<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Small Office Networking</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.64.1"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="previous" href="simple.html" title="Chapter 2. No Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 4. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 3. Small Office Networking</h2></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id2515052">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2515076">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2515137">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2515193">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2515405">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2515426">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2517298">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2517971">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2517997">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2518074">Questions and Answers</a></span></dt></dl></div><p>
So far, this book has focused on the basics of simple yet effective
network solutions. Network administrators who take pride in their work
(that's most of us, right?) take care to deliver what our users want,
but not too much more. If we make things too complex, we confound our users and
increase costs of network ownership. A professional network manager
avoids the temptation to put too much pizazz into the way that the network
operates. Some creativity is helpful, but do keep it under control.
</p><p><a class="indexterm" name="id2514988"></a>
Five years ago there were two companies from which a lesson can be learned.
In one case the network administrator spent three months building a new
network to replace an old Netware server. What he delivered had all the
bells and whistles he could muster. There were a few teething problems
during the change-over, nothing serious but a little disruptive all the
same. Users were exposed to many changes at once. The network
administrator was asked to resign two months after implementing the
new system. This was necessary because so many staff had complained
they had lost time and were not happy with the new network.
Everything was automated and he delivered more features than any advanced
user could think of. He was just too smart for his own good.
</p><p>
In the case of the other company, a new network manager was appointed
to oversee the replacement of a LanTastic network with an MS Windows
NT 4.0 network. He had the replacement installed and operational within
two weeks. Before installation and change-over, he called a meeting to
explain to all users what was going to happen, how it would affect them
and that he would be available 24 hours a day to help them transition.
One week after conversion, he held another meeting asking for cooperation
in the introduction of a few new features that would help to make life
easier. Network users were thrilled with what he was doing to help
them. The network he implemented was nowhere near as complex as the first example, had fewer
features, and yet he had happy users. Months later he was still adding
new innovations. He always asked the users if a
particular feature was what they wanted. He asked his boss for a raise
and got it. He often told me, & sleeves for when you need them.</em></span></span>& get on with our next exercise.
</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2515052"></a>Introduction</h2></div></div><div></div></div><p>
Abmas Accounting Inc. has grown. Mr. Meany likes you and says he knew you
were the right person for the job. That's why he asked you to install the
new server. The past few months have been hard work. You advised Mr. Meany
that it is time for a change. Abmas now has 52 users, having acquired an
investment consulting business recently. The new users were added to the
network without any problems.
</p><p>
Some of the Windows clients are getting to be past their use-by date.
You have found damaged and unusable software on some of the workstations
that came with the acquired business and found some machines that are
in need of both hardware and software maintenance.
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2515076"></a>Assignment Tasks</h3></div></div><div></div></div><p>
<a class="indexterm" name="id2515084"></a>
Mr. Meany has decided to retire in 12 months. He wants you to help him
make the business run better. Many of the new staff want notebook computers.
They visit customer business premises with the need to use local network
facilities; these users are technically competent. The company uses a
business application that requires Windows XP Professional. In short, a
complete client upgrade is about to happen. Mr. Meany told you that he is working
on another business acquisition and that by the time he retires there will be
80 to 100 users.
</p><p>
Mr. Meany is not concerned about security. He wants to make it easier for
staff to do their work. He has hired you to help him appoint a full-time
network manager before he retires. Above all, he says he is investing in
the ability to grow. He is determined to live his lifelong dream and
hand the business over to a bright and capable executive who can make
things happen. This means your network design must cope well with
growth.
</p><p>
In a few months, Abmas will require an Internet connection for email
and so staff easily obtain software updates. Mr. Meany is warming up to the
installation of anti-virus software, but is not yet ready to approve
this expense. He told you to spend the money a virus scanner costs
on better quality notebook computers for mobile users.
</p><p>
One of Mr. Meany's golfing partners sold him on the idea to buy new laser
printers. One black only, the other a color laser printer. Staff support
the need for a color printer so they can present more attractive proposals
and reports.
</p><p>
Mr. Meany also asked if it would be possible for one of the staff to manage
user accounts from the Windows desktop. That person will be responsible for
basic operations.
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2515137"></a>Dissection and Discussion</h2></div></div><div></div></div><p>
What are the key requirements in this business example? A quick review indicates
a need for:
</p><div class="itemizedlist"><ul type="disc"><li><p>
Scalability from 52 to over 100 users in 12 months
</p></li><li><p>
Mobile computing capability
<a class="indexterm" name="id2515162"></a>
</p></li><li><p>
Improved reliability and usability
</p></li><li><p>
Easier administration
</p></li></ul></div><p>
In this instance the installed Linux system is assumed to be a Red Hat Linux 9.0 server
(as in <a href="simple.html#AccountingOffice" title="Accounting Office">???</a>).
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2515193"></a>Technical Issues</h3></div></div><div></div></div><p>
<a class="indexterm" name="id2515201"></a>
<a class="indexterm" name="id2515208"></a>
<a class="indexterm" name="id2515214"></a>
<a class="indexterm" name="id2515221"></a>
<a class="indexterm" name="id2515228"></a>
It is time to implement a domain security environment. You will use the <tt class="constant">
smbpasswd</tt> (default) backend. You should implement a DHCP server. There is no need to
run DNS at this time, but the system will use WINS. The Domain name will be <tt class="constant">
BILLMORE</tt>. This time, the name of the server will be <tt class="constant">SLEETH</tt>.
</p><p>
All printers will be configured as DHCP clients. The DHCP server will assign
the printer a fixed IP address by way of its Ethernet interface (MAC) address.
