summaryrefslogtreecommitdiffstats
path: root/source4/scripting/python/samba/tests
diff options
context:
space:
mode:
authorAmitay Isaacs <amitay@gmail.com>2011-09-08 15:24:11 +1000
committerAndrew Bartlett <abartlet@samba.org>2011-09-12 20:42:14 +1000
commit9a5524e00ad8f257305f823d4a9936026e6d9160 (patch)
tree3dba7cad82bff1437624d1a91991bda2090cc931 /source4/scripting/python/samba/tests
parent41e9f9d504a31e8eed24cb4260c2e574812961e2 (diff)
downloadsamba-9a5524e00ad8f257305f823d4a9936026e6d9160.tar.gz
samba-9a5524e00ad8f257305f823d4a9936026e6d9160.tar.xz
samba-9a5524e00ad8f257305f823d4a9936026e6d9160.zip
s4-provision: Add named.conf template for BIND9 with DLZ support
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4/scripting/python/samba/tests')
0 files changed, 0 insertions, 0 deletions
generated by cgit (git 2.34.1) at 2025-06-23 15:59:25 +0000
#n131'>131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151 2152 2153 2154 2155 2156 2157 2158 2159 2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220 2221 2222 2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389 2390 2391 2392 2393 2394 2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535 2536 2537 2538 2539 2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552 2553 2554 2555 2556 2557 2558 2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572 2573 2574 2575 2576 2577 2578 2579 2580 2581 2582 2583 2584 2585 2586 2587 2588 2589 2590 2591 2592 2593 2594 2595 2596 2597 2598 2599 2600 2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768 2769 2770 2771 2772 2773 2774 2775 2776 2777 2778 2779 2780 2781 2782 2783 2784 2785 2786 2787 2788 2789 2790 2791 2792 2793 2794 2795 2796 2797 2798 2799 2800 2801 2802 2803 2804 2805 2806 2807 2808 2809 2810 2811 2812 2813 2814 2815 2816 2817 2818 2819 2820 2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858 2859 2860 2861 2862 2863 2864 2865 2866 2867 2868 2869 2870 2871 2872 2873 2874 2875 2876 2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967 2968 2969 2970 2971 2972 2973 2974 2975 2976 2977 2978 2979 2980 2981 2982 2983 2984 2985 2986 2987 2988 2989 2990 2991 2992 2993 2994 2995 2996 2997 2998 2999 3000 3001 3002 3003 3004 3005 3006 3007 3008 3009 3010 3011 3012 3013 3014 3015 3016 3017 3018 3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037 3038 3039 3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070 3071 3072 3073 3074 3075 3076 3077 3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091 3092 3093 3094 3095 3096 3097 3098 3099 3100 3101 3102 3103 3104 3105 3106 3107 3108 3109 3110 3111 3112 3113 3114 3115 3116 3117 3118 3119 3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 3136 3137 3138 3139 3140 3141 3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160 3161 3162 3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175 3176 3177 3178 3179 3180 3181 3182 3183 3184 3185 3186 3187 3188 3189 3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200 3201 3202 3203 3204 3205 3206 3207 3208 3209 3210 3211 3212 3213 3214 3215 3216 3217 3218 3219 3220 3221 3222 3223 3224 3225 3226 3227 3228 3229 3230 3231 3232 3233 3234 3235 3236 3237 3238 3239 3240 3241 3242 3243 3244 3245 3246 3247 3248 3249 3250 3251 3252 3253 3254 3255 3256 3257 3258 3259 3260 3261 3262 3263 3264 3265 3266 3267 3268 3269 3270 3271 3272 3273 3274 3275 3276 3277 3278 3279 3280 3281 3282 3283 3284 3285 3286 3287 3288 3289 3290 3291 3292 3293 3294 3295 3296 3297 3298 3299 3300 3301 3302 3303 3304 3305 3306 3307 3308 3309 3310 3311 3312 3313 3314 3315 3316 3317 3318 3319 3320 3321 3322 3323 3324 3325 3326 3327 3328 3329 3330 3331 3332 3333 3334 3335 3336 3337 3338 3339 3340 3341 3342 3343 3344 3345 3346 3347 3348 3349 3350 3351 3352 3353 3354 3355 3356 3357 3358 3359 3360 3361 3362 3363 3364 3365 3366 3367 3368 3369 3370 3371 3372 3373 3374 3375 3376 3377 3378 3379 3380 3381 3382 3383 3384 3385 3386 3387 3388 3389 3390 3391 3392 3393 3394 3395 3396 3397 3398 3399 3400 3401 3402 3403 3404 3405 3406 3407 3408 3409 3410 3411 3412 3413 3414 3415 3416 3417 3418 3419 3420 3421 3422 3423 3424 3425 3426 3427 3428 3429 3430 3431 3432 3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443 3444 3445 3446 3447 3448 3449 3450 3451 3452 3453 3454 3455 3456 3457 3458 3459 3460 3461 3462 3463 3464 3465 3466 3467 3468 3469 3470 3471 3472 3473 3474 3475 3476 3477 3478 3479 3480 3481 3482 3483 3484 3485 3486 3487 3488 3489 3490 3491 3492 3493 3494 3495 3496 3497 3498 3499 3500 3501 3502 3503 3504 3505 3506 3507 3508 3509 3510 3511 3512 3513 3514 3515 3516 3517 3518 3519 3520 3521 3522 3523 3524 3525 3526 3527 3528 3529 3530 3531 3532 3533 3534 3535 3536 3537 3538 3539 3540 3541 3542 3543 3544 3545 3546 3547 3548 3549 3550 3551 3552 3553 3554 3555 3556 3557 3558 3559 3560 3561 3562 3563 3564 3565 3566 3567 3568 3569 3570 3571 3572 3573 3574 3575 3576 3577 3578 3579 3580 3581 3582 3583 3584 3585 3586 3587 3588 3589 3590 3591 3592 3593 3594 3595 3596 3597 3598 3599 3600 3601 3602 3603 3604 3605 3606 3607 3608 3609 3610 3611 3612 3613 3614 3615 3616 3617 3618 3619 3620 3621 3622 3623 3624 3625 3626 3627 3628 3629 3630 3631 3632 3633 3634 3635 3636 3637 3638 3639 3640 3641 3642 3643 3644 3645 3646 3647 3648 3649 3650 3651 3652 3653 3654 3655 3656 3657 3658 3659 3660 3661 3662 3663 3664 3665 3666 3667 3668 3669 3670 3671 3672 3673 3674 3675 3676 3677 3678 3679 3680 3681 3682 3683 3684 3685 3686 3687 3688 3689 3690 3691 3692 3693 3694 3695 3696 3697 3698 3699 3700 3701 3702 3703 3704 3705 3706 3707 3708 3709 3710 3711 3712 3713 3714 3715 3716 3717 3718 3719 3720 3721 3722 3723 3724 3725 3726 3727 3728 3729 3730 3731 3732 3733 3734 3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745 3746 3747 3748 3749 3750 3751 3752 3753 3754 3755 3756 3757 3758 3759 3760 3761 3762 3763 3764 3765 3766 3767 3768 3769 3770 3771 3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797 3798 3799 3800 3801 3802 3803 3804 3805 3806 3807 3808 3809 3810 3811 3812 3813 3814 3815 3816 3817 3818 3819 3820 3821 3822 3823 3824 3825 3826 3827 3828 3829 3830 3831 3832 3833 3834 3835 3836 3837 3838 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858 3859 3860 3861 3862 3863 3864 3865 3866 3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942 3943 3944 3945 3946 3947 3948 3949 3950 3951 3952 3953 3954 3955 3956 3957 3958 3959 3960 3961 3962 3963 3964 3965 3966 3967 3968 3969 3970 3971 3972 3973 3974 3975 3976 3977 3978 3979 3980 3981 3982 3983 3984 3985 3986 3987 3988 3989 3990 3991 3992 3993 3994 3995 3996 3997 3998 3999 4000 4001 4002 4003 4004 4005 4006 4007 4008 4009 4010 4011 4012 4013 4014 4015 4016 4017 4018 4019 4020 4021 4022 4023 4024 4025 4026 4027 4028 4029 4030 4031 4032 4033 4034 4035 4036 4037 4038 4039 4040 4041 4042 4043 4044 4045 4046 4047 4048 4049 4050 4051 4052 4053 4054 4055 4056 4057 4058 4059 4060 4061 4062 4063 4064 4065 4066 4067 4068 4069 4070 4071 4072 4073 4074 4075 4076 4077 4078 4079 4080 4081 4082 4083 4084 4085 4086 4087 4088 4089 4090 4091 4092 4093 4094 4095 4096 4097 4098 4099 4100 4101 4102 4103 4104 4105 4106 4107 4108 4109 4110 4111 4112 4113 4114 4115 4116 4117 4118 4119 4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139 4140 4141 4142 4143 4144 4145 4146 4147 4148 4149 4150 4151 4152 4153 4154 4155 4156 4157 4158 4159 4160 4161 4162 4163 4164 4165 4166 4167 4168 4169 4170 4171 4172 4173 4174 4175 4176 4177 4178 4179 4180 4181 4182 4183 4184 4185 4186 4187 4188 4189 4190 4191 4192 4193 4194 4195 4196 4197 4198 4199 4200 4201 4202 4203 4204 4205 4206 4207 4208 4209 4210 4211 4212 4213 4214 4215 4216 4217 4218 4219 4220 4221 4222 4223 4224 4225 4226 4227 4228 4229 4230 4231 4232 4233 4234 4235 4236 4237 4238 4239 4240 4241 4242 4243 4244 4245 4246 4247 4248 4249 4250 4251 4252 4253 4254 4255 4256 4257 4258 4259 4260 4261 4262 4263 4264 4265 4266 4267 4268 4269 4270 4271 4272 4273 4274 4275 4276 4277 4278 4279 4280 4281 4282 4283 4284 4285 4286 4287 4288 4289 4290 4291 4292 4293 4294 4295 4296 4297 4298 4299 4300 4301 4302 4303 4304 4305 4306 4307 4308 4309 4310 4311 4312 4313 4314 4315 4316 4317 4318 4319 4320 4321 4322 4323 4324 4325 4326 4327 4328 4329 4330 4331 4332 4333 4334 4335 4336 4337 4338 4339 4340 4341 4342 4343 4344 4345 4346 4347 4348 4349 4350 4351 4352 4353 4354 4355 4356 4357 4358 4359 4360 4361 4362 4363 4364 4365 4366 4367 4368 4369 4370 4371 4372 4373 4374 4375 4376 4377 4378 4379 4380 4381 4382 4383 4384 4385 4386 4387 4388 4389 4390 4391 4392 4393 4394 4395 4396 4397 4398 4399 4400 4401 4402 4403 4404 4405 4406 4407 4408 4409 4410 4411 4412 4413 4414 4415 4416 4417 4418 4419 4420 4421 4422 4423 4424 4425 4426 4427 4428 4429 4430 4431 4432 4433 4434 4435 4436 4437 4438 4439 4440 4441 4442 4443 4444 4445 4446 4447 4448 4449 4450 4451 4452 4453 4454 4455 4456 4457 4458 4459 4460 4461 4462 4463 4464 4465 4466 4467 4468 4469 4470 4471 4472 4473 4474 4475 4476 4477 4478 4479 4480 4481 4482 4483 4484 4485 4486 4487 4488 4489 4490 4491 4492 4493 4494 4495 4496 4497 4498 4499 4500 4501 4502 4503 4504 4505 4506 4507 4508 4509 4510 4511 4512 4513 4514 4515 4516 4517 4518 4519 4520 4521 4522 4523 4524 4525 4526 4527 4528 4529 4530 4531 4532 4533 4534 4535 4536 4537 4538 4539 4540 4541 4542 4543 4544 4545 4546 4547 4548 4549 4550 4551 4552 4553 4554 4555 4556 4557 4558 4559 4560 4561 4562 4563 4564 4565 4566 4567 4568 4569 4570 4571 4572 4573 4574 4575 4576 4577 4578 4579 4580 4581 4582 4583 4584 4585 4586 4587 4588 4589 4590 4591 4592 4593 4594 4595 4596 4597 4598 4599 4600 4601 4602 4603 4604 4605 4606 4607 4608 4609 4610 4611 4612 4613 4614 4615 4616 4617 4618 4619 4620 4621 4622 4623 4624 4625 4626 4627 4628 4629 4630 4631 4632 4633 4634 4635 4636 4637 4638 4639 4640 4641 4642 4643 4644 4645 4646 4647 4648 4649 4650 4651 4652 4653 4654 4655 4656 4657 4658 4659 4660 4661 4662 4663 4664 4665 4666 4667 4668 4669 4670 4671 4672 4673 4674 4675 4676 4677 4678 4679 4680 4681 4682 4683 4684 4685 4686 4687 4688 4689 4690 4691 4692 4693 4694 4695 4696 4697 4698 4699 4700 4701 4702 4703 4704 4705 4706 4707 4708 4709 4710 4711 4712 4713 4714 4715 4716 4717 4718 4719 4720 4721 4722 4723 4724 4725 4726 4727 4728 4729 4730 4731 4732 4733 4734 4735 4736 4737 4738 4739 4740 4741 4742 4743 4744 4745 4746 4747 4748 4749 4750 4751 4752 4753 4754 4755 4756 4757 4758 4759 4760 4761 4762 4763 4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779 4780 4781 4782 4783 4784 4785 4786 4787 4788 4789 4790 4791 4792 4793 4794 4795 4796 4797 4798 4799 4800 4801 4802 4803 4804 4805 4806 4807 4808 4809 4810 4811 4812 4813 4814 4815 4816 4817 4818 4819 4820 4821 4822 4823 4824 4825 4826 4827 4828 4829 4830 4831 4832 4833 4834 4835 4836 4837 4838 4839 4840 4841 4842 4843 4844 4845 4846 4847 4848 4849 4850 4851 4852 4853 4854 4855 4856 4857 4858 4859 4860 4861 4862 4863 4864 4865 4866 4867 4868 4869 4870 4871 4872 4873 4874 4875 4876 4877 4878 4879 4880 4881 4882 4883 4884 4885 4886 4887 4888 4889 4890 4891 4892 4893 4894 4895 4896 4897 4898 4899 4900 4901 4902 4903 4904 4905 4906 4907 4908 4909 4910 4911 4912 4913 4914 4915 4916 4917 4918 4919 4920 4921 4922 4923 4924 4925 4926 4927 4928 4929 4930 4931 4932 4933 4934 4935 4936 4937 4938 4939 4940 4941 4942 4943 4944 4945 4946 4947 4948 4949 4950 4951 4952 4953 4954 4955 4956 4957 4958 4959 4960 4961 4962 4963 4964 4965 4966 4967 4968 4969 4970 4971 4972 4973 4974 4975 4976 4977 4978 4979 4980 4981 4982 4983 4984 4985 4986 4987 4988 4989 4990 4991 4992 4993 4994 4995 4996 4997 4998 4999 5000 5001 5002 5003 5004 5005 5006 5007 5008 5009 5010 5011 5012 5013 5014 5015 5016 5017 5018 5019 5020 5021 5022 5023 5024 5025 5026 5027 5028 5029 5030 5031 5032 5033 5034 5035 5036 5037 5038 5039 5040 5041 5042 5043 5044 5045 5046 5047 5048 5049 5050 5051 5052 5053 5054 5055 5056 5057 5058 5059 5060 5061 5062 5063 5064 5065 5066 5067 5068 5069 5070 5071 5072 5073 5074 5075 5076 5077 5078 5079 5080 5081 5082 5083 5084 5085 5086 5087 5088 5089 5090 5091 5092 5093 5094 5095 5096 5097 5098 5099 5100 5101 5102 5103 5104 5105 5106 5107 5108 5109 5110 5111 5112 5113 5114 5115 5116 5117 5118 5119 5120 5121 5122 5123 5124 5125 5126 5127 5128 5129 5130 5131 5132 5133 5134 5135 5136 5137 5138 5139 5140 5141 5142 5143 5144 5145 5146 5147 5148 5149 5150 5151 5152 5153 5154 5155 5156 5157 5158 5159 5160 5161 5162 5163 5164 5165 5166 5167 5168 5169 5170 5171 5172 5173 5174 5175 5176 5177 5178 5179 5180 5181 5182 5183 5184 5185 5186 5187 5188 5189 5190 5191 5192 5193 5194 5195 5196 5197 5198 5199 5200 5201 5202 5203 5204 5205 5206 5207 5208 5209 5210 5211 5212 5213 5214 5215 5216 5217 5218 5219 5220 5221 5222 5223 5224 5225 5226 5227 5228 5229 5230 5231 5232 5233 5234 5235 5236 5237 5238 5239 5240 5241 5242 5243 5244 5245 5246 5247 5248 5249 5250 5251 5252 5253 5254 5255 5256 5257 5258 5259 5260 5261 5262 5263 5264 5265 5266 5267 5268 5269 5270 5271 5272 5273 5274 5275 5276 5277 5278 5279 5280 5281 5282 5283 5284 5285 5286 5287 5288 5289 5290 5291 5292 5293 5294 5295 5296 5297 5298 5299 5300 5301 5302 5303 5304 5305 5306 5307 5308 5309 5310 5311 5312 5313 5314 5315 5316 5317 5318 5319 5320 5321 5322 5323 5324 5325 5326 5327 5328 5329 5330 5331 5332 5333 5334 5335 5336 5337 5338 5339 5340 5341 5342 5343 5344 5345 5346 5347 5348 5349 5350 5351 5352 5353 5354 5355 5356 5357 5358 5359 5360 5361 5362 5363 5364 5365 5366 5367 5368 5369 5370 5371 5372 5373 5374 5375 5376 5377 5378 5379 5380 5381 5382 5383 5384 5385 5386 5387 5388 5389 5390 5391 5392 5393 5394 5395 5396 5397 5398 5399 5400 5401 5402 5403 5404 5405 5406 5407 5408 5409 5410 5411 5412 5413 5414 5415 5416 5417 5418 5419 5420 5421 5422 5423 5424 5425 5426 5427 5428 5429 5430 5431 5432 5433 5434 5435 5436 5437 5438 5439 5440 5441 5442 5443 5444 5445 5446 5447 5448 5449 5450 5451 5452 5453 5454 5455 5456 5457 5458 5459 5460 5461 5462 5463 5464 5465 5466 5467 5468 5469 5470 5471 5472 5473 5474 5475 5476 5477 5478 5479 5480 5481 5482 5483 5484 5485 5486 5487 5488 5489 5490 5491 5492 5493 5494 5495 5496 5497 5498 5499 5500 5501 5502 5503 5504 5505 5506 5507 5508 5509 5510 5511 5512 5513 5514 5515 5516 5517 5518 5519 5520 5521 5522 5523 5524 5525 5526 5527 5528 5529 5530 5531 5532 5533 5534 5535 5536 5537 5538 5539 5540 5541 5542 5543 5544 5545 5546 5547 5548 5549 5550 5551 5552 5553 5554 5555 5556 5557 5558 5559 5560 5561 5562 5563 5564 5565 5566 5567 5568 5569 5570 5571 5572 5573 5574 5575 5576 5577 5578 5579 5580 5581 5582 5583 5584 5585 5586 5587 5588 5589 5590 5591 5592 5593 5594 5595 5596 5597 5598 5599 5600 5601 5602 5603 5604 5605 5606 5607 5608 5609 5610 5611 5612 5613 5614 5615 5616 5617 5618 5619 5620 5621 5622 5623 5624 5625 5626 5627 5628 5629 5630 5631 5632 5633 5634 5635 5636 5637 5638 5639 5640 5641 5642 5643 5644 5645 5646 5647 5648 5649 5650 5651 5652 5653 5654 5655 5656 5657 5658 5659 5660 5661 5662 5663 5664 5665 5666 5667 5668 5669 5670 5671 5672 5673 5674 5675 5676 5677 5678 5679 5680 5681 5682 5683 5684 5685 5686 5687 5688 5689 5690 5691 5692 5693 5694 5695 5696 5697 5698 5699 5700 5701 5702 5703 5704 5705 5706 5707 5708 5709 5710 5711 5712 5713 5714 5715 5716 5717 5718 5719 5720 5721 5722 5723 5724 5725 5726 5727 5728 5729 5730 5731 5732 5733 5734 5735 5736 5737 5738 5739 5740 5741 5742 5743 5744 5745 5746 5747 5748 5749 5750 5751 5752 5753 5754 5755 5756 5757 5758 5759 5760 5761 5762 5763 5764 5765 5766 5767 5768 5769 5770 5771 5772 5773 5774 5775 5776 5777 5778 5779 5780 5781 5782 5783 5784 5785 5786 5787 5788 5789 5790 5791 5792 5793 5794 5795 5796 5797 5798 5799 5800 5801 5802 5803 5804 5805 5806 5807 5808 5809 5810 5811 5812 5813 5814 5815 5816 5817 5818 5819 5820 5821 5822 5823 5824 5825 5826 5827 5828 5829 5830 5831 5832 5833 5834 5835 5836 5837 5838 5839 5840 5841 5842 5843 5844 5845 5846 5847 5848 5849 5850 5851 5852 5853 5854 5855 5856 5857 5858 5859 5860 5861 5862 5863 5864 5865 5866 5867 5868 5869 5870 5871 5872 