1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
4 <title>No-Frills Samba Servers</title>
6 <?latex \pagenumbering{arabic} ?>
9 This is the start of the real journey toward the successful deployment of Samba. For some this chapter
10 is the end of the road because their needs will have been adequately met. For others, this chapter is
11 the beginning of a journey that will take them well past the contents of this book. This book provides
12 example configurations of, for the greater part, complete networking solutions. The intent of this book
13 is to help you to get your Samba installation working with least amount of pain and aggravation.
17 <title>Introduction</title>
20 This chapter lays the groundwork for understanding the basics of Samba operation.
21 Instead of a bland technical discussion, each principle is demonstrated by way of a
22 real-world scenario for which a working solution<footnote><para>The examples given mirror those documented
23 in The Official Samba-3 HOWTO and Reference Guide (TOSHARG) Chapter 2, Section 2.3.1. You may gain additional
24 insight from the standalone server configurations covered in TOSHARG, sections 2.3.1.2 through 2.3.1.4.
25 </para></footnote> is fully described.
29 The practical exercises take you on a journey through a drafting office, a charity administration
30 office, and an accounting office. You may choose to apply any or all of these exercises to your own environment.
34 Every assignment case can be implemented far more creatively, but remember that the solutions you
35 create are designed to demonstrate a particular solution possibility. With experience, you should
36 find much improved solutions compared with those presented here. By the time you complete this book,
37 you should aim to be a Samba expert, so do attempt to find better solutions and try them as you work your
38 way through the examples.
43 <title>Assignment Tasks</title>
46 Each case presented highlights different aspects of Windows networking for which a simple
47 Samba-based solution can be provided. Each has subtly different requirements taken from real-world cases.
48 The cases are briefly reviewed to cover important points. Instructions are based
49 on the assumption that the official Samba Team RPM package has been installed.
53 This chapter has three assignments built around fictitious companies:
58 <listitem><para>A drafting office</para></listitem>
59 <listitem><para>A charity administration office</para></listitem>
60 <listitem><para>An accounting office</para></listitem>
69 <title>Drafting Office</title>
72 Our fictitious company is called <emphasis>Abmas Design, Inc.</emphasis> This is a three-person
73 computer-aided design (CAD) business that often has more work than can be handled. The
74 business owner hires contract draftspeople from wherever he can. They bring their own
75 notebook computers into the office. There are four permanent drafting machines. Abmas has a
76 collection of over 10 years of plans that must be available for all draftsmen to reference.
77 Abmas hires the services of an experienced network engineer to update the
78 plans that are stored on a central server one day per month. She knows how to upload
79 plans from each machine. The files available from the server must remain read-only.
80 Anyone should be able to access the plans at any time and without barriers or difficulty.
83 <para><indexterm><primary>Red Hat</primary></indexterm>
84 <indexterm><primary>Fedora</primary></indexterm>
85 Mr. Bob Jordan has asked you to install the new server as economically as possible. The central
86 server has a Pentium-IV 1.6GHz CPU, 768MB RAM, a 20GB IDE boot drive, a 160GB IDE second disk
87 to store plans, and a 100-base-T Ethernet card. You have already installed Red Hat Fedora CoreX and
88 have upgraded Samba to version 3.0.20 using the RPM package that is provided from the Samba
89 <ulink url="http://www.samba.org">FTP</ulink> sites. (Note: Fedora CoreX indicates your favorite
94 <primary>consultant</primary>
96 The four permanent drafting machines (Microsoft Windows workstations) have attached printers
97 and plotters that are shared on a peer-to-peer basis by any and all network users. The intent
98 is to continue to share printers in this manner. The three permanent staff work together with
99 all contractors to store all new work on one PC. A daily copy is made of the work storage
100 area to another PC for safekeeping. When the network consultant arrives, the weekly work
101 area is copied to the central server and the files are removed from the main weekly storage
102 machine. The office works best with this arrangement and does not want to change anything.
103 Old habits are too ingrained.
107 <title>Dissection and Discussion</title>
110 <indexterm><primary>file server</primary><secondary>read-only</secondary></indexterm>
111 The requirements for this server installation demand simplicity. An anonymous read-only
112 file server adequately meets all needs. The network consultant determines how
113 to upload all files from the weekly storage area to the server. This installation should
114 focus only on critical aspects of the installation.
118 It is not necessary to have specific users on the server. The site has a method for storing
119 all design files (plans). Each plan is stored in a directory that is named YYYYWW,<footnote><para>
120 This information is given purely as an example of how data may be stored in such a way that it
121 will be easy to locate records at a later date. The example is not meant to imply any instructions
122 that may be construed as essential to the design of the solution; this is something you will almost
123 certainly want to determine for yourself.</para></footnote> where
124 YYYY is the year, and WW is the week of the year. This arrangement allows work to be stored
125 by week of year to preserve the filing technique the site is familiar with.
126 There is also a customer directory that is alphabetically listed. At the top level are 26
127 directories (A-Z), in each is a second-level of directory for the first plus second letters of the name
128 (A-Z); inside each is a directory by the customers' name. Inside each directory is a symbolic
129 link to each design drawing or plan. This way of storing customer data files permits all
130 plans to be located both by customer name and by the date the work was performed, without
131 demanding the disk space that would be needed if a duplicate file copy were to be stored.
132 The share containing the plans is called <emphasis>Plans</emphasis>.
138 <title>Implementation</title>
141 It is assumed that the server is fully installed and ready for installation and
142 configuration of Samba 3.0.20 and any support files needed. All TCP/IP addresses
143 have been hard-coded. In our case the IP address of the Samba server is
144 <constant>192.168.1.1</constant> and the netmask is <constant>255.255.255.0</constant>.
145 The hostname of the server used is <constant>server</constant>.
149 <title>Samba Server Configuration</title>
152 Download the Samba-3 RPM packages for Red Hat Fedora Core2 from the Samba
153 <ulink url="http://www.samba.org">FTP servers.</ulink>
157 <indexterm><primary>RPM</primary><secondary>install</secondary></indexterm>
158 <indexterm><primary>package</primary></indexterm>
159 Install the RPM package using either the Red Hat Linux preferred GUI
160 tool or the <command>rpm</command>:
162 &rootprompt; rpm -Uvh samba-3.0.20-1.i386.rpm
167 Create a mount point for the file system that will be used to store all data files.
168 You can create a directory called <filename>/plans</filename>:
170 &rootprompt; mkdir /plans
171 &rootprompt; chmod 755 /plans
173 The 755 permissions on this directory (mount point) permit the owner to read, write,
174 and execute, and the group and everyone else to read and execute only.