See <a href="small.html#dhcp01" title="Example 3.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">???</a>.
</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
The <tt class="filename">smb.conf</tt> file you are creating in this exercise can be used with equal effectiveness
with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is
possible to start with the installation that you have created here, migrate it
to a Samba-3 configuration and then secure the system further. Configurations following
this one will utilize features that may not be supported in Samba-2.2.x releases.
However, you should note that the examples in each chapter start with the assumption
that a fresh new installation is being effected.
</p></div><p>
Later on, when the Internet connection is implemented, you will add DNS as well as
other enhancements. It is important that you plan accordingly.
</p><p>
<a class="indexterm" name="id2515292"></a>
You have split the network into two separate areas. Each has its own ether-switch.
There are 20 users on the accounting network and 32 users on the financial services
network. The server has two network interfaces, one serving each network. The
network printers will be located in a central area. You plan to install the new
printers and keep the old printer in use also.
</p><p>
You will provide separate file storage areas for each business entity. The old system
will go away, accounting files will be handled under a single directory, and files will
be stored under customer name, not under a personal work area. Staff will be made
responsible for file location, so maintain the old share point.
</p><p>
Given that DNS will not be used, you will configure WINS name resolution for UNIX
hostname name resolution.
</p><p>
<a class="indexterm" name="id2515322"></a>
<a class="indexterm" name="id2515332"></a>
It is necessary to map Windows Domain Groups to UNIX groups as a minimum. It is
advisable to also map Windows Local Groups to UNIX groups. Additionally, the two
key staff groups in the firm are Accounting Staff and Financial Services Staff.
For these, it is necessary to create UNIX groups as well as Windows Domain Groups.
</p><p>
In the sample <tt class="filename">smb.conf</tt> file, you have configured Samba to call the UNIX <span><b class="command">groupadd</b></span>
to add group entries. This utility does not permit the addition of group names that
contain upper-case characters or spaces. This is considered a bug. The <span><b class="command">groupadd</b></span>
is part of the <span><b class="command">shadow-utils</b></span> Open Source Software package.
A later release of this package may have been patched to resolve this bug.
If your operating platform has this bug, it means that attempts to add a Windows Domain
Group that has either a space or upper-case characters in it will fail. See <span class="emphasis"><em>TOSHARG</em></span>, Section 11.3.1,
Example 11.1, for more information.
</p><p>
<a class="indexterm" name="id2515390"></a>
Vendor-supplied printer drivers will be installed on each client. The CUPS print spooler
on the UNIX host will be operated in <tt class="constant">raw</tt> mode.
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2515405"></a>Political Issues</h3></div></div><div></div></div><p>
Mr. Meany is an old-school manager. He sets the rules and wants to see compliance.
He is willing to spend money on things he believes are of value. You need more
time to convince him of real priorities.
</p><p>
Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be
supplied with anti-virus software? Above all, demonstrate good purchase value and remember
to make your users happy.
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2515426"></a>Implementation</h2></div></div><div></div></div><p><a class="indexterm" name="id2515433"></a>
In this example, the assumption is made that this server is being configured from a clean start.
The alternate approach could be to demonstrate the migration of the system that is documented
in <a href="simple.html#AcctgNet" title="Implementation">???</a> to meet the new requirements. The decision to treat this case, as with
future examples, as a new installation is based on the premise that you can determine
the migration steps from the information provided in the separate chapter on this subject.
Additionally, a fresh installation makes the example easier to follow.
</p><p><a class="indexterm" name="id2515459"></a>
Each user will be given a home directory on the UNIX system, which will be available as a private
share. Two additional shares will be created, one for the Accounting Department and the other for
the Financial Services Department. Network users will be given access to these shares by way
of group membership.
</p><p>
<a class="indexterm" name="id2515477"></a>
UNIX group membership is the primary mechanism by which Windows Domain users will be granted
rights and privileges within the Windows environment.
</p><p><a class="indexterm" name="id2515491"></a>
The user <span><b class="command">alanm</b></span> will be made the owner of all files. This will be preserved
by setting the sticky bit (set UID/GID) on the top-level directories.
</p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure 3.1. Abmas Accounting 52 User Network Topology</b></p><div class="mediaobject"><img src="images/acct2net.png" width="351" alt="Abmas Accounting 52 User Network Topology"></div></div><div class="procedure"><ol type="1"><li><p>
Using UNIX/Linux system tools, name the server <tt class="constant">sleeth</tt>.
</p></li><li><p>
<a class="indexterm" name="id2515570"></a>
Place an entry for the machine <tt class="constant">sleeth</tt> in the <tt class="filename">/etc/hosts</tt>.
The printers are network attached, so it is desirable that there should be entries for the
network printers also. An example <tt class="filename">/etc/hosts</tt> file is shown here:
</p><pre class="screen">
192.168.1.1 sleeth sleeth1
192.168.2.1 sleeth2
192.168.1.10 hplj6
192.168.1.11 hplj4
192.168.2.10 qms
</pre><p>
</p></li><li><p>
Install the Samba-3 binary RPM from the Samba-Team FTP site.
</p></li><li><p>
Install the ISC DHCP server using the UNIX/Linux system tools available to you.
</p></li><li><p><a class="indexterm" name="id2515625"></a><a class="indexterm" name="id2515633"></a><a class="indexterm" name="id2515641"></a><a class="indexterm" name="id2515648"></a>
Given that Samba will be operating over two network interfaces and clients on each side
may want to be able to reach clients on the other side, it is imperative that IP forwarding
shall be enabled. Use the system tool of your choice to enable IP forwarding. In the
absence of such a tool on the Linux system, add to the <tt class="filename">/etc/rc.d/rc.local</tt>
file an entry as follows:
</p><pre class="screen">
echo 1 > /proc/sys/net/ipv4/ip_forward
</pre><p>
This causes the Linux kernel to forward IP packets so that it acts as a router.
