.conf (part C)</filename></entry>
 433                                         <entry>Yes</entry>
 434                                         <entry>No</entry>
 435                                         <entry>No</entry>
 436                                 </row>
 437                                 <row>
 438                                         <entry><link linkend="abmasbizdns"/></entry>
 439                                         <entry><filename>{VLN}/master/abmas.biz.hosts</filename></entry>
 440                                         <entry>Yes</entry>
 441                                         <entry>No</entry>
 442                                         <entry>No</entry>
 443                                 </row>
 444                                 <row>
 445                                         <entry><link linkend="abmasusdns"/></entry>
 446                                         <entry><filename>{VLN}/master/abmas.us.hosts</filename></entry>
 447                                         <entry>Yes</entry>
 448                                         <entry>No</entry>
 449                                         <entry>No</entry>
 450                                 </row>
 451                                 <row>
 452                                         <entry><link linkend="bldg12nameda"/></entry>
 453                                         <entry><filename>/etc/named.conf (part A)</filename></entry>
 454                                         <entry>No</entry>
 455                                         <entry>Yes</entry>
 456                                         <entry>Yes</entry>
 457                                 </row>
 458                                 <row>
 459                                         <entry><link linkend="bldg12namedb"/></entry>
 460                                         <entry><filename>/etc/named.conf (part B)</filename></entry>
 461                                         <entry>No</entry>
 462                                         <entry>Yes</entry>
 463                                         <entry>Yes</entry>
 464                                 </row>
 465                                 <row>
 466                                         <entry><link linkend="loopback"/></entry>
 467                                         <entry><filename>{VLN}/localhost.zone</filename></entry>
 468                                         <entry>Yes</entry>
 469                                         <entry>Yes</entry>
 470                                         <entry>Yes</entry>
 471                                 </row>
 472                                 <row>
 473                                         <entry><link linkend="dnsloopy"/></entry>
 474                                         <entry><filename>{VLN}/127.0.0.zone</filename></entry>
 475                                         <entry>Yes</entry>
 476                                         <entry>Yes</entry>
 477                                         <entry>Yes</entry>
 478                                 </row>
 479                                 <row>
 480                                         <entry><link linkend="roothint"/></entry>
 481                                         <entry><filename>{VLN}/root.hint</filename></entry>
 482                                         <entry>Yes</entry>
 483                                         <entry>Yes</entry>
 484                                         <entry>Yes</entry>
 485                                 </row>
 486                         </tbody>
 487                 </tgroup>
 488         </table>
 489
 490         </sect2>
 491
 492         <sect2>
 493         <title>Server Preparation: All Servers</title>
 494
 495         <para>
 496         The following steps apply to all servers. Follow each step carefully.
 497         </para>
 498
 499                 <procedure>
 500                 <title>Server Preparation Steps</title>
 501
 502                         <step><para>
 503                         Using the UNIX/Linux system tools, set the name of the server as shown in the network
 504                         topology diagram in <link linkend="chap05net"/>. For SUSE Linux products, the tool
 505                         that permits this is called <command>yast2</command>; for Red Hat Linux products,
 506                         you can use the <command>netcfg</command> tool.
 507                         Verify that your hostname is correctly set by running:
 508 <screen>
 509 &rootprompt; uname -n
 510 </screen>
 511                         An alternate method to verify the hostname is:
 512 <screen>
 513 &rootprompt; hostname -f
 514 </screen>
 515                         </para></step>
 516
 517                         <step><para>
 518                         <indexterm><primary>/etc/hosts</primary></indexterm>
 519                         <indexterm><primary>named</primary></indexterm>
 520                         Edit your <filename>/etc/hosts</filename> file to include the primary names and addresses
 521                         of all network interfaces that are on the host server. This is necessary so that during
 522                         startup the system is able to resolve all its own names to the IP address prior to
 523                         startup of the DNS server. You should check the startup order of your system. If the
 524                         CUPS print server is started before the DNS server (<command>named</command>), you
 525                         should also include an entry for the printers in the <filename>/etc/hosts</filename> file.
 526                         </para></step>
 527
 528                         <step><para>
 529                         <indexterm><primary>/etc/resolv.conf</primary></indexterm>
 530                         All DNS name resolution should be handled locally. To ensure that the server is configured
 531                         correctly to handle this, edit <filename>/etc/resolv.conf</filename> so it has the following
 532                         content:
 533 <screen>
 534 search abmas.us abmas.biz
 535 nameserver 127.0.0.1
 536 </screen>
 537                         This instructs the name resolver function (when configured correctly) to ask the DNS server
 538                         that is running locally to resolve names to addresses.
 539                         </para></step>
 540
 541
 542                         <step><para>
 543                         <indexterm><primary>administrator</primary></indexterm>
 544                         <indexterm><primary>smbpasswd</primary></indexterm>
 545                         Add the <constant>root</constant> user to the password backend:
 546 <screen>
 547 &rootprompt; smbpasswd -a root
 548 New SMB password: XXXXXXXX
 549 Retype new SMB password: XXXXXXXX
 550 &rootprompt;
 551 </screen>
 552                         The <constant>root</constant> account is the UNIX equivalent of the Windows domain administrator.
 553                         This account is essential in the regular maintenance of your Samba server. It must never be
 554                         deleted. If for any reason the account is deleted, you may not be able to recreate this account
 555                         without considerable trouble.
 556                         </para></step>
 557
 558                         <step><para>
 559                         <indexterm><primary>username map</primary></indexterm>
 560                         <indexterm><primary>/etc/samba/smbusers</primary></indexterm>
 561                         Create the username map file to permit the <constant>root</constant> account to be called
 562                         <constant>Administrator</constant> from the Windows network environment. To do this, create
 563                         the file <filename>/etc/samba/smbusers</filename> with the following contents:
 564 <screen>
 565 ####
 566 # User mapping file
 567 ####
 568 # File Format
 569 # -----------
 570 # Unix_ID = Windows_ID
 571 #
 572 # Examples:
 573 # root = Administrator
 574 # janes = "Jane Smith"
 575 # jimbo = Jim Bones
 576 #
 577 # Note: If the name contains a space it must be double quoted.
 578 #       In the example above the name 'jimbo' will be mapped to Windows
 579 #       user names 'Jim' and 'Bones' because the space was not quoted.
 580 #######################################################################
 581 root = Administrator
 582 ####
 583 # End of File
 584 ####
 585 </screen>
 586                         </para></step>
 587
 588                         <step><para>
 589                         Configure all network-attached printers to have a fixed IP address.
 590                         </para></step>
 591
 592                         <step><para>
 593                         Create an entry in the DNS database on the server <constant>MASSIVE</constant>
 594                         in both the forward lookup database for the zone <constant>abmas.biz.hosts</constant>
 595                         and in the reverse lookup database for the network segment that the printer is
 596                         located in. Example configuration files for similar zones were presented in <link linkend="secure"/>,
 597                         <link linkend="abmasbiz"/> and <link linkend="eth2zone"/>.
 598                         </para></step>
 599
 600                         <step><para>
 601                         Follow the instructions in the printer manufacturer's manuals to permit printing
 602                         to port 9100.  Use any other port the manufacturer specifies for direct mode,
 603                         raw printing.  This allows the CUPS spooler to print using raw mode protocols.
 604                         <indexterm><primary>CUPS</primary></indexterm>
 605                         <indexterm><primary>raw printing</primary></indexterm>
 606                         </para></step>
 607
 608                         <step><para>
 609                         <indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm>
 610                         Only on the server to which the printer is attached configure the CUPS Print
 611                         Queues as follows:
 612 <screen>
 613 &rootprompt; lpadmin -p <parameter>printque</parameter> -v socket://<parameter>printer-name</parameter>.abmas.biz:9100 -E
 614 </screen>
 615                         <indexterm><primary>print filter</primary></indexterm>
 616                         This step creates the necessary print queue to use no assigned print filter. This
 617                         is ideal for raw printing, that is, printing without use of filters.