178 <indexterm><primary>file system</primary><secondary>Ext3</secondary></indexterm>
179 Use Red Hat Linux system tools (refer to Red Hat instructions)
180 to format the 160GB hard drive with a suitable file system. An Ext3 file system
181 is suitable. Configure this drive to automatically mount using the <filename>/plans</filename>
182 directory as the mount point.
186 Install the &smb.conf; file shown in <link linkend="draft-smbconf"/> in the
187 <filename>/etc/samba</filename> directory.
189 <example id="draft-smbconf">
190 <title>Drafting Office &smb.conf; File</title>
192 <smbconfcomment>Global Parameters</smbconfcomment>
193 <smbconfsection name="[global]"/>
194 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
195 <smbconfoption name="security">SHARE</smbconfoption>
197 <smbconfsection name="[Plans]"/>
198 <smbconfoption name="path">/plans</smbconfoption>
199 <smbconfoption name="read only">Yes</smbconfoption>
200 <smbconfoption name="guest ok">Yes</smbconfoption>
206 <indexterm><primary>/etc/hosts</primary></indexterm>
207 Verify that the <filename>/etc/hosts</filename> file contains the following entry:
217 <indexterm><primary>samba</primary><secondary>starting samba</secondary></indexterm>
218 <indexterm><primary>chkconfig</primary></indexterm>
219 <indexterm><primary>starting samba</primary></indexterm>
220 Use the standard system tool to start Samba and to configure it to restart
221 automatically at every system reboot. For example,
223 &rootprompt; chkconfig smb on
224 &rootprompt; /etc/rc.d/init.d/smb restart
231 <title>Windows Client Configuration</title>
234 Make certain that all clients are set to the same network address range as
235 used for the Samba server. For example, one client might have an IP
236 address 192.168.1.10.
240 <indexterm><primary>netmask</primary></indexterm>
241 Ensure that the netmask used on the Windows clients matches that used
242 for the Samba server. All clients must have the same netmask, such as
247 <indexterm><primary>workgroup</primary></indexterm>
248 Set the workgroup name on all clients to <constant>MIDEARTH</constant>.
252 Verify on each client that the machine called <constant>SERVER</constant>
253 is visible in the <guimenu>Network Neighborhood</guimenu>, that it is
254 possible to connect to it and see the share <guimenuitem>Plans</guimenuitem>,
255 and that it is possible to open that share to reveal its contents.
262 <sect3 id="validate1">
263 <title>Validation</title>
266 <indexterm><primary>validation</primary></indexterm>
267 The first priority in validating the new Samba configuration should be to check
268 that Samba answers on the loop-back interface. Then it is time to check that Samba
269 answers its own name correctly. Last, check that a client can connect to the Samba
275 <indexterm><primary>smbd</primary></indexterm>
276 <indexterm><primary>daemon</primary></indexterm>
277 <indexterm><primary>smbclient</primary></indexterm>
278 To check the ability to access the <command>smbd</command> daemon
279 services, execute the following:
281 &rootprompt; smbclient -L localhost -U%
282 Sharename Type Comment
283 --------- ---- -------
285 IPC$ IPC IPC Service (Samba 3.0.20)
286 ADMIN$ IPC IPC Service (Samba 3.0.20)
296 <indexterm><primary>loopback</primary></indexterm>
297 <indexterm><primary>NULL connection</primary></indexterm>
298 This indicates that Samba is able to respond on the loopback interface to
299 a NULL connection. The <parameter>-U%</parameter> means send an empty
300 username and an empty password. This command should be repeated after
301 Samba has been running for 15 minutes.
305 Now verify that Samba correctly handles being passed a username
306 and password, and that it answers its own name. Execute the following:
308 &rootprompt; smbclient -L server -Uroot%password
310 The output should be identical to the previous response. Samba has been
311 configured to ignore all usernames given; instead it uses the
312 <parameter>guest account</parameter> for all connections.
316 <indexterm><primary>Windows Explorer</primary></indexterm>
317 <indexterm><primary>Network Neighborhood</primary></indexterm>
318 From the Windows 9x/Me client, launch Windows Explorer:
320 <guiicon>[Desktop: right-click] Network Neighborhood</guiicon>
321 <guimenu>Explore</guimenu>
322 <guimenuitem>[Left Panel] [+] Entire Network</guimenuitem>
323 <guimenuitem>[Left Panel] [+] Server</guimenuitem>
324 <guimenuitem>[Left Panel] [+] Plans</guimenuitem>
325 </menuchoice>. In the right panel you should see the files and directories
326 (folders) that are in the <guiicon>Plans</guiicon> share.
335 <title>Charity Administration Office</title>
338 The fictitious charity organization is called <emphasis>Abmas Vision NL</emphasis>. This office
339 has five networked computers. Staff are all volunteers, staff changes are frequent.
340 Ms. Amy May, the director of operations, wants a no-hassle network. Anyone should be able to
341 use any PC. Only two Windows applications are used: a custom funds tracking and management package
342 that stores all files on the central server and Microsoft Word. The office prepares mail-out
343 letters, invitations, and thank-you notes. All files must be stored in perpetuity.
344 The custom funds tracking and management (FTM) software is configured to use a server named
345 <constant>SERVER</constant>, a share named <constant>FTMFILES</constant>, and a printer queue
346 named <constant>PRINTQ</constant> that uses preprinted stationery, thus demanding a
347 dedicated printer. This printer does not need to be mapped to a local printer on the workstations.
351 The FTM software has been in use since the days of Windows 3.11. The software was configured
352 by the vendor who has since gone out of business. The identities of the file
353 server and the printer are hard-coded in a configuration file that was created using a
354 setup tool that the vendor did not provide to Abmas Vision NL or to its predecessors. The
355 company that produced the software is no longer in business. In order to avoid risk of
356 any incompatibilities, the share name and the name of the target print queue must be set
357 precisely as the application expects. In fact, share names and print queue names
358 should be treated as case insensitive (i.e., case does not matter), but Abmas Vision advises
359 that if the share name is not in lowercase, the application claims it cannot find the
364 <indexterm><primary>print queue</primary></indexterm>
365 <indexterm><primary>print spooler</primary></indexterm>
366 Printer handling in Samba results in a significant level of confusion. Samba presents to the
367 MS Windows client only a print queue. The Samba <command>smbd</command> process passes a
368 print job sent to it from the Windows client to the native UNIX printing system. The native
369 UNIX printing system (spooler) places the job in a print queue from which it is
370 delivered to the printer. In this book, network diagrams refer to a printer by the name
371 of the print queue that services that printer. It does not matter what the fully qualified
372 name (or the hostname) of a network-attached printer is. The UNIX print spooler is configured
373 to correctly deliver all jobs to the printer.