</p></li><li><p>
Install the <tt class="filename">smb.conf</tt> file as shown in <a href="small.html#acct2conf" title="Example 3.3. Accounting Office Network smb.conf File [globals] Section">???</a> and
<a href="small.html#acct3conf" title="Example 3.4. Accounting Office Network smb.conf File Services and Shares Section">???</a>. Combine these two examples to form a single
<tt class="filename">/etc/samba/smb.conf</tt> file.
</p></li><li><p><a class="indexterm" name="id2515717"></a>
Add the user <span><b class="command">root</b></span> to the Samba password backend:
</p><pre class="screen">
<tt class="prompt">rootNew SMB password: XXXXXXX
Retype new SMB password: XXXXXXX
<tt class="prompt">root</pre><p>
<a class="indexterm" name="id2515751"></a>
This is the Windows Domain Administrator password. Never delete this account from
the password backend after Windows Domain Groups have been initialized. If you delete
this account, your system is crippled. You cannot restore this account
and your Samba server is no longer capable of being administered.
</p></li><li><p>
<a class="indexterm" name="id2515770"></a>
Create the username map file to permit the <tt class="constant">root</tt> account to be called
<tt class="constant">Administrator</tt> from the Windows network environment. To do this, create
the file <tt class="filename">/etc/samba/smbusers</tt> with the following contents:
</p><pre class="screen">
root = Administrator
</pre><p>
</p></li><li><p>
<a class="indexterm" name="id2515814"></a>
Create and map Windows Domain Groups to UNIX groups. A sample script is provided in
<a href="small.html#initGrps" title="Example 3.1. Script to Map Windows NT Groups to UNIX Groups">???</a>. Create a file containing this script. We called ours
<tt class="filename">/etc/samba/initGrps.sh</tt>. Set this file so it can be executed,
and then execute the script. Sample output should be as follows:
</p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 3.1. Script to Map Windows NT Groups to UNIX Groups</b></p><a class="indexterm" name="id2515847"></a><pre class="screen">
#!/bin/bash
groupadd acctsdep
groupadd finsrvcs
net groupmap modify ntgroup="Domain Admins" unixgroup=root
net groupmap modify ntgroup="Domain Users" unixgroup=users
net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
</pre></div><p>
</p><pre class="screen">
<tt class="prompt">root<tt class="prompt">root<tt class="prompt">rootUpdated mapping entry for Domain Admins
Updated mapping entry for Domain Users
Updated mapping entry for Domain Guests
No rid or sid specified, choosing algorithmic mapping
Successfully added group Accounts Dept to the mapping db
No rid or sid specified, choosing algorithmic mapping
Successfully added group Domain Guests to the mapping db
<tt class="prompt">root<tt class="prompt">rootAccount Operators (S-1-5-32-548) -> -1
Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep
Administrators (S-1-5-32-544) -> -1
Backup Operators (S-1-5-32-551) -> -1
Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root
Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody
Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users
Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs
Guests (S-1-5-32-546) -> -1
Power Users (S-1-5-32-547) -> -1
Print Operators (S-1-5-32-550) -> -1
Replicators (S-1-5-32-552) -> -1
System Operators (S-1-5-32-549) -> -1
Users (S-1-5-32-545) -> -1
</pre><p>
</p></li><li><p>
<a class="indexterm" name="id2515936"></a>
<a class="indexterm" name="id2515943"></a>
<a class="indexterm" name="id2515952"></a>
For each user who needs to be given a Windows Domain account, make an entry in the
<tt class="filename">/etc/passwd</tt> file as well as in the Samba password backend.
Use the system tool of your choice to create the UNIX system accounts and use the Samba
<span><b class="command">smbpasswd</b></span> program to create the Domain user accounts.
</p><p>
<a class="indexterm" name="id2515979"></a>
<a class="indexterm" name="id2515986"></a>
<a class="indexterm" name="id2515992"></a>
There are a number of tools for user management under UNIX. Commonly known ones include:
<span><b class="command">useradd</b></span>, <span><b class="command">adduser</b></span>. In addition to these, there are a plethora of custom
tools. With the tool of your choice, create a home directory for each user.
</p></li><li><p>
Using the preferred tool for your UNIX system, add each user to the UNIX groups created
previously as necessary. File system access control will be based on UNIX group membership.
</p></li><li><p>
Create the directory mount point for the disk sub-system that is mounted to provide
data storage for company files. In this case the mount point indicated in the <tt class="filename">smb.conf</tt>
file is <tt class="filename">/data</tt>. Format the file system as required, mount the formatted
file system partition using <span><b class="command">mount</b></span>,
and make the appropriate changes in <tt class="filename">/etc/fstab</tt>.
</p></li><li><p>
Create the top-level file storage directories are follows:
</p><pre class="screen">
<tt class="prompt">root<tt class="prompt">root<tt class="prompt">root<tt class="prompt">root<tt class="prompt">root</pre><p>
Each department is responsible for creating its own directory structure within its
share. The directory root of the <span><b class="command">accounts</b></span> share is <tt class="filename">/data/accounts</tt>.
The directory root of the <span><b class="command">finsvcs</b></span> share is <tt class="filename">/data/finsvcs</tt>.
</p></li><li><p>
Configure the printers with the IP addresses as shown in <a href="small.html#acct2net" title="Figure 3.1. Abmas Accounting 52 User Network Topology">???</a>.