5873 5874 5875 5876 5877 5878 5879 5880 5881 5882 5883 5884 5885 5886 5887 5888 5889 5890 5891 5892 5893 5894 5895 5896 5897 5898 5899 5900 5901 5902 5903 5904 5905 5906 5907 5908 5909 5910 5911 5912 5913 5914 5915 5916 5917 5918 5919 5920 5921 5922 5923 5924 5925 5926 5927 5928 5929 5930 5931 5932 5933 5934 5935 5936 5937 5938 5939 5940 5941 5942 5943 5944 5945 5946 5947 5948 5949 5950 5951 5952 5953 5954 5955 5956 5957 5958 5959 5960 5961 5962 5963 5964 5965 5966 5967 5968 5969 5970 5971 5972 5973 5974 5975 5976 5977 5978 5979 5980 5981 5982 5983 5984 5985 5986 5987 5988 5989 5990 5991 5992 5993 5994 5995 5996 5997 5998 5999 6000 6001 6002 6003 6004 6005 6006 6007 6008 6009 6010 6011 6012 6013 6014 6015 6016 6017 6018 6019 6020 6021 6022 6023 6024 6025 6026 6027 6028 6029 6030 6031 6032 6033 6034 6035 6036 6037 6038 6039 6040 6041 6042 6043 6044 6045 6046 6047 6048 6049 6050 6051 6052 6053 6054 6055 6056 6057 6058 6059 6060 6061 6062 6063 6064 6065 6066 6067 6068 6069 6070 6071 6072 6073 6074 6075 6076 6077 6078 6079 6080 6081 6082 6083 6084 6085 6086 6087 6088 6089 6090 6091 6092 6093 6094 6095 6096 6097 6098 6099 6100 6101 6102 6103 6104 6105 6106 6107 6108 6109 6110 6111 6112 6113 6114 6115 6116 6117 6118 6119 6120 6121 6122 6123 6124 6125 6126 6127 6128 6129 6130 6131 6132 6133 6134 6135 6136 6137 6138 6139 6140 6141 6142 6143 6144 6145 6146 6147 6148 6149 6150 6151 6152 6153 6154 6155 6156 6157 6158 6159 6160 6161 6162 6163 6164 6165 6166 6167 6168 6169 6170 6171 6172 6173 6174 6175 6176 6177 6178 6179 6180 6181 6182 6183 6184 6185 6186 6187 6188 6189 6190 6191 6192 6193 6194 6195 6196 6197 6198 6199 6200 6201 6202 6203 6204 6205 6206 6207 6208 6209 6210 6211 6212 6213 6214 6215 6216 6217 6218 6219 6220 6221 6222 6223 6224 6225 6226 6227 6228 6229 6230 6231 6232 6233 6234 6235 6236 6237 6238 6239 6240 6241 6242 6243 6244 6245 6246 6247 6248 6249 6250 6251 6252 6253 6254 6255 6256 6257 6258 6259 6260 6261 6262 6263 6264 6265 6266 6267 6268 6269 6270 6271 6272 6273 6274 6275 6276 6277 6278 6279 6280 6281 6282 6283 6284 6285 6286 6287 6288 6289 6290 6291 6292 6293 6294 6295 6296 6297 6298 6299 6300 6301 6302 6303 6304 6305 6306 6307 6308 6309 6310 6311 6312 6313 6314 6315 6316 6317 6318 6319 6320 6321 6322 6323 6324 6325 6326 6327 6328 6329 6330 6331 6332 6333 6334 6335 6336 6337 6338 6339 6340 6341 6342 6343 6344 6345 6346 6347 6348 6349 6350 6351 6352 6353 6354 6355 6356 6357 6358 6359 6360 6361 6362 6363 6364 6365 6366 6367 6368 6369 6370 6371 6372 6373 6374 6375 6376 6377 6378 6379 6380 6381 6382 6383 6384 6385 6386 6387 6388 6389 6390 6391 6392 6393 6394 6395 6396 6397 6398 6399 6400 6401 6402 6403 6404 6405 6406 6407 6408 6409 6410 6411 6412 6413 6414 6415 6416 6417 6418 6419 6420 6421 6422 6423 6424 6425 6426 6427 6428 6429 6430 6431 6432 6433 6434 6435 6436 6437 6438 6439 6440 6441 6442 6443 6444 6445 6446 6447 6448 6449 6450 6451 6452 6453 6454 6455 6456 6457 6458 6459 6460 6461 6462 6463 6464 6465 6466 6467 6468 6469 6470 6471 6472 6473 6474 6475 6476 6477 6478 6479 6480 6481 6482 6483 6484 6485 6486 6487 6488 6489 6490 6491 6492 6493 6494 6495 6496 6497 6498 6499 6500 6501 6502 6503 6504 6505 6506 6507 6508 6509 6510 6511 6512 6513 6514 6515 6516 6517 6518 6519 6520 6521 6522 6523 6524 6525 6526 6527 6528 6529 6530 6531 6532 6533 6534 6535 6536 6537 6538 6539 6540 6541 6542 6543 6544 6545 6546 6547 6548 6549 6550 6551 6552 6553 6554 6555 6556 6557 6558 6559 6560 6561 6562 6563 6564 6565 6566 6567 6568 6569 6570 6571 6572 6573 6574 6575 6576 6577 6578 6579 6580 6581 6582 6583 6584 6585 6586 6587 6588 6589 6590 6591 6592 6593 6594 6595 6596 6597 6598 6599 6600 6601 6602 6603 6604 6605 6606 6607 6608 6609 6610 6611 6612 6613 6614 6615 6616 6617 6618 6619 6620 6621 6622 6623 6624 6625 6626 6627 6628 6629 6630 6631 6632 6633 6634 6635 6636 6637 6638 6639 6640 6641 6642 6643 6644 6645 6646 6647 6648 6649 6650 6651 6652 6653 6654 6655 6656 6657 6658 6659 6660 6661 6662 6663 6664 6665 6666 6667 6668 6669 6670 6671 6672 6673 6674 6675 6676 6677 6678 6679 6680 6681 6682 6683 6684 6685 6686 6687 6688 6689 6690 6691 6692 6693 6694 6695 6696 6697 6698 6699 6700 6701 6702 6703 6704 6705 6706 6707 6708 6709 6710 6711 6712 6713 6714 6715 6716 6717 6718 6719 6720 6721 6722 6723 6724 6725 6726 6727 6728 6729 6730 6731 6732 6733 6734 6735 6736 6737 6738 6739 6740 6741 6742 6743 6744 6745 6746 6747 6748 6749 6750 6751 6752 6753 6754 6755 6756 6757 6758 6759 6760 6761 6762 6763 6764 6765 6766 6767 6768 6769 6770 6771 6772 6773 6774 6775 6776 6777 6778 6779 6780 6781 6782 6783 6784 6785 6786 6787 6788 6789 6790 6791 6792 6793 6794 6795 6796 6797 6798 6799 6800 6801 6802 6803 6804 6805 6806 6807 6808 6809 6810 6811 6812 6813 6814 6815 6816 6817 6818 6819 6820 6821 6822 6823 6824 6825 6826 6827 6828 6829 6830 6831 6832 6833 6834 6835 6836 6837 6838 6839 6840 6841 6842 6843 6844 6845 6846 6847 6848 6849 6850 6851 6852 6853 6854 6855 6856 6857 6858 6859 6860 6861 6862 6863 6864 6865 6866 6867 6868 6869 6870 6871 6872 6873 6874 6875 6876 6877 6878 6879 6880 6881 6882 6883 6884 6885 6886 6887 6888 6889 6890 6891 6892 6893 6894 6895 6896 6897 6898 6899 6900 6901 6902 6903 6904 6905 6906 6907 6908 6909 6910 6911 6912 6913 6914 6915 6916 6917 6918 6919 6920 6921 6922 6923 6924 6925 6926 6927 6928 6929 6930 6931 6932 6933 6934 6935 6936 6937 6938 6939 6940 6941 6942 6943 6944 6945 6946 6947 6948 6949 6950 6951 6952 6953 6954 6955 6956 6957 6958 6959 6960 6961 6962 6963 6964 6965 6966 6967 6968 6969 6970 6971 6972 6973 6974 6975 6976 6977 6978 6979 6980 6981 6982 6983 6984 6985 6986 6987 6988 6989 6990 6991 6992 6993 6994 6995 6996 6997 6998 6999 7000 7001 7002 7003 7004 7005 7006 7007 7008 7009 7010 7011 7012 7013 7014 7015 7016 7017 7018 7019 7020 7021 7022 7023 7024 7025 7026 7027 7028 7029 7030 7031 7032 7033 7034 7035 7036 7037 7038 7039 7040 7041 7042 7043 7044 7045 7046 7047 7048 7049 7050 7051 7052 7053 7054 7055 7056 7057 7058 7059 7060 7061 7062 7063 7064 7065 7066 7067 7068 7069 7070 7071 7072 7073 7074 7075 7076 7077 7078 7079 7080 7081 7082 7083 7084 7085 7086 7087 7088 7089 7090 7091 7092 7093 7094 7095 7096 7097 7098 7099 7100 7101 7102 7103 7104 7105 7106 7107 7108 7109 7110 7111 7112 7113 7114 7115 7116 7117 7118 7119 7120 7121 7122 7123 7124 7125 7126 7127 7128 7129 7130 7131 7132 7133 7134 7135 7136 7137 7138 7139 7140 7141 7142 7143 7144 7145 7146 7147 7148 7149 7150 7151 7152 7153 7154 7155 7156 7157 7158 7159 7160 7161 7162 7163 7164 7165 7166 7167 7168 7169 7170 7171 7172 7173 7174 7175 7176 7177 7178 7179 7180 7181 7182 7183 7184 7185 7186 7187 7188 7189 7190 7191 7192 7193 7194 7195 7196 7197 7198 7199 7200 7201 7202 7203 7204 7205 7206 7207 7208 7209 7210 7211 7212 7213 7214 7215 7216 7217 7218 7219 7220 7221 7222 7223 7224 7225 7226 7227 7228 7229 7230 7231 7232 7233 7234 7235 7236 7237 7238 7239 7240 7241 7242 7243 7244 7245 7246 7247 7248 7249 7250 7251 7252 7253 7254 7255 7256 7257 7258 7259 7260 7261 7262 7263 7264 7265 7266 7267 7268 7269 7270 7271 7272 7273 7274 7275 7276 7277 7278 7279 7280 7281 7282 7283 7284 7285 7286 7287 7288 7289 7290 7291 7292 7293 7294 7295 7296 7297 7298 7299 7300 7301 7302 7303 7304 7305 7306 7307 7308 7309 7310 7311 7312 7313 7314 7315 7316 7317 7318 7319 7320 7321 7322 7323 7324 7325 7326 7327 7328 7329 7330 7331 7332 7333 7334 7335 7336 7337 7338 7339 7340 7341 7342 7343 7344 7345 7346 7347 7348 7349 7350 7351 7352 7353 7354 7355 7356 7357 7358 7359 7360 7361 7362 7363 7364 7365 7366 7367 7368 7369 7370 7371 7372 7373 7374 7375 7376 7377 7378 7379 7380 7381 7382 7383 7384 7385 7386 7387 7388 7389 7390 7391 7392 7393 7394 7395 7396 7397 7398 7399 7400 7401 7402 7403 7404 7405 7406 7407 7408 7409 7410 7411 7412 7413 7414 7415 7416 7417 7418 7419 7420 7421 7422 7423 7424 7425 7426 7427 7428 7429 7430 7431 7432 7433 7434 7435 7436 7437 7438 7439 7440 7441 7442 7443 7444 7445 7446 7447 7448 7449 7450 7451 7452 7453 7454 7455 7456 7457 7458 7459 7460 7461 7462 7463 7464 7465 7466 7467 7468 7469 7470 7471 7472 7473 7474 7475 7476 7477 7478 7479 7480 7481 7482 7483 7484 7485 7486 7487 7488 7489 7490 7491 7492 7493 7494 7495 7496 7497 7498 7499 7500 7501 7502 7503 7504 7505 7506 7507 7508 7509 7510 7511 7512 7513 7514 7515 7516 7517 7518 7519 7520 7521 7522 7523 7524 7525 7526 7527 7528 7529 7530 7531 7532 7533 7534 7535 7536 7537 7538 7539 7540 7541 7542 7543 7544 7545 7546 7547 7548 7549 7550 7551 7552 7553 7554 7555 7556 7557 7558 7559 7560 7561 7562 7563 7564 7565 7566 7567 7568 7569 7570 7571 7572 7573 7574 7575 7576 7577 7578 7579 7580 7581 7582 7583 7584 7585 7586 7587 7588 7589 7590 7591 7592 7593 7594 7595 7596 7597 7598 7599 7600 7601 7602 7603 7604 7605 7606 7607 7608 7609 7610 7611 7612 7613 7614 7615 7616 7617 7618 7619 7620 7621 7622 7623 7624 7625 7626 7627 7628 7629 7630 7631 7632 7633 7634 7635 7636 7637 7638 7639 7640 7641 7642 7643 7644 7645 7646 7647 7648 7649 7650 7651 7652 7653 7654 7655 7656 7657 7658 7659 7660 7661 7662 7663 7664 7665 7666 7667 7668 7669 7670 7671 7672 7673 7674 7675 7676 7677 7678 7679 7680 7681 7682 7683 7684 7685 7686 7687 7688 7689 7690 7691 7692 7693 7694 7695 7696 7697 7698 7699 7700 7701 7702 7703 7704 7705 7706 7707 7708 7709 7710 7711 7712 7713 7714 7715 7716 7717 7718 7719 7720 7721 7722 7723 7724 7725 7726 7727 7728 7729 7730 7731 7732 7733 7734 7735 7736 7737 7738 7739 7740 7741 7742 7743 7744 7745 7746 7747 7748 7749 7750 7751 7752 7753 7754 7755 7756 7757 7758 7759 7760 7761 7762 7763 7764 7765 7766 7767 7768 7769 7770 7771 7772 7773 7774 7775 7776 7777 7778 7779 7780 7781 7782 7783 7784 7785 7786 7787 7788 7789 7790 7791 7792 7793 7794 7795 7796 7797 7798 7799 7800 7801 7802 7803 7804 7805 7806 7807 7808 7809 7810 7811 7812 7813 7814 7815 7816 7817 7818 7819 7820 7821 7822 7823 7824 7825 7826 7827 7828 7829 7830 7831 7832 7833 7834 7835 7836 7837 7838 7839 7840 7841 7842 7843 7844 7845 7846 7847 7848 7849 7850 7851 7852 7853 7854 7855 7856 7857 7858 7859 7860 7861 7862 7863 7864 7865 7866 7867 7868 7869 7870 7871 7872 7873 7874 7875 7876 7877 7878 7879 7880 7881 7882 7883 7884 7885 7886 7887 7888 7889 7890 7891 7892 7893 7894 7895 7896 7897 7898 7899 7900 7901 7902 7903 7904 7905 7906 7907 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 7921 7922 7923 7924 7925 7926 7927 7928 7929 7930 7931 7932 7933 7934 7935 7936 7937 7938 7939 7940 7941 7942 7943 7944 7945 7946 7947 7948 7949 7950 7951 7952 7953 7954 7955 7956 7957 7958 7959 7960 7961 7962 7963 7964 7965 7966 7967 7968 7969 7970 7971 7972 7973 7974 7975 7976 7977 7978 7979 7980 7981 7982 7983 7984 7985 7986 7987 7988 7989 7990 7991 7992 7993 7994 7995 7996 7997 7998 7999 8000 8001 8002 8003 8004 8005 8006 8007 8008 8009 8010 8011 8012 8013 8014 8015 8016 8017 8018 8019 8020 8021 8022 8023 8024 8025 8026 8027 8028 8029 8030 8031 8032 8033 8034 8035 8036 8037 8038 8039 8040 8041 8042 8043 8044 8045 8046 8047 8048 8049 8050 8051 8052 8053 8054 8055 8056 8057 8058 8059 8060 8061 8062 8063 8064 8065 8066 8067 8068 8069 8070 8071 8072 8073 8074 8075 8076 8077 8078 8079 8080 8081 8082 8083 8084 8085 8086 8087 8088 8089 8090 8091 8092 8093 8094 8095 8096 8097 8098 8099 8100 8101 8102 8103 8104 8105 8106 8107 8108 8109 8110 8111 8112 8113 8114 8115 8116 8117 8118 8119 8120 8121 8122 8123 8124 8125 8126 8127 8128 8129 8130 8131 8132 8133 8134 8135 8136 8137 8138 8139 8140 8141 8142 8143 8144 8145 8146 8147 8148 8149 8150 8151 8152 8153 8154 8155 8156 8157 8158 8159 8160 8161 8162 8163 8164 8165 8166 8167 8168 8169 8170 8171 8172 8173 8174 8175 8176 8177 8178 8179 8180 8181 8182 8183 8184 8185 8186 8187 8188 8189 8190 8191 8192 8193 8194 8195 8196 8197 8198 8199 8200 8201 8202 8203 8204 8205 8206 8207 8208 8209 8210 8211 8212 8213 8214 8215 8216 8217 8218 8219 8220 8221 8222 8223 8224 8225 8226 8227 8228 8229 8230 8231 8232 8233 8234 8235 8236 8237 8238 8239 8240 8241 8242 8243 8244 8245 8246 8247 8248 8249 8250 8251 8252 8253 8254 8255 8256 8257 8258 8259 8260 8261 8262 8263 8264 8265 8266 8267 8268 8269 8270 8271 8272 8273 8274 8275 8276 8277 8278 8279 8280 8281 8282 8283 8284 8285 8286 8287 8288 8289 8290 8291 8292 8293 8294 8295 8296 8297 8298 8299 8300 8301 8302 8303 8304 8305 8306 8307 8308 8309 8310 8311 8312 8313 8314 8315 8316 8317 8318 8319 8320 8321 8322 8323 8324 8325 8326 8327 8328 8329 8330 8331 8332 8333 8334 8335 8336 8337 8338 8339 8340 8341 8342 8343 8344 8345 8346 8347 8348 8349 8350 8351 8352 8353 8354 8355 8356 8357 8358 8359 8360 8361 8362 8363 8364 8365 8366 8367 8368 8369 8370 8371 8372 8373 8374 8375 8376 8377 8378 8379 8380 8381 8382 8383 8384 8385 8386 8387 8388 8389 8390 8391 8392 8393 8394 8395 8396 8397 8398 8399 8400 8401 8402 8403 8404 8405 8406 8407 8408 8409 8410 8411 8412 8413 8414 8415 8416 8417 8418 8419 8420 8421 8422 8423 8424 8425 8426 8427 8428 8429 8430 8431 8432 8433 8434 8435 8436 8437 8438 8439 8440 8441 8442 8443 8444 8445 8446 8447 8448 8449 8450 8451 8452 8453 8454 8455 8456 8457 8458 8459 8460 8461 8462 8463 8464 8465 8466 8467 8468 8469 8470 8471 8472 8473 8474 8475 8476 8477 8478 8479 8480 8481 8482 8483 8484 8485 8486 8487 8488 8489 8490 8491 8492 8493 8494 8495 8496 8497 8498 8499 8500 8501 8502 8503 8504 8505 8506 8507 8508 8509 8510 8511 8512 8513 8514 8515 8516 8517 8518 8519 8520 8521 8522 8523 8524 8525 8526 8527 8528 8529 8530 8531 8532 8533 8534 8535 8536 8537 8538 8539 8540 8541 8542 8543 8544 8545 8546 8547 8548 8549 8550 8551 8552 8553 8554 8555 8556 8557 8558 8559 8560 8561 8562 8563 8564 8565 8566 8567 8568 8569 8570 8571 8572 8573 8574 8575 8576 8577 8578 8579 8580 8581 8582 8583 8584 8585 8586 8587 8588 8589 8590 8591 8592 8593 8594 8595 8596 8597 8598 8599 8600 8601 8602 8603 8604 8605 8606 8607 8608 8609 8610 8611 8612 8613 8614 8615 8616 8617 8618 8619 8620 8621 8622 8623 8624 8625 8626 8627 8628 8629 8630 8631 8632 8633 8634 8635 8636 8637 8638 8639 8640 8641 8642 8643 8644 8645 8646 8647 8648 8649 8650 8651 8652 8653 8654 8655 8656 8657 8658 8659 8660 8661 8662 8663 8664 8665 8666 8667 8668 8669 8670 8671 8672 8673 8674 8675 8676 8677 8678 8679 8680 8681 8682 8683 8684 8685 8686 8687 8688 8689 8690 8691 8692 8693 8694 8695 8696 8697 8698 8699 8700 8701 8702 8703 8704 8705 8706 8707 8708 8709 8710 8711 8712 8713 8714 8715 8716 8717 8718 8719 8720 8721 8722 8723 8724 8725 8726 8727 8728 8729 8730 8731 8732 8733 8734 8735 8736 8737 8738 8739 8740 8741 8742 8743 8744 8745 8746 8747 8748 8749 8750 8751 8752 8753 8754 8755 8756 8757 8758 8759 8760 8761 8762 8763 8764 8765 8766 8767 8768 8769 8770 8771 8772 8773 8774 8775 8776 8777 8778 8779 8780 8781 8782 8783 8784 8785 8786 8787 8788 8789 8790 8791 8792 8793 8794 8795 8796 8797 8798 8799 8800 8801 8802 8803 8804 8805 8806 8807 8808 8809 8810 8811 8812 8813 8814 8815 8816 8817 8818 8819 8820 8821 8822 8823 8824 8825 8826 8827 8828 8829 8830 8831 8832 8833 8834 8835 8836 8837 8838 8839 8840 8841 8842 8843 8844 8845 8846 8847 8848 8849 8850 8851 8852 8853 8854 8855 8856 8857 8858 8859 8860 8861 8862 8863 8864 8865 8866 8867 8868 8869 8870 8871 8872 8873 8874 8875 8876 8877 8878 8879 8880 8881 8882 8883 8884 8885 8886 8887 8888 8889 8890 8891 8892 8893 8894 8895 8896 8897 8898 8899 8900 8901 8902 8903 8904 8905 8906 8907 8908 8909 8910 8911 8912 8913 8914 8915 8916 8917 8918 8919 8920 8921 8922 8923 8924 8925 8926 8927 8928 8929 8930 8931 8932 8933 8934 8935 8936 8937 8938 8939 8940 8941 8942 8943 8944 8945 8946 8947 8948 8949 8950 8951 8952 8953 8954 8955 8956 8957 8958 8959 8960 8961 8962 8963 8964 8965 8966 8967 8968 8969 8970 8971 8972 8973 8974 8975 8976 8977 8978 8979 8980 8981 8982 8983 8984 8985 8986 8987 8988 8989 8990 8991 8992 8993 8994 8995 8996 8997 8998 8999 9000 9001 9002 9003 9004 9005 9006 9007 9008 9009 9010 9011 9012 9013 9014 9015 9016 9017 9018 9019 9020 9021 9022 9023 9024 9025 9026 9027 9028 9029 9030 9031 9032 9033 9034 9035 9036 9037 9038 9039 