377 This organization has a policy forbidding use of privately owned computers on site as a measure
378 to prevent leakage of confidential information. Only the five PCs owned by Abmas Vision NL are
379 used on this network.
383 <indexterm><primary>SUSE Enterprise Linux Server</primary></indexterm>
384 The central server was donated by a local computer store. It is a dual processor Pentium-III
385 server, has 1GB RAM, a 3-Ware IDE RAID Controller that has four 200GB IDE hard drives, and a
386 100-base-T network card. The office has 100-base-T permanent network connections that go to
387 a central hub, and all equipment is new. The five network computers all are equipped with Microsoft
388 Windows Me. Funding is limited, so the server has no operating system on it. You have approval
389 to install Samba on Linux, provided it works without problems. There are two HP LaserJet
390 5 PS printers that are network connected. The second printer is to be used for general
391 office and letter printing. Your recommendation to allow only the Linux server to print directly
392 to the printers was accepted. You have supplied SUSE Enterprise Linux Server 9 and
393 have upgraded Samba to version 3.0.20.
397 <title>Dissection and Discussion</title>
400 <indexterm><primary>force user</primary></indexterm>
401 <indexterm><primary>nt acl support</primary></indexterm>
402 <indexterm><primary>UID</primary></indexterm>
403 <indexterm><primary>Posix</primary></indexterm>
404 This installation demands simplicity. Frequent turnover of volunteer staff indicates that
405 a network environment that requires users to logon might be problematic. It is suggested that the
406 best solution for this office would be one where the user can log onto any PC with any username
407 and password. Samba can accommodate an office like this by using the <parameter>force user</parameter>
408 parameter in share and printer definitions. Using the <parameter>force user</parameter>
409 parameter ensures that all files are owned by same user identifier (UID) and thus that there
410 will never be a problem with file access due to file access permissions. Additionally, you elect
411 to use the <parameter>nt acl support = No</parameter> option to ensure that
412 access control lists (Posix type) cannot be written to any file or directory. This prevents
413 an inadvertent ACL from overriding actual file permissions.
417 <indexterm><primary>SUID</primary></indexterm>
418 <indexterm><primary>SGID</primary></indexterm>
419 <indexterm><primary>security</primary><secondary>share mode</secondary></indexterm>
420 This organization is a prime candidate for Share Mode security. The <parameter>force user</parameter>
421 allows all files to be owned by the same user and group. In addition, it would not hurt to
422 set SUID and set SGID shared directories. This means that all new files that are created, no matter
423 who creates it, are owned by the owner or group of the directory in which they are created.
424 For further information regarding the significance of the SUID/SGID settings, see Appendix A,
425 <link linkend="ch12-SUIDSGID"/>.
429 <indexterm><primary>CUPS</primary></indexterm>
430 <indexterm><primary>printing</primary><secondary>raw</secondary></indexterm>
431 <indexterm><primary>Red Hat Linux</primary></indexterm>
432 <indexterm><primary>SUSE Linux</primary></indexterm>
433 All client workstations print to a print queue on the server. This ensures that print jobs
434 continue to print in the event that a user shuts down the workstation immediately after
435 sending a job to the printer. Today, both Red Hat Linux and SUSE Linux use CUPS-based printing.
436 Older Linux systems offered a choice between the LPRng printing system or CUPS. It appears, however,
437 that CUPS has become the leading UNIX printing technology.
441 <indexterm><primary>print queue</primary></indexterm>
442 The print queues are set up as <constant>Raw</constant> devices, which means that CUPS will
443 not do intelligent print processing, and vendor-supplied drivers must be installed locally on the
448 The hypothetical software, FTM, is representative of
449 custom-built software that directly uses a NetBIOS interface. Most such software originated in
450 the days of MS/PC DOS. NetBIOS names are uppercase (and functionally are case insensitive),
451 so some old software applications would permit only uppercase names to be entered.
452 Some such applications were later ported to MS Windows but retain the uppercase network
453 resource naming conventions because customers are familiar with that. We made the decision
454 to name shares and print queues for this application in uppercase for the same reason.
455 Nothing would break if we were to use lowercase names, but that decision might create a need
456 to retrain staff &smbmdash; something well avoided at this time.
460 NetBIOS networking does not print directly to a printer. Instead, all printing is done to a
461 print queue. The print spooling system is responsible for communicating with the physical
462 printer. In this example, therefore, the resource called <constant>PRINTQ</constant>
463 really is just a print queue. The name of the print queue is representative of
464 the device to which the print spooler delivers print jobs.
470 <title>Implementation</title>
473 It is assumed that the server is fully installed and ready for configuration of
474 Samba 3.0.20 and for necessary support files. All TCP/IP addresses should be hard-coded.
475 In our case, the IP address of the Samba server is 192.168.1.1 and the netmask is
476 255.255.255.0. The hostname of the server used is <constant>server</constant>.
477 The office network is built as shown in <link linkend="charitynet"/>.
480 <figure id="charitynet">
481 <title>Charity Administration Office Network</title>
482 <imagefile scale="80">Charity-Network</imagefile>
488 <title>Samba Server Configuration</title>
491 <indexterm><primary>groupadd</primary></indexterm>
492 Create a group account for office file storage:
494 &rootprompt; groupadd office
499 <indexterm><primary>useradd</primary></indexterm>
500 <indexterm><primary>passwd</primary></indexterm>
501 Create a user account for office file storage:
503 &rootprompt; useradd -m abmas
504 &rootprompt; passwd abmas
505 Changing password for abmas.
506 New password: XXXXXXXX
507 Re-enter new password: XXXXXXXX
510 where XXXXXXXX is a secret password.
514 Use the 3-Ware IDE RAID Controller firmware utilities to configure the four 200GB
515 drives as a single RAID level 5 drive, with one drive set aside as the hot spare.
516 (Refer to the 3-Ware RAID Controller Manual for the manufacturer's preferred procedure.)
517 The resulting drive has a capacity of approximately 500GB of usable space.
521 <indexterm><primary>permissions</primary></indexterm>
522 Create a mount point for the file system that can be used to store all data files.
523 Create a directory called <filename>/data</filename>:
525 &rootprompt; mkdir /data
526 &rootprompt; chmod 755 /data
528 The 755 permissions on this directory (mount point) permit the owner to read, write, and execute,
529 and the group and everyone else to read and execute only.