Follow the instructions in the manufacturers' manuals to permit printing to port 9100.
This allows the CUPS spooler to print using raw mode protocols.
<a class="indexterm" name="id2516151"></a>
<a class="indexterm" name="id2516158"></a>
</p></li><li><p>
<a class="indexterm" name="id2516171"></a><a class="indexterm" name="id2516180"></a>
Configure the CUPS Print Queues as follows:
</p><pre class="screen">
<tt class="prompt">root<tt class="prompt">root<tt class="prompt">root</pre><p>
<a class="indexterm" name="id2516215"></a>
This creates the necessary print queues with no assigned print filter.
</p></li><li><p>
<a class="indexterm" name="id2516230"></a>
<a class="indexterm" name="id2516237"></a>
<a class="indexterm" name="id2516244"></a>
Edit the file <tt class="filename">/etc/cups/mime.convs</tt> to uncomment the line:
</p><pre class="screen">
application/octet-stream application/vnd.cups-raw 0 -
</pre><p>
</p></li><li><p>
<a class="indexterm" name="id2516271"></a>
Edit the file <tt class="filename">/etc/cups/mime.types</tt> to uncomment the line:
</p><pre class="screen">
application/octet-stream
</pre><p>
</p></li><li><p><a class="indexterm" name="id2516297"></a>
Using your favorite system editor, create an <tt class="filename">/etc/dhcpd.conf</tt> with the
contents as shown in <a href="small.html#dhcp01" title="Example 3.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">???</a>.
</p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 3.2. Abmas Accounting DHCP Server Configuration File <tt class="filename">/etc/dhcpd.conf</tt></b></p><a class="indexterm" name="id2516335"></a><pre class="screen">
default-lease-time 86400;
max-lease-time 172800;
default-lease-time 86400;
option ntp-servers 192.168.1.1;
option domain-name "abmas.biz";
option domain-name-servers 192.168.1.1, 192.168.2.1;
option netbios-name-servers 192.168.1.1, 192.168.2.1;
option netbios-node-type 8;
subnet 192.168.1.0 netmask 255.255.255.0 {
range dynamic-bootp 192.168.1.128 192.168.1.254;
option subnet-mask 255.255.255.0;
option routers 192.168.1.1;
allow unknown-clients;
host hplj4 {
hardware ethernet 08:00:46:7a:35:e4;
fixed-address 192.168.1.10;
}
host hplj6 {
hardware ethernet 00:03:47:cb:81:e0;
fixed-address 192.168.1.11;
}
}
subnet 192.168.2.0 netmask 255.255.255.0 {
range dynamic-bootp 192.168.2.128 192.168.2.254;
option subnet-mask 255.255.255.0;
option routers 192.168.2.1;
allow unknown-clients;
host qms {
hardware ethernet 01:04:31:db:e1:c0;
fixed-address 192.168.1.10;
}
}
subnet 127.0.0.0 netmask 255.0.0.0 {
}
</pre></div><p>
</p></li><li><p>
Use the standard system tool to start Samba and CUPS and configure them to start
automatically at every system reboot. For example:
</p><p>
<a class="indexterm" name="id2516381"></a>
<a class="indexterm" name="id2516388"></a>
<a class="indexterm" name="id2516395"></a>
<a class="indexterm" name="id2516402"></a><a class="indexterm" name="id2516408"></a>
</p><pre class="screen">
<tt class="prompt">root<tt class="prompt">root<tt class="prompt">root<tt class="prompt">root<tt class="prompt">root<tt class="prompt">root</pre><p>
</p></li><li><p>
<a class="indexterm" name="id2516466"></a>
<a class="indexterm" name="id2516473"></a>
<a class="indexterm" name="id2516482"></a><a class="indexterm" name="id2516488"></a>
<a class="indexterm" name="id2516497"></a>
<a class="indexterm" name="id2516503"></a>
Configure the Name Service Switch (NSS) to handle WINS based name resolution.