9040 9041 9042 9043 9044 9045 9046 9047 9048 9049 9050 9051 9052 9053 9054 9055 9056 9057 9058 9059 9060 9061 9062 9063 9064 9065 9066 9067 9068 9069 9070 9071 9072 9073 9074 9075 9076 9077 9078 9079 9080 9081 9082 9083 9084 9085 9086 9087 9088 9089 9090 9091 9092 9093 9094 9095 9096 9097 9098 9099 9100 9101 9102 9103 9104 9105 9106 9107 9108 9109 9110 9111 9112 9113 9114 9115 9116 9117 9118 9119 9120 9121 9122 9123 9124 9125 9126 9127 9128 9129 9130 9131 9132 9133 9134 9135 9136 9137 9138 9139 9140 9141 9142 9143 9144 9145 9146 9147 9148 9149 9150 9151 9152 9153 9154 9155 9156 9157 9158 9159 9160 9161 9162 9163 9164 9165 9166 9167 9168 9169 9170 9171 9172 9173 9174 9175 9176 9177 9178 9179 9180 9181 9182 9183 9184 9185 9186 9187 9188 9189 9190 9191 9192 9193 9194 9195 9196 9197 9198 9199 9200 9201 9202 9203 9204 9205 9206 9207 9208 9209 9210 9211 9212 9213 9214 9215 9216 9217 9218 9219 9220 9221 9222 9223 9224 9225 9226 9227 9228 9229 9230 9231 9232 9233 9234 9235 9236 9237 9238 9239 9240 9241 9242 9243 9244 9245 9246 9247 9248 9249 9250 9251 9252 9253 9254 9255 9256 9257 9258 9259 9260 9261 9262 9263 9264 9265 9266 9267 9268 9269 9270 9271 9272 9273 9274 9275 9276 9277 9278 9279 9280 9281 9282 9283 9284 9285 9286 9287 9288 9289 9290 9291 9292 9293 9294 9295 9296 9297 9298 9299 9300 9301 9302 9303 9304 9305 9306 9307 9308 9309 9310 9311 9312 9313 9314 9315 9316 9317 9318 9319 9320 9321 9322 9323 9324 9325 9326 9327 9328 9329 9330 9331 9332 9333 9334 9335 9336 9337 9338 9339 9340 9341 9342 9343 9344 9345 9346 9347 9348 9349 9350 9351 9352 9353 9354 9355 9356 9357 9358 9359 9360 9361 9362 9363 9364 9365 9366 9367 9368 9369 9370 9371 9372 9373 9374 9375 9376 9377 9378 9379 9380 9381 9382 9383 9384 9385 9386 9387 9388 9389 9390 9391 9392 9393 9394 9395 9396 9397 9398 9399 9400 9401 9402 9403 9404 9405 9406 9407 9408 9409 9410 9411 9412 9413 9414 9415 9416 9417 9418 9419 9420 9421 9422 9423 9424 9425 9426 9427 9428 9429 9430 9431 9432 9433 9434 9435 9436 9437 9438 9439 9440 9441 9442 9443 9444 9445 9446 9447 9448 9449 9450 9451 9452 9453 9454 9455 9456 9457 9458 9459 9460 9461 9462 9463 9464 9465 9466 9467 9468 9469 9470 9471 9472 9473 9474 9475 9476 9477 9478 9479 9480 9481 9482 9483 9484 9485 9486 9487 9488 9489 9490 9491 9492 9493 9494 9495 9496 9497 9498 9499 9500 9501 9502 9503 9504 9505 9506 9507 9508 9509 9510 9511 9512 9513 9514 9515 9516 9517 9518 9519 9520 9521 9522 9523 9524 9525 9526 9527 9528 9529 9530 9531 9532 9533 9534 9535 9536 9537 9538 9539 9540 9541 9542 9543 9544 9545 9546 9547 9548 9549 9550 9551 9552 9553 9554 9555 9556 9557 9558 9559 9560 9561 9562 9563 9564 9565 9566 9567 9568 9569 9570 9571 9572 9573 9574 9575 9576 9577 9578 9579 9580 9581 9582 9583 9584 9585 9586 9587 9588 9589 9590 9591 9592 9593 9594 9595 9596 9597 9598 9599 9600 9601 9602 9603 9604 9605 9606 9607 9608 9609 9610 9611 9612 9613 9614 9615 9616 9617 9618 9619 9620 9621 9622 9623 9624 9625 9626 9627 9628 9629 9630 9631 9632 9633 9634 9635 9636 9637 9638 9639 9640 9641 9642 9643 9644 9645 9646 9647 9648 9649 9650 9651 9652 9653 9654 9655 9656 9657 9658 9659 9660 9661 9662 9663 9664 9665 9666 9667 9668 9669 9670 9671 9672 9673 9674 9675 9676 9677 9678 9679 9680 9681 9682 9683 9684 9685 9686 9687 9688 9689 9690 9691 9692 9693 9694 9695 9696 9697 9698 9699 9700 9701 9702 9703 9704 9705 9706 9707 9708 9709 9710 9711 9712 9713 9714 9715 9716 9717 9718 9719 9720 9721 9722 9723 9724 9725 9726 9727 9728 9729 9730 9731 9732 9733 9734 9735 9736 9737 9738 9739 9740 9741 9742 9743 9744 9745 9746 9747 9748 9749 9750 9751 9752 9753 9754 9755 9756 9757 9758 9759 9760 9761 9762 9763 9764 9765 9766 9767 9768 9769 9770 9771 9772 9773 9774 9775 9776 9777 9778 9779 9780 9781 9782 9783 9784 9785 9786 9787 9788 9789 9790 9791 9792 9793 9794 9795 9796 9797 9798 9799 9800 9801 9802 9803 9804 9805 9806 9807 9808 9809 9810 9811 9812 9813 9814 9815 9816 9817 9818 9819 9820 9821 9822 9823 9824 9825 9826 9827 9828 9829 9830 9831 9832 9833 9834 9835 9836 9837 9838 9839 9840 9841 9842 9843 9844 9845 9846 9847 9848 9849 9850 9851 9852 9853 9854 9855 9856 9857 9858 9859 9860 9861 9862 9863 9864 9865 9866 9867 9868 9869 9870 9871 9872 9873 9874 9875 9876 9877 9878 9879 9880 9881 9882 9883 9884 9885 9886 9887 9888 9889 9890 9891 9892 9893 9894 9895 9896 9897 9898 9899 9900 9901 9902 9903 9904 9905 9906 9907 9908 9909 9910 9911 9912 9913 9914 9915 9916 9917 9918 9919 9920 9921 9922 9923 9924 9925 9926 9927 9928 9929 9930 9931 9932 9933 9934 9935 9936 9937 9938 9939 9940 9941 9942 9943 9944 9945 9946 9947 9948 9949 9950 9951 9952 9953 9954 9955 9956 9957 9958 9959 9960 9961 9962 9963 9964 9965 9966 9967 9968 9969 9970 9971 9972 9973 9974 9975 9976 9977 9978 9979 9980 9981 9982 9983 9984 9985 9986 9987 9988 9989 9990 9991 9992 9993 9994 9995 9996 9997 9998 9999 10000 10001 10002 10003 10004 10005 10006 10007 10008 10009 10010 10011 10012 10013 10014 10015 10016 10017 10018 10019 10020 10021 10022 10023 10024 10025 10026 10027 10028 10029 10030 10031 10032 10033 10034 10035 10036 10037 10038 10039 10040 10041 10042 10043 10044 10045 10046 10047 10048 10049 10050 10051 10052 10053 10054 10055 10056 10057 10058 10059 10060 10061 10062 10063 10064 10065 10066 10067 10068 10069 10070 10071 10072 10073 10074 10075 10076 10077 10078 10079 10080 10081 10082 10083 10084 10085 10086 10087 10088 10089 10090 10091 10092 10093 10094 10095 10096 10097 10098 10099 10100 10101 10102 10103 10104 10105 10106 10107 10108 10109 10110 10111 10112 10113 10114 10115 10116 10117 10118 10119 10120 10121 10122 10123 10124 10125 10126 10127 10128 10129 10130 10131 10132 10133 10134 10135 10136 10137 10138 10139 10140 10141 10142 10143 10144 10145 10146 10147 10148 10149 10150 10151 10152 10153 10154 10155 10156 10157 10158 10159 10160 10161 10162 10163 10164 10165 10166 10167 10168 10169 10170 10171 10172 10173 10174 10175 10176 10177 10178 10179 10180 10181 10182 10183 10184 10185 10186 10187 10188 10189 10190 10191 10192 10193 10194 10195 10196 10197 10198 10199 10200 10201 10202 10203 10204 10205 10206 10207 10208 10209 10210 10211 10212 10213 10214 10215 10216 10217 10218 10219 10220 10221 10222 10223 10224 10225 10226 10227 10228 10229 10230 10231 10232 10233 10234 10235 10236 10237 10238 10239 10240 10241 10242 10243 10244 10245 10246 10247 10248 10249 10250 10251 10252 10253 10254 10255 10256 10257 10258 10259 10260 10261 10262 10263 10264 10265 10266 10267 10268 10269 10270 10271 10272 10273 10274 10275 10276 10277 10278 10279 10280 10281 10282 10283 10284 10285 10286 10287 10288 10289 10290 10291 10292 10293 10294 10295 10296 10297 10298 10299 10300 10301 10302 10303 10304 10305 10306 10307 10308 10309 10310 10311 10312 10313 10314 10315 10316 10317 10318 10319 10320 10321 10322 10323 10324 10325 10326 10327 10328 10329 10330 10331 10332 10333 10334 10335 10336 10337 10338 10339 10340 10341 10342 10343 10344 10345 10346 10347 10348 10349 10350 10351 10352 10353 10354 10355 10356 10357 10358 10359 10360 10361 10362 10363 10364 10365 10366 10367 10368 10369 10370 10371 10372 10373 10374 10375 10376 10377 10378 10379 10380 10381 10382 10383 10384 10385 10386 10387 10388 10389 10390 10391 10392 10393 10394 10395 10396 10397 10398 10399 10400 10401 10402 10403 10404 10405 10406 10407 10408 10409 10410 10411 10412 10413 10414 10415 10416 10417 10418 10419 10420 10421 10422 10423 10424 10425 10426 10427 10428 10429 10430 10431 10432 10433 10434 10435 10436 10437 10438 10439 10440 10441 10442 10443 10444 10445 10446 10447 10448 10449 10450 10451 10452 10453 10454 10455 10456 10457 10458 10459 10460 10461 10462 10463 10464 10465 10466 10467 10468 10469 10470 10471 10472 10473 10474 10475 10476 10477 10478 10479 10480 10481 10482 10483 10484 10485 10486 10487 10488 10489 10490 10491 10492 10493 10494 10495 10496 10497 10498 10499 10500 10501 10502 10503 10504 10505 10506 10507 10508 10509 10510 10511 10512 10513 10514 10515 10516 10517 10518 10519 10520 10521 10522 10523 10524 10525 10526 10527 10528 10529 10530 10531 10532 10533 10534 10535 10536 10537 10538 10539 10540 10541 10542 10543 10544 10545 10546 10547 10548 10549 10550 10551 10552 10553 10554 10555 10556 10557 10558 10559 10560 10561 10562 10563 10564 10565 10566 10567 10568 10569 10570 10571 10572 10573 10574 10575 10576 10577 10578 10579 10580 10581 10582 10583 10584 10585 10586 10587 10588 10589 10590 10591 10592 10593 10594 10595 10596 10597 10598 10599 10600 10601 10602 10603 10604 10605 10606 10607 10608 10609 10610 10611 10612 10613 10614 10615 10616 10617 10618 10619 10620 10621 10622 10623 10624 10625 10626 10627 10628 10629 10630 10631 10632 10633 10634 10635 10636 10637 10638 10639 10640 10641 10642 10643 10644 10645 10646 10647 10648 10649 10650 10651 10652 10653 10654 10655 10656 10657 10658 10659 10660 10661 10662 10663 10664 10665 10666 10667 10668 10669 10670 10671 10672 10673 10674 10675 10676 10677 10678 10679 10680 10681 10682 10683 10684 10685 10686 10687 10688 10689 10690 10691 10692 10693 10694 10695 10696 10697 10698 10699 10700 10701 10702 10703 10704 10705 10706 10707 10708 10709 10710 10711 10712 10713 10714 10715 10716 10717 10718 10719 10720 10721 10722 10723 10724 10725 10726 10727 10728 10729 10730 10731 10732 10733 10734 10735 10736 10737 10738 10739 10740 10741 10742 10743 10744 10745 10746 10747 10748 10749 10750 10751 10752 10753 10754 10755 10756 10757 10758 10759 10760 10761 10762 10763 10764 10765 10766 10767 10768 10769 10770 10771 10772 10773 10774 10775 10776 10777 10778 10779 10780 10781 10782 10783 10784 10785 10786 10787 10788 10789 10790 10791 10792 10793 10794 10795 10796 10797 10798 10799 10800 10801 10802 10803 10804 10805 10806 10807 10808 10809 10810 10811 10812 10813 10814 10815 10816 10817 10818 10819 10820 10821 10822 10823 10824 10825 10826 10827 10828 10829 10830 10831 10832 10833 10834 10835 10836 10837 10838 10839 10840 10841 10842 10843 10844 10845 10846 10847 10848 10849 10850 10851 10852 10853 10854 10855 10856 10857 10858 10859 10860 10861 10862 10863 10864 10865 10866 10867 10868 10869 10870 10871 10872 10873 10874 10875 10876 10877 10878 10879 10880 10881 10882 10883 10884 10885 10886 10887 10888 10889 10890 10891 10892 10893 10894 10895 10896 10897 10898 10899 10900 10901 10902 10903 10904 10905 10906 10907 10908 10909 10910 10911 10912 10913 10914 10915 10916 10917 10918 10919 10920 10921 10922 10923 10924 10925 10926 10927 10928 10929 10930 10931 10932 10933 10934 10935 10936 10937 10938 10939 10940 10941 10942 10943 10944 10945 10946 10947 10948 10949 10950 10951 10952 10953 10954 10955 10956 10957 10958 10959 10960 10961 10962 10963 10964 10965 10966 10967 10968 10969 10970 10971 10972 10973 10974 10975 10976 10977 10978 10979 10980 10981 10982 10983 10984 10985 10986 10987 10988 10989 10990 10991 10992 10993 10994 10995 10996 10997 10998 10999 11000 11001 11002 11003 11004 11005 11006 11007 11008 11009 11010 11011 11012 11013 11014 11015 11016 11017 11018 11019 11020 11021 11022 11023 11024 11025 11026 11027 11028 11029 11030 11031 11032 11033 11034 11035 11036 11037 11038 11039 11040 11041 11042 11043 11044 11045 11046 11047 11048 11049 11050 11051 11052 11053 11054 11055 11056 11057 11058 11059 11060 11061 11062 11063 11064 11065 11066 11067 11068 11069 11070 11071 11072 11073 11074 11075 11076 11077 11078 11079 11080 11081 11082 11083 11084 11085 11086 11087 11088 11089 11090 11091 11092 11093 11094 11095 11096 11097 11098 11099 11100 11101 11102 11103 11104 11105 11106 11107 11108 11109 11110 11111 11112 11113 11114 11115 11116 11117 11118 11119 11120 11121 11122 11123 11124 11125 11126 11127 11128 11129 11130 11131 11132 11133 11134 11135 11136 11137 11138 11139 11140 11141 11142 11143 11144 11145 11146 11147 11148 11149 11150 11151 11152 11153 11154 11155 11156 11157 11158 11159 11160 11161 11162 11163 11164 11165 11166 11167 11168 11169 11170 11171 11172 11173 11174 11175 11176 11177 11178 11179 11180 11181 11182 11183 11184 11185 11186 11187 11188 11189 11190 11191 11192 11193 11194 11195 11196 11197 11198 11199 11200 11201 11202 11203 11204 11205 11206 11207 11208 11209 11210 11211 11212 11213 11214 11215 11216 11217 11218 11219 11220 11221 11222 11223 11224 11225 11226 11227 11228 11229 11230 11231 11232 11233 11234 11235 11236 11237 11238 11239 11240 11241 11242 11243 11244 11245 11246 11247 11248 11249 11250 11251 11252 11253 11254 11255 11256 11257 11258 11259 11260 11261 11262 11263 11264 11265 11266 11267 11268 11269 11270 11271 11272 11273 11274 11275 11276 11277 11278 11279 11280 11281 11282 11283 11284 11285 11286 11287 11288 11289 11290 11291 11292 11293 11294 11295 11296 11297 11298 11299 11300 11301 11302 11303 11304 11305 11306 11307 11308 11309 11310 11311 11312 11313 11314 11315 11316 11317 11318 11319 11320 11321 11322 11323 11324 11325 11326 11327 11328 11329 11330 11331 11332 11333 11334 11335 11336 11337 11338 11339 11340 11341 11342 11343 11344 11345 11346 11347 11348 11349 11350 11351 11352 11353 11354 11355 11356 11357 11358 11359 11360 11361 11362 11363 11364 11365 11366 11367 11368 11369 11370 11371 11372 11373 11374 11375 11376 11377 11378 11379 11380 11381 11382 11383 11384 11385 11386 11387 11388 11389 11390 11391 11392 11393 11394 11395 11396 11397 11398 11399 11400 11401 11402 11403 11404 11405 11406 11407 11408 11409 11410 11411 11412 11413 11414 11415 11416 11417 11418 11419 11420 11421 11422 11423 11424 11425 11426 11427 11428 11429 11430 11431 11432 11433 11434 11435 11436 11437 11438 11439 11440 11441 11442 11443 11444 11445 11446 11447 11448 11449 11450 11451 11452 11453 11454 11455 11456 11457 11458 11459 11460 11461 11462 11463 11464 11465 11466 11467 11468 11469 11470 11471 11472 11473 11474 11475 11476 11477 11478 11479 11480 11481 11482 11483 11484 11485 11486 11487 11488 11489 11490 11491 11492 11493 11494 11495 11496 11497 11498 11499 11500 11501 11502 11503 11504 11505 11506 11507 11508 11509 11510 11511 11512 11513 11514 11515 11516 11517 11518 11519 11520 11521 11522 11523 11524 11525 11526 11527 11528 11529 11530 11531 11532 11533 11534 11535 11536 11537 11538 11539 11540 11541 11542 11543 11544 11545 11546 11547 11548 11549 11550 11551 11552 11553 11554 11555 11556 11557 11558 11559 11560 11561 11562 11563 11564 11565 11566 11567 11568 11569 11570 11571 11572 11573 11574 11575 11576 11577 11578 11579 11580 11581 11582 11583 11584 11585 11586 11587 11588 11589 11590 11591 11592 11593 11594 11595 11596 11597 11598 11599 11600 11601 11602 11603 11604 11605 11606 11607 11608 11609 11610 11611 11612 11613 11614 11615 11616 11617 11618 11619 11620 11621 11622 11623 11624 11625 11626 11627 11628 11629 11630 11631 11632 11633 11634 11635 11636 11637 11638 11639 11640 11641 11642 11643 11644 11645 11646 11647 11648 11649 11650 11651 11652 11653 11654 11655 11656 11657 11658 11659 11660 11661 11662 11663 11664 11665 11666 11667 11668 11669 11670 11671 11672 11673 11674 11675 11676 11677 11678 11679 11680 11681 11682 11683 11684 11685 11686 11687 11688 11689 11690 11691 11692 11693 11694 11695 11696 11697 11698 11699 11700 11701 11702 11703 11704 11705 11706 11707 11708 11709 11710 11711 11712 11713 11714 11715 11716 11717 11718 11719 11720 11721 11722 11723 11724 11725 11726 11727 11728 11729 11730 11731 11732 11733 11734 11735 11736 11737 11738 11739 11740 11741 11742 11743 11744 11745 11746 11747 11748 11749 11750 11751 11752 11753 11754 11755 11756 11757 11758 11759 11760 11761 11762 11763 11764 11765 11766 11767 11768 11769 11770 11771 11772 11773 11774 11775 11776 11777 11778 11779 11780 11781 11782 11783 11784 11785 11786 11787 11788 11789 11790 11791 11792 11793 11794 11795 11796 11797 11798 11799 11800 11801 11802 11803 11804 11805 11806 11807 11808 11809 11810 11811 11812 11813 11814 11815 11816 11817 11818 11819 11820 11821 11822 11823 11824 11825 11826 11827 11828 11829 11830 11831 11832 11833 11834 11835 11836 11837 