 618                         The name <parameter>printque</parameter> is the name you have assigned for
 619                         the particular printer.
 620                         </para></step>
 621
 622                         <step><para>
 623                         Print queues may not be enabled at creation. Make certain that the queues
 624                         you have just created are enabled by executing the following:
 625 <screen>
 626 &rootprompt; /usr/bin/enable <parameter>printque</parameter>
 627 </screen>
 628                         </para></step>
 629
 630                         <step><para>
 631                         Even though your print queue may be enabled, it is still possible that it
 632                         does not accept print jobs. A print queue services incoming printing
 633                         requests only when configured to do so. Ensure that your print queue is
 634                         set to accept incoming jobs by executing the following command:
 635 <screen>
 636 &rootprompt; /usr/bin/accept <parameter>printque</parameter>
 637 </screen>
 638                         </para></step>
 639
 640                         <step><para>
 641                         <indexterm><primary>mime type</primary></indexterm>
 642                         <indexterm><primary>/etc/mime.convs</primary></indexterm>
 643                         <indexterm><primary>application/octet-stream</primary></indexterm>
 644                         This step, as well as the next one, may be omitted where CUPS version 1.1.18
 645                         or later is in use.  Although it does no harm to follow it anyhow, and may
 646                         help to avoid later time spent trying to figure out why print jobs may be
 647                         disappearing without trace. Look at these two steps as <emphasis>insurance</emphasis>
 648                         against lost time. Edit  file <filename>/etc/cups/mime.convs</filename> to
 649                         uncomment the line:
 650 <screen>
 651 application/octet-stream     application/vnd.cups-raw      0     -
 652 </screen>
 653                         </para></step>
 654
 655                         <step><para>
 656                         <indexterm><primary>/etc/mime.types</primary></indexterm>
 657                         Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
 658 <screen>
 659 application/octet-stream
 660 </screen>
 661                         </para></step>
 662
 663                         <step><para>
 664                         Refer to the CUPS printing manual for instructions regarding how to configure
 665                         CUPS so that print queues that reside on CUPS servers on remote networks
 666                         route print jobs to the print server that owns that queue. The default setting
 667                         on your CUPS server may automatically discover remotely installed printers and
 668                         may permit this functionality without requiring specific configuration.
 669                         </para></step>
 670
 671                         <step><para>
 672                         As part of the roll-out program, you need to configure the application's
 673                         server shares. This can be done once on the central server and may then be
 674                         replicated using a tool such as <command>rsync</command>. Refer to the man
 675                         page for <command>rsync</command> for details regarding use. The notes in
 676                         <link linkend="ch4appscfg"/> may help in your decisions to use an application
 677                         server facility.
 678                         </para></step>
 679
 680                 </procedure>
 681
 682         <note><para>
 683         Logon scripts that are run from a domain controller (PDC or BDC) are capable of using semi-intelligent
 684         processes to automap Windows client drives to an application server that is nearest to the client. This
 685         is considerably more difficult when a single PDC is used on a routed network. It can be done, but not
 686         as elegantly as you see in the next chapter.
 687         </para></note>
 688
 689         </sect2>
 690
 691         <sect2>
 692         <title>Server-Specific Preparation</title>
 693
 694         <para>
 695         There are some steps that apply to particular server functionality only. Each step is critical
 696         to correct server operation. The following step-by-step installation guidance will assist you
 697         to work through the process of configuring the PDC and then both BDC's.
 698         </para>
 699
 700                 <sect3>
 701                 <title>Configuration for Server: <constant>MASSIVE</constant></title>
 702
 703                 <para>
 704                 The steps presented here attempt to implement Samba installation in a generic manner. While
 705                 some steps are clearly specific to Linux, it should not be too difficult to apply them to
 706                 your platform of choice.
 707                 </para>
 708
 709                 <procedure>
 710                 <title>Primary Domain Controller Preparation</title>
 711
 712                         <step><para>
 713                         <indexterm><primary>/etc/rc.d/boot.local</primary></indexterm>
 714                         <indexterm><primary>IP forwarding</primary></indexterm>
 715                         The host server acts as a router between the two internal network segments as well
 716                         as for all Internet access. This necessitates that IP forwarding be enabled. This can be
 717                         achieved by adding to the <filename>/etc/rc.d/boot.local</filename> an entry as follows:
 718 <screen>
 719 echo 1 > /proc/sys/net/ipv4/ip_forward
 720 </screen>
 721                         To ensure that your kernel is capable of IP forwarding during configuration, you may wish to execute
 722                         that command manually also. This setting permits the Linux system to act as a router.
 723                         </para></step>
 724
 725                         <step><para>
 726                         This server is dual hosted (i.e., has two network interfaces) &smbmdash; one goes to the Internet
 727                         and the other to a local network that has a router that is the gateway to the remote networks.
 728                         You must therefore configure the server with route table entries so that it can find machines
 729                         on the remote networks. You can do this using the appropriate system tools for your Linux
 730                         server or using static entries that you place in one of the system startup files. It is best
 731                         to always use the tools that the operating system vendor provided. In the case of SUSE Linux, the
 732                         best tool to do this is YaST (refer to SUSE Administration Manual); in the case of Red Hat,
 733                         this is best done using the graphical system configuration tools (see the Red Hat documentation).
 734                         An example of how this may be done manually is as follows:
 735 <screen>
 736 &rootprompt; route add net 172.16.4.0 netmask 255.255.252.0 gw 172.16.0.128
 737 &rootprompt; route add net 172.16.8.0 netmask 255.255.252.0 gw 172.16.0.128
 738 </screen>
 739                         If you just execute these commands manually, the route table entries you have created are
 740                         not persistent across system reboots. You may add these commands directly to the local
 741                         startup files as follows: (SUSE) <filename>/etc/rc.d/boot.local</filename>, (Red Hat)
 742                         <filename>/etc/rc.d/init.d/rc.local</filename>.
 743                         </para></step>
 744
 745                         <step><para>
 746                         <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
 747                         The final step that must be completed is to edit the <filename>/etc/nsswitch.conf</filename> file.
 748                         This file controls the operation of the various resolver libraries that are part of the Linux
 749                         Glibc libraries. Edit this file so that it contains the following entries:
 750 <screen>
 751 hosts:      files dns wins
 752 </screen>
 753                         </para></step>
 754
 755                         <step><para>
 756                         <indexterm><primary>initGrps.sh</primary></indexterm>
 757                         Create and map Windows domain groups to UNIX groups. A sample script is provided in
 758                         <link linkend="ch5-initgrps"/>. Create a file containing this script. You called yours
 759                         <filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed
 760                         and then execute the script. An example of the execution of this script as well as its
 761                         validation are shown in Section 4.3.2, Step 5.
 762                         </para></step>
 763
 764                         <step><para>
 765                         <indexterm><primary>/etc/passwd</primary></indexterm>
 766                         <indexterm><primary>password</primary><secondary>backend</secondary></indexterm>
 767                         <indexterm><primary>smbpasswd</primary></indexterm>
 768                         For each user who needs to be given a Windows domain account, make an entry in the
 769                         <filename>/etc/passwd</filename> file as well as in the Samba password backend.
 770                         Use the system tool of your choice to create the UNIX system account, and use the Samba
 771                         <command>smbpasswd</command> to create a domain user account.
 772                         </para>
 773
 774                         <para>
 775                         <indexterm><primary>useradd</primary></indexterm>
 776                         <indexterm><primary>adduser</primary></indexterm>
 777                         <indexterm><primary>user</primary><secondary>management</secondary></indexterm>
 778                         There are a number of tools for user management under UNIX, such as
 779                         <command>useradd</command>, <command>adduser</command>, as well as a plethora of custom
 780                         tools. With the tool of your choice, create a home directory for each user.