533 Use SUSE Linux system tools (refer to the SUSE Administrators Guide for correct
534 procedures) to format the partition with a suitable file system. The reiserfs file system
535 is suitable. Configure this drive to automount using the <filename>/data</filename>
536 directory as the mount point. It must be mounted before proceeding.
540 Under the directory called <filename>/data</filename>, create two directories
541 named <filename>ftmfiles</filename> and <filename>officefiles</filename>, and set
542 ownership and permissions:
544 &rootprompt; mkdir -p /data/{ftmfiles,officefiles/{letters,invitations,misc}}
545 &rootprompt; chown -R abmas:office /data
546 &rootprompt; chmod -R ug+rwxs,o-w,o+rx /data
548 These demonstrate compound operations. The <command>mkdir</command> command
549 creates in one step these directories:
553 /data/officefiles/letters
554 /data/officefiles/invitations
555 /data/officefiles/misc
557 <indexterm><primary>TOSHARG</primary></indexterm>
558 The <command>chown</command> operation sets the owner to the user <constant>abmas</constant>
559 and the group to <constant>office</constant> on all directories just created. It recursively
560 sets the permissions so that the owner and group have SUID/SGID with read, write, and execute
561 permission, and everyone else has read and execute permission. This means that all files and
562 directories are created with the same owner and group as the directory in which they are
563 created. Any new directories created still have the same owner, group, and permissions as the
564 directory they are in. This should eliminate all permissions-based file access problems. For
565 more information on this subject, refer to TOSHARG<footnote>The Official Samba-3 HOWTO and
566 Reference Guide, Chapter 15, File, Directory and Share Access Controls.</footnote> or refer
567 to the UNIX man page for the <command>chmod</command> and the <command>chown</command> commands.
571 Install the &smb.conf; file shown in <link linkend="charity-smbconfnew"/> in the
572 <filename>/etc/samba</filename> directory. This newer &smb.conf; file uses user-mode security
573 and is more suited to the mode of operation of Samba-3 that the older share-mode security
574 configuration that was shown in the first edition of this book.
578 Note: If you want to use the older style configuration that uses share-mode security, you
579 can install the file shown in <link linkend="charity-smbconf"/> in the
580 <filename>/etc/samba</filename> directory.
584 <indexterm><primary>smbd</primary></indexterm>
585 We must ensure that the <command>smbd</command> can resolve the name of the Samba
586 server to its IP address. Verify that the <filename>/etc/hosts</filename> file
587 contains the following entry:
594 Configure the printers with the IP address as shown in <link linkend="charitynet"/>.
595 Follow the instructions in the manufacturer's manual to permit printing to port 9100
596 so that the CUPS spooler can print using raw mode protocols.
600 <indexterm><primary>lpadmin</primary></indexterm>
601 Configure the CUPS Print Queues:
603 &rootprompt; lpadmin -p PRINTQ -v socket://192.168.1.20:9100 -E
604 &rootprompt; lpadmin -p hplj5 -v socket://192.168.1.30:9100 -E
606 This creates the necessary print queues with no assigned print filter.
610 <indexterm><primary>mime type</primary></indexterm>
611 <indexterm><primary>/etc/cups/mime.convs</primary></indexterm>
612 <indexterm><primary>application/octet-stream</primary></indexterm>
613 Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
615 application/octet-stream application/vnd.cups-raw 0 -
620 <indexterm><primary>/etc/cups/mime.types</primary></indexterm>
621 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
623 application/octet-stream
628 <indexterm><primary>starting samba</primary></indexterm>
629 Use the standard system tool to start Samba and CUPS to configure them to restart
630 automatically at every system reboot. For example,
634 <indexterm><primary>starting samba</primary></indexterm>
635 <indexterm><primary>starting CUPS</primary></indexterm>
636 <indexterm><primary>chkconfig</primary></indexterm>
638 &rootprompt; chkconfig smb on
639 &rootprompt; chkconfig cups on
640 &rootprompt; /etc/rc.d/init.d/smb restart
641 &rootprompt; /etc/rc.d/init.d/cups restart
647 <example id="charity-smbconfnew">
648 <title>Charity Administration Office &smb.conf; New-style File</title>
650 <smbconfcomment>Global Parameters - Newer Configuration</smbconfcomment>
651 <smbconfsection name="[global]"/>
652 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
653 <smbconfoption name="printing">CUPS</smbconfoption>
654 <smbconfoption name="printcap name">CUPS</smbconfoption>
655 <smbconfoption name="map to guest">Bad User</smbconfoption>
656 <smbconfoption name="show add printer wizard">No</smbconfoption>
657 <smbconfoption name="wins support">yes</smbconfoption>
659 <smbconfsection name="[FTMFILES]"/>
660 <smbconfoption name="comment">Funds Tracking & Management Files</smbconfoption>
661 <smbconfoption name="path">/data/ftmfiles</smbconfoption>
662 <smbconfoption name="read only">No</smbconfoption>
663 <smbconfoption name="force user">abmas</smbconfoption>
664 <smbconfoption name="force group">office</smbconfoption>
665 <smbconfoption name="guest ok">Yes</smbconfoption>
666 <smbconfoption name="nt acl support">No</smbconfoption>
668 <smbconfsection name="[office]"/>
669 <smbconfoption name="comment">General Office Files</smbconfoption>
670 <smbconfoption name="path">/data/officefiles</smbconfoption>
671 <smbconfoption name="read only">No</smbconfoption>
672 <smbconfoption name="force user">abmas</smbconfoption>
673 <smbconfoption name="force group">office</smbconfoption>
674 <smbconfoption name="guest ok">Yes</smbconfoption>
675 <smbconfoption name="nt acl support">No</smbconfoption>
677 <smbconfsection name="[printers]"/>
678 <smbconfoption name="comment">Print Temporary Spool Configuration</smbconfoption>
679 <smbconfoption name="path">/var/spool/samba</smbconfoption>
680 <smbconfoption name="printable">Yes</smbconfoption>
681 <smbconfoption name="guest ok">Yes</smbconfoption>
682 <smbconfoption name="use client driver">Yes</smbconfoption>
683 <smbconfoption name="browseable">No</smbconfoption>
687 <example id="charity-smbconf">
688 <title>Charity Administration Office &smb.conf; Old-style File</title>
690 <smbconfcomment>Global Parameters - Older Style Configuration</smbconfcomment>
691 <smbconfsection name="[global]"/>
692 <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
693 <smbconfoption name="security">SHARE</smbconfoption>
694 <smbconfoption name="printing">CUPS</smbconfoption>
695 <smbconfoption name="printcap name">CUPS</smbconfoption>