Since this system does not use a DNS server, it is safe to remove this option from
the NSS configuration. Edit the <tt class="filename">/etc/nsswitch.conf</tt> file so that
the <tt class="constant">hosts:</tt> entry looks like this:
</p><pre class="screen">
hosts: files wins
</pre><p>
</p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 3.3. Accounting Office Network smb.conf File [globals] Section</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td>
workgroup = BILLMORE</tt></i></td></tr><tr><td><a class="indexterm" name="id2516576"></a><i class="parameter"><tt>
passwd chat = *New*Password* \</tt></i></td></tr><tr><td><i class="parameter"><tt>%n\n*Re-enter*new*password* %n\n *Password*changed*</tt></i></td></tr><tr><td><a class="indexterm" name="id2516600"></a><i class="parameter"><tt>
username map = /etc/samba/smbusers</tt></i></td></tr><tr><td><a class="indexterm" name="id2516616"></a><i class="parameter"><tt>
syslog = 0</tt></i></td></tr><tr><td><a class="indexterm" name="id2516632"></a><i class="parameter"><tt>
name resolve order = wins bcast hosts</tt></i></td></tr><tr><td><a class="indexterm" name="id2516648"></a><i class="parameter"><tt>
printcap name = CUPS</tt></i></td></tr><tr><td><a class="indexterm" name="id2516663"></a><i class="parameter"><tt>
show add printer wizard = No</tt></i></td></tr><tr><td><a class="indexterm" name="id2516679"></a><i class="parameter"><tt>
add user script = /usr/sbin/useradd -m '%u'</tt></i></td></tr><tr><td><a class="indexterm" name="id2516696"></a><i class="parameter"><tt>
delete user script = /usr/sbin/userdel -r '%u'</tt></i></td></tr><tr><td><a class="indexterm" name="id2516712"></a><i class="parameter"><tt>
add group script = /usr/sbin/groupadd '%g'</tt></i></td></tr><tr><td><a class="indexterm" name="id2516728"></a><i class="parameter"><tt>
delete group script = /usr/sbin/groupdel '%g'</tt></i></td></tr><tr><td><a class="indexterm" name="id2516744"></a><i class="parameter"><tt>
add user to group script = /usr/sbin/usermod -G '%g' '%u'</tt></i></td></tr><tr><td><a class="indexterm" name="id2516761"></a><i class="parameter"><tt>
add machine script = /usr/sbin/useradd \</tt></i></td></tr><tr><td><i class="parameter"><tt>-s /bin/false -d /dev/null '%u'</tt></i></td></tr><tr><td><a class="indexterm" name="id2516784"></a><i class="parameter"><tt>
logon script = scripts\login.bat</tt></i></td></tr><tr><td><a class="indexterm" name="id2516800"></a><i class="parameter"><tt>
logon path = </tt></i></td></tr><tr><td><a class="indexterm" name="id2516816"></a><i class="parameter"><tt>
logon drive = X:</tt></i></td></tr><tr><td><a class="indexterm" name="id2516831"></a><i class="parameter"><tt>
domain logons = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2516847"></a><i class="parameter"><tt>
preferred master = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2516863"></a><i class="parameter"><tt>
wins support = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2516879"></a><i class="parameter"><tt>
printing = CUPS</tt></i></td></tr></table></div><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 3.4. Accounting Office Network smb.conf File Services and Shares Section</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><i class="parameter"><tt>[homes]</tt></i></td></tr><tr><td><a class="indexterm" name="id2516917"></a><i class="parameter"><tt>
comment = Home Directories</tt></i></td></tr><tr><td><a class="indexterm" name="id2516932"></a><i class="parameter"><tt>
valid users = %S</tt></i></td></tr><tr><td><a class="indexterm" name="id2516948"></a><i class="parameter"><tt>
read only = No</tt></i></td></tr><tr><td><a class="indexterm" name="id2516964"></a><i class="parameter"><tt>
browseable = No</tt></i></td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[printers]</tt></i></td></tr><tr><td><a class="indexterm" name="id2516988"></a><i class="parameter"><tt>
comment = SMB Print Spool</tt></i></td></tr><tr><td><a class="indexterm" name="id2517004"></a><i class="parameter"><tt>
path = /var/spool/samba</tt></i></td></tr><tr><td><a class="indexterm" name="id2517020"></a><i class="parameter"><tt>
printable = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2517036"></a><i class="parameter"><tt>
guest ok = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2517051"></a><i class="parameter"><tt>
use client driver = Yes</tt></i></td></tr><tr><td><a class="indexterm" name="id2517067"></a><i class="parameter"><tt>
browseable = No</tt></i></td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[netlogon]</tt></i></td></tr><tr><td><a class="indexterm" name="id2517092"></a><i class="parameter"><tt>
comment = Network Logon Service</tt></i></td></tr><tr><td><a class="indexterm" name="id2517108"></a><i class="parameter"><tt>
path = /data/%U</tt></i></td></tr><tr><td><a class="indexterm" name="id2517123"></a><i class="parameter"><tt>
valid users = %S</tt></i></td></tr><tr><td><a class="indexterm" name="id2517139"></a><i class="parameter"><tt>
read only = No</tt></i></td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[accounts]</tt></i></td></tr><tr><td><a class="indexterm" name="id2517163"></a><i class="parameter"><tt>
comment = Accounting Files</tt></i></td></tr><tr><td><a class="indexterm" name="id2517179"></a><i class="parameter"><tt>
path = /data/accounts</tt></i></td></tr><tr><td><a class="indexterm" name="id2517195"></a><i class="parameter"><tt>
valid users = %G</tt></i></td></tr><tr><td><a class="indexterm" name="id2517211"></a><i class="parameter"><tt>
read only = No</tt></i></td></tr><tr><td> </td></tr><tr><td><i class="parameter"><tt>[finsvcs]</tt></i></td></tr><tr><td><a class="indexterm" name="id2517235"></a><i class="parameter"><tt>
comment = Financial Service Files</tt></i></td></tr><tr><td><a class="indexterm" name="id2517252"></a><i class="parameter"><tt>
path = /data/finsvcs</tt></i></td></tr><tr><td><a class="indexterm" name="id2517267"></a><i class="parameter"><tt>
valid users = %G</tt></i></td></tr><tr><td><a class="indexterm" name="id2517282"></a><i class="parameter"><tt>
read only = No</tt></i></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2517298"></a>Validation</h3></div></div><div></div></div><p>
Does everything function as it ought? That is the key question at this point.
Here are some simple steps to validate your Samba server configuration.
</p><div class="procedure"><ol type="1"><li><p><a class="indexterm" name="id2517316"></a>
If your <tt class="filename">smb.conf</tt> file has bogus options or parameters, this may cause Samba
to refuse to start. The first step should always be to validate the contents
of this file by running:
</p><pre class="screen">
<tt class="prompt">rootLoad smb config files from smb.conf
Processing section "[homes]"
Processing section "[printers]"
Processing section "[netlogon]"
Processing section "[accounts]"
Processing section "[service]"
Loaded services file OK.