 781                         </para></step>
 782
 783                         <step><para>
 784                         Using the preferred tool for your UNIX system, add each user to the UNIX groups created
 785                         previously as necessary. File system access control is based on UNIX group membership.
 786                         </para></step>
 787
 788                         <step><para>
 789                         Create the directory mount point for the disk subsystem that is to be mounted to provide
 790                         data storage for company files, in this case, the mount point indicated in the &smb.conf;
 791                         file is <filename>/data</filename>. Format the file system as required and mount the formatted
 792                         file system partition using appropriate system tools.
 793                         </para></step>
 794
 795                         <step><para>
 796                 <indexterm><primary>file system</primary>
 797                   <secondary>permissions</secondary></indexterm>
 798                         Create the top-level file storage directories for data and applications as follows:
 799 <screen>
 800 &rootprompt; mkdir -p /data/{accounts,finsvcs,pidata}
 801 &rootprompt; mkdir -p /apps
 802 &rootprompt; chown -R root:root /data
 803 &rootprompt; chown -R root:root /apps
 804 &rootprompt; chown -R bjordan:accounts /data/accounts
 805 &rootprompt; chown -R bjordan:finsvcs /data/finsvcs
 806 &rootprompt; chown -R bjordan:finsvcs /data/pidata
 807 &rootprompt; chmod -R ug+rwxs,o-rwx /data
 808 &rootprompt; chmod -R ug+rwx,o+rx-w /apps
 809 </screen>
 810                         Each department is responsible for creating its own directory structure within the departmental
 811                         share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>.
 812                         The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>.
 813                         The <filename>/apps</filename> directory is the root of the <constant>apps</constant> share
 814                         that provides the application server infrastructure.
 815                         </para></step>
 816
 817                         <step><para>
 818                         The &smb.conf; file specifies an infrastructure to support roaming profiles and network
 819                         logon services. You can now create the file system infrastructure to provide the
 820                         locations on disk that these services require. Adequate planning is essential
 821                         because desktop profiles can grow to be quite large. For planning purposes, a minimum of
 822                         200 MB of storage should be allowed per user for profile storage. The following
 823                         commands create the directory infrastructure needed:
 824 <screen>
 825 &rootprompt; mkdir -p /var/spool/samba
 826 &rootprompt; mkdir -p /var/lib/samba/{netlogon/scripts,profiles}
 827 &rootprompt; chown -R root:root /var/spool/samba
 828 &rootprompt; chown -R root:root /var/lib/samba
 829 &rootprompt; chmod a+rwxt /var/spool/samba
 830 </screen>
 831                         For each user account that is created on the system, the following commands should be
 832                         executed:
 833 <screen>
 834 &rootprompt; mkdir /var/lib/samba/profiles/'username'
 835 &rootprompt; chown 'username':users /var/lib/samba/profiles/'username'
 836 &rootprompt; chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username'
 837 </screen>
 838                         </para></step>
 839
 840                         <step><para>
 841                         <indexterm><primary>unix2dos</primary></indexterm>
 842                         <indexterm><primary>dos2unix</primary></indexterm>
 843                         Create a logon script. It is important that each line is correctly terminated with
 844                         a carriage return and line-feed combination (i.e., DOS encoding). The following procedure
 845                         works if the right tools (<constant>unxi2dos</constant> and <constant>dos2unix</constant>) are installed.
 846                         First, create a file called <filename>/var/lib/samba/netlogon/scripts/logon.bat.unix</filename>
 847                         with the following contents:
 848 <screen>
 849 net time \\massive /set /yes
 850 net use h: /home
 851 </screen>
 852                         Convert the UNIX file to a DOS file:
 853 <screen>
 854 &rootprompt; dos2unix &lt; /var/lib/samba/netlogon/scripts/logon.bat.unix \
 855         &gt; /var/lib/samba/netlogon/scripts/logon.bat
 856 </screen>
 857                         </para></step>
 858
 859                         <step><para>
 860                         There is one preparatory step without which you cannot have a working Samba network
 861                         environment. You must add an account for each network user. You can do this by executing
 862                         the following steps for each user:
 863 <screen>
 864 &rootprompt; useradd -m <parameter>username</parameter>
 865 &rootprompt; passwd <parameter>username</parameter>
 866 Changing password for <parameter>username</parameter>.
 867 New password: XXXXXXXX
 868 Re-enter new password: XXXXXXXX
 869 Password changed
 870 &rootprompt; smbpasswd -a <parameter>username</parameter>
 871 New SMB password: XXXXXXXX
 872 Retype new SMB password: XXXXXXXX
 873 Added user <parameter>username</parameter>.
 874 </screen>
 875                         You do, of course, use a valid user login ID in place of <parameter>username</parameter>.
 876                         </para></step>
 877
 878                         <step><para>
 879                         Follow the processes shown in <link linkend="ch5-procstart"/> to start all services.
 880                         </para></step>
 881
 882                         <step><para>
 883                         Your server is ready for validation testing. Do not proceed with the steps in
 884                         <link linkend="ch5-domsvrspec"/> until after the operation of the server has been
 885                         validated following the same methods as outlined in <link linkend="secure"/>, <link linkend="ch4valid"/>.
 886                         </para></step>
 887
 888                 </procedure>
 889
 890                 </sect3>
 891
 892                 <sect3 id="ch5-domsvrspec">
 893                 <title>Configuration Specific to Domain Member Servers: <constant>BLDG1, BLDG2</constant></title>
 894
 895                 <para>
 896                 The following steps will guide you trough the nuances of imlplementing BDC's for the broadcast
 897                 isolated network segments. Remember that if the target installation platform is not Linux, it may
 898                 be necessary to adapt some commands to the equivalent on the target platform.
 899                 </para>
 900
 901                 <procedure>
 902                 <title>Backup Domain Controller Configuration Steps</title>
 903
 904                         <step><para>
 905                         <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
 906                         The final step that must be completed is to edit the <filename>/etc/nsswitch.conf</filename> file.
 907                         This file controls the operation of the various resolver libraries that are part of the Linux
 908                         Glibc libraries. Edit this file so that it contains the following entries:
 909 <screen>
 910 passwd:     files winbind
 911 group:      files winbind
 912 hosts:      files dns wins
 913 </screen>
 914                         </para></step>
 915
 916                         <step><para>
 917                         Follow the steps outlined in <link linkend="ch5-procstart"/> to start all services. Do not
 918                         start Samba at this time. Samba is controlled by the process called <command>smb</command>.
 919                         </para></step>
 920
 921                         <step><para>
 922                         <indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
 923                         You must now attempt to join the domain member servers to the domain. The following
 924                         instructions should be executed to effect this:
 925 <screen>
 926 &rootprompt; net rpc join
 927 </screen>
 928                         </para></step>
 929
 930                         <step><para>
 931                         <indexterm><primary>service</primary><secondary>smb</secondary><tertiary>start</tertiary></indexterm>
 932                         You now start the Samba services by executing:
 933 <screen>
 934 &rootprompt; service smb start
 935 </screen>
 936                         </para></step>
 937
 938                         <step><para>
 939                         Your server is ready for validation testing. Do not proceed with the steps in
 940                         <link linkend="ch5-domsvrspec"/> until after the operation of the server has been
 941                         validated following the same methods as outlined in <link linkend="ch4valid"/>.