696 <smbconfoption name="disable spoolss">Yes</smbconfoption>
697 <smbconfoption name="show add printer wizard">No</smbconfoption>
698 <smbconfoption name="wins support">yes</smbconfoption>
700 <smbconfsection name="[FTMFILES]"/>
701 <smbconfoption name="comment">Funds Tracking & Management Files</smbconfoption>
702 <smbconfoption name="path">/data/ftmfiles</smbconfoption>
703 <smbconfoption name="read only">No</smbconfoption>
704 <smbconfoption name="force user">abmas</smbconfoption>
705 <smbconfoption name="force group">office</smbconfoption>
706 <smbconfoption name="guest ok">Yes</smbconfoption>
707 <smbconfoption name="nt acl support">No</smbconfoption>
709 <smbconfsection name="[office]"/>
710 <smbconfoption name="comment">General Office Files</smbconfoption>
711 <smbconfoption name="path">/data/officefiles</smbconfoption>
712 <smbconfoption name="read only">No</smbconfoption>
713 <smbconfoption name="force user">abmas</smbconfoption>
714 <smbconfoption name="force group">office</smbconfoption>
715 <smbconfoption name="guest ok">Yes</smbconfoption>
716 <smbconfoption name="nt acl support">No</smbconfoption>
718 <smbconfsection name="[printers]"/>
719 <smbconfoption name="comment">Print Temporary Spool Configuration</smbconfoption>
720 <smbconfoption name="path">/var/spool/samba</smbconfoption>
721 <smbconfoption name="printable">Yes</smbconfoption>
722 <smbconfoption name="guest ok">Yes</smbconfoption>
723 <smbconfoption name="use client driver">Yes</smbconfoption>
724 <smbconfoption name="browseable">No</smbconfoption>
729 <title>Windows Client Configuration</title>
732 Configure clients to the network settings shown in <link linkend="charitynet"/>.
736 Ensure that the netmask used on the Windows clients matches that used
737 for the Samba server. All clients must have the same netmask, such as
738 <constant>255.255.255.0</constant>.
742 <indexterm><primary>WINS</primary></indexterm>
743 On all Windows clients, set the WINS Server address to <constant>192.168.1.1</constant>,
744 the IP address of the server.
748 Set the workgroup name on all clients to <constant>MIDEARTH</constant>.
752 <indexterm><secondary>logon</secondary></indexterm>
753 Install the <quote>Client for Microsoft Networks.</quote> Ensure that the only option
754 enabled in its properties is the option <quote>Logon and restore network connections.</quote>
758 Click <guibutton>OK</guibutton> when you are prompted to reboot the system. Reboot the
759 system, then log on using any username and password you choose.
763 <indexterm><primary>My Network Places</primary></indexterm>
764 Verify on each client that the machine called <constant>SERVER</constant>
765 is visible in <guimenu>My Network Places</guimenu>, that it is
766 possible to connect to it and see the share <guimenuitem>office</guimenuitem>,
767 and that it is possible to open that share to reveal its contents.
771 <indexterm><primary>password caching</primary></indexterm>
772 <indexterm><primary>regedit</primary></indexterm>
773 Disable password caching on all Windows 9x/Me machines using the registry change file
774 shown in <link linkend="MEreg"/>. Be sure to remove all files that have the
775 <filename>PWL</filename> extension that are in the <filename>C:\WINDOWS</filename>
778 <title>Windows Me &smbmdash; Registry Edit File: Disable Password Caching</title>
782 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
783 Windows\CurrentVersion\Policies\Network]
784 "DisablePwdCaching"=dword:00000001
787 The best way to apply this change is to save the patch in a file called
788 <filename>ME-dpwc.reg</filename> and then execute:
790 C:\WINDOWS: regedit ME-dpwc.reg
795 Instruct all users to log onto the workstation using a name and password of their own
796 choosing. The Samba server has been
797 configured to ignore the username and password given.
801 On each Windows Me workstation, configure a network drive mapping to drive <filename>G:</filename>
802 that redirects to the uniform naming convention (UNC) resource
803 <filename>\\server\office</filename>. Make this a permanent drive connection:
808 Right-click <guimenu>My Network</guimenu>
809 <guimenuitem>Map Network Drive...</guimenuitem>
814 In the box labeled <quote>Drive:</quote>, type G.
818 In the box labeled <quote>Path:</quote>, enter
819 <filename>\\server\officefiles</filename>.
823 Click <guimenuitem>Reconnect at logon</guimenuitem>.
824 Click <guibutton>OK</guibutton>.
831 On each workstation, install the FTM software following the
832 manufacturer's instructions.
836 During installation, you are prompted for the name of the Windows 98
837 server. Enter the name <constant>SERVER</constant>.
840 You are prompted for the name of the data share.
841 The prompt defaults to <constant>FTMFILES</constant>. Press enter to accept the default value.
844 You are now prompted for the print queue name. The default prompt is the name of
845 the server you entered (<constant>SERVER</constant> as follows:
846 <constant>\\SERVER\PRINTQ</constant>). Simply accept the default and press enter to
847 continue. The software now completes the installation.
853 Install an office automation software package of the customer's choice. Either Microsoft
854 Office 2003 Standard or OpenOffice 1.1.0 suffices for any functions the office may
855 need to perform. Repeat this on each workstation.
859 Install a printer on each workstation using the following steps:
865 <guimenu>Start</guimenu>
866 <guimenuitem>Settings</guimenuitem>
867 <guimenuitem>Printers</guimenuitem>
868 <guiicon>Add Printer</guiicon>
869 <guibutton>Next</guibutton>
870 </menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
871 Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
875 Click <guibutton>Next</guibutton>. In the Manufacturer: panel, select
876 <constant>HP</constant>. In the Printers: panel, select the printer called
877 <constant>HP LaserJet 5/5M Postscript</constant>. Click <guibutton>Next</guibutton>.
881 In the Available ports: panel, select <constant>FILE:</constant>. Accept the
882 default printer name by clicking <guibutton>Next</guibutton>. When asked,
883 <quote>Would you like to print a test page?</quote>, click
884 <guimenuitem>No</guimenuitem>. Click <guibutton>Finish</guibutton>.
888 You may be prompted for the name of a file to print to. If so, close the
889 dialog panel. Right-click <menuchoice>
890 <guiicon>HP LaserJet 5/5M Postscript</guiicon>
891 <guimenuitem>Properties</guimenuitem>
892 <guisubmenu>Details (Tab)</guisubmenu>
893 <guimenuitem>Add Port</guimenuitem>
898 In the Network panel, enter the name of
899 the print queue on the Samba server as follows: <constant>\\SERVER\hplj5</constant>.