[global]
workgroup = BILLMORE
passwd chat = *New*Password* \
%n\n *Re-enter*new*password* %n\n *Password*changed*
username map = /etc/samba/smbusers
syslog = 0
name resolve order = wins bcast hosts
printcap name = CUPS
show add printer wizard = No
add user script = /usr/sbin/useradd -m '%u'
delete user script = /usr/sbin/userdel -r '%u'
add group script = /usr/sbin/groupadd '%g'
delete group script = /usr/sbin/groupdel '%g'
add user to group script = /usr/sbin/usermod -G '%g' '%u'
add machine script = /usr/sbin/useradd
-s /bin/false -d /dev/null '%u'
logon script = scripts\logon.bat
logon path =
logon drive = X:
domain logons = Yes
preferred master = Yes
wins support = Yes
printing = cups
...
</pre><p>
The inclusion of an invalid parameter (say one called dogbert) would generate an
error as follows:
</p><pre class="screen">
Unknown parameter encountered: "dogbert"
Ignoring unknown parameter "dogbert"
</pre><p>
Clear away all errors before proceeding and start or restart samba as necessary.
</p></li><li><p>
<a class="indexterm" name="id2517382"></a><a class="indexterm" name="id2517388"></a><a class="indexterm" name="id2517396"></a><a class="indexterm" name="id2517404"></a>
Check that the Samba server is running:
</p><pre class="screen">
<tt class="prompt">root14244 ? S 0:00 /usr/sbin/nmbd -D
14245 ? S 0:00 /usr/sbin/nmbd -D
14290 ? S 0:00 /usr/sbin/smbd -D
$rootprompt; ps ax | grep winbind
14293 ? S 0:00 /usr/sbin/winbindd -B
14295 ? S 0:00 /usr/sbin/winbindd -B
</pre><p>
The <span><b class="command">winbindd</b></span> daemon is running in split mode (normal) so there are also
two instances of it. For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG</em></span>, Chapter 20,
Section 20.3. The single instance of <span><b class="command">smbd</b></span> is normal.
</p></li><li><p>
<a class="indexterm" name="id2517456"></a>
Check that an anonymous connection can be made to the Samba server:
</p><pre class="screen">
<tt class="prompt">root
Sharename Type Comment
--------- ---- -------
netlogon Disk Network Logon Service
accounts Disk Accounting Files
finsvcs Disk Financial Service Files
IPC$ IPC IPC Service (Samba3)
ADMIN$ IPC IPC Service (Samba3)
hplj4 Printer Hewlett-Packard LaserJet 4
hplj6 Printer Hewlett-Packard LaserJet 6
qms Printer QMS Magicolor Laser Printer XXXX
Server Comment
--------- -------
SLEETH Samba 3.0.2
Workgroup Master
--------- -------
BILLMORE SLEETH
</pre><p>
This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
of browsing the server from a Windows client to obtain a list of shares on the server.
The <tt class="constant">-U%</tt> argument means, send a "<tt class="constant">NULL</tt> username and
a <tt class="constant">NULL</tt> password."
</p></li><li><p>
<a class="indexterm" name="id2517510"></a>
<a class="indexterm" name="id2517517"></a><a class="indexterm" name="id2517523"></a>
Verify that the printers have the IP addresses assigned in the DHCP server configuration file.
The easiest way to do this is to ping the printer name. Immediately after the ping response
has been received, execute <span><b class="command">arp -a</b></span> to find the MAC address of the printer
that has responded. Now you can compare the IP address and the MAC address of the printer
with the configuration information in the <tt class="filename">/etc/dhcpd.conf</tt> file. They
should, of course, match. For example:
</p><pre class="screen">
<tt class="prompt">rootPING hplj4 (192.168.1.11) 56(84) bytes of data.
64 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms
<tt class="prompt">roothplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0
</pre><p>
The MAC address <tt class="constant">08:00:46:7A:35:E4</tt> matches that specified for the
IP address from which the printer has responded and with the entry for it in the
<tt class="filename">/etc/dhcpd.conf</tt> file.
</p></li><li><p>
<a class="indexterm" name="id2517591"></a>
Make an authenticated connection to the server using the <span><b class="command">smbclient</b></span> tool:
</p><pre class="screen">
<tt class="prompt">rootPassword: XXXXXXX
smb: \> dir
. D 0 Sun Nov 9 01:28:34 2003
.. D 0 Sat Aug 16 17:24:26 2003
.mc DH 0 Sat Nov 8 21:57:38 2003
.qt DH 0 Fri Sep 5 00:48:25 2003
SMB D 0 Sun Oct 19 23:04:30 2003
Documents D 0 Sat Nov 1 00:31:51 2003
xpsp1a_en_x86.exe 131170400 Sun Nov 2 01:25:44 2003
65387 blocks of size 65536. 28590 blocks available
smb: \> q
</pre><p>
</p></li></ol></div></div><div class="procedure"><p class="title"><b>Procedure 3.3. Windows XP Professional Client Configuration</b></p><ol type="1"><li><p>
Configure clients to the network settings shown in <a href="small.html#acct2net" title="Figure 3.1. Abmas Accounting 52 User Network Topology">???</a>.
All clients use DHCP for TCP/IP protocol stack configuration.
<a class="indexterm" name="id2517662"></a>
<a class="indexterm" name="id2517669"></a>
DHCP configures all Windows clients to use the WINS Server address <tt class="constant">192.168.1.1</tt>.
</p></li><li><p>
Join the Windows Domain called <tt class="constant">BILLMORE</tt>. Use the Domain Administrator
user name <tt class="constant">root</tt> and the SMB password you assigned to this account.