 942                         </para></step>
 943
 944                 </procedure>
 945
 946                 </sect3>
 947
 948         </sect2>
 949
 950 <!-- One -->
 951 <example id="ch5-massivesmb">
 952 <title>Server: MASSIVE (PDC), File: <filename>/etc/samba/smb.conf</filename></title>
 953 <smbconfblock>
 954 <smbconfcomment>Global parameters</smbconfcomment>
 955 <smbconfsection name="[global]"/>
 956 <smbconfoption name="workgroup">MEGANET</smbconfoption>
 957 <smbconfoption name="netbios name">MASSIVE</smbconfoption>
 958 <smbconfoption name="interfaces">eth1, lo</smbconfoption>
 959 <smbconfoption name="bind interfaces only">Yes</smbconfoption>
 960 <smbconfoption name="passdb backend">tdbsam</smbconfoption>
 961 <smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption>
 962 <smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption>
 963 <smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
 964 <smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption>
 965 <smbconfoption name="add user to group script">/usr/sbin/usermod -G '%g' '%u'</smbconfoption>
 966 <smbconfoption name="add machine script">/usr/sbin/</smbconfoption>
 967 <member><parameter>useradd -s /bin/false -d /var/lib/nobody '%u'</parameter></member>
 968 <smbconfoption name="preferred master">Yes</smbconfoption>
 969 <smbconfoption name="wins support">Yes</smbconfoption>
 970 <smbconfoption name="include">/etc/samba/dc-common.conf</smbconfoption>
 971
 972 <smbconfsection name="[IPC$]"/>
 973 <smbconfoption name="path">/tmp</smbconfoption>
 974 <smbconfoption name="hosts allow">172.16.0.0/16, 127.0.0.1</smbconfoption>
 975 <smbconfoption name="hosts deny">0.0.0.0/0</smbconfoption>
 976
 977 <smbconfsection name="[accounts]"/>
 978 <smbconfoption name="comment">Accounting Files</smbconfoption>
 979 <smbconfoption name="path">/data/accounts</smbconfoption>
 980 <smbconfoption name="read only">No</smbconfoption>
 981
 982 <smbconfsection name="[service]"/>
 983 <smbconfoption name="comment">Financial Services Files</smbconfoption>
 984 <smbconfoption name="path">/data/service</smbconfoption>
 985 <smbconfoption name="read only">No</smbconfoption>
 986
 987 <smbconfsection name="[pidata]"/>
 988 <smbconfoption name="comment">Property Insurance Files</smbconfoption>
 989 <smbconfoption name="path">/data/pidata</smbconfoption>
 990 <smbconfoption name="read only">No</smbconfoption>
 991 </smbconfblock>
 992 </example>
 993
 994 <!-- Two -->
 995 <example id="ch5-dc-common">
 996 <title>Server: MASSIVE (PDC), File: <filename>/etc/samba/dc-common.conf</filename></title>
 997 <smbconfblock>
 998 <smbconfcomment>Global parameters</smbconfcomment>
 999 <smbconfsection name="[global]"/>
1000 <smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
1001 <smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
1002 <smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
1003 <smbconfoption name="logon path">\%L\profiles\%U</smbconfoption>
1004 <smbconfoption name="logon drive">X:</smbconfoption>
1005 <smbconfoption name="logon home">\%L\%U</smbconfoption>
1006 <smbconfoption name="domain logons">Yes</smbconfoption>
1007 <smbconfoption name="preferred master">Yes</smbconfoption>
1008 <smbconfoption name="include">/etc/samba/common.conf</smbconfoption>
1009
1010 <smbconfsection name="[homes]"/>
1011 <smbconfoption name="comment">Home Directories</smbconfoption>
1012 <smbconfoption name="valid users">%S</smbconfoption>
1013 <smbconfoption name="read only">No</smbconfoption>
1014 <smbconfoption name="browseable">No</smbconfoption>
1015
1016 <smbconfsection name="[netlogon]"/>
1017 <smbconfoption name="comment">Network Logon Service</smbconfoption>
1018 <smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
1019 <smbconfoption name="guest ok">Yes</smbconfoption>
1020 <smbconfoption name="locking">No</smbconfoption>
1021
1022 <smbconfsection name="[profiles]"/>
1023 <smbconfoption name="comment">Profile Share</smbconfoption>
1024 <smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
1025 <smbconfoption name="read only">No</smbconfoption>
1026 <smbconfoption name="profile acls">Yes</smbconfoption>
1027 </smbconfblock>
1028 </example>
1029
1030 <!-- Three -->
1031 <example id="ch5-commonsmb">
1032 <title>Common Samba Configuration File: <filename>/etc/samba/common.conf</filename></title>
1033 <smbconfblock
1034 <smbconfsection name="[global]"/>
1035 <smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
1036 <smbconfoption name="log level">1</smbconfoption>
1037 <smbconfoption name="syslog">0</smbconfoption>
1038 <smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
1039 <smbconfoption name="max log size">50</smbconfoption>
1040 <smbconfoption name="smb ports">139 445</smbconfoption>
1041 <smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
1042 <smbconfoption name="time server">Yes</smbconfoption>
1043 <smbconfoption name="printcap name">CUPS</smbconfoption>
1044 <smbconfoption name="show add printer wizard">No</smbconfoption>
1045 <smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
1046 <smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
1047 <smbconfoption name="utmp">Yes</smbconfoption>
1048 <smbconfoption name="map acl inherit">Yes</smbconfoption>
1049 <smbconfoption name="printing">cups</smbconfoption>
1050 <smbconfoption name="veto files">/*.eml/*.nws/*.{*}/</smbconfoption>
1051 <smbconfoption name="veto oplock files">/*.doc/*.xls/*.mdb/</smbconfoption>
1052 <smbconfoption name="include"> </smbconfoption>
1053
1054 <smbconfcomment>Share and Service Definitions are common to all servers</smbconfcomment>
1055 <smbconfsection name="[printers]"/>
1056 <smbconfoption name="comment">SMB Print Spool</smbconfoption>
1057 <smbconfoption name="path">/var/spool/samba</smbconfoption>
1058 <smbconfoption name="guest ok">Yes</smbconfoption>
1059 <smbconfoption name="printable">Yes</smbconfoption>
1060 <smbconfoption name="use client driver">Yes</smbconfoption>
1061 <smbconfoption name="default devmode">Yes</smbconfoption>
1062 <smbconfoption name="browseable">No</smbconfoption>
1063
1064 <smbconfsection name="[apps]"/>
1065 <smbconfoption name="comment">Application Files</smbconfoption>
1066 <smbconfoption name="path">/apps</smbconfoption>
1067 <smbconfoption name="admin users">bjordan</smbconfoption>
1068 <smbconfoption name="read only">No</smbconfoption>
1069 </smbconfblock>
1070 </example>
1071
1072 <!-- Four -->
1073 <example id="ch5-bldg1-smb">
1074 <title>Server: BLDG1 (Member), File: smb.conf</title>
1075 <smbconfblock>
1076 <smbconfcomment>Global parameters</smbconfcomment>
1077 <smbconfsection name="[global]"/>
1078 <smbconfoption name="workgroup">MEGANET</smbconfoption>
1079 <smbconfoption name="netbios name">BLDG1</smbconfoption>
1080 <smbconfoption name="include">/etc/samba/dom-mem.conf</smbconfoption>
1081 </smbconfblock>
1082 </example>
1083
1084 <!-- Five -->
1085 <example id="ch5-bldg2-smb">
1086 <title>Server: BLDG2 (Member), File: smb.conf</title>
1087 <smbconfblock>
1088 <smbconfcomment>Global parameters</smbconfcomment>
1089 <smbconfsection name="[global]"/>
1090 <smbconfoption name="workgroup">MEGANET</smbconfoption>
1091 <smbconfoption name="netbios name">BLDG2</smbconfoption>
1092 <smbconfoption name="include">/etc/samba/dom-mem.conf</smbconfoption>
1093 </smbconfblock>
1094 </example>
1095
1096 <!-- Six -->
1097 <example id="ch5-dommem-smb">
1098 <title>Common Domain Member Include File: dom-mem.conf</title>
1099 <smbconfblock>
1100 <smbconfcomment>Global parameters</smbconfcomment>
1101 <smbconfsection name="[global]"/>
1102 <smbconfoption name="shutdown script">/var/lib/samba/scripts/shutdown.sh</smbconfoption>
1103 <smbconfoption name="abort shutdown script">/sbin/shutdown -c</smbconfoption>
1104 <smbconfoption name="preferred master">Yes</smbconfoption>
1105 <smbconfoption name="wins server">172.16.0.1</smbconfoption>
1106 <smbconfoption name="idmap uid">15000-20000</smbconfoption>
1107 <smbconfoption name="idmap gid">15000-20000</smbconfoption>
1108 <smbconfoption name="include">/etc/samba/common.conf</smbconfoption>
1109 </smbconfblock>
1110 </example>
1111
1112 <!-- Seven -->
1113 <example id="massive-dhcp">
1114 <title>Server: MASSIVE, File: dhcpd.conf</title>
1115 <screen>
1116 # Abmas Accounting Inc.