11838 11839 11840 11841 11842 11843 11844 11845 11846 11847 11848 11849 11850 11851 11852 11853 11854 11855 11856 11857 11858 11859 11860 11861 11862 11863 11864 11865 11866 11867 11868 11869 11870 11871 11872 11873 11874 11875 11876 11877 11878 11879 11880 11881 11882 11883 11884 11885 11886 11887 11888 11889 11890 11891 11892 11893 11894 11895 11896 11897 11898 11899 11900 11901 11902 11903 11904 11905 11906 11907 11908 11909 11910 11911 11912 11913 11914 11915 11916 11917 11918 11919 11920 11921 11922 11923 11924 11925 11926 11927 11928 11929 11930 11931 11932 11933 11934 11935 11936 11937 11938 11939 11940 11941 11942 11943 11944 11945 11946 11947 11948 11949 11950 11951 11952 11953 11954 11955 11956 11957 11958 11959 11960 11961 11962 11963 11964 11965 11966 11967 11968 11969 11970 11971 11972 11973 11974 11975 11976 11977 11978 11979 11980 11981 11982 11983 11984 11985 11986 11987 11988 11989 11990 11991 11992 11993 11994 11995 11996 11997 11998 11999 12000 12001 12002 12003 12004 12005 12006 12007 12008 12009 12010 12011 12012 12013 12014 12015 12016 12017 12018 12019 12020 12021 12022 12023 12024 12025 12026 12027 12028 12029 12030 12031 12032 12033 12034 12035 12036 12037 12038 12039 12040 12041 12042 12043 12044 12045 12046 12047 12048 12049 12050 12051 12052 12053 12054 12055 12056 12057 12058 12059 12060 12061 12062 12063 12064 12065 12066 12067 12068 12069 12070 12071 12072 12073 12074 12075 12076 12077 12078 12079 12080 12081 12082 12083 12084 12085 12086 12087 12088 12089 12090 12091 12092 12093 12094 12095 12096 12097 12098 12099 12100 12101 12102 12103 12104 12105 12106 12107 12108 12109 12110 12111 12112 12113 12114 12115 12116 12117 12118 12119 12120 12121 12122 12123 12124 12125 12126 12127 12128 12129 12130 12131 12132 12133 12134 12135 12136 12137 12138 12139 12140 12141 12142 12143 12144 12145 12146 12147 12148 12149 12150 12151 12152 12153 12154 12155 12156 12157 12158 12159 12160 12161 12162 12163 12164 12165 12166 12167 12168 12169 12170 12171 12172 12173 12174 12175 12176 12177 12178 12179 12180 12181 12182 12183 12184 12185 12186 12187 12188 12189 12190 12191 12192 12193 12194 12195 12196 12197 12198 12199 12200 12201 12202 12203 12204 12205 12206 12207 12208 12209 12210 12211 12212 12213 12214 12215 12216 12217 12218 12219 12220 12221 12222 12223 12224 12225 12226 12227 12228 12229 12230 12231 12232 12233 12234 12235 12236 12237 12238 12239 12240 12241 12242 12243 12244 12245 12246 12247 12248 12249 12250 12251 12252 12253 12254 12255 12256 12257 12258 12259 12260 12261 12262 12263 12264 12265 12266 12267 12268 12269 12270 12271 12272 12273 12274 12275 12276 12277 12278 12279 12280 12281 12282 12283 12284 12285 12286 12287 12288 12289 12290 12291 12292 12293 12294 12295 12296 12297 12298 12299 12300 12301 12302 12303 12304 12305 12306 12307 12308 12309 12310 12311 12312 12313 12314 12315 12316 12317 12318 12319 12320 12321 12322 12323 12324 12325 12326 12327 12328 12329 12330 12331 12332 12333 12334 12335 12336 12337 12338 12339 12340 12341 12342 12343 12344 12345 12346 12347 12348 12349 12350 12351 12352 12353 12354 12355 12356 12357 12358 12359 12360 12361 12362 12363 12364 12365 12366 12367 12368 12369 12370 12371 12372 12373 12374 12375 12376 12377 12378 12379 12380 12381 12382 12383 12384 12385 12386 12387 12388 12389 12390 12391 12392 12393 12394 12395 12396 12397 12398 12399 12400 12401 12402 12403 12404 12405 12406 12407 12408 12409 12410 12411 12412 12413 12414 12415 12416 12417 12418 12419 12420 12421 12422 12423 12424 12425 12426 12427 12428 12429 12430 12431 12432 12433 12434 12435 12436 12437 12438 12439 12440 12441 12442 12443 12444 12445 12446 12447 12448 12449 12450 12451 12452 12453 12454 12455 12456 12457 12458 12459 12460 12461 12462 12463 12464 12465 12466 12467 12468 12469 12470 12471 12472 12473 12474 12475 12476 12477 12478 12479 12480 12481 12482 12483 12484 12485 12486 12487 12488 12489 12490 12491 12492 12493 12494 12495 12496 12497 12498 12499 12500 12501 12502 12503 12504 12505 12506 12507 12508 12509 12510 12511 12512 12513 12514 12515 12516 12517 12518 12519 12520 12521 12522 12523 12524 12525 12526 12527 12528 12529 12530 12531 12532 12533 12534 12535 12536 12537 12538 12539 12540 12541 12542 12543 12544 12545 12546 12547 12548 12549 12550 12551 12552 12553 12554 12555 12556 12557 12558 12559 12560 12561 12562 12563 12564 12565 12566 12567 12568 12569 12570 12571 12572 12573 12574 12575 12576 12577 12578 12579 12580 12581 12582 12583 12584 12585 12586 12587 12588 12589 12590 12591 12592 12593 12594 12595 12596 12597 12598 12599 12600 12601 12602 12603 12604 12605 12606 12607 12608 12609 12610 12611 12612 12613 12614 12615 12616 12617 12618 12619 12620 12621 12622 12623 12624 12625 12626 12627 12628 12629 12630 12631 12632 12633 12634 12635 12636 12637 12638 12639 12640 12641 12642 12643 12644 12645 12646 12647 12648 12649 12650 12651 12652 12653 12654 12655 12656 12657 12658 12659 12660 12661 12662 12663 12664 12665 12666 12667 12668 12669 12670 12671 12672 12673 12674 12675 12676 12677 12678 12679 12680 12681 12682 12683 12684 12685 12686 12687 12688 12689 12690 12691 12692 12693 12694 12695 12696 12697 12698 12699 12700 12701 12702 12703 12704 12705 12706 12707 12708 12709 12710 12711 12712 12713 12714 12715 12716 12717 12718 12719 12720 12721 12722 12723 12724 12725 12726 12727 12728 12729 12730 12731 12732 12733 12734 12735 12736 12737 12738 12739 12740 12741 12742 12743 12744 12745 12746 12747 12748 12749 12750 12751 12752 12753 12754 12755 12756 12757 12758 12759 12760 12761 12762 12763 12764 12765 12766 12767 12768 12769 12770 12771 12772 12773 12774 12775 12776 12777 12778 12779 12780 12781 12782 12783 12784 12785 12786 12787 12788 12789 12790 12791 12792 12793 12794 12795 12796 12797 12798 12799 12800 12801 12802 12803 12804 12805 12806 12807 12808 12809 12810 12811 12812 12813 12814 12815 12816 12817 12818 12819 12820 12821 12822 12823 12824 12825 12826 12827 12828 12829 12830 12831 12832 12833 12834 12835 12836 12837 12838 12839 12840 12841 12842 12843 12844 12845 12846 12847 12848 12849 12850 12851 12852 12853 12854 12855 12856 12857 12858 12859 12860 12861 12862 12863 12864 12865 12866 12867 12868 12869 12870 12871 12872 12873 12874 12875 12876 12877 12878 12879 12880 12881 12882 12883 12884 12885 12886 12887 12888 12889 12890 12891 12892 12893 12894 12895 12896 12897 12898 12899 12900 12901 12902 12903 12904 12905 12906 12907 12908 12909 12910 12911 12912 12913 12914 12915 12916 12917 12918 12919 12920 12921 12922 12923 12924 12925 12926 12927 12928 12929 12930 12931 12932 12933 12934 12935 12936 12937 12938 12939 12940 12941 12942 12943 12944 12945 12946 12947 12948 12949 12950 12951 12952 12953 12954 12955 12956 12957 12958 12959 12960 12961 12962 12963 12964 12965 12966 12967 12968 12969 12970 12971 12972 12973 12974 12975 12976 12977 12978 12979 12980 12981 12982 12983 12984 12985 12986 12987 12988 12989 12990 12991 12992 12993 12994 12995 12996 12997 12998 12999 13000 13001 13002 13003 13004 13005 13006 13007 13008 13009 13010 13011 13012 13013 13014 13015 13016 13017 13018 13019 13020 13021 13022 13023 13024 13025 13026 13027 13028 13029 13030 13031 13032 13033 13034 13035 13036 13037 13038 13039 13040 13041 13042 13043 13044 13045 13046 13047 13048 13049 13050 13051 13052 13053 13054 13055 13056 13057 13058 13059 13060 13061 13062 13063 13064 13065 13066 13067 13068 13069 13070 13071 13072 13073 13074 13075 13076 13077 13078 13079 13080 13081 13082 13083 13084 13085 13086 13087 13088 13089 13090 13091 13092 13093 13094 13095 13096 13097 13098 13099 13100 13101 13102 13103 13104 13105 13106 13107 13108 13109 13110 13111 13112 13113 13114 13115 13116 13117 13118 13119 13120 13121 13122 13123 13124 13125 13126 13127 13128 13129 13130 13131 13132 13133 13134 13135 13136 13137 13138 13139 13140 13141 13142 13143 13144 13145 13146 13147 13148 13149 13150 13151 13152 13153 13154 13155 13156 13157 13158 13159 13160 13161 13162 13163 13164 13165 13166 13167 13168 13169 13170 13171 13172 13173 13174 13175 13176 13177 13178 13179 13180 13181 13182 13183 13184 13185 13186 13187 13188 13189 13190 13191 13192 13193 13194 13195 13196 13197 13198 13199 13200 13201 13202 13203 13204 13205 13206 13207 13208 13209 13210 13211 13212 13213 13214 13215 13216 13217 13218 13219 13220 13221 13222 13223 13224 13225 13226 13227 13228 13229 13230 13231 13232 13233 13234 13235 13236 13237 13238 13239 13240 13241 13242 13243 13244 13245 13246 13247 13248 13249 13250 13251 13252 13253 13254 13255 13256 13257 13258 13259 13260 13261 13262 13263 13264 13265 13266 13267 13268 13269 13270 13271 13272 13273 13274 13275 13276 13277 13278 13279 13280 13281 13282 13283 13284 13285 13286 13287 13288 13289 13290 13291 13292 13293 13294 13295 13296 13297 13298 13299 13300 13301 13302 13303 13304 13305 13306 13307 13308 13309 13310 13311 13312 13313 13314 13315 13316 13317 13318 13319 13320 13321 13322 13323 13324 13325 13326 13327 13328 13329 13330 13331 13332 13333 13334 13335 13336 13337 13338 13339 13340 13341 13342 13343 13344 13345 13346 13347 13348 13349 13350 13351 13352 13353 13354 13355 13356 13357 13358 13359 13360 13361 13362 13363 13364 13365 13366 13367 13368 13369 13370 13371 13372 13373 13374 13375 13376 13377 13378 13379 13380 13381 13382 13383 13384 13385 13386 13387 13388 13389 13390 13391 13392 13393 13394 13395 13396 13397 13398 13399 13400 13401 13402 13403 13404 13405 13406 13407 13408 13409 13410 13411 13412 13413 13414 13415 13416 13417 13418 13419 13420 13421 13422 13423 13424 13425 13426 13427 13428 13429 13430 13431 13432 13433 13434 13435 13436 13437 13438 13439 13440 13441 13442 13443 13444 13445 13446 13447 13448 13449 13450 13451 13452 13453 13454 13455 13456 13457 13458 13459 13460 13461 13462 13463 13464 13465 13466 13467 13468 13469 13470 13471 13472 13473 13474 13475 13476 13477 13478 13479 13480 13481 13482 13483 13484 13485 13486 13487 13488 13489 13490 13491 13492 13493 13494 13495 13496 13497 13498 13499 13500 13501 13502 13503 13504 13505 13506 13507 13508 13509 13510 13511 13512 13513 13514 13515 13516 13517 13518 13519 13520 13521 13522 13523 13524 13525 13526 13527 13528 13529 13530 13531 13532 13533 13534 13535 13536 13537 13538 13539 13540 13541 13542 13543 13544 13545 13546 13547 13548 13549 13550 13551 13552 13553 13554 13555 13556 13557 13558 13559 13560 13561 13562 13563 13564 13565 13566 13567 13568 13569 13570 13571 13572 13573 13574 13575 13576 13577 13578 13579 13580 13581 13582 13583 13584 13585 13586 13587 13588 13589 13590 13591 13592 13593 13594 13595 13596 13597 13598 13599 13600 13601 13602 13603 13604 13605 13606 13607 13608 13609 13610 13611 13612 13613 13614 13615 13616 13617 13618 13619 13620 13621 13622 13623 13624 13625 13626 13627 13628 13629 13630 13631 13632 13633 13634 13635 13636 13637 13638 13639 13640 13641 13642 13643 13644 13645 13646 13647 13648 13649 13650 13651 13652 13653 13654 13655 13656 13657 13658 13659 13660 13661 13662 13663 13664 13665 13666 13667 13668 13669 13670 13671 13672 13673 13674 13675 13676 13677 13678 13679 13680 13681 13682 13683 13684 13685 13686 13687 13688 13689 13690 13691 13692 13693 13694 13695 13696 13697 13698 13699 13700 13701 13702 13703 13704 13705 13706 13707 13708 13709 13710 13711 13712 13713 13714 13715 13716 13717 13718 13719 13720 13721 13722 13723 13724 13725 13726 13727 13728 13729 13730 13731 13732 13733 13734 13735 13736 13737 13738 13739 13740 13741 13742 13743 13744 13745 13746 13747 13748 13749 13750 13751 13752 13753 13754 13755 13756 13757 13758 13759 13760 13761 13762 13763 13764 13765 13766 13767 13768 13769 13770 13771 13772 13773 13774 13775 13776 13777 13778 13779 13780 13781 13782 13783 13784 13785 13786 13787 13788 13789 13790 13791 13792 13793 13794 13795 13796 13797 13798 13799 13800 13801 13802 13803 13804 13805 13806 13807 13808 13809 13810 13811 13812 13813 13814 13815 13816 13817 13818 13819 13820 13821 13822 13823 13824 13825 13826 13827 13828 13829 13830 13831 13832 13833 13834 13835 13836 13837 13838 13839 13840 13841 13842 13843 13844 13845 13846 13847 13848 13849 13850 13851 13852 13853 13854 13855 13856 13857 13858 13859 13860 13861 13862 13863 13864 13865 13866 13867 13868 13869 13870 13871 13872 13873 13874 13875 13876 13877 13878 13879 13880 13881 13882 13883 13884 13885 13886 13887 13888 13889 13890 13891 13892 13893 13894 13895 13896 13897 13898 13899 13900 13901 13902 13903 13904 13905 13906 13907 13908 13909 13910 13911 13912 13913 13914 13915 13916 13917 13918 13919 13920 13921 13922 13923 13924 13925 13926 13927 13928 13929 13930 13931 13932 13933 13934 13935 13936 13937 13938 13939 13940 13941 13942 13943 13944 13945 13946 13947 13948 13949 13950 13951 13952 13953 13954 13955 13956 13957 13958 13959 13960 13961 13962 13963 13964 13965 13966 13967 13968 13969 13970 13971 13972 13973 13974 13975 13976 13977 13978 13979 13980 13981 13982 13983 13984 13985 13986 13987 13988 13989 13990 13991 13992 13993 13994 13995 13996 13997 13998 13999 14000 14001 14002 14003 14004 14005 14006 14007 14008 14009 14010 14011 14012 14013 14014 14015 14016 14017 14018 14019 14020 14021 14022 14023 14024 14025 14026 14027 14028 14029 14030 14031 14032 14033 14034 14035 14036 14037 14038 14039 14040 14041 14042 14043 14044 14045 14046 14047 14048 14049 14050 14051 14052 14053 14054 14055 14056 14057 14058 14059 14060 14061 14062 14063 14064 14065 14066 14067 14068 14069 14070 14071 14072 14073 14074 14075 14076 14077 14078 14079 14080 14081 14082 14083 14084 14085 14086 14087 14088 14089 14090 14091 14092 14093 14094 14095 14096 14097 14098 14099 14100 14101 14102 14103 14104 14105 14106 14107 14108 14109 14110 14111 14112 14113 14114 14115 14116 14117 14118 14119 14120 14121 14122 14123 14124 14125 14126 14127 14128 14129 14130 14131 14132 14133 14134 14135 14136 14137 14138 14139 14140 14141 14142 14143 14144 14145 14146 14147 14148 14149 14150 14151 14152 14153 14154 14155 14156 14157 14158 14159 14160 14161 14162 14163 14164 14165 14166 14167 14168 14169 14170 14171 14172 14173 14174 14175 14176 14177 14178 14179 14180 14181 14182 14183 14184 14185 14186 14187 14188 14189 14190 14191 14192 14193 14194 14195 14196 14197 14198 14199 14200 14201 14202 14203 14204 14205 14206 14207 14208 14209 14210 14211 14212 14213 14214 14215 14216 14217 14218 14219 14220 14221 14222 14223 14224 14225 14226 14227 14228 14229 14230 14231 14232 14233 14234 14235 14236 14237 14238 14239 14240 14241 14242 14243 14244 14245 14246 14247 14248 14249 14250 14251 14252 14253 14254 14255 14256 14257 14258 14259 14260 14261 14262 14263 14264 14265 14266 14267 14268 14269 14270 14271 14272 14273 14274 14275 14276 14277 14278 14279 14280 14281 14282 14283 14284 14285 14286 14287 14288 14289 14290 14291 14292 14293 14294 14295 14296 14297 14298 14299 14300 14301 14302 14303 14304 14305 14306 14307 14308 14309 14310 14311 14312 14313 14314 14315 14316 14317 14318 14319 14320 14321 14322 14323 14324 14325 14326 14327 14328 14329 14330 14331 14332 14333 14334 14335 14336 14337 14338 14339 14340 14341 14342 14343 14344 14345 14346 14347 14348 14349 14350 14351 14352 14353 14354 14355 14356 14357 14358 14359 14360 14361 14362 14363 14364 14365 14366 14367 14368 14369 14370 14371 14372 14373 14374 14375 14376 14377 14378 14379 14380 14381 14382 14383 14384 14385 14386 14387 14388 14389 14390 14391 14392 14393 14394 14395 14396 14397 14398 14399 14400 14401 14402 14403 14404 14405 14406 14407 14408 14409 14410 14411 14412 14413 14414 14415 14416 14417 14418 14419 14420 14421 14422 14423 14424 14425 14426 14427 14428 14429 14430 14431 14432 14433 14434 14435 14436 14437 14438 14439 14440 14441 14442 14443 14444 14445 14446 14447 14448 14449 14450 14451 14452 14453 14454 14455 14456 14457 14458 14459 14460 14461 14462 14463 14464 14465 14466 14467 14468 14469 14470 14471 14472 14473 14474 14475 