A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
a Windows Domain is given in <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>.
Reboot the machine as prompted and then logon using a Domain User account.
</p></li><li><p>
Verify on each client that the machine called <tt class="constant">SLEETH</tt>
is visible in <span class="guimenu">My Network Places</span>, that it is
possible to connect to it and see the shares <span class="guimenuitem">accounts</span>
and <span class="guimenuitem">finsvcs</span>,
and that it is possible to open that share to reveal its contents.
</p></li><li><p>
Instruct all users to log onto the workstation using their assigned user name and password.
</p></li><li><p>
Install a printer on each using the following steps:
</p><div class="procedure"><ol type="1"><li><p>
Click <span class="guimenu">Start</span>-><span class="guimenuitem">Settings</span>-><span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>.
Ensure that <span class="guimenuitem">Local printer</span> is selected.
</p></li><li><p>
Click <span class="guibutton">Next</span>. In the panel labeled
<span class="guimenuitem">Manufacturer:</span>, select <tt class="constant">HP</tt>.
In the <span class="guimenuitem">Printers:</span> panel, select the printer called
<tt class="constant">HP LaserJet 4</tt>. Click <span class="guibutton">Next</span>.
</p></li><li><p>
In the panel labeled <span class="guimenuitem">Available ports:</span>, select
<tt class="constant">FILE:</tt>. Accept the default printer name by clicking
<span class="guibutton">Next</span>. When asked, & test page?</em></span></span>& <span class="guibutton">Finish</span>.
</p></li><li><p>
You may be prompted for the name of a file to print to. If so, close the
dialog panel. Right-click <span class="guiicon">HP LaserJet 4</span>-><span class="guimenuitem">Properties</span>.
</p></li><li><p>
In the panel labeled <span class="guimenuitem">Network</span>, enter the name of
the print queue on the Samba server as follows: <tt class="constant">\\SERVER\hplj4</tt>.
Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation.
</p></li><li><p>
Repeat the printer installation steps above for the HP LaserJet 6 printer
as well as for the QMS Magicolor XXXX laser printer.
</p></li></ol></div><p>
</p></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2517971"></a>Notebook Computers: A Special Case</h3></div></div><div></div></div><p>
As a network administrator, you already know how to create local machine accounts for Windows 200x/XP
Professional systems. This is the preferred solution to provide continuity of work for notebook users
so that absence from the office network environment does not become a barrier to productivity.
</p><p>
By creating a local machine account that has the same user name and password as you create for that
user in the Windows Domain environment, the user can log onto the machine locally and still
transparently access network resources as if logged onto the domain itself. There are some trade-offs
that mean that as the network is more tightly secured it becomes necessary to modify Windows client
configuration somewhat.
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2517997"></a>Key Points Learned</h3></div></div><div></div></div><p>
In this network design and implementation exercise, you have created a Windows NT4 style Domain
Controller using Samba-3.0.2. As a result of following these guidelines meant that you experienced
and implemented several important aspects of Windows networking. In the next chapter of this book,
you build on the experience gained. These are the highlights from this chapter:
</p><div class="itemizedlist"><ul type="disc"><li><p>
<a class="indexterm" name="id2518018"></a>
You implemented a DHCP Server and Microsoft Windows clients were able to obtain all necessary
network configuration settings from this server.
</p></li><li><p>
<a class="indexterm" name="id2518031"></a>
You created a Windows Domain Controller. You were able to use the network logon service
and successfully joined Windows 200x/XP Professional clients to the Domain.
</p></li><li><p>
<a class="indexterm" name="id2518046"></a>
You created raw print queues in the CUPS printing system. You maintained a simple
printing system so that all users can share centrally managed printers. You installed
native printer drivers on the Windows clients.
</p></li><li><p>
You experienced the benefits of centrally managed user accounts on the server.
</p></li><li><p>
You offered Mobile notebook users a solution that allows them to continue to work
while away from the office and not connected to the corporate network.
</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2518074"></a>Questions and Answers</h2></div></div><div></div></div><p>
Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that
may help.
</p><div class="qandaset"><dl><dt> <a href="small.html#id2518092">
What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
</a></dt><dt> <a href="small.html#id2518118">
Are there any DHCP server configuration parameters in the /etc/dhcpd.conf
that should be noted in particular?
</a></dt><dt> <a href="small.html#id2518150">
Is it possible to create a Windows Domain account that is specifically called Administrator?
</a></dt><dt> <a href="small.html#id2518189">
Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0?
</a></dt><dt> <a href="small.html#id2518231">
One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
root access. How can we do this?
</a></dt><dt> <a href="small.html#id2518272">
Why must I map Windows Domain Groups to UNIX groups?
</a></dt><dt> <a href="small.html#id2518300">
I deleted my root account and now I cannot add it back! What can I do?
</a></dt><dt> <a href="small.html#id2518372">
When I run net groupmap list, it reports a group called Administrators
as well as Domain Admins. What is the difference between them?
</a></dt><dt> <a href="small.html#id2518421">
What is the effect of changing the name of a Samba server, or of changing the Domain name?
</a></dt><dt> <a href="small.html#id2518473">
How can I manage user accounts from my Windows XP Professional workstation?
</a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2518092"></a><a name="id2518094"></a><b></b></td><td align="left" valign="top"><p>
What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
First and foremost, portability. It means that notebook users can move between
the Abmas office and client offices (so long as they, too, use DHCP) without having to manually
reconfigure their machines. It also means that when they work from their home environments
either using DHCP assigned addressing or when using dial-up networking, settings such as
default routes and DNS server addresses that apply only to the Abmas office environment do
not interfere with remote operations. This is an extremely important feature of DHCP.