1117
1118 default-lease-time 86400;
1119 max-lease-time 172800;
1120 default-lease-time 86400;
1121 ddns-updates on;
1122 ddns-update-style interim;
1123
1124 option ntp-servers 172.16.0.1;
1125 option domain-name "abmas.biz";
1126 option domain-name-servers 172.16.0.1, 172.16.4.1;
1127 option netbios-name-servers 172.16.0.1;
1128 option netbios-node-type 8;
1129
1130 subnet 172.16.1.0 netmask 255.255.252.0 {
1131         range dynamic-bootp 172.16.1.0 172.16.2.255;
1132         option subnet-mask 255.255.252.0;
1133         option routers 172.16.0.1, 172.16.0.128;
1134         allow unknown-clients;
1135         }
1136 subnet 172.16.4.0 netmask 255.255.252.0 {
1137         range dynamic-bootp 172.16.7.0 172.16.7.254;
1138         option subnet-mask 255.255.252.0;
1139         option routers 172.16.4.128;
1140         allow unknown-clients;
1141         }
1142 subnet 172.16.8.0 netmask 255.255.252.0 {
1143         range dynamic-bootp 172.16.11.0 172.16.11.254;
1144         option subnet-mask 255.255.252.0;
1145         option routers 172.16.4.128;
1146         allow unknown-clients;
1147         }
1148 subnet 127.0.0.0 netmask 255.0.0.0 {
1149         }
1150 subnet 123.45.67.64 netmask 255.255.255.252 {
1151         }
1152 </screen>
1153 </example>
1154
1155 <!-- Eight -->
1156 <example id="bldg1dhcp">
1157 <title>Server: BLDG1, File: dhcpd.conf</title>
1158 <screen>
1159 # Abmas Accounting Inc.
1160
1161 default-lease-time 86400;
1162 max-lease-time 172800;
1163 default-lease-time 86400;
1164 ddns-updates on;
1165 ddns-update-style ad-hoc;
1166
1167 option ntp-servers 172.16.0.1;
1168 option domain-name "abmas.biz";
1169 option domain-name-servers 172.16.0.1, 172.16.4.1;
1170 option netbios-name-servers 172.16.0.1;
1171 option netbios-node-type 8;
1172
1173 subnet 172.16.1.0 netmask 255.255.252.0 {
1174         range dynamic-bootp 172.16.3.0 172.16.2.254;
1175         option subnet-mask 255.255.252.0;
1176         option routers 172.16.0.1, 172.16.0.128;
1177         allow unknown-clients;
1178         }
1179 subnet 172.16.4.0 netmask 255.255.252.0 {
1180         range dynamic-bootp 172.16.5.0 172.16.6.255;
1181         option subnet-mask 255.255.252.0;
1182         option routers 172.16.4.128;
1183         allow unknown-clients;
1184         }
1185 subnet 127.0.0.0 netmask 255.0.0.0 {
1186         }
1187 </screen>
1188 </example>
1189
1190 <!-- Nine -->
1191 <example id="bldg2dhcp">
1192 <title>Server: BLDG2, File: dhcpd.conf</title>
1193 <screen>
1194 # Abmas Accounting Inc.
1195
1196 default-lease-time 86400;
1197 max-lease-time 172800;
1198 default-lease-time 86400;
1199 ddns-updates on;
1200 ddns-update-style interim;
1201
1202 option ntp-servers 172.16.0.1;
1203 option domain-name "abmas.biz";
1204 option domain-name-servers 172.16.0.1, 172.16.4.1;
1205 option netbios-name-servers 172.16.0.1;
1206 option netbios-node-type 8;
1207
1208 subnet 172.16.8.0 netmask 255.255.252.0 {
1209         range dynamic-bootp 172.16.9.0 172.16.10.255;
1210         option subnet-mask 255.255.252.0;
1211         option routers 172.16.8.128;
1212         allow unknown-clients;
1213         }
1214 subnet 127.0.0.0 netmask 255.0.0.0 {
1215         }
1216 </screen>
1217 </example>
1218
1219 <!-- Ten -->
1220 <example id="massive-nameda">
1221 <title>Server: MASSIVE, File: named.conf, Part: A</title>
1222 <screen>
1223 ###
1224 # Abmas Biz DNS Control File
1225 ###
1226 # Date: November 15, 2003
1227 ###
1228 options {
1229         directory "/var/lib/named";
1230         forwarders {
1231                 123.45.12.23;
1232                 123.45.54.32;
1233                 };
1234         forward first;
1235         listen-on {
1236                 mynet;
1237                 };
1238         auth-nxdomain yes;
1239         multiple-cnames yes;
1240         notify no;
1241 };
1242
1243 zone "." in {
1244         type hint;
1245         file "root.hint";
1246 };
1247
1248 zone "localhost" in {
1249         type master;
1250         file "localhost.zone";
1251 };
1252
1253 zone "0.0.127.in-addr.arpa" in {
1254         type master;
1255         file "127.0.0.zone";
1256 };
1257
1258 acl mynet {
1259         172.16.0.0/24;
1260         172.16.4.0/24;
1261         172.16.8.0/24;
1262         127.0.0.1;
1263 };
1264
1265 acl seconddns {
1266         123.45.54.32;
1267 }
1268 </screen>
1269 </example>
1270
1271 <!-- Eleven -->
1272 <example id="massive-namedb">
1273 <title>Server: MASSIVE, File: named.conf, Part: B</title>
1274 <screen>
1275 zone "abmas.biz" {
1276         type master;
1277         file "/var/lib/named/master/abmas.biz.hosts";
1278         allow-query {
1279                 mynet;
1280         };
1281         allow-transfer {
1282                 mynet;
1283         };
1284         allow-update {
1285                 mynet;
1286         };
1287 };
1288
1289 zone "abmas.us" {
1290         type master;
1291         file "/var/lib/named/master/abmas.us.hosts";
1292         allow-query {
1293                 all;
1294         };
1295         allow-transfer {
1296                 seconddns;
1297         };
1298 };
1299 </screen>
1300 </example>
1301
1302 <!-- Twelve -->
1303 <example id="massive-namedc">
1304 <title>Server: MASSIVE, File: named.conf, Part: C</title>
1305 <screen>
1306 zone "0.16.172.in-addr.arpa" {
1307         type master;
1308         file "/var/lib/named/master/172.16.0.0.rev";
1309         allow-query {
1310                 mynet;
1311         };
1312         allow-transfer {
1313                 mynet;
1314         };
1315         allow-update {
1316                 mynet;
1317         };
1318 };
1319
1320 zone "4.16.172.in-addr.arpa" {
1321         type master;
1322         file "/var/lib/named/master/172.16.4.0.rev";
1323         allow-query {
1324                 mynet;
1325         };
1326         allow-transfer {
1327                 mynet;
1328         };
1329         allow-update {
1330                 mynet;
1331         };
1332 };
1333
1334 zone "8.16.172.in-addr.arpa" {
1335         type master;
1336         file "/var/lib/named/master/172.16.8.0.rev";
1337         allow-query {
1338                 mynet;
1339         };
1340         allow-transfer {
1341                 mynet;
1342         };
1343         allow-update {
1344                 mynet;
1345         };
1346 };
1347 </screen>
1348 </example>
1349
1350 <!-- Thirteen -->
1351 <example id="abmasbizdns">
1352 <title>Forward Zone File: abmas.biz.hosts</title>
1353 <screen>
1354 $ORIGIN .