14476 14477 14478 14479 14480 14481 14482 14483 14484 14485 14486 14487 14488 14489 14490 14491 14492 14493 14494 14495 14496 14497 14498 14499 14500 14501 14502 14503 14504 14505 14506 14507 14508 14509 14510 14511 14512 14513 14514 14515 14516 14517 14518 14519 14520 14521 14522 14523 14524 14525 14526 14527 14528 14529 14530 14531 14532 14533 14534 14535 14536 14537 14538 14539 14540 14541 14542 14543 14544 14545 14546 14547 14548 14549 14550 14551 14552 14553 14554 14555 14556 14557 14558 14559 14560 14561 14562 14563 14564 14565 14566 14567 14568 14569 14570 14571 14572 14573 14574 14575 14576 14577 14578 14579 14580 14581 14582 14583 14584 14585 14586 14587 14588 14589 14590 14591 14592 14593 14594 14595 14596 14597 14598 14599 14600 14601 14602 14603 14604 14605 14606 14607 14608 14609 14610 14611 14612 14613 14614 14615 14616 14617 14618 14619 14620 14621 14622 14623 14624 14625 14626 14627 14628 14629 14630 14631 14632 14633 14634 14635 14636 14637 14638 14639 14640 14641 14642 14643 14644 14645 14646 14647 14648 14649 14650 14651 14652 14653 14654 14655 14656 14657 14658 14659 14660 14661 14662 14663 14664 14665 14666 14667 14668 14669 14670 14671 14672 14673 14674 14675 14676 14677 14678 14679 14680 14681 14682 14683 14684 14685 14686 14687 14688 14689 14690 14691 14692 14693 14694 14695 14696 14697 14698 14699 14700 14701 14702 14703 14704 14705 14706 14707 14708 14709 14710 14711 14712 14713 14714 14715 14716 14717 14718 14719 14720 14721 14722 14723 14724 14725 14726 14727 14728 14729 14730 14731 14732 14733 14734 14735 14736 14737 14738 14739 14740 14741 14742 14743 14744 14745 14746 14747 14748 14749 14750 14751 14752 14753 14754 14755 14756 14757 14758 14759 14760 14761 14762 14763 14764 14765 14766 14767 14768 14769 14770 14771 14772 14773 14774 14775 14776 14777 14778 14779 14780 14781 14782 14783 14784 14785 14786 14787 14788 14789 14790 14791 14792 14793 14794 14795 14796 14797 14798 14799 14800 14801 14802 14803 14804 14805 14806 14807 14808 14809 14810 14811 14812 14813 14814 14815 14816 14817 14818 14819 14820 14821 14822 14823 14824 14825 14826 14827 14828 14829 14830 14831 14832 14833 14834 14835 14836 14837 14838 14839 14840 14841 14842 14843 14844 14845 14846 14847 14848 14849 14850 14851 14852 14853 14854 14855 14856 14857 14858 14859 14860 14861 14862 14863 14864 14865 14866 14867 14868 14869 14870 14871 14872 14873 14874 14875 14876 14877 14878 14879 14880 14881 14882 14883 14884 14885 14886 14887 14888 14889 14890 14891 14892 14893 14894 14895 14896 14897 14898 14899 14900 14901 14902 14903 14904 14905 14906 14907 14908 14909 14910 14911 14912 14913 14914 14915 14916 14917 14918 14919 14920 14921 14922 14923 14924 14925 14926 14927 14928 14929 14930 14931 14932 14933 14934 14935 14936 14937 14938 14939 14940 14941 14942 14943 14944 14945 14946 14947 14948 14949 14950 14951 14952 14953 14954 14955 14956 14957 14958 14959 14960 14961 14962 14963 14964 14965 14966 14967 14968 14969 14970 14971 14972 14973 14974 14975 14976 14977 14978 14979 14980 14981 14982 14983 14984 14985 14986 14987 14988 14989 14990 14991 14992 14993 14994 14995 14996 14997 14998 14999 15000 15001 15002 15003 15004 15005 15006 15007 15008 15009 15010 15011 15012 15013 15014 15015 15016 15017 15018 15019 15020 15021 15022 15023 15024 15025 15026 15027 15028 15029 15030 15031 15032 15033 15034 15035 15036 15037 15038 15039 15040 15041 15042 15043 15044 15045 15046 15047 15048 15049 15050 15051 15052 15053 15054 15055 15056 15057 15058 15059 15060 15061 15062 15063 15064 15065 15066 15067 15068 15069 15070 15071 15072 15073 15074 15075 15076 15077 15078 15079 15080 15081 15082 15083 15084 15085 15086 15087 15088 15089 15090 15091 15092 15093 15094 15095 15096 15097 15098 15099 15100 15101 15102 15103 15104 15105 15106 15107 15108 15109 15110 15111 15112 15113 15114 15115 15116 15117 15118 15119 15120 15121 15122 15123 15124 15125 15126 15127 15128 15129 15130 15131 15132 15133 15134 15135 15136 15137 15138 15139 15140 15141 15142 15143 15144 15145 15146 15147 15148 15149 15150 15151 15152 15153 15154 15155 15156 15157 15158 15159 15160 15161 15162 15163 15164 15165 15166 15167 15168 15169 15170 15171 15172 15173 15174 15175 15176 15177 15178 15179 15180 15181 15182 15183 15184 15185 15186 15187 15188 15189 15190 15191 15192 15193 15194 15195 15196 15197 15198 15199 15200 15201 15202 15203 15204 15205 15206 15207 15208 15209 15210 15211 15212 15213 15214 15215 15216 15217 15218 15219 15220 15221 15222 15223 15224 15225 15226 15227 15228 15229 15230 15231 15232 15233 15234 15235 15236 15237 15238 15239 15240 15241 15242 15243 15244 15245 15246 15247 15248 15249 15250 15251 15252 15253 15254 15255 15256 15257 15258 15259 15260 15261 15262 15263 15264 15265 15266 15267 15268 15269 15270 15271 15272 15273 15274 15275 15276 15277 15278 15279 15280 15281 15282 15283 15284 15285 15286 15287 15288 15289 15290 15291 15292 15293 15294 15295 15296 15297 15298 15299 15300 15301 15302 15303 15304 15305 15306 15307 15308 15309 15310 15311 15312 15313 15314 15315 15316 15317 15318 15319 15320 15321 15322 15323 15324 15325 15326 15327 15328 15329 15330 15331 15332 15333 15334 15335 15336 15337 15338 15339 15340 15341 15342 15343 15344 15345 15346 15347 15348 15349 15350 15351 15352 15353 15354 15355 15356 15357 15358 15359 15360 15361 15362 15363 15364 15365 15366 15367 15368 15369 15370 15371 15372 15373 15374 15375 15376 15377 15378 15379 15380 15381 15382 15383 15384 15385 15386 15387 15388 15389 15390 15391 15392 15393 15394 15395 15396 15397 15398 15399 15400 15401 15402 15403 15404 15405 15406 15407 15408 15409 15410 15411 15412 15413 15414 15415 15416 15417 15418 15419 15420 15421 15422 15423 15424 15425 15426 15427 15428 15429 15430 15431 15432 15433 15434 15435 15436 15437 15438 15439 15440 15441 15442 15443 15444 15445 15446 15447 15448 15449 15450 15451 15452 15453 15454 15455 15456 15457 15458 15459 15460 15461 15462 15463 15464 15465 15466 15467 15468 15469 15470 15471 15472 15473 15474 15475 15476 15477 15478 15479 15480 15481 15482 15483 15484 15485 15486 15487 15488 15489 15490 15491 15492 15493 15494 15495 15496 15497 15498 15499 15500 15501 15502 15503 15504 15505 15506 15507 15508 15509 15510 15511 15512 15513 15514 15515 15516 15517 15518 15519 15520 15521 15522 15523 15524 15525 15526 15527 15528 15529 15530 15531 15532 15533 15534 15535 15536 15537 15538 15539 15540 15541 15542 15543 15544 15545 15546 15547 15548 15549 15550 15551 15552 15553 15554 15555 15556 15557 15558 15559 15560 15561 15562 15563 15564 15565 15566 15567 15568 15569 15570 15571 15572 15573 15574 15575 15576 15577 15578 15579 15580 15581 15582 15583 15584 15585 15586 15587 15588 15589 15590 15591 15592 15593 15594 15595 15596 15597 15598 15599 15600 15601 15602 15603 15604 15605 15606 15607 15608 15609 15610 15611 15612 15613 15614 15615 15616 15617 15618 15619 15620 15621 15622 15623 15624 15625 15626 15627 15628 15629 15630 15631 15632 15633 15634 15635 15636 15637 15638 15639 15640 15641 15642 15643 15644 15645 15646 15647 15648 15649 15650 15651 15652 15653 15654 15655 15656 15657 15658 15659 15660 15661 15662 15663 15664 15665 15666 15667 15668 15669 15670 15671 15672 15673 15674 15675 15676 15677 15678 15679 15680 15681 15682 15683 15684 15685 15686 15687 15688 15689 15690 15691 15692 15693 15694 15695 15696 15697 15698 15699 15700 15701 15702 15703 15704 15705 15706 15707 15708 15709 15710 15711 15712 15713 15714 15715 15716 15717 15718 15719 15720 15721 15722 15723 15724 15725 15726 15727 15728 15729 15730 15731 15732 15733 15734 15735 15736 15737 15738 15739 15740 15741 15742 15743 15744 15745 15746 15747 15748 15749 15750 15751 15752 15753 15754 15755 15756 15757 15758 15759 15760 15761 15762 15763 15764 15765 15766 15767 15768 15769 15770 15771 15772 15773 15774 15775 15776 15777 15778 15779 15780 15781 15782 15783 15784 15785 15786 15787 15788 15789 15790 15791 15792 15793 15794 15795 15796 15797 15798 15799 15800 15801 15802 15803 15804 15805 15806 15807 15808 15809 15810 15811 15812 15813 15814 15815 15816 15817 15818 15819 15820 15821 15822 15823 15824 15825 15826 15827 15828 15829 15830 15831 15832 15833 15834 15835 15836 15837 15838 15839 15840 15841 15842 15843 15844 15845 15846 15847 15848 15849 15850 15851 15852 15853 15854 15855 15856 15857 15858 15859 15860 15861 15862 15863 15864 15865 15866 15867 15868 15869 15870 15871 15872 15873 15874 15875 15876 15877 15878 15879 15880 15881 15882 15883 15884 15885 15886 15887 15888 15889 15890 15891 15892 15893 15894 15895 15896 15897 15898 15899 15900 15901 15902 15903 15904 15905 15906 15907 15908 15909 15910 15911 15912 15913 15914 15915 15916 15917 15918 15919 15920 15921 15922 15923 15924 15925 15926 15927 15928 15929 15930 15931 15932 15933 15934 15935 15936 15937 15938 15939 15940 15941 15942 15943 15944 15945 15946 15947 15948 15949 15950 15951 15952 15953 15954 15955 15956 15957 15958 15959 15960 15961 15962 15963 15964 15965 15966 15967 15968 15969 15970 15971 15972 15973 15974 15975 15976 15977 15978 15979 15980 15981 15982 15983 15984 15985 15986 15987 15988 15989 15990 15991 15992 15993 15994 15995 15996 15997 15998 15999 16000 16001 16002 16003 16004 16005 16006 16007 16008 16009 16010 16011 16012 16013 16014 16015 16016 16017 16018 16019 16020 16021 16022 16023 16024 16025 16026 16027 16028 16029 16030 16031 16032 16033 16034 16035 16036 16037 16038 16039 16040 16041 16042 16043 16044 16045 16046 16047 16048 16049 16050 16051 16052 16053 16054 16055 16056 16057 16058 16059 16060 16061 16062 16063 16064 16065 16066 16067 16068 16069 16070 16071 16072 16073 16074 16075 16076 16077 16078 16079 16080 16081 16082 16083 16084 16085 16086 16087 16088 16089 16090 16091 16092 16093 16094 16095 16096 16097 16098 16099 16100 16101 16102 16103 16104 16105 16106 16107 16108 16109 16110 16111 16112 16113 16114 16115 16116 16117 16118 16119 16120 16121 16122 16123 16124 16125 16126 16127 16128 16129 16130 16131 16132 16133 16134 16135 16136 16137 16138 16139 16140 16141 16142 16143 16144 16145 16146 16147 16148 16149 16150 16151 16152 16153 16154 16155 16156 16157 16158 16159 16160 16161 16162 16163 16164 16165 16166 16167 16168 16169 16170 16171 16172 16173 16174 16175 16176 16177 16178 16179 16180 16181 16182 16183 16184 16185 16186 16187 16188 16189 16190 16191 16192 16193 16194 16195 16196 16197 16198 16199 16200 16201 16202 16203 16204 16205 16206 16207 16208 16209 16210 16211 16212 16213 16214 16215 16216 16217 16218 16219 16220 16221 16222 16223 16224 16225 16226 16227 16228 16229 16230 16231 16232 16233 16234 16235 16236 16237 16238 16239 16240 16241 16242 16243 16244 16245 16246 16247 16248 16249 16250 16251 16252 16253 16254 16255 16256 16257 16258 16259 16260 16261 16262 16263 16264 16265 16266 16267 16268 16269 16270 16271 16272 16273 16274 16275 16276 16277 16278 16279 16280 16281 16282 16283 16284 16285 16286 16287 16288 16289 16290 16291 16292 16293 16294 16295 16296 16297 16298 16299 16300 16301 16302 16303 16304 16305 16306 16307 16308 16309 16310 16311 16312 16313 16314 16315 16316 16317 16318 16319 16320 16321 16322 16323 16324 16325 16326 16327 16328 16329 16330 16331 16332 16333 16334 16335 16336 16337 16338 16339 16340 16341 16342 16343 16344 16345 16346 16347 16348 16349 16350 16351 16352 16353 16354 16355 16356 16357 16358 16359 16360 16361 16362 16363 16364 16365 16366 16367 16368 16369 16370 16371 16372 16373 16374 16375 16376 16377 16378 16379 16380 16381 16382 16383 16384 16385 16386 16387 16388 16389 16390 16391 16392 16393 16394 16395 16396 16397 16398 16399 16400 16401 16402 16403 16404 16405 16406 16407 16408 16409 16410 16411 16412 16413 16414 16415 16416 16417 16418 16419 16420 16421 16422 16423 16424 16425 16426 16427 16428 16429 16430 16431 16432 16433 16434 16435 16436 16437 16438 16439 16440 16441 16442 16443 16444 16445 16446 16447 16448 16449 16450 16451 16452 16453 16454 16455 16456 16457 16458 16459 16460 16461 16462 16463 16464 16465 16466 16467 16468 16469 16470 16471 16472 16473 16474 16475 16476 16477 16478 16479 16480 16481 16482 16483 16484 16485 16486 16487 16488 16489 16490 16491 16492 16493 16494 16495 16496 16497 16498 16499 16500 16501 16502 16503 16504 16505 16506 16507 16508 16509 16510 16511 16512 16513 16514 16515 16516 16517 16518 16519 16520 16521 16522 16523 16524 16525 16526 16527 16528 16529 16530 16531 16532 16533 16534 16535 16536 16537 16538 16539 16540 16541 16542 16543 16544 16545 16546 16547 16548 16549 16550 16551 16552 16553 16554 16555 16556 16557 16558 16559 16560 16561 16562 16563 16564 16565 16566 16567 16568 16569 16570 16571 16572 16573 16574 16575 16576 16577 16578 16579 16580 16581 16582 16583 16584 16585 16586 16587 16588 16589 16590 16591 16592 16593 16594 16595 16596 16597 16598 16599 16600 16601 16602 16603 16604 16605 16606 16607 16608 16609 16610 16611 16612 16613 16614 16615 16616 16617 16618 16619 16620 16621 16622 16623 16624 16625 16626 16627 16628 16629 16630 16631 16632 16633 16634 16635 16636 16637 16638 16639 16640 16641 16642 16643 16644 16645 16646 16647 16648 16649 16650 16651 16652 16653 16654 16655 16656 16657 16658 16659 16660 16661 16662 16663 16664 16665 16666 16667 16668 16669 16670 16671 16672 16673 16674 16675 16676 16677 16678 16679 16680 16681 16682 16683 16684 16685 16686 16687 16688 16689 16690 16691 16692 16693 16694 16695 16696 16697 16698 16699 16700 16701 16702 16703 16704 16705 16706 16707 16708 16709 16710 16711 16712 16713 16714 16715 16716 16717 16718 16719 16720 16721 16722 16723 16724 16725 16726 16727 16728 16729 16730 16731 16732 16733 16734 16735 16736 16737 16738 16739 16740 16741 16742 16743 16744 16745 16746 16747 16748 16749 16750 16751 16752 16753 16754 16755 16756 16757 16758 16759 16760 16761 16762 16763 16764 16765 16766 16767 16768 16769 16770 16771 16772 16773 16774 16775 16776 16777 16778 16779 16780 16781 16782 16783 16784 16785 16786 16787 16788 16789 16790 16791 16792 16793 16794 16795 16796 16797 16798 16799 16800 16801 16802 16803 16804 16805 16806 16807 16808 16809 16810 16811 16812 16813 16814 16815 16816 16817 16818 16819 16820 16821 16822 16823 16824 16825 16826 16827 16828 16829 16830 16831 16832 16833 16834 16835 16836 16837 16838 16839 16840 16841 16842 16843 16844 16845 16846 16847 16848 16849 16850 16851 16852 16853 16854 16855 16856 16857 16858 16859 16860 16861 16862 16863 16864 16865 16866 16867 16868 16869 16870 16871 16872 16873 16874 16875 16876 16877 16878 16879 16880 16881 16882 16883 16884 16885 16886 16887 16888 16889 16890 16891 16892 16893 16894 16895 16896 16897 16898 16899 16900 16901 16902 16903 16904 16905 16906 16907 16908 16909 16910 16911 16912 16913 16914 16915 16916 16917 16918 16919 16920 16921 16922 16923 16924 16925 16926 16927 16928 16929 16930 16931 16932 16933 16934 16935 16936 16937 16938 16939 16940 16941 16942 16943 16944 16945 16946 16947 16948 16949 16950 16951 16952 16953 16954 16955 16956 16957 16958 16959 16960 16961 16962 16963 16964 16965 16966 16967 16968 16969 16970 16971 16972 16973 16974 16975 16976 16977 16978 16979 16980 16981 16982 16983 16984 16985 16986 16987 16988 16989 16990 16991 16992 16993 16994 16995 16996 16997 16998 16999 17000 17001 17002 17003 17004 17005 17006 17007 17008 17009 17010 17011 17012 17013 17014 17015 17016 17017 17018 17019 17020 17021 17022 17023 17024 17025 17026 17027 17028 17029 17030 17031 17032 17033 17034 17035 17036 17037 17038 17039 17040 17041 17042 17043 17044 17045 17046 17047 17048 17049 17050 17051 17052 17053 17054 17055 17056 17057 17058 17059 17060 17061 17062 17063 17064 17065 17066 17067 17068 17069 17070 17071 17072 17073 17074 17075 17076 17077 17078 17079 17080 17081 17082 17083 17084 17085 17086 17087 17088 17089 17090 17091 17092 17093 17094 17095 17096 17097 17098 17099 17100 17101 17102 17103 17104 17105 17106 17107 17108 17109 17110 17111 17112 17113 