901 <guibutton>OK</guibutton>
902 <guibutton>OK</guibutton>
903 </menuchoice> to complete the installation.
907 It is a good idea to test the functionality of the complete installation before
908 handing the newly configured network over to the Charity Administration Office
921 <title>Validation</title>
924 Use the same validation process as was followed in <link linkend="validate1"/>.
931 <sect2 id="AccountingOffice">
932 <title>Accounting Office</title>
935 Abmas Accounting is a 40-year-old family-run business. There are nine permanent
936 computer users. The network clients were upgraded two years ago. All computers run Windows 2000
937 Professional. This year the server will be upgraded from an old Windows NT4 server (actually
938 running Windows NT4 Workstation, which worked fine for fewer than 10 users) that has
939 run in workgroup (standalone) mode, to a new Linux server running Samba.
943 The office does not want a Domain Server. Mr. Alan Meany wants to keep the Windows 2000 Professional
944 clients running as workgroup machines so that any staff member can take a machine home and keep
945 working. It has worked well so far, and your task is to replace the old server. All users have
946 their own workstation logon (you configured it that way when the machines were installed).
947 Mr. Meany wants the new system to operate the same way as the old Windows NT4 server &smbmdash; users
948 cannot access each others' files, but he can access everyone's files. Each person's work files are
949 in a separate share on the server. Users log on to their Windows workstation with their username
950 and enter an assigned password; they do not need to enter a password when accessing their files
955 <indexterm><primary>Red Hat Linux</primary></indexterm>
956 The new server will run Red Hat Fedora Core2. You should install Samba-3.0.20 and
957 copy all files from the old system to the new one. The existing Windows NT4 server has a parallel
958 port HP LaserJet 4 printer that is shared by all. The printer driver is installed on each
959 workstation. You must not change anything on the workstations. Mr. Meany gave instructions to
960 replace the server, <quote>but leave everything else alone to avoid staff unrest.</quote>
964 You have tried to educate Mr. Meany and found that he has no desire to understand networking.
965 He believes that Windows for Workgroups 3.11 was <quote>the best server Microsoft ever sold
966 </quote> and that Windows NT and 2000 are <quote>too fang-dangled complex!</quote>
970 <title>Dissection and Discussion</title>
973 <indexterm><primary>security</primary><secondary>user mode</secondary></indexterm>
974 The requirements of this network installation are not unusual. The staff are not interested in the
975 details of networking. Passwords are never changed. In this example solution, we demonstrate the use
976 of User Mode security in a simple context. Directories should be set SGID to ensure that members
977 of a common group can access the contents. Each user has his or her own share to which only they
978 can connect. Mr. Meany's share will be a top-level directory above the share point for each employee.
979 Mr. Meany is a member of the same group as his staff and can access their work files.
980 The well-used HP LaserJet 4 is available as a service called <constant>hplj</constant>.
984 You have finished configuring the new hardware and have just completed installation of Red Hat
985 Fedora Core2. Roll up your sleeves and let's get to work.
990 <sect3 id="AcctgNet">
991 <title>Implementation</title>
994 The workstations have fixed IP addresses. The old server runs Windows NT4 Workstation, so it
995 cannot be running as a WINS server. It is best that the new configuration preserves the same
996 configuration. The office does not use Internet access, so security really is not an issue.
1000 The core information regarding the users, their passwords, the directory share point, and the
1001 share name is given in <link linkend="acctingnet"/>. The overall network topology is shown in
1002 <link linkend="acctingnet2"/>. All machines have been configured as indicated prior to the
1003 start of Samba configuration. The following prescriptive steps may now commence.
1006 <figure id="acctingnet2">
1007 <title>Accounting Office Network Topology</title>
1008 <imagefile scale="85">AccountingNetwork</imagefile>
1011 <table id="acctingnet">
1012 <title>Accounting Office Network Information</title>
1014 <colspec align="left"/>
1015 <colspec align="left"/>
1016 <colspec align="left"/>
1017 <colspec align="left"/>
1018 <colspec align="left"/>
1019 <colspec align="left"/>
1023 <entry>Login-ID</entry>
1024 <entry>Password</entry>
1025 <entry>Share Name</entry>
1026 <entry>Directory</entry>
1032 <entry>Alan Meany</entry>
1034 <entry>alm1961</entry>
1036 <entry>/data</entry>
1040 <entry>James Meany</entry>
1041 <entry>james</entry>
1042 <entry>jimm1962</entry>
1043 <entry>james</entry>
1044 <entry>/data/james</entry>
1048 <entry>Jeannie Meany</entry>
1049 <entry>jeannie</entry>
1050 <entry>jema1965</entry>
1051 <entry>jeannie</entry>
1052 <entry>/data/jeannie</entry>
1056 <entry>Suzy Millicent</entry>
1058 <entry>suzy1967</entry>
1060 <entry>/data/suzy</entry>
1064 <entry>Ursula Jenning</entry>
1066 <entry>ujen1974</entry>
1067 <entry>ursula</entry>
1068 <entry>/data/ursula</entry>
1072 <entry>Peter Pan</entry>
1073 <entry>peter</entry>
1074 <entry>pete1984</entry>
1075 <entry>peter</entry>
1076 <entry>/data/peter</entry>
1080 <entry>Dale Roland</entry>
1082 <entry>dale1986</entry>
1084 <entry>/data/dale</entry>
1088 <entry>Bertrand E Paoletti</entry>
1090 <entry>eric1993</entry>
1092 <entry>/data/eric</entry>
1096 <entry>Russell Lewis</entry>
1098 <entry>russ2001</entry>
1099 <entry>russell</entry>
1100 <entry>/data/russell</entry>
1110 <title>Migration from Windows NT4 Workstation System to Samba-3</title>
1112 <step><para><indexterm>
1113 <primary>migration</primary>
1115 Rename the old server from <constant>CASHPOOL</constant> to <constant>STABLE</constant>
1116 by logging onto the console as the <constant>Administrator</constant>. Restart the machine
1117 following system prompts.