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2518118"></a><a name="id2518121"></a><b></b></td><td align="left" valign="top"><p>
Are there any DHCP server configuration parameters in the <tt class="filename">/etc/dhcpd.conf</tt>
that should be noted in particular?
</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
Yes. The configuration you created automatically provides each client with the IP address
of your WINS server. It also configures the client to preferentially register NetBIOS names
with the WINS server, and then instructs the client to first query the WINS server when a
NetBIOS machine name needs to be resolved to an IP Address. This means that this configuration
results in far lower UDP broadcast traffic than would be the case if WINS was not used.
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2518150"></a><a name="id2518152"></a><b></b></td><td align="left" valign="top"><p>
Is it possible to create a Windows Domain account that is specifically called <tt class="constant">Administrator</tt>?
</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
You can surely create a Windows Domain Account called <tt class="constant">Administrator</tt>. It is also
possible to map that account so that it has the effective UNIX UID of 0. This way it isn't
necessary to use the <i class="parameter"><tt>username map</tt></i> facility to map this account to the UNIX
account called <tt class="constant">root</tt>.
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2518189"></a><a name="id2518191"></a><b></b></td><td align="left" valign="top"><p>
Why is it necessary to give the Windows Domain <tt class="constant">Administrator</tt> a UNIX UID of 0?
</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
The Windows Domain <tt class="constant">Administrator</tt> account is the most privileged account that
exists on the Windows platform. This user can change any setting, add/delete or modify user
accounts, and completely reconfigure the system. The equivalent to this account in the UNIX
environment is the <tt class="constant">root</tt> account. If you want to permit the Windows Domain
Administrator to manage accounts, as well as permissions, privileges, and security
settings within the Domain and on the Samba server, equivalent rights must be assigned. This is
achieved with the <tt class="constant">root</tt> UID equal to 0.
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2518231"></a><a name="id2518233"></a><b></b></td><td align="left" valign="top"><p>
One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
<tt class="constant">root</tt> access. How can we do this?
</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
Users who are members of the <tt class="constant">Domain Admins</tt> group can add machines to the
Domain. This group is mapped to the UNIX group account called <tt class="constant">root</tt>
(or equivalent on <tt class="constant">wheel</tt> on some UNIX systems) that has a GID of 0.
This must be the primary GID of the account of the user who is a member of the Windows <tt class="constant">
Domain Admins</tt> account.
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2518272"></a><a name="id2518275"></a><b></b></td><td align="left" valign="top"><p>
Why must I map Windows Domain Groups to UNIX groups?
</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are:
<span class="guimenu">Domain Guests, Domain Users, Domain Admins</span>.
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2518300"></a><a name="id2518302"></a><b></b></td><td align="left" valign="top"><p>
I deleted my <tt class="constant">root</tt> account and now I cannot add it back! What can I do?
</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
This is a nasty problem. Fortunately, here is a solution.
</p><div class="procedure"><ol type="1"><li><p>
Back up your existing configuration files in case you need to restore them.
</p></li><li><p>
Rename the <tt class="filename">group_mapping.tdb</tt> file.
</p></li><li><p>
Use the <span><b class="command">smbpasswd</b></span> to add the root account.
</p></li><li><p>
Restore the <tt class="filename">group_mapping.tdb</tt> file.
</p></li></ol></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id2518372"></a><a name="id2518375"></a><b></b></td><td align="left" valign="top"><p>
When I run <span><b class="command">net groupmap list</b></span>, it reports a group called <span class="guimenu">Administrators</span>
as well as <span class="guimenu">Domain Admins</span>. What is the difference between them?
</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
The group called <span class="guimenu">Administrators</span> is representative of the same account that would be
present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain
Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This
may change at some later date. These accounts are provided only so that security objects are correctly shown.
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2518421"></a><a name="id2518423"></a><b></b></td><td align="left" valign="top"><p>
What is the effect of changing the name of a Samba server, or of changing the Domain name?
</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
In the event that you elect to change the name of the Samba server, on restarting <span><b class="command">smbd</b></span>,
Windows security identifiers are changed. In the case of a Stand-Alone server or a Domain Member server,
the machine SID is changed. This may break Domain Membership. In the case of a change of the Domain name
(Workgroup name), the Domain SID is changed. This affects all Domain Memberships.
</p><p>
If it becomes necessary to change either the Server name or the Domain name, be sure to back up the respective
SID before the change is made. You can back up the SID from use of the <span><b class="command">net getlocalsid</b></span> (Samba-3),
or by way of the <span><b class="command">smbpasswd</b></span> (Samba-2.2.x). To change the SID, you use the same tool. Be sure
to check the man page for this command for detailed instructions regarding the steps involved.
</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2518473"></a><a name="id2518475"></a><b></b></td><td align="left" valign="top"><p>
How can I manage user accounts from my Windows XP Professional workstation?
</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
Samba-3 implements a Windows NT4 style security domain architecture. This type of Domain cannot
be managed using tools present on a Windows XP Professional installation. You may download from the
Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use
it. This package extracts the tools known as: <span><b class="command">User Manager for Domains, Server Manager, Event
Viewer</b></span>. You may use the <span class="guimenu">User Manager for Domains</span> to manage your Samba-3
Domain user and group accounts. Of course, you do need to be logged on as the <tt class="constant">Administrator</tt>
for the Samba-3 Domain. It may help to log on as the <tt class="constant">root</tt> account.
</p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="index.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. No Frills Samba Servers </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. Secure Office Networking</td></tr></table></div></body></html>