17114 17115 17116 17117 17118 17119 17120 17121 17122 17123 17124 17125 17126 17127 17128 17129 17130 17131 17132 17133 17134 17135 17136 17137 17138 17139 17140 17141 17142 17143 17144 17145 17146 17147 17148 17149 17150 17151 17152 17153 17154 17155 17156 17157 17158 17159 17160 17161 17162 17163 17164 17165 17166 17167 17168 17169 17170 17171 17172 17173 17174 17175 17176 17177 17178 17179 17180 17181 17182 17183 17184 17185 17186 17187 17188 17189 17190 17191 17192 17193 17194 17195 17196 17197 17198 17199 17200 17201 17202 17203 17204 17205 17206 17207 17208 17209 17210 17211 17212 17213 17214 17215 17216 17217 17218 17219 17220 17221 17222 17223 17224 17225 17226 17227 17228 17229 17230 17231 17232 17233 17234 17235 17236 17237 17238 17239 17240 17241 17242 17243 17244 17245 17246 17247 17248 17249 17250 17251 17252 17253 17254 17255 17256 17257 17258 17259 17260 17261 17262 17263 17264 17265 17266 17267 17268 17269 17270 17271 17272 17273 17274 17275 17276 17277 17278 17279 17280 17281 17282 17283 17284 17285 17286 17287 17288 17289 17290 17291 17292 17293 17294 17295 17296 17297 17298 17299 17300 17301 17302 17303 17304 17305 17306 17307 17308 17309 17310 17311 17312 17313 17314 17315 17316 17317 17318 17319 17320 17321 17322 17323 17324 17325 17326 17327 17328 17329 17330 17331 17332 17333 17334 17335 17336 17337 17338 17339 17340 17341 17342 17343 17344 17345 17346 17347 17348 17349 17350 17351 17352 17353 17354 17355 17356 17357 17358 17359 17360 17361 17362 17363 17364 17365 17366 17367 17368 17369 17370 17371 17372 17373 17374 17375 17376 17377 17378 17379 17380 17381 17382 17383 17384 17385 17386 17387 17388 17389 17390 17391 17392 17393 17394 17395 17396 17397 17398 17399 17400 17401 17402 17403 17404 17405 17406 17407 17408 17409 17410 17411 17412 17413 17414 17415 17416 17417 17418 17419 17420 17421 17422 17423 17424 17425 17426 17427 17428 17429 17430 17431 17432 17433 17434 17435 17436 17437 17438 17439 17440 17441 17442 17443 17444 17445 17446 17447 17448 17449 17450 17451 17452 17453 17454 17455 17456 17457 17458 17459 17460 17461 17462 17463 17464 17465 17466 17467 17468 17469 17470 17471 17472 17473 17474 17475 17476 17477 17478 17479 17480 17481 17482 17483 17484 17485 17486 17487 17488 17489 17490 17491 17492 17493 17494 17495 17496 17497 17498 17499 17500 17501 17502 17503 17504 17505 17506 17507 17508 17509 17510 17511 17512 17513 17514 17515 17516 17517 17518 17519 17520 17521 17522 17523 17524 17525 17526 17527 17528 17529 17530 17531 17532 17533 17534 17535 17536 17537 17538 17539 17540 17541 17542 17543 17544 17545 17546 17547 17548 17549 17550 17551 17552 17553 17554 17555 17556 17557 17558 17559 17560 17561 17562 17563 17564 17565 17566 17567 17568 17569 17570 17571 17572 17573 17574 17575 17576 17577 17578 17579 17580 17581 17582 17583 17584 17585 17586 17587 17588 17589 17590 17591 17592 17593 17594 17595 17596 17597 17598 17599 17600 17601 17602 17603 17604 17605 17606 17607 17608 17609 17610 17611 17612 17613 17614 17615 17616 17617 17618 17619 17620 17621 17622 17623 17624 17625 17626 17627 17628 17629 17630 17631 17632 17633 17634 17635 17636 17637 17638 17639 17640 17641 17642 17643 17644 17645 17646 17647 17648 17649 17650 17651 17652 17653 17654 17655 17656 17657 17658 17659 17660 17661 17662 17663 17664 17665 17666 17667 17668 17669 17670 17671 17672 17673 17674 17675 17676 17677 17678 17679 17680 17681 17682 17683 17684 17685 17686 17687 17688 17689 17690 17691 17692 17693 17694 17695 17696 17697 17698 17699 17700 17701 17702 17703 17704 17705 17706 17707 17708 17709 17710 17711 17712 17713 17714 17715 17716 17717 17718 17719 17720 17721 17722 17723 17724 17725 17726 17727 17728 17729 17730 17731 17732 17733 17734 17735 17736 17737 17738 17739 17740 17741 17742 17743 17744 17745 17746 17747 17748 17749 17750 17751 17752 17753 17754 17755 17756 17757 17758 17759 17760 17761 17762 17763 17764 17765 17766 17767 17768 17769 17770 17771 17772 17773 17774 17775 17776 17777 17778 17779 17780 17781 17782 17783 17784 17785 17786 17787 17788 17789 17790 17791 17792 17793 17794 17795 17796 17797 17798 17799 17800 17801 17802 17803 17804 17805 17806 17807 17808 17809 17810 17811 17812 17813 17814 17815 17816 17817 17818 17819 17820 17821 17822 17823 17824 17825 17826 17827 17828 17829 17830 17831 17832 17833 17834 17835 17836 17837 17838 17839 17840 17841 17842 17843 17844 17845 17846 17847 17848 17849 17850 17851 17852 17853 17854 17855 17856 17857 17858 17859 17860 17861 17862 17863 17864 17865 17866 17867 17868 17869 17870 17871 17872 17873 17874 17875 17876 17877 17878 17879 17880 17881 17882 17883 17884 17885 17886 17887 17888 17889 17890 17891 17892 17893 17894 17895 17896 17897 17898 17899 17900 17901 17902 17903 17904 17905 17906 17907 17908 17909 17910 17911 17912 17913 17914 17915 17916 17917 17918 17919 17920 17921 17922 17923 17924 17925 17926 17927 17928 17929 17930 17931 17932 17933 17934 17935 17936 17937 17938 17939 17940 17941 17942 17943 17944 17945 17946 17947 17948 17949 17950 17951 17952 17953 17954 17955 17956 17957 17958 17959 17960 17961 17962 17963 17964 17965 17966 17967 17968 17969 17970 17971 17972 17973 17974 17975 17976 17977 17978 17979 17980 17981 17982 17983 17984 17985 17986 17987 17988 17989 17990 17991 17992 17993 17994 17995 17996 17997 17998 17999 18000 18001 18002 18003 18004 18005 18006 18007 18008 18009 18010 18011 18012 18013 18014 18015 18016 18017 18018 18019 18020 18021 18022 18023 18024 18025 18026 18027 18028 18029 18030 18031 18032 18033 18034 18035 18036 18037 18038 18039 18040 18041 18042 18043 18044 18045 18046 18047 18048 18049 18050 18051 18052 18053 18054 18055 18056 18057 18058 18059 18060 18061 18062 18063 18064 18065 18066 18067 18068 18069 18070 18071 18072 18073 18074 18075 18076 18077 18078 18079 18080 18081 18082 18083 18084 18085 18086 18087 18088 18089 18090 18091 18092 18093 18094 18095 18096 18097 18098 18099 18100 18101 18102 18103 18104 18105 18106 18107 18108 18109 18110 18111 18112 18113 18114 18115 18116 18117 18118 18119 18120 18121 18122 18123 18124 18125 18126 18127 18128 18129 18130 18131 18132 18133 18134 18135 18136 18137 18138 18139 18140 18141 18142 18143 18144 18145 18146 18147 18148 18149 18150 18151 18152 18153 18154 18155 18156 18157 18158 18159 18160 18161 18162 18163 18164 18165 18166 18167 18168 18169 18170 18171 18172 18173 18174 18175 18176 18177 18178 18179 18180 18181 18182 18183 18184 18185 18186 18187 18188 18189 18190 18191 18192 18193 18194 18195 18196 18197 18198 18199 18200 18201 18202 18203 18204 18205 18206 18207 18208 18209 18210 18211 18212 18213 18214 18215 18216 18217 18218 18219 18220 18221 18222 18223 18224 18225 18226 18227 18228 18229 18230 18231 18232 18233 18234 18235 18236 18237 18238 18239 18240 18241 18242 18243 18244 18245 18246 18247 18248 18249 18250 18251 18252 18253 18254 18255 18256 18257 18258 18259 18260 18261 18262 18263 18264 18265 18266 18267 18268 18269 18270 18271 18272 18273 18274 18275 18276 18277 18278 18279 18280 18281 18282 18283 18284 18285 18286 18287 18288 18289 18290 18291 18292 18293 18294 18295 18296 18297 18298 18299 18300 18301 18302 18303 18304 18305 18306 18307 18308 18309 18310 18311 18312 18313 18314 18315 18316 18317 18318 18319 18320 18321 18322 18323 18324 18325 18326 18327 18328 18329 18330 18331 18332 18333 18334 18335 18336 18337 18338 18339 18340 18341 18342 18343 18344 18345 18346 18347 18348 18349 18350 18351 18352 18353 18354 18355 18356 18357 18358 18359 18360 18361 18362 18363 18364 18365 18366 18367 18368 18369 18370 18371 18372 18373 18374 18375 18376 18377 18378 18379 18380 18381 18382 18383 18384 18385 18386 18387 18388 18389 18390 18391 18392 18393 18394 18395 18396 18397 18398 18399 18400 18401 18402 18403 18404 18405 18406 18407 18408 18409 18410 18411 18412 18413 18414 18415 18416 18417 18418 18419 18420 18421 18422 18423 18424 18425 18426 18427 18428 18429 18430 18431 18432 18433 18434 18435 18436 18437 18438 18439 18440 18441 18442 18443 18444 18445 18446 18447 18448 18449 18450 18451 18452 18453 18454 18455 18456 18457 18458 18459 18460 18461 18462 18463 18464 18465 18466 18467 18468 18469 18470 18471 18472 18473 18474 18475 18476 18477 18478 18479 18480 18481 18482 18483 18484 18485 18486 18487 18488 18489 18490 18491 18492 18493 18494 18495 18496 18497 18498 18499 18500 18501 18502 18503 18504 18505 18506 18507 18508 18509 18510 18511 18512 18513 18514 18515 18516 18517 18518 18519 18520 18521 18522 18523 18524 18525 18526 18527 18528 18529 18530 18531 18532 18533 18534 18535 18536 18537 18538 18539 18540 18541 18542 18543 18544 18545 18546 18547 18548 18549 18550 18551 18552 18553 18554 18555 18556 18557 18558 18559 18560 18561 18562 18563 18564 18565 18566 18567 18568 18569 18570 18571 18572 18573 18574 18575 18576 18577 18578 18579 18580 18581 18582 18583 18584 18585 18586 18587 18588 18589 18590 18591 18592 18593 18594 18595 18596 18597 18598 18599 18600 18601 18602 18603 18604 18605 18606 18607 18608 18609 18610 18611 18612 18613 18614 18615 18616 18617 18618 18619 18620 18621 18622 18623 18624 18625 18626 18627 18628 18629 18630 18631 18632 18633 18634 18635 18636 18637 18638 18639 18640 18641 18642 18643 18644 18645 18646 18647 18648 18649 18650 18651 18652 18653 18654 18655 18656 18657 18658 18659 18660 18661 18662 18663 18664 18665 18666 18667 18668 18669 18670 18671 18672 18673 18674 18675 18676 18677 18678 18679 18680 18681 18682 18683 18684 18685 18686 18687 18688 18689 18690 18691 18692 18693 18694 18695 18696 18697 18698 18699 18700 18701 18702 18703 18704 18705 18706 18707 18708 18709 18710 18711 18712 18713 18714 18715 18716 18717 18718 18719 18720 18721 18722 18723 18724 18725 18726 18727 18728 18729 18730 18731 18732 18733 18734 18735 18736 18737 18738 18739 18740 18741 18742 18743 18744 18745 18746 18747 18748 18749 18750 18751 18752 18753 18754 18755 18756 18757 18758 18759 18760 18761 18762 18763 18764 18765 18766 18767 18768 18769 18770 18771 18772 18773 18774 18775 18776 18777 18778 18779 18780 18781 18782 18783 18784 18785 18786 18787 18788 18789 18790 18791 18792 18793 18794 18795 18796 18797 18798 18799 18800 18801 18802 18803 18804 18805 18806 18807 18808 18809 18810 18811 18812 18813 18814 18815 18816 18817 18818 18819 18820 18821 18822 18823 18824 18825 18826 18827 18828 18829 18830 18831 18832 18833 18834 18835 18836 18837 18838 18839 18840 18841 18842 18843 18844 18845 18846 18847 18848 18849 18850 18851 18852 18853 18854 18855 18856 18857 18858 18859 18860 18861 18862 18863 18864 18865 18866 18867 18868 18869 18870 18871 18872 18873 18874 18875 18876 18877 18878 18879 18880 18881 18882 18883 18884 18885 18886 18887 18888 18889 18890 18891 18892 18893 18894 18895 18896 18897 18898 18899 18900 18901 18902 18903 18904 18905 18906 18907 18908 18909 18910 18911 18912 18913 18914 18915 18916 18917 18918 18919 18920 18921 18922 18923 18924 18925 18926 18927 18928 18929 18930 18931 18932 18933 18934 18935 18936 18937 18938 18939 18940 18941 18942 18943 18944 18945 18946 18947 18948 18949 18950 18951 18952 18953 18954 18955 18956 18957 18958 18959 18960 18961 18962 18963 18964 18965 18966 18967 18968 18969 18970 18971 18972 18973 18974 18975 18976 18977 18978 18979 18980 18981 18982 18983 18984 18985 18986 18987 18988 18989 18990 18991 18992 18993 18994 18995 18996 18997 18998 18999 19000 19001 19002 19003 19004 19005 19006 19007 19008 19009 19010 19011 19012 19013 19014 19015 19016 19017 19018 19019 19020 19021 19022 19023 19024 19025 19026 19027 19028 19029 19030 19031 19032 19033 19034 19035 19036 19037 19038 19039 19040 19041 19042 19043 19044 19045 19046 19047 19048 19049 19050 19051 19052 19053 19054 19055 19056 19057 19058 19059 19060 19061 19062 19063 19064 19065 19066 19067 19068 19069 19070 19071 19072 19073 19074 19075 19076 19077 19078 19079 19080 19081 19082 19083 19084 19085 19086 19087 19088 19089 19090 19091 19092 19093 19094 19095 19096 19097 19098 19099 19100 19101 19102 19103 19104 19105 19106 19107 19108 19109 19110 19111 19112 19113 19114 19115 19116 19117 19118 19119 19120 19121 19122 19123 19124 19125 19126 19127 19128 19129 19130 19131 19132 19133 19134 19135 19136 19137 19138 19139 19140 19141 19142 19143 19144 19145 19146 19147 19148 19149 19150 19151 19152 19153 19154 19155 19156 19157 19158 19159 19160 19161 19162 19163 19164 19165 19166 19167 19168 19169 19170 19171 19172 19173 19174 19175 19176 19177 19178 19179 19180 19181 19182 19183 19184 19185 19186 19187 19188 19189 19190 19191 19192 19193 19194 19195 19196 19197 19198 19199 19200 19201 19202 19203 19204 19205 19206 19207 19208 19209 19210 19211 19212 19213 19214 19215 19216 19217 19218 19219 19220 19221 19222 19223 19224 19225 19226 19227 19228 19229 19230 19231 19232 19233 19234 19235 19236 19237 19238 19239 19240 19241 19242 19243 19244 19245 19246 19247 19248 19249 19250 19251 19252 19253 19254 19255 19256 19257 19258 19259 19260 19261 19262 19263 19264 19265 19266 19267 19268 19269 19270 19271 19272 19273 19274 19275 19276 19277 19278 19279 19280 19281 19282 19283 19284 19285 19286 19287 19288 19289 19290 19291 19292 19293 19294 19295 19296 19297 19298 19299 19300 19301 19302 19303 19304 19305 19306 19307 19308 19309 19310 19311 19312 19313 19314 19315 19316 19317 19318 19319 19320 19321 19322 19323 19324 19325 19326 19327 19328 19329 19330 19331 19332 19333 19334 19335 19336 19337 19338 19339 19340 19341 19342 19343 19344 19345 19346 19347 19348 19349 19350 19351 19352 19353 19354 19355 19356 19357 19358 19359 19360 19361 19362 19363 19364 19365 19366 19367 19368 19369 19370 19371 19372 19373 19374 19375 19376 19377 19378 19379 19380 19381 19382 19383 19384 19385 19386 19387 19388 19389 19390 19391 19392 19393 19394 19395 19396 19397 19398 19399 19400 19401 19402 19403 19404 19405 19406 19407 19408 19409 19410 19411 19412 19413 19414 19415 19416 19417 19418 19419 19420 19421 19422 19423 19424 19425 19426 19427 19428 19429 19430 19431 19432 19433 19434 19435 19436 19437 19438 19439 19440 19441 19442 19443 19444 19445 19446 19447 19448 19449 19450 19451 19452 19453 19454 19455 19456 19457 19458 19459 19460 19461 19462 19463 19464 19465 19466 19467 19468 19469 19470 19471 19472 19473 19474 19475 19476 19477 19478 19479 19480 19481 19482 19483 19484 19485 19486 19487 19488 19489 19490 19491 19492 19493 19494 19495 19496 19497 19498 19499 19500 19501 19502 19503 19504 19505 19506 19507 19508 19509 19510 19511 19512 19513 19514 19515 19516 19517 19518 19519 19520 19521 19522 19523 19524 19525 19526 19527 19528 19529 19530 19531 19532 19533 19534 19535 19536 19537 19538 19539 19540 19541 19542 19543 19544 19545 19546 19547 19548 19549 19550 19551 19552 19553 19554 19555 19556 19557 19558 19559 19560 19561 19562 19563 19564 19565 19566 19567 19568 19569 19570 19571 19572 19573 19574 19575 19576 19577 19578 19579 19580 19581 19582 19583 19584 19585 19586 19587 19588 19589 19590 19591 19592 19593 19594 19595 19596 19597 19598 19599 19600 19601 19602 19603 19604 19605 19606 19607 19608 19609 19610 19611 19612 19613 19614 19615 19616 19617 19618 19619 19620 19621 19622 19623 19624 19625 19626 19627 19628 19629 19630 19631 19632 19633 19634 19635 19636 19637 19638 19639 19640 19641 19642 19643 19644 19645 19646 19647 19648 19649 19650 19651 19652 19653 19654 19655 19656 19657 19658 19659 19660 19661 19662 19663 19664 19665 19666 19667 19668 19669 19670 19671 19672 19673 19674 19675 19676 19677 19678 19679 19680 19681 19682 19683 19684 19685 19686 19687 19688 19689 19690 19691 19692 19693 19694 19695 19696 19697 19698 19699 19700 19701 19702 19703 19704 19705 19706 19707 19708 19709 19710 19711 19712 19713 19714 19715 19716 19717 19718 19719 19720 19721 19722 19723 19724 19725 19726 19727 19728 19729 19730 19731 19732 19733 19734 19735 19736 19737 19738 19739 19740 19741 19742 19743 19744 19745 19746 19747 19748 19749 19750 19751 