1355 $TTL 38400      ; 10 hours 40 minutes
1356 abmas.biz       IN SOA  massive.abmas.biz. root.abmas.biz. (
1357                                 2003021833 ; serial
1358                                 10800      ; refresh (3 hours)
1359                                 3600       ; retry (1 hour)
1360                                 604800     ; expire (1 week)
1361                                 38400      ; minimum (10 hours 40 minutes)
1362                                 )
1363                         NS      massive.abmas.biz.
1364                         NS      bldg1.abmas.biz.
1365                         NS      bldg2.abmas.biz.
1366                         MX      10 massive.abmas.biz.
1367 $ORIGIN abmas.biz.
1368 massive                 A       172.16.0.1
1369 router0                 A       172.16.0.128
1370 bldg1                   A       172.16.4.1
1371 router4                 A       172.16.4.128
1372 bldg2                   A       172.16.8.1
1373 router8                 A       172.16.8.128
1374 </screen>
1375 </example>
1376
1377 <!-- Forteen -->
1378 <example id="abmasusdns">
1379 <title>Forward Zone File: abmas.biz.hosts</title>
1380 <screen>
1381 $ORIGIN .
1382 $TTL 38400      ; 10 hours 40 minutes
1383 abmas.us        IN SOA  server.abmas.us. root.abmas.us. (
1384                                 2003021833 ; serial
1385                                 10800      ; refresh (3 hours)
1386                                 3600       ; retry (1 hour)
1387                                 604800     ; expire (1 week)
1388                                 38400      ; minimum (10 hours 40 minutes)
1389                                 )
1390                         NS      dns.abmas.us.
1391                         NS      dns2.abmas.us.
1392                         MX      10 mail.abmas.us.
1393 $ORIGIN abmas.us.
1394 server                  A       123.45.67.66
1395 dns2                    A       123.45.54.32
1396 gw                      A       123.45.67.65
1397 www                     CNAME   server
1398 mail                    CNAME   server
1399 dns                     CNAME   server
1400 </screen>
1401 </example>
1402
1403 <!-- Fifteen -->
1404 <example id="bldg12nameda">
1405 <title>Servers: BLDG1/BLDG2, File: named.conf, Part: A</title>
1406 <screen>
1407 ###
1408 # Abmas Biz DNS Control File
1409 ###
1410 # Date: November 15, 2003
1411 ###
1412 options {
1413         directory "/var/lib/named";
1414         forwarders {
1415                 172.16.0.1;
1416                 };
1417         forward first;
1418         listen-on {
1419                 mynet;
1420                 };
1421         auth-nxdomain yes;
1422         multiple-cnames yes;
1423         notify no;
1424 };
1425
1426 zone "." in {
1427         type hint;
1428         file "root.hint";
1429 };
1430
1431 zone "localhost" in {
1432         type master;
1433         file "localhost.zone";
1434 };
1435
1436 zone "0.0.127.in-addr.arpa" in {
1437         type master;
1438         file "127.0.0.zone";
1439 };
1440
1441 acl mynet {
1442         172.16.0.0/24;
1443         172.16.4.0/24;
1444         172.16.8.0/24;
1445         127.0.0.1;
1446 };
1447
1448 acl seconddns {
1449         123.45.54.32;
1450 }
1451 </screen>
1452 </example>
1453
1454 <!-- Sixteen -->
1455 <example id="bldg12namedb">
1456 <title>Servers: BLDG1/BLDG2, File: named.conf, Part: B</title>
1457 <screen>
1458 zone "abmas.biz" {
1459         type slave;
1460         file "/var/lib/named/slave/abmas.biz.hosts";
1461         allow-query {
1462                 mynet;
1463         };
1464         allow-transfer {
1465                 mynet;
1466         };
1467 };
1468
1469 zone "0.16.172.in-addr.arpa" {
1470         type slave;
1471         file "/var/lib/slave/master/172.16.0.0.rev";
1472         allow-query {
1473                 mynet;
1474         };
1475         allow-transfer {
1476                 mynet;
1477         };
1478 };
1479
1480 zone "4.16.172.in-addr.arpa" {
1481         type slave;
1482         file "/var/lib/named/slave/172.16.4.0.rev";
1483         allow-query {
1484                 mynet;
1485         };
1486         allow-transfer {
1487                 mynet;
1488         };
1489 };
1490
1491 zone "8.16.172.in-addr.arpa" {
1492         type slave;
1493         file "/var/lib/named/slave/172.16.8.0.rev";
1494         allow-query {
1495                 mynet;
1496         };
1497         allow-transfer {
1498                 mynet;
1499         };
1500 };
1501 </screen>
1502 </example>
1503
1504
1505 <!-- Seventeen -->
1506 <example id="ch5-initgrps">
1507 <title>Initialize Groups Script, File: /etc/samba/initGrps.sh</title>
1508 <screen>
1509 #!/bin/bash
1510
1511 # Create UNIX groups
1512 groupadd acctsdep
1513 groupadd finsrvcs
1514 groupadd piops
1515
1516 # Map Windows Domain Groups to UNIX groups
1517 net groupmap modify ntgroup="Domain Admins"  unixgroup=root
1518 net groupmap modify ntgroup="Domain Users"   unixgroup=users
1519 net groupmap modify ntgroup="Domain Guests"  unixgroup=nobody
1520
1521 # Add Functional Domain Groups
1522 net groupmap add ntgroup="Accounts Dept"       unixgroup=acctsdep type=d
1523 net groupmap add ntgroup="Financial Services"  unixgroup=finsrvcs type=d
1524 net groupmap add ntgroup="Insurance Group"     unixgroup=piops type=d
1525 </screen>
1526 </example>
1527
1528 <!-- End of Examples -->
1529
1530         <sect2 id="ch5-procstart">
1531         <title>Process Startup Configuration</title>
1532
1533         <para>
1534                 <indexterm><primary>chkconfig</primary></indexterm>
1535                 <indexterm><primary>daemon control</primary></indexterm>
1536         There are two essential steps to process startup configuration. A process
1537         must be configured so that it is automatically restarted each time the server
1538         is rebooted. This step involves use of the <command>chkconfig</command> tool that
1539         created appropriate symbolic links from the master daemon control file that is
1540         located in the <filename>/etc/rc.d</filename> directory to the <filename>/etc/rc'x'.d</filename>
1541         directories. Links are created so that when the system run-level is changed, the
1542         necessary start or kill script is run.
1543         </para>
1544
1545         <para>
1546         <indexterm><primary>/etc/xinetd.d</primary></indexterm>
1547         In the event that a service is provided not as a daemon but via the internetworking
1548         super daemon (<command>inetd</command> or <command>xinetd</command>), then the <command>chkconfig</command>
1549         tool makes the necessary entries in the <filename>/etc/xinetd.d</filename> directory
1550         and sends a hang-up (HUP) signal to the super daemon, thus forcing it to
1551         re-read its control files.
1552         </para>
1553
1554         <para>
1555         Last, each service must be started to permit system validation to proceed. The following steps
1556                 are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you
1557                 are installing Samba.