1121 Name the new server <constant>CASHPOOL</constant> using the standard configuration method.
1122 Restart the machine following system prompts.
1126 Install the latest Samba-3 binary Red Hat Linux RPM that is available from the
1131 <indexterm><primary>group account</primary></indexterm>
1132 <indexterm><primary>groupadd</primary></indexterm>
1133 Add a group account for the office to use. Execute the following:
1135 &rootprompt; groupadd accts
1140 Install the &smb.conf; file shown<footnote><para>This example uses the
1141 <parameter>smbpasswd</parameter> file in an obtuse way, since the use of
1142 the <parameter>passdb backend</parameter> has not been specified in the &smb.conf;
1143 file. This means that you are depending on correct default behavior.</para></footnote>
1144 in <link linkend="acctconf"/>.
1148 <indexterm><primary>useradd</primary></indexterm>
1149 <indexterm><primary>passwd</primary></indexterm>
1150 <indexterm><primary>smbpasswd</primary></indexterm>
1151 For each user who uses this system (see <link linkend="acctingnet"/>),
1152 execute the following:
1154 &rootprompt; useradd -m -G accts -c "Name of User" "LoginID"
1155 &rootprompt; passwd "LoginID"
1156 Changing password for user "LoginID"
1157 New Password: XXXXXXXXX <-- the password from the table
1158 Retype new password: XXXXXXXXX
1159 &rootprompt; smbpasswd -a "LoginID"
1160 New SMB password: XXXXXXXXX <-- the password from the table
1161 Retype new SMB password: XXXXXXXXX
1162 Added user "LoginID"
1167 <indexterm><primary>data storage</primary></indexterm>
1168 Create the directory structure for the file shares by executing the following:
1170 &rootprompt; mkdir -p /data
1171 &rootprompt; chown alan /data
1172 &rootprompt; for i in james suzy ursula peter dale eric jeannie russell
1177 &rootprompt; chgrp -R accts /data
1178 &rootprompt; chmod -R ug+rwxs,o-r+x /data
1180 The data storage structure is now prepared for use.
1184 <indexterm><primary>lpadmin</primary></indexterm>
1185 Configure the CUPS Print Queues:
1187 &rootprompt; lpadmin -p hplj -v parallel:/dev/lp0 -E
1189 This creates the necessary print queues with no assigned print filter.
1193 <indexterm><primary>mime types</primary></indexterm>
1194 <indexterm><primary>/etc/cups/mime.convs</primary></indexterm>
1195 Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
1197 application/octet-stream application/vnd.cups-raw 0 -
1202 <indexterm><primary>/etc/cups/mime.types</primary></indexterm>
1203 <indexterm><primary>application/octet-stream</primary></indexterm>
1204 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
1206 application/octet-stream
1211 <indexterm><primary>starting samba</primary></indexterm>
1212 Use the standard system tool to start Samba and CUPS to configure them to restart
1213 automatically at every system reboot. For example,
1217 <indexterm><primary>starting samba</primary></indexterm>
1218 <indexterm><primary>startingCUPS</primary></indexterm>
1219 <indexterm><primary>chkconfig</primary></indexterm>
1221 &rootprompt; chkconfig smb on
1222 &rootprompt; chkconfig cups on
1223 &rootprompt; /etc/rc.d/init.d/smb restart
1224 &rootprompt; /etc/rc.d/init.d/cups restart
1229 On Alan's workstation, use Windows Explorer to migrate the files from the old server
1230 to the new server. The new server should appear in the <guimenu>Network Neighborhood</guimenu>
1231 with the name of the old server (<constant>CASHPOOL</constant>).
1237 Log on to Alan's workstation as the user <constant>alan</constant>.
1241 Launch a second instance of Windows Explorer and navigate to the share called
1242 <guiicon>files</guiicon> on the server called <guimenu>STABLE</guimenu>.
1246 Click in the right panel, and press <guimenu>Ctrl-A</guimenu> to select all files and
1247 directories. Press <guimenu>Ctrl-C</guimenu> to instruct Windows that you wish to
1248 copy all selected items.
1252 Launch the Windows Explorer, and navigate to the share called <guiicon>files</guiicon>
1253 on the server called <guimenu>CASHPOOL</guimenu>. Click in the right panel, and then press
1254 <guimenu>Ctrl-V</guimenu> to commence the copying process.
1261 Verify that the files are being copied correctly from the Windows NT4 machine to the Samba-3 server.
1262 This is best done on the Samba-3 server. Check the contents of the directory tree under
1263 <filename>/data</filename> by executing the following command:
1265 &rootprompt; ls -aR /data
1267 Make certain to check the ownership and permissions on all files. If in doubt, execute the following:
1269 &rootprompt; chown alan /data
1270 &rootprompt; for i in james suzy ursula peter dale eric jeannie russell
1274 &rootprompt; chgrp -R accts /data
1275 &rootprompt; chmod -R ug+rwxs,o-r+x /data
1280 The migration of all data should now be complete. It is time to validate the installation.
1281 For this, you should make sure all applications, including printing, work before asking the
1282 customer to test drive the new network.
1287 <example id="acctconf">
1288 <title>Accounting Office Network &smb.conf; Old Style Configuration File</title>
1290 <smbconfcomment>Global parameters</smbconfcomment>
1291 <smbconfsection name="[global]"/>
1292 <smbconfoption name="workgroup">BILLMORE</smbconfoption>
1293 <smbconfoption name="printcap name">CUPS</smbconfoption>
1294 <smbconfoption name="disable spoolss">Yes</smbconfoption>
1295 <smbconfoption name="show add printer wizard">No</smbconfoption>
1296 <smbconfoption name="printing">cups</smbconfoption>
1298 <smbconfsection name="[files]"/>
1299 <smbconfoption name="comment">Work area files</smbconfoption>
1300 <smbconfoption name="path">/data/%U</smbconfoption>
1301 <smbconfoption name="read only">No</smbconfoption>
1303 <smbconfsection name="[master]"/>
1304 <smbconfoption name="comment">Master work area files</smbconfoption>
1305 <smbconfoption name="path">/data</smbconfoption>
1306 <smbconfoption name="valid users">alan</smbconfoption>
1307 <smbconfoption name="read only">No</smbconfoption>
1309 <smbconfsection name="[printers]"/>
1310 <smbconfoption name="comment">Print Temporary Spool Configuration</smbconfoption>
1311 <smbconfoption name="path">/var/spool/samba</smbconfoption>
1312 <smbconfoption name="printable">Yes</smbconfoption>
1313 <smbconfoption name="guest ok">Yes</smbconfoption>
1314 <smbconfoption name="use client driver">Yes</smbconfoption>
1315 <smbconfoption name="browseable">No</smbconfoption>
1324 <title>Questions and Answers</title>
1327 The following questions and answers draw from the examples in this chapter.
1328 Many design decisions are impacted by the configurations chosen. The intent
1329 is to expose some of the hidden implications.