19752 19753 19754 19755 19756 19757 19758 19759 19760 19761 19762 19763 19764 19765 19766 19767 19768 19769 19770 19771 19772 19773 19774 19775 19776 19777 19778 19779 19780 19781 19782 19783 19784 19785 19786 19787 19788 19789 19790 19791 19792 19793 19794 19795 19796 19797 19798 19799 19800 19801 19802 19803 19804 19805 19806 19807 19808 19809 19810 19811 19812 19813 19814 19815 19816 19817 19818 19819 19820 19821 19822 19823 19824 19825 19826 19827 19828 19829 19830 19831 19832 19833 19834 19835 19836 19837 19838 19839 19840 19841 19842 19843 19844 19845 19846 19847 19848 19849 19850 19851 19852 19853 19854 19855 19856 19857 19858 19859 19860 19861 19862 19863 19864 19865 19866 19867 19868 19869 19870 19871 19872 19873 19874 19875 19876 19877 19878 19879 19880 19881 19882 19883 19884 19885 19886 19887 19888 19889 19890 19891 19892 19893 19894 19895 19896 19897 19898 19899 19900 19901 19902 19903 19904 19905 19906 19907 19908 19909 19910 19911 19912 19913 19914 19915 19916 19917 19918 19919 19920 19921 19922 19923 19924 19925 19926 19927 19928 19929 19930 19931 19932 19933 19934 19935 19936 19937 19938 19939 19940 19941 19942 19943 19944 19945 19946 19947 19948 19949 19950 19951 19952 19953 19954 19955 19956 19957 19958 19959 19960 19961 19962 19963 19964 19965 19966 19967 19968 19969 19970 19971 19972 19973 19974 19975 19976 19977 19978 19979 19980 19981 19982 19983 19984 19985 19986 19987 19988 19989 19990 19991 19992 19993 19994 19995 19996 19997 19998 19999 20000 20001 20002 20003 20004 20005 20006 20007 20008 20009 20010 20011 20012 20013 20014 20015 20016 20017 20018 20019 20020 20021 20022 20023 20024 20025 20026 20027 20028 20029 20030 20031 20032 20033 20034 20035 20036 20037 20038 20039 20040 20041 20042 20043 20044 20045 20046 20047 20048 20049 20050 20051 20052 20053 20054 20055 20056 20057 20058 20059 20060 20061 20062 20063 20064 20065 20066 20067 20068 20069 20070 20071 20072 20073 20074 20075 20076 20077 20078 20079 20080 20081 20082 20083 20084 20085 20086 20087 20088 20089 20090 20091 20092 20093 20094 20095 20096 20097 20098 20099 20100 20101 20102 20103 20104 20105 20106 20107 20108 20109 20110 20111 20112 20113 20114 20115 20116 20117 20118 20119 20120 20121 20122 20123 20124 20125 20126 20127 20128 20129 20130 20131 20132 20133 20134 20135 20136 20137 20138 20139 20140 20141 20142 20143 20144 20145 20146 20147 20148 20149 20150 20151 20152 20153 20154 20155 20156 20157 20158 20159 20160 20161 20162 20163 20164 20165 20166 20167 20168 20169 20170 20171 20172 20173 20174 20175 20176 20177 20178 20179 20180 20181 20182 20183 20184 20185 20186 20187 20188 20189 20190 20191 20192 20193 20194 20195 20196 20197 20198 20199 20200 20201 20202 20203 20204 20205 20206 20207 20208 20209 20210 20211 20212 20213 20214 20215 20216 20217 20218 20219 20220 20221 20222 20223 20224 20225 20226 20227 20228 20229 20230 20231 20232 20233 20234 20235 20236 20237 20238 20239 20240 20241 20242 20243 20244 20245 20246 20247 20248 20249 20250 20251 20252 20253 20254 20255 20256 20257 20258 20259 20260 20261 20262 20263 20264 20265 20266 20267 20268 20269 20270 20271 20272 20273 20274 20275 20276 20277 20278 20279 20280 20281 20282 20283 20284 20285 20286 20287 20288 20289 20290 20291 20292 20293 20294 20295 20296 20297 20298 20299 20300 20301 20302 20303 20304 20305 20306 20307 20308 20309 20310 20311 20312 20313 20314 20315 20316 20317 20318 20319 20320 20321 20322 20323 20324 20325 20326 20327 20328 20329 20330 20331 20332 20333 20334 20335 20336 20337 20338 20339 20340 20341 20342 20343 20344 20345 20346 20347 20348 20349 20350 20351 20352 20353 20354 20355 20356 20357 20358 20359 20360 20361 20362 20363 20364 20365 20366 20367 20368 20369 20370 20371 20372 20373 20374 20375 20376 20377 20378 20379 20380 20381 20382 20383 20384 20385 20386 20387 20388 20389 20390 20391 20392 20393 20394 20395 20396 20397 20398 20399 20400 20401 20402 20403 20404 20405 20406 20407 20408 20409 20410 20411 20412 20413 20414 20415 20416 20417 20418 20419 20420 20421 20422 20423 20424 20425 20426 20427 20428 20429 20430 20431 20432 20433 20434 20435 20436 20437 20438 20439 20440 20441 20442 20443 20444 20445 20446 20447 20448 20449 20450 20451 20452 20453 20454 20455 20456 20457 20458 20459 20460 20461 20462 20463 20464 20465 20466 20467 20468 20469 20470 20471 20472 20473 20474 20475 20476 20477 20478 20479 20480 20481 20482 20483 20484 20485 20486 20487 20488 20489 20490 20491 20492 20493 20494 20495 20496 20497 20498 20499 20500 20501 20502 20503 20504 20505 20506 20507 20508 20509 20510 20511 20512 20513 20514 20515 20516 20517 20518 20519 20520 20521 20522 20523 20524 20525 20526 20527 20528 20529 20530 20531 20532 20533 20534 20535 20536 20537 20538 20539 20540 20541 20542 20543 20544 20545 20546 20547 20548 20549 20550 20551 20552 20553 20554 20555 20556 20557 20558 20559 20560 20561 20562 20563 20564 20565 20566 20567 20568 20569 20570 20571 20572 20573 20574 20575 20576 20577 20578 20579 20580 20581 20582 20583 20584 20585 20586 20587 20588 20589 20590 20591 20592 20593 20594 20595 20596 20597 20598 20599 20600 20601 20602 20603 20604 20605 20606 20607 20608 20609 20610 20611 20612 20613 20614 20615 20616 20617 20618 20619 20620 20621 20622 20623 20624 20625 20626 20627 20628 20629 20630 20631 20632 20633 20634 20635 20636 20637 20638 20639 20640 20641 20642 20643 20644 20645 20646 20647 20648 20649 20650 20651 20652 20653 20654 20655 20656 20657 20658 20659 20660 20661 20662 20663 20664 20665 20666 20667 20668 20669 20670 20671 20672 20673 20674 20675 20676 20677 20678 20679 20680 20681 20682 20683 20684 20685 20686 20687 20688 20689 20690 20691 20692 20693 20694 20695 20696 20697 20698 20699 20700 20701 20702 20703 20704 20705 20706 20707 20708 20709 20710 20711 20712 20713 20714 20715 20716 20717 20718 20719 20720 20721 20722 20723 20724 20725 20726 20727 20728 20729 20730 20731 20732 20733 20734 20735 20736 20737 20738 20739 20740 20741 20742 20743 20744 20745 20746 20747 20748 20749 20750 20751 20752 20753 20754 20755 20756 20757 20758 20759 20760 20761 20762 20763 20764 20765 20766 20767 20768 20769 20770 20771 20772 20773 20774 20775 20776 20777 20778 20779 20780 20781 20782 20783 20784 20785 20786 20787 20788 20789 20790 20791 20792 20793 20794 20795 20796 20797 20798 20799 20800 20801 20802 20803 20804 20805 20806 20807 20808 20809 20810 20811 20812 20813 20814 20815 20816 20817 20818 20819 20820 20821 20822 20823 20824 20825 20826 20827 20828 20829 20830 20831 20832 20833 20834 20835 20836 20837 20838 20839 20840 20841 20842 20843 20844 20845 20846 20847 20848 20849 20850 20851 20852 20853 20854 20855 20856 20857 20858 20859 20860 20861 20862 20863 20864 20865 20866 20867 20868 20869 20870 20871 20872 20873 20874 20875 20876 20877 20878 20879 20880 20881 20882 20883 20884 20885 20886 20887 20888 20889 20890 20891 20892 20893 20894 20895 20896 20897 20898 20899 20900 20901 20902 20903 20904 20905 20906 20907 20908 20909 20910 20911 20912 20913 20914 20915 20916 20917 20918 20919 20920 20921 20922 20923 20924 20925 20926 20927 20928 20929 20930 20931 20932 20933 20934 20935 20936 20937 20938 20939 20940 20941 20942 20943 20944 20945 20946 20947 20948 20949 20950 20951 20952 20953 20954 20955 20956 20957 20958 20959 20960 20961 20962 20963 20964 20965 20966 20967 20968 20969 20970 20971 20972 20973 20974 20975 20976 20977 20978 20979 20980 20981 20982 20983 20984 20985 20986 20987 20988 20989 20990 20991 20992 20993 20994 20995 20996 20997 20998 20999 21000 21001 21002 21003 21004 21005 21006 21007 21008 21009 21010 21011 21012 21013 21014 21015 21016 21017 21018 21019 21020 21021 21022 21023 21024 21025 21026 21027 21028 21029 21030 21031 21032 21033 21034 21035 21036 21037 21038 21039 21040 21041 21042 21043 21044 21045 21046 21047 21048 21049 21050 21051 21052 21053 21054 21055 21056 21057 21058 21059 21060 21061 21062 21063 21064 21065 21066 21067 21068 21069 21070 21071 21072 21073 21074 21075 21076 21077 21078 21079 21080 21081 21082 21083 21084 21085 21086 21087 21088 21089 21090 21091 21092 21093 21094 21095 21096 21097 21098 21099 21100 21101 21102 21103 21104 21105 21106 21107 21108 21109 21110 21111 21112 21113 21114 21115 21116 21117 21118 21119 21120 21121 21122 21123 21124 21125 21126 21127 21128 21129 21130 21131 21132 21133 21134 21135 21136 21137 21138 21139 21140 21141 21142 21143 21144 21145 21146 21147 21148 21149 21150 21151 21152 21153 21154 21155 21156 21157 21158 21159 21160 21161 21162 21163 21164 21165 21166 21167 21168 21169 21170 21171 21172 21173 21174 21175 21176 21177 21178 21179 21180 21181 21182 21183 21184 21185 21186 21187 21188 21189 21190 21191 21192 21193 21194 21195 21196 21197 21198 21199 21200 21201 21202 21203 21204 21205 21206 21207 21208 21209 21210 21211 21212 21213 21214 21215 21216 21217 21218 21219 21220 21221 21222 21223 21224 21225 21226 21227 21228 21229 21230 21231 21232 21233 21234 21235 21236 21237 21238 21239 21240 21241 21242 21243 21244 21245 21246 21247 21248 21249 21250 21251 21252 21253 21254 21255 21256 21257 21258 21259 21260 21261 21262 21263 21264 21265 21266 21267 21268 21269 21270 21271 21272 21273 21274 21275 21276 21277 21278 21279 21280 21281 21282 21283 21284 21285 21286 21287 21288 21289 21290 21291 21292 21293 21294 21295 21296 21297 21298 21299 21300 21301 21302 21303 21304 21305 21306 21307 21308 21309 21310 21311 21312 21313 21314 21315 21316 21317 21318 21319 21320 21321 21322 21323 21324 21325 21326 21327 21328 21329 21330 21331 21332 21333 21334 21335 21336 21337 21338 21339 21340 21341 21342 21343 21344 21345 21346 21347 21348 21349 21350 21351 21352 21353 21354 21355 21356 21357 21358 21359 21360 21361 21362 21363 21364 21365 21366 21367 21368 21369 21370 21371 21372 21373 21374 21375 21376 21377 21378 21379 21380 21381 21382 21383 21384 21385 21386 21387 21388 21389 21390 21391 21392 21393 21394 21395 21396 21397 21398 21399 21400 21401 21402 21403 21404 21405 21406 21407 21408 21409 21410 21411 21412 21413 21414 21415 21416 21417 21418 21419 21420 21421 21422 21423 21424 21425 21426 21427 21428 21429 21430 21431 21432 21433 21434 21435 21436 21437 21438 21439 21440 21441 21442 21443 21444 21445 21446 21447 21448 21449 21450 21451 21452 21453 21454 21455 21456 21457 21458 21459 21460 21461 21462 21463 21464 21465 21466 21467 21468 21469 21470 21471 21472 21473 21474 21475 21476 21477 21478 21479 21480 21481 21482 21483 21484 21485 21486 21487 21488 21489 21490 21491 21492 21493 21494 21495 21496 21497 21498 21499 21500 21501 21502 21503 21504 21505 21506 21507 21508 21509 21510 21511 21512 21513 21514 21515 21516 21517 21518 21519 21520 21521 21522 21523 21524 21525 21526 21527 21528 21529 21530 21531 21532 21533 21534 21535 21536 21537 21538 21539 21540 21541 21542 21543 21544 21545 21546 21547 21548 21549 21550 21551 21552 21553 21554 21555 21556 21557 21558 21559 21560 21561 21562 21563 21564 21565 21566 21567 21568 21569 21570 21571 21572 21573 21574 21575 21576 21577 21578 21579 21580 21581 21582 21583 21584 21585 21586 21587 21588 21589 21590 21591 21592 21593 21594 21595 21596 21597 21598 21599 21600 21601 21602 21603 21604 21605 21606 21607 21608 21609 21610 21611 21612 21613 21614 21615 21616 21617 21618 21619 21620 21621 21622 21623 21624 21625 21626 21627 21628 21629 21630 21631 21632 21633 21634 21635 21636 21637 21638 21639 21640 21641 21642 21643 21644 21645 21646 21647 21648 21649 21650 21651 21652 21653 21654 21655 21656 21657 21658 21659 21660 21661 21662 21663 21664 21665 21666 21667 21668 21669 21670 21671 21672 21673 21674 21675 21676 21677 21678 21679 21680 21681 21682 21683 21684 21685 21686 21687 21688 21689 21690 21691 21692 21693 21694 21695 21696 21697 21698 21699 21700 21701 21702 21703 21704 21705 21706 21707 21708 21709 21710 21711 21712 21713 21714 21715 21716 21717 21718 21719 21720 21721 21722 21723 21724 21725 21726 21727 21728 21729 21730 21731 21732 21733 21734 21735 21736 21737 21738 21739 21740 21741 21742 21743 21744 21745 21746 21747 21748 21749 21750 21751 21752 21753 21754 21755 21756 21757 21758 21759 21760 21761 21762 21763 21764 21765 21766 21767 21768 21769 21770 21771 21772 21773 21774 21775 21776 21777 21778 21779 21780 21781 21782 21783 21784 21785 21786 21787 21788 21789 21790 21791 21792 21793 21794 21795 21796 21797 21798 21799 21800 21801 21802 21803 21804 21805 21806 21807 21808 21809 21810 21811 21812 21813 21814 21815 21816 21817 21818 21819 21820 21821 21822 21823 21824 21825 21826 21827 21828 21829 21830 21831 21832 21833 21834 21835 21836 21837 21838 21839 21840 21841 21842 21843 21844 21845 21846 21847 21848 21849 21850 21851 21852 21853 21854 21855 21856 21857 21858 21859 21860 21861 21862 21863 21864 21865 21866 21867 21868 21869 21870 21871 21872 21873 21874 21875 21876 21877 21878 21879 21880 21881 21882 21883 21884 21885 21886 21887 21888 21889 21890 21891 21892 21893 21894 21895 21896 21897 21898 21899 21900 21901 21902 21903 21904 21905 21906 21907 21908 21909 21910 21911 21912 21913 21914 21915 21916 21917 21918 21919 21920 21921 21922 21923 21924 21925 21926 21927 21928 21929 21930 21931 21932 21933 21934 21935 21936 21937 21938 21939 21940 21941 21942 21943 21944 21945 21946 21947 21948 21949 21950 21951 21952 21953 21954 21955 21956 21957 21958 21959 21960 21961 21962 21963 21964 21965 21966 21967 21968 21969 21970 21971 21972 21973 21974 21975 21976 21977 21978 21979 21980 21981 21982 21983 21984 21985 21986 21987 21988 21989 21990 21991 21992 21993 21994 21995 21996 21997 21998 21999 22000 22001 22002 22003 22004 22005 22006 22007 22008 22009 22010 22011 22012 22013 22014 22015 22016 22017 22018 22019 22020 22021 22022 22023 22024 22025 22026 22027 22028 22029 22030 22031 22032 22033 22034 22035 22036 22037 22038 22039 22040 22041 22042 22043 22044 22045 22046 22047 22048 22049 22050 22051 22052 22053 22054 22055 22056 22057 22058 22059 22060 22061 22062 22063 22064 22065 22066 22067 22068 22069 22070 22071 22072 22073 22074 22075 22076 22077 22078 22079 22080 22081 22082 22083 22084 22085 22086 22087 22088 22089 22090 22091 22092 22093 22094 22095 22096 22097 22098 22099 22100 22101 22102 22103 22104 22105 22106 22107 22108 22109 22110 22111 22112 22113 22114 22115 22116 22117 22118 22119 22120 22121 22122 22123 22124 22125 22126 22127 22128 22129 22130 22131 22132 22133 22134 22135 22136 22137 22138 22139 22140 22141 22142 22143 22144 22145 22146 22147 22148 22149 22150 22151 22152 22153 22154 22155 22156 22157 22158 22159 22160 22161 22162 22163 22164 22165 22166 22167 22168 22169 22170 22171 22172 22173 22174 22175 22176 22177 22178 22179 22180 22181 22182 22183 22184 22185 22186 22187 22188 22189 22190 22191 22192 22193 22194 22195 22196 22197 22198 22199 22200 22201 22202 22203 22204 22205 22206 22207 22208 22209 22210 22211 22212 22213 22214 22215 22216 22217 22218 22219 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML
><HEAD
><TITLE
>SAMBA Project Documentation</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.7"></HEAD
><BODY
CLASS="BOOK"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="BOOK"
><A
NAME="SAMBA-HOWTO-COLLECTION"
></A
><DIV
CLASS="TITLEPAGE"
><H1
CLASS="TITLE"
><A
NAME="SAMBA-HOWTO-COLLECTION"
>SAMBA Project Documentation</A
></H1
><H3
CLASS="AUTHOR"
><A
NAME="AEN4"
></A
>SAMBA Team</H3
><DIV
CLASS="AFFILIATION"
><DIV
CLASS="ADDRESS"
><P
CLASS="ADDRESS"
><CODE
CLASS="EMAIL"
>&#60;<A
HREF="mailto:samba@samba.org"
>samba@samba.org</A
>&#62;</CODE
></P
></DIV
></DIV
><H4
CLASS="EDITEDBY"
>Edited by</H4
><H3
CLASS="EDITOR"
>Jelmer R. Vernooij</H3
><H3
CLASS="EDITOR"
>John H. Terpstra</H3
><H3
CLASS="EDITOR"
>Gerald (Jerry) Carter</H3
><DIV
><DIV
CLASS="ABSTRACT"
><P
></P
><A
NAME="AEN34"
></A
><P
>This book is a collection of HOWTOs added to Samba documentation over the years.
Samba is always under development, and so is it's documentation.