1558         </para>
1559
1560         <procedure>
1561                 <title>Process Startup Configuration Steps</title>
1562
1563                 <step><para>
1564                 Use the standard system tool to configure each service to restart
1565                 automatically at every system reboot. For example,
1566                 <indexterm><primary>chkconfig</primary></indexterm>
1567 <screen>
1568 &rootprompt; chkconfig dhpc on
1569 &rootprompt; chkconfig named on
1570 &rootprompt; chkconfig cups on
1571 &rootprompt; chkconfig smb on
1572 &rootprompt; chkconfig swat on
1573 </screen>
1574                 </para></step>
1575
1576                 <step><para>
1577                 <indexterm><primary>starting dhcpd</primary></indexterm>
1578                 <indexterm><primary>starting samba</primary></indexterm>
1579                 <indexterm><primary>starting CUPS</primary></indexterm>
1580                 Now start each service to permit the system to be validated.
1581                 Execute each of the following in the sequence shown:
1582
1583 <screen>
1584 &rootprompt; service dhcp restart
1585 &rootprompt; service named restart
1586 &rootprompt; service cups restart
1587 &rootprompt; service smb restart
1588 &rootprompt; service swat restart
1589 </screen>
1590                 </para></step>
1591         </procedure>
1592
1593         </sect2>
1594
1595         <sect2 id="ch5wincfg">
1596         <title>Windows Client Configuration</title>
1597
1598         <para>
1599         The procedure for desktop client configuration for the network in this chapter is similar to
1600         that used for the previous one. There are a few subtle changes that should be noted.
1601         </para>
1602
1603         <procedure>
1604         <title>Windows Client Configuration Steps</title>
1605
1606                 <step><para>
1607                 Install MS Windows XP Professional. During installation, configure the client to use DHCP for
1608                 TCP/IP protocol configuration.
1609                 <indexterm><primary>WINS</primary></indexterm>
1610                 <indexterm><primary>DHCP</primary></indexterm>
1611                 DHCP configures all Windows clients to use the WINS Server address that has been defined
1612                 for the local subnet.
1613                 </para></step>
1614
1615                 <step><para>
1616                 Join the Windows domain <constant>MEGANET</constant>. Use the domain administrator
1617                 username <constant>root</constant> and the SMB password you assigned to this account.
1618                 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
1619                 a Windows domain is given in Appendix A, <link linkend="domjoin"/>.
1620                 Reboot the machine as prompted and then log on using the domain administrator account
1621                 (<constant>root</constant>).
1622                 </para></step>
1623
1624                 <step><para>
1625                 Verify that the server called <constant>MEGANET</constant> is visible in <guimenu>My Network Places</guimenu>,
1626                 that it is possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>,
1627                 <guimenuitem>apps</guimenuitem>, and <guimenuitem>finsvcs</guimenuitem>,
1628                 and that it is possible to open each share to reveal its contents.
1629                 </para></step>
1630
1631                 <step><para>
1632                 Create a drive mapping to the <constant>apps</constant> share on a server. At this time, it does
1633                 not particularly matter which application server is used. It is necessary to manually
1634                 set a persistent drive mapping to the local applications server on each workstation at the time of
1635                 installation. This step is avoided by the improvements to the design of the network configuration
1636                 in the next chapter.
1637                 </para></step>
1638
1639                 <step><para>
1640                 Perform an administrative installation of each application to be used. Select the options
1641                 that you wish to use. Of course, you choose to run applications over the network, correct?
1642                 </para></step>
1643
1644                 <step><para>
1645                 Now install all applications to be installed locally. Typical tools include Adobe Acrobat,
1646                 NTP-based time synchronization software, drivers for specific local devices such as fingerprint
1647                 scanners, and the like. Probably the most significant application to be locally installed
1648                 is antivirus software.
1649                 </para></step>
1650
1651                 <step><para>
1652                 Now install all four printers onto the staging system. The printers you install
1653                 include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers, and you
1654                 also configure use of the identical printers that are located in the financial services department.
1655                 Install printers on each machine using the following steps:
1656
1657                         <procedure>
1658                         <title>Steps to Install Printer Drivers on Windows Clients</title>
1659
1660                                 <step><para>
1661                                 Click <menuchoice>
1662                                         <guimenu>Start</guimenu>
1663                                         <guimenuitem>Settings</guimenuitem>
1664                                         <guimenuitem>Printers</guimenuitem>
1665                                         <guiicon>Add Printer</guiicon>
1666                                         <guibutton>Next</guibutton>
1667                                         </menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
1668                                         Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
1669                                 </para></step>
1670
1671                                 <step><para>
1672                                 Click <guibutton>Next</guibutton>. In the
1673                                 <guimenuitem>Manufacturer:</guimenuitem> panel, select <constant>HP</constant>.
1674                                 In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
1675                                 <constant>HP LaserJet 6</constant>. Click <guibutton>Next</guibutton>.
1676                                 </para></step>
1677
1678                                 <step><para>
1679                                 In the <guimenuitem>Available ports:</guimenuitem> panel, select
1680                                 <constant>FILE:</constant>. Accept the default printer name by clicking
1681                                 <guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
1682                                 test page?</quote>, click <guimenuitem>No</guimenuitem>. Click
1683                                 <guibutton>Finish</guibutton>.
1684                                 </para></step>
1685
1686                                 <step><para>
1687                                 You may be prompted for the name of a file to print to. If so, close the
1688                                 dialog panel. Right-click <menuchoice>
1689                                         <guiicon>HP LaserJet 6</guiicon>
1690                                         <guimenuitem>Properties</guimenuitem>
1691                                         <guimenusub>Details (Tab)</guimenusub>
1692                                         <guimenubutton>Add Port</guimenubutton>
1693                                         </menuchoice>.
1694                                 </para></step>
1695
1696                                 <step><para>
1697                                 In the <guimenuitem>Network</guimenuitem> panel, enter the name of
1698                                 the print queue on the Samba server as follows: <constant>\\BLDG1\hplj6a</constant>.
1699                                 Click <menuchoice>
1700                                         <guibutton>OK</guibutton>
1701                                         <guibutton>OK</guibutton>
1702                                         </menuchoice> to complete the installation.
1703                                 </para></step>
1704
1705                                 <step><para>
1706                                 Repeat the printer installation steps above for both HP LaserJet 6 printers
1707                                 as well as for both QMS Magicolor laser printers. Remember to install all
1708                                 printers but to set the destination port for each to the server on the
1709                                 local network. For example, a workstation in the accounting group should
1710                                 have all printers directed at the server <constant>BLDG1</constant>.
1711                                 You may elect to point all desktop workstation configurations at the
1712                                 server called <constant>MASSIVE</constant> and then in your deployment
1713                                 procedures, it would be wise to document the need to redirect the printer
1714                                 configuration (as well as the applications server drive mapping) to the
1715                                 server on the network segment on which the workstation is to be located.
1716                                 </para></step>
1717                         </procedure>
1718                 </para></step>
1719
1720                 <step><para>
1721                 When you are satisfied that the staging systems are complete, use the appropriate procedure to
1722                 remove the client from the domain. Reboot the system, and then log on as the local administrator
1723                 and clean out all temporary files stored on the system. Before shutting down, use the disk
1724                 defragmentation tool so that the file system is in optimal condition before replication.
1725                 </para></step>
1726
1727                 <step><para>
1728                 Boot the workstation using the Norton (Symantec) Ghosting disk (or CD-ROM) and image the
1729                 machine to a network share on the server.
1730                 </para></step>
1731
1732                 <step><para>
1733                 You may now replicate the image using the appropriate Norton Ghost procedure to the target
1734                 machines. Make sure to use the procedure that ensures each machine has a unique
1735                 Windows security identifier (SID). When the installation of the disk image is complete, boot the PC.
1736                 </para></step>
1737
1738                 <step><para>
1739                 Log onto the machine as the local Administrator (the only option), and join the machine to
1740                 the domain following the procedure set out in Appendix A, <link linkend="domjoin"/>. You must now set the
1741                 persistent drive mapping to the applications server that the user is to use. The system is now
1742                 ready for the user to log on, provided you have created a network logon account for that
1743                 user, of course.