1332 <qandaset defaultlabel="chap02qa">
1337 What makes an anonymous Samba server more simple than a non-anonymous Samba server?
1344 In the anonymous server, the only account used is the <constant>guest</constant> account.
1345 In a non-anonymous configuration, it is necessary to add real user accounts to both the
1346 UNIX system and to the Samba configuration. Non-anonymous servers require additional
1357 How is the operation of the parameter <parameter>force user</parameter> different from
1358 setting the root directory of the share SUID?
1365 The parameter <parameter>force user</parameter> causes all operations on the share to assume the UID
1366 of the forced user. The new default GID that applies is the primary GID of the forced user.
1367 This gives all users of this resource the actual privilege of the forced user.
1371 When a directory is set SUID, the operating system forces files that are written within it
1372 to be owned by the owner of the directory. While this happens, the user who is using the share
1373 has only the level of privilege he or she is assigned within the operating system context.
1377 The parameter <parameter>force user</parameter> has potential security implications that go
1378 beyond the actual share root directory. Be careful and wary of using this parameter.
1388 When would you both use the per share parameter <parameter>force user</parameter> and set
1389 the share root directory SUID?
1396 You would use both parameters when it is necessary to guarantee that all share handling operations
1397 are conducted as the forced user, while all file and directory creation are done as the SUID
1408 What is better about CUPS printing than LPRng printing?
1415 CUPS is a print spooling system that has integrated remote management facilities, provides completely
1416 automated print processing/preprocessing, and can be configured to automatically
1417 apply print preprocessing filters to ensure that a print job submitted is correctly rendered for the
1418 target printer. CUPS includes an image file RIP that supports printing of image files to
1419 non-PostScript printers. CUPS has lots of bells and whistles and is more like a supercharged MS Windows
1420 NT/200x print monitor and processor. Its complexity can be eliminated or turbocharged to suit
1425 The LPRng software is an enhanced, extended, and portable implementation of the Berkeley LPR print
1426 spooler functionality. It provides the same interface and meets RFC1179 requirements. LPRng can be
1427 configured to act like CUPS, but it is in principle a replacement for the old Berkeley lpr/lpd
1428 spooler. LPRng is generally preferred by those who are familiar with Berkeley lpr/lpd.
1432 Which spooling system is better is a matter of personal taste. It depends on what you want to do and how you want to
1433 do it and manage it. Most modern Linux systems ship with CUPS as the default print management system.
1443 When should Windows client IP addresses be hard-coded?
1450 When there are few MS Windows clients, little client change, no mobile users, and users are not
1451 inclined to tamper with network settings, it is a safe and convenient matter to hard-code Windows
1452 client TCP/IP settings. Given that it is possible to lock down the Windows desktop and remove
1453 user ability to access network configuration controls, fixed configuration eliminates the need
1454 for a DHCP server. This reduces maintenance overheads and eliminates a possible point of network
1465 Under what circumstances is it best to use a DHCP server?
1472 In network configurations where there are mobile users, or where Windows client PCs move around
1473 (particularly between offices or between subnets), it makes complete sense to control all Windows
1474 client configurations using a DHCP server. Additionally, when users do tamper with the network
1475 settings, DHCP can be used to normalize all client settings.
1479 One underappreciated benefit of using a DHCP server to assign all network client
1480 device TCP/IP settings is that it makes it a pain-free process to change network TCP/IP
1481 settings, change network addressing, or enhance the ability of client devices to
1482 benefit from new network services.
1486 Another benefit of modern DHCP servers is their ability to register dynamically
1487 assigned IP addresses with the DNS server. The benefits of Dynamic DNS (DDNS) are considerable in
1488 a large Windows network environment.
1498 What is the purpose of setting the parameter <parameter>guest ok</parameter> on a share?
1505 If this parameter is set to yes for a service, then no password is required to connect to the service.
1506 Privileges are those of the guest account.
1516 When would you set the global parameter <parameter>disable spoolss</parameter>?
1523 Setting this parameter to <constant>Yes</constant> disables Samba's support for the SPOOLSS set of
1524 MS-RPCs and yields behavior identical to Samba 2.0.x. Windows NT/2000 clients can downgrade to
1525 using LanMan style printing commands. Windows 9x/Me are unaffected by the parameter. However, this
1526 disables the ability to upload printer drivers to a Samba server via the Windows NT/200x Add Printer
1527 Wizard or by using the NT printer properties dialog window. It also disables the capability of
1528 Windows NT/200x clients to download print drivers from the Samba host on demand. Be extremely careful about
1529 setting this parameter.
1533 The alternate parameter <parameter>use client driver</parameter> applies only to Windows NT/200x clients. It has no
1534 effect on Windows 95/98/Me clients. When serving a printer to Windows NT/200x clients without first installing a valid
1535 printer driver on the Samba host, the client is required to install a local printer driver. From this point on,
1536 the client treats the printer as a local printer and not a network printer connection. This is much the same behavior
1537 that occurs when <parameter>disable spoolss = yes</parameter>.
1541 Under normal circumstances, the NT/200x client attempts to open the network printer using MS-RPC. Because the client
1542 considers the printer to be local, it attempts to issue the <parameter>OpenPrinterEx()</parameter> call requesting
1543 access rights associated with the logged on user. If the user possesses local administrator rights but not root
1544 privilege on the Samba host (often the case), the <parameter>OpenPrinterEx()</parameter> call fails. The result is
1545 that the client now displays an <quote>Access Denied; Unable to connect</quote> message in the printer queue window
1546 (even though jobs may be printed successfully). This parameter MUST not be enabled on a print share that has a valid
1547 print driver installed on the Samba server.
1557 Why would you disable password caching on Windows 9x/Me clients?
1564 Windows 9x/Me workstations that are set at default (password caching enabled) store the username and
1565 password in files located in the Windows master directory. Such files can be scavenged (read off a client
1566 machine) and decrypted, thus revealing the user's access credentials for all systems the user may have accessed.
1567 It is most insecure to allow any Windows 9x/Me client to operate with password caching enabled.
1577 The example of Abmas Accounting uses User Mode security. How does this provide anonymous access?
1584 The example used does not provide anonymous access. Since the clients are all Windows 2000 Professional,
1585 and given that users are logging onto their machines, by default the client attempts to connect to
1586 a remote server using currently logged in user credentials. By ensuring that the user's login ID and
1587 password are the same as those set on the Samba server, access is transparent and does not require
1588 separate user authentication.
git.samba.org / import / samba-docs-svnimport.git / blob