1744                 </para></step>
1745
1746                 <step><para>
1747                 Instruct all users to log onto the workstation using their assigned username and password.
1748                 </para></step>
1749         </procedure>
1750
1751         </sect2>
1752
1753         <sect2>
1754                 <title>Key Points Learned</title>
1755
1756                 <para>
1757                 The network you have just deployed has been a valuable exercise in forced constraint.
1758                 You have deployed a network that works well, although you may soon start to see
1759                 performance problems, at which time the modifications demonstrated in <link linkend="happy"/>
1760                 bring the network to life. The following key learning points were experienced:
1761                 </para>
1762
1763                 <itemizedlist>
1764                         <listitem><para>
1765                         The power of using &smb.conf; include files
1766                         </para></listitem>
1767
1768                         <listitem><para>
1769                         Use of a single PDC over a routed network
1770                         </para></listitem>
1771
1772                         <listitem><para>
1773                         Joining a Samba-3 domain member server to a Samba-3 domain
1774                         </para></listitem>
1775
1776                         <listitem><para>
1777                         Configuration of winbind to use domain users and groups for Samba access
1778                         to resources on the domain member servers
1779                         </para></listitem>
1780
1781                         <listitem><para>
1782                         The introduction of roaming profiles
1783                         </para></listitem>
1784
1785                 </itemizedlist>
1786
1787         </sect2>
1788
1789 </sect1>
1790
1791 <sect1>
1792         <title>Questions and Answers</title>
1793
1794         <para>
1795         </para>
1796
1797         <qandaset defaultlabel="chap01qa" type="number">
1798         <qandaentry>
1799         <question>
1800
1801                 <para>
1802                 The example &smb.conf; files in this chapter make use of the <parameter>include</parameter> facility.
1803                 How may I get to see what the actual working &smb.conf; settings are?
1804                 </para>
1805
1806         </question>
1807         <answer>
1808
1809                 <para>
1810                 You may readily see the net compound effect of the included files by running:
1811 <screen>
1812 &rootprompt; testparm -s | less
1813 </screen>
1814                 </para>
1815
1816         </answer>
1817         </qandaentry>
1818
1819         <qandaentry>
1820         <question>
1821
1822                 <para>
1823                 Why does the include file <filename>common.conf</filename> have an empty include statement?
1824                 </para>
1825
1826         </question>
1827         <answer>
1828
1829                 <para>
1830                 The use of the empty include statement nullifies further includes. For example, let's say you
1831                 desire to have just an smb.conf file that is built from the array of include files of which the
1832                 master control file is called <filename>master.conf</filename>. The following command
1833                 produces a compound &smb.conf; file.
1834 <screen>
1835 &rootprompt; testparm -s /etc/samba/master.conf > /etc/samba/smb.conf
1836 </screen>
1837                 If the include parameter was not in the common.conf file, the final &smb.conf; file leaves
1838                 the include in place, even though the file it points to has already been included. This is a bug
1839                 that will be fixed at a future date.
1840                 </para>
1841
1842         </answer>
1843         </qandaentry>
1844
1845         <qandaentry>
1846         <question>
1847
1848                 <para>
1849                 I accept that the simplest configuration necessary to do the job is the best. The use of <parameter>tdbsam</parameter>
1850                 passdb backend is much simpler than having to manage an LDAP-based <parameter>ldapsam</parameter> passdb backend.
1851                 I tried using <command>rsync</command> to replicate the <filename>passdb.tdb</filename>, and it seems to work fine!
1852                 So what is the problem?
1853                 </para>
1854
1855         </question>
1856         <answer>
1857
1858                 <para>
1859                 Replication of the <parameter>tdbsam</parameter> database file can result in loss of currency in its
1860                 contents between the PDC and BDCs. The most notable symptom is that workstations may not be able
1861                 to log onto the network following a reboot and may have to rejoin the domain to recover network
1862                 access capability.
1863                 </para>
1864
1865         </answer>
1866         </qandaentry>
1867
1868         <qandaentry>
1869         <question>
1870
1871                 <para>
1872                 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash?
1873                 </para>
1874
1875         </question>
1876         <answer>
1877
1878                 <para>
1879                 No. It is possible to have as many DHCP servers on a network segment as makes sense. A DHCP server
1880                 offers an IP address lease, but it is the client that determines which offer is accepted, no matter how many
1881                 offers are made. Under normal operation, the client accepts the first offer it receives.
1882                 </para>
1883
1884                 <para>
1885                 The only exception to this rule is when the client makes a directed request from a specific DHCP server
1886                 for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash.
1887                 </para>
1888
1889         </answer>
1890         </qandaentry>
1891
1892         <qandaentry>
1893         <question>
1894
1895                 <para>
1896                 How does the Windows client find the PDC?
1897                 </para>
1898
1899         </question>
1900         <answer>
1901
1902                 <para>
1903                 The Windows client obtains the WINS server address from the DHCP lease information. It also
1904                 obtains from the DHCP lease information the parameter that causes it to use directed UDP (UDP Unicast)
1905                 to register itself with the WINS server and to obtain enumeration of vital network information to
1906                 enable it to operate successfully.
1907                 </para>
1908
1909         </answer>
1910         </qandaentry>
1911
1912         <qandaentry>
1913         <question>
1914
1915                 <para>
1916                 Why did you enable IP forwarding (routing) only on the server called <constant>MASSIVE</constant>?
1917                 </para>
1918
1919         </question>
1920         <answer>
1921
1922                 <para>
1923                 The server called <constant>MASSIVE</constant> is acting as a router to the Internet. No other server
1924                 (BLDG1 or BLDG2) has any need for IP forwarding because they are attached only to their own network.
1925                 Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network
1926                 segments to the router that is its gateway to them.
1927                 </para>
1928
1929         </answer>
1930         </qandaentry>
1931
1932         <qandaentry>
1933         <question>
1934
1935                 <para>
1936                 You did nothing special to implement roaming profiles. Why?
1937                 </para>
1938
1939         </question>
1940         <answer>
1941
1942                 <para>
1943                 Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional
1944                 clients is to use roaming profiles.
1945                 </para>
1946
1947         </answer>
1948         </qandaentry>
1949
1950         <qandaentry>
1951         <question>
1952
1953                 <para>
1954                 On the domain member computers, you configured winbind in the <filename>/etc/nsswitch.conf</filename> file.
1955                 You did not configure any PAM settings. Is this an omission?
1956                 </para>
1957
1958         </question>
1959         <answer>
1960
1961                 <para>
1962                 PAM is needed only for authentication. When Samba is using Microsoft encrypted passwords, it makes only
1963                 marginal use of PAM. PAM configuration handles only authentication. If you want to log onto the domain
1964                 member servers using Windows networking usernames and passwords, it is necessary to configure PAM
1965                 to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name
1966                 service switch (NSS).
1967                 </para>
1968
1969         </answer>
1970         </qandaentry>
1971
1972         <qandaentry>
1973         <question>
1974
1975                 <para>
1976                 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this?
1977                 </para>
1978
1979         </question>
1980         <answer>
1981
1982                 <para>
1983                 Oh, I did not think you would notice that. It is there so that it can be used. This is more fully discussed
1984                 in <emphasis>TOSHARG</emphasis>, which has a full chapter dedicated to the subject. While we are on the
1985                 subject, it should be noted that you should definitely not use SWAT on any system that makes use
1986                 of &smb.conf; <parameter>include</parameter> files because SWAT optimizes them out into an aggregated
1987                 file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to
1988                 handle this functionality gracefully.
1989                 </para>
1990
1991         </answer>
1992         </qandaentry>
1993
1994         <qandaentry>
1995         <question>
1996
1997                 <para>
1998                 The domain controller has an auto-shutdown script. Isn't that dangerous?
1999                 </para>
2000
2001         </question>
2002         <answer>
2003
2004                 <para>
2005                 Well done, you spotted that! I guess it is dangerous. It is good to know that you can do this, though.
2006                 </para>
2007
2008         </answer>
2009         </qandaentry>
2010
2011         </qandaset>
2012
2013 </sect1>
2014
2015 </chapter>
2016