The most recent version of this document
can be found at <A
HREF="http://www.samba.org/"
TARGET="_top"
>http://www.samba.org/</A
>
on the "Documentation" page.  Please send updates to <A
HREF="mailto:jerry@samba.org"
TARGET="_top"
>jerry@samba.org</A
> or 
<A
HREF="mailto:jelmer@samba.org"
TARGET="_top"
>jelmer@samba.org</A
>.</P
><P
></P
></DIV
></DIV
><DIV
CLASS="LEGALNOTICE"
><P
></P
><A
NAME="AEN39"
></A
><P
>This documentation is distributed under the GNU General Public License (GPL) 
version 2.  A copy of the license is included with the Samba source
distribution.  A copy can be found on-line at <A
HREF="http://www.fsf.org/licenses/gpl.txt"
TARGET="_top"
>http://www.fsf.org/licenses/gpl.txt</A
></P
><P
></P
></DIV
><HR></DIV
><DIV
CLASS="TOC"
><DL
><DT
><B
>Table of Contents</B
></DT
><DT
>I. <A
HREF="#INTRODUCTION"
>General installation</A
></DT
><DD
><DL
><DT
>1. <A
HREF="#INTROSMB"
>Introduction to Samba</A
></DT
><DD
><DL
><DT
>1.1. <A
HREF="#AEN61"
>Background</A
></DT
><DT
>1.2. <A
HREF="#AEN67"
>Terminology</A
></DT
><DT
>1.3. <A
HREF="#AEN91"
>Related Projects</A
></DT
><DT
>1.4. <A
HREF="#AEN100"
>SMB Methodology</A
></DT
><DT
>1.5. <A
HREF="#AEN115"
>Additional Resources</A
></DT
><DT
>1.6. <A
HREF="#AEN151"
>Epilogue</A
></DT
><DT
>1.7. <A
HREF="#AEN162"
>Miscellaneous</A
></DT
></DL
></DD
><DT
>2. <A
HREF="#INSTALL"
>How to Install and Test SAMBA</A
></DT
><DD
><DL
><DT
>2.1. <A
HREF="#AEN187"
>Obtaining and installing samba</A
></DT
><DT
>2.2. <A
HREF="#AEN193"
>Configuring samba</A
></DT
><DT
>2.3. <A
HREF="#AEN229"
>Try listing the shares available on your 
	server</A
></DT
><DT
>2.4. <A
HREF="#AEN238"
>Try connecting with the unix client</A
></DT
><DT
>2.5. <A
HREF="#AEN259"
>Try connecting from a DOS, WfWg, Win9x, WinNT, 
	Win2k, OS/2, etc... client</A
></DT
><DT
>2.6. <A
HREF="#AEN272"
>What If Things Don't Work?</A
></DT
></DL
></DD
><DT
>3. <A
HREF="#BROWSING-QUICK"
>Quick Cross Subnet Browsing / Cross Workgroup Browsing guide</A
></DT
><DD
><DL
><DT
>3.1. <A
HREF="#AEN305"
>Discussion</A
></DT
><DT
>3.2. <A
HREF="#AEN326"
>How browsing functions and how to deploy stable and 
dependable browsing using Samba</A
></DT
><DT
>3.3. <A
HREF="#AEN340"
>Use of the <B
CLASS="COMMAND"
>Remote Announce</B
> parameter</A
></DT
><DT
>3.4. <A
HREF="#AEN363"
>Use of the <B
CLASS="COMMAND"
>Remote Browse Sync</B
> parameter</A
></DT
><DT
>3.5. <A
HREF="#AEN374"
>Use of WINS</A
></DT
><DT
>3.6. <A
HREF="#AEN400"
>Do NOT use more than one (1) protocol on MS Windows machines</A
></DT
><DT
>3.7. <A
HREF="#AEN408"
>Name Resolution Order</A
></DT
></DL
></DD
><DT
>4. <A
HREF="#PASSDB"
>User information database</A
></DT
><DD
><DL
><DT
>4.1. <A
HREF="#AEN468"
>Introduction</A
></DT
><DT
>4.2. <A
HREF="#AEN475"
>Important Notes About Security</A
></DT
><DT
>4.3. <A
HREF="#AEN513"
>The smbpasswd Command</A
></DT
><DT
>4.4. <A
HREF="#AEN544"
>Plain text</A
></DT
><DT
>4.5. <A
HREF="#AEN549"
>TDB</A
></DT
><DT
>4.6. <A
HREF="#AEN552"
>LDAP</A
></DT
><DT
>4.7. <A
HREF="#AEN765"
>MySQL</A
></DT
><DT
>4.8. <A
HREF="#AEN807"
>XML</A
></DT
></DL
></DD
></DL
></DD
><DT
>II. <A
HREF="#TYPE"
>Type of installation</A
></DT
><DD
><DL
><DT
>5. <A
HREF="#SERVERTYPE"
>Nomenclature of Server Types</A
></DT
><DD
><DL
><DT
>5.1. <A
HREF="#AEN846"
>Stand Alone Server</A
></DT
><DT
>5.2. <A
HREF="#AEN853"
>Domain Member Server</A
></DT
><DT
>5.3. <A
HREF="#AEN859"
>Domain Controller</A
></DT
></DL
></DD
><DT
>6. <A
HREF="#SECURITYLEVELS"
>Samba as Stand-Alone Server</A
></DT
><DD
><DL
><DT
>6.1. <A
HREF="#AEN896"
>User and Share security level</A
></DT
></DL
></DD
><DT
>7. <A
HREF="#SAMBA-PDC"
>Samba as an NT4 or Win2k Primary Domain Controller</A
></DT
><DD
><DL
><DT
>7.1. <A
HREF="#AEN1009"
>Prerequisite Reading</A
></DT
><DT
>7.2. <A
HREF="#AEN1013"
>Background</A
></DT
><DT
>7.3. <A
HREF="#AEN1053"
>Configuring the Samba Domain Controller</A
></DT
><DT
>7.4. <A
HREF="#AEN1095"
>Creating Machine Trust Accounts and Joining Clients to the Domain</A
></DT
><DT
>7.5. <A
HREF="#AEN1211"
>Common Problems and Errors</A
></DT
><DT
>7.6. <A
HREF="#AEN1240"
>Domain Control for Windows 9x/ME</A
></DT
></DL
></DD
><DT
>8. <A
HREF="#SAMBA-BDC"
>Samba Backup Domain Controller to Samba Domain Control</A
></DT
><DD
><DL
><DT
>8.1. <A
HREF="#AEN1293"
>Prerequisite Reading</A
></DT
><DT
>8.2. <A
HREF="#AEN1297"
>Background</A
></DT
><DT
>8.3. <A
HREF="#AEN1305"
>What qualifies a Domain Controller on the network?</A
></DT
><DT
>8.4. <A
HREF="#AEN1314"
>Can Samba be a Backup Domain Controller to an NT PDC?</A
></DT
><DT
>8.5. <A
HREF="#AEN1319"
>How do I set up a Samba BDC?</A
></DT
></DL
></DD
><DT
>9. <A
HREF="#ADS"
>Samba as a ADS domain member</A
></DT
><DD
><DL
><DT
>9.1. <A
HREF="#AEN1363"
>Setup your <TT
CLASS="FILENAME"
>smb.conf</TT
></A
></DT
><DT
>9.2. <A
HREF="#AEN1376"
>Setup your <TT
CLASS="FILENAME"
>/etc/krb5.conf</TT
></A
></DT
><DT
>9.3. <A
HREF="#ADS-CREATE-MACHINE-ACCOUNT"
>Create the computer account</A
></DT
><DT
>9.4. <A
HREF="#ADS-TEST-SERVER"
>Test your server setup</A
></DT
><DT
>9.5. <A
HREF="#ADS-TEST-SMBCLIENT"
>Testing with <SPAN
CLASS="APPLICATION"
>smbclient</SPAN
></A
></DT
><DT
>9.6. <A
HREF="#AEN1424"
>Notes</A
></DT
></DL
></DD
><DT
>10. <A
HREF="#DOMAIN-MEMBER"
>Samba as a NT4 or Win2k domain member</A
></DT
><DD
><DL
><DT
>10.1. <A
HREF="#AEN1447"
>Joining an NT Domain with Samba 3.0</A
></DT
><DT
>10.2. <A
HREF="#AEN1501"
>Why is this better than security = server?</A
></DT
></DL
></DD
></DL
></DD
><DT
>III. <A
HREF="#OPTIONAL"
>Advanced Configuration</A
></DT
><DD
><DL
><DT
>11. <A
HREF="#UNIX-PERMISSIONS"
>UNIX Permission Bits and Windows NT Access Control Lists</A
></DT
><DD
><DL
><DT
>11.1. <A
HREF="#AEN1533"
>Viewing and changing UNIX permissions using the NT 
	security dialogs</A
></DT
><DT
>11.2. <A
HREF="#AEN1539"
>How to view file security on a Samba share</A
></DT
><DT
>11.3. <A
HREF="#AEN1550"
>Viewing file ownership</A
></DT
><DT
>11.4. <A
HREF="#AEN1570"
>Viewing file or directory permissions</A
></DT
><DT
>11.5. <A
HREF="#AEN1606"
>Modifying file or directory permissions</A
></DT
><DT
>11.6. <A
HREF="#AEN1628"
>Interaction with the standard Samba create mask 
	parameters</A
></DT
><DT
>11.7. <A
HREF="#AEN1681"
>Interaction with the standard Samba file attribute 
	mapping</A
></DT
></DL
></DD
><DT
>12. <A
HREF="#GROUPMAPPING"
>Configuring Group Mapping</A
></DT
><DT
>13. <A
HREF="#PRINTING"
>Printing Support</A
></DT
><DD
><DL
><DT
>13.1. <A
HREF="#AEN1744"
>Introduction</A
></DT
><DT
>13.2. <A
HREF="#AEN1766"
>Configuration</A
></DT
><DT
>13.3. <A
HREF="#AEN1878"
>The Imprints Toolset</A
></DT
><DT
>13.4. <A
HREF="#AEN1921"
>Diagnosis</A
></DT
></DL
></DD
><DT
>14. <A
HREF="#CUPS-PRINTING"
>CUPS Printing Support</A
></DT
><DD
><DL
><DT
>14.1. <A
HREF="#AEN2034"
>Introduction</A
></DT
><DT
>14.2. <A
HREF="#AEN2041"
>Configuring <TT
CLASS="FILENAME"
>smb.conf</TT
> for CUPS</A
></DT
><DT
>14.3. <A
HREF="#AEN2061"
>CUPS - RAW Print Through Mode</A
></DT
><DT
>14.4. <A
HREF="#AEN2118"
>CUPS as a network PostScript RIP -- CUPS drivers working on server, Adobe
PostScript driver with CUPS-PPDs downloaded to clients</A
></DT
><DT
>14.5. <A
HREF="#AEN2139"
>Windows Terminal Servers (WTS) as CUPS clients</A
></DT
><DT
>14.6. <A
HREF="#AEN2143"
>Setting up CUPS for driver download</A
></DT
><DT
>14.7. <A
HREF="#AEN2156"
>Sources of CUPS drivers / PPDs</A
></DT
><DT
>14.8. <A
HREF="#AEN2212"
>The CUPS Filter Chains</A
></DT
><DT
>14.9. <A
HREF="#AEN2251"
>CUPS Print Drivers and Devices</A
></DT
><DT
>14.10. <A
HREF="#AEN2328"
>Limiting the number of pages users can print</A
></DT
><DT
>14.11. <A
HREF="#AEN2424"
>Advanced Postscript Printing from MS Windows</A
></DT
><DT
>14.12. <A
HREF="#AEN2439"
>Auto-Deletion of CUPS spool files</A
></DT
></DL
></DD
><DT
>15. <A
HREF="#WINBIND"
>Unified Logons between Windows NT and UNIX using Winbind</A
></DT
><DD
><DL
><DT
>15.1. <A
HREF="#AEN2515"
>Abstract</A
></DT
><DT
>15.2. <A
HREF="#AEN2519"
>Introduction</A
></DT
><DT
>15.3. <A
HREF="#AEN2532"
>What Winbind Provides</A
></DT
><DT
>15.4. <A
HREF="#AEN2543"
>How Winbind Works</A
></DT
><DT
>15.5. <A
HREF="#AEN2586"
>Installation and Configuration</A
></DT
><DT
>15.6. <A
HREF="#AEN2843"
>Limitations</A
></DT
><DT
>15.7. <A
HREF="#AEN2853"
>Conclusion</A
></DT
></DL
></DD
><DT
>16. <A
HREF="#ADVANCEDNETWORKMANAGEMENT"
>Advanced Network Manangement</A
></DT
><DD
><DL
><DT
>16.1. <A
HREF="#AEN2869"
>Configuring Samba Share Access Controls</A
></DT
><DT
>16.2. <A
HREF="#AEN2907"
>Remote Server Administration</A
></DT
><DT
>16.3. <A
HREF="#AEN2924"
>Network Logon Script Magic</A
></DT
></DL
></DD
><DT
>17. <A
HREF="#POLICYMGMT"
>System and Account Policies</A
></DT
><DD
><DL
><DT
>17.1. <A
HREF="#AEN2958"
>Creating and Managing System Policies</A
></DT
><DT
>17.2. <A
HREF="#AEN3030"
>Managing Account/User Policies</A
></DT
><DT
>17.3. <A
HREF="#AEN3052"
>System Startup and Logon Processing Overview</A
></DT
></DL
></DD
><DT
>18. <A
HREF="#PROFILEMGMT"
>Desktop Profile Management</A
></DT
><DD
><DL
><DT
>18.1. <A
HREF="#AEN3095"
>Roaming Profiles</A
></DT
><DT
>18.2. <A
HREF="#AEN3302"
>Mandatory profiles</A
></DT
><DT
>18.3. <A
HREF="#AEN3309"
>Creating/Managing Group Profiles</A
></DT
><DT
>18.4. <A
HREF="#AEN3315"
>Default Profile for Windows Users</A
></DT
></DL
></DD
><DT
>19. <A
HREF="#INTERDOMAINTRUSTS"
>Interdomain Trust Relationships</A
></DT
><DD
><DL
><DT
>19.1. <A
HREF="#AEN3446"
>Trust Relationship Background</A
></DT
><DT
>19.2. <A
HREF="#AEN3455"
>Native MS Windows NT4 Trusts Configuration</A
></DT
><DT
>19.3. <A
HREF="#AEN3464"
>Configuring Samba NT-style Domain Trusts</A
></DT
></DL
></DD
><DT
>20. <A
HREF="#PAM"
>PAM Configuration for Centrally Managed Authentication</A
></DT
><DD
><DL
><DT
>20.1. <A
HREF="#AEN3507"
>Samba and PAM</A
></DT
><DT
>20.2. <A
HREF="#AEN3558"
>Distributed Authentication</A
></DT
><DT
>20.3. <A
HREF="#AEN3563"
>PAM Configuration in smb.conf</A
></DT
></DL
></DD
><DT
>21. <A
HREF="#VFS"
>Stackable VFS modules</A
></DT
><DD
><DL
><DT
>21.1. <A
HREF="#AEN3600"
>Introduction and configuration</A
></DT
><DT
>21.2. <A
HREF="#AEN3609"
>Included modules</A
></DT
><DT
>21.3. <A
HREF="#AEN3667"
>VFS modules available elsewhere</A
></DT
></DL
></DD
><DT
>22. <A
HREF="#MSDFS"
>Hosting a Microsoft Distributed File System tree on Samba</A
></DT
><DD
><DL
><DT
>22.1. <A
HREF="#AEN3695"
>Instructions</A
></DT
></DL
></DD
><DT
>23. <A
HREF="#INTEGRATE-MS-NETWORKS"
>Integrating MS Windows networks with Samba</A
></DT
><DD
><DL
><DT
>23.1. <A
HREF="#AEN3758"
>Name Resolution in a pure Unix/Linux world</A
></DT
><DT
>23.2. <A
HREF="#AEN3821"
>Name resolution as used within MS Windows networking</A
></DT
></DL
></DD
><DT
>24. <A
HREF="#IMPROVED-BROWSING"
>Improved browsing in samba</A
></DT
><DD
><DL
><DT
>24.1. <A
HREF="#AEN3874"
>Overview of browsing</A
></DT
><DT
>24.2. <A
HREF="#AEN3880"
>Browsing support in samba</A
></DT
><DT
>24.3. <A
HREF="#AEN3895"
>Problem resolution</A
></DT
><DT
>24.4. <A
HREF="#AEN3907"
>Browsing across subnets</A
></DT
><DT
>24.5. <A
HREF="#AEN3948"
>Setting up a WINS server</A
></DT
><DT
>24.6. <A
HREF="#AEN3971"
>Setting up Browsing in a WORKGROUP</A
></DT
><DT
>24.7. <A
HREF="#AEN3997"
>Setting up Browsing in a DOMAIN</A
></DT
><DT
>24.8. <A
HREF="#BROWSE-FORCE-MASTER"
>Forcing samba to be the master</A
></DT
><DT
>24.9. <A
HREF="#AEN4032"
>Making samba the domain master</A
></DT
><DT
>24.10. <A
HREF="#AEN4054"
>Note about broadcast addresses</A
></DT
><DT
>24.11. <A
HREF="#AEN4057"
>Multiple interfaces</A
></DT
></DL
></DD
><DT
>25. <A
HREF="#SECURING-SAMBA"
>Securing Samba</A
></DT
><DD
><DL
><DT
>25.1. <A
HREF="#AEN4073"
>Introduction</A
></DT
><DT
>25.2. <A
HREF="#AEN4076"
>Using host based protection</A
></DT
><DT
>25.3. <A
HREF="#AEN4086"
>Using interface protection</A
></DT
><DT
>25.4. <A
HREF="#AEN4094"
>Using a firewall</A
></DT
><DT
>25.5. <A
HREF="#AEN4101"
>Using a IPC$ share deny</A
></DT
><DT
>25.6. <A
HREF="#AEN4110"
>Upgrading Samba</A
></DT
></DL
></DD
><DT
>26. <A
HREF="#UNICODE"
>Unicode/Charsets</A
></DT
><DD
><DL
><DT
>26.1. <A
HREF="#AEN4132"
>What are charsets and unicode?</A
></DT
><DT
>26.2. <A
HREF="#AEN4141"
>Samba and charsets</A
></DT
><DT
>26.3. <A
HREF="#AEN4160"
>Conversion from old names</A
></DT
><DT
>26.4. <A
HREF="#AEN4168"
>Japanese charsets</A
></DT
></DL
></DD
></DL
></DD
><DT
>IV. <A
HREF="#APPENDIXES"
>Appendixes</A
></DT
><DD
><DL
><DT
>27. <A
HREF="#COMPILING"
>How to compile SAMBA</A
></DT
><DD
><DL
><DT
>27.1. <A
HREF="#AEN4204"
>Access Samba source code via CVS</A
></DT
><DT
>27.2. <A
HREF="#AEN4247"
>Accessing the samba sources via rsync and ftp</A
></DT
><DT
>27.3. <A
HREF="#AEN4253"
>Verifying Samba's PGP signature</A
></DT
><DT
>27.4. <A
HREF="#AEN4265"
>Building the Binaries</A
></DT
><DT
>27.5. <A
HREF="#AEN4322"
>Starting the smbd and nmbd</A
></DT
></DL
></DD
><DT
>28. <A
HREF="#NT4MIGRATION"
>Migration from NT4 PDC to Samba-3 PDC</A
></DT
><DD
><DL
><DT
>28.1. <A
HREF="#AEN4396"
>Planning and Getting Started</A
></DT
><DT
>28.2. <A
HREF="#AEN4429"
>Managing Samba-3 Domain Control</A
></DT
></DL
></DD
><DT
>29. <A
HREF="#PORTABILITY"
>Portability</A
></DT
><DD
><DL
><DT
>29.1. <A
HREF="#AEN4444"
>HPUX</A
></DT
><DT
>29.2. <A
HREF="#AEN4450"
>SCO Unix</A
></DT
><DT
>29.3. <A
HREF="#AEN4454"
>DNIX</A
></DT
><DT
>29.4. <A
HREF="#AEN4483"
>RedHat Linux Rembrandt-II</A
></DT
><DT
>29.5. <A
HREF="#AEN4489"
>AIX</A
></DT
><DT
>29.6. <A
HREF="#AEN4495"
>Solaris</A
></DT
></DL
></DD
><DT
>30. <A
HREF="#OTHER-CLIENTS"
>Samba and other CIFS clients</A
></DT
><DD
><DL
><DT
>30.1. <A
HREF="#AEN4522"
>Macintosh clients?</A
></DT
><DT
>30.2. <A
HREF="#AEN4531"
>OS2 Client</A
></DT
><DT
>30.3. <A
HREF="#AEN4571"
>Windows for Workgroups</A
></DT
><DT
>30.4. <A
HREF="#AEN4595"
>Windows '95/'98</A
></DT
><DT
>30.5. <A
HREF="#AEN4611"
>Windows 2000 Service Pack 2</A
></DT
><DT
>30.6. <A
HREF="#AEN4628"
>Windows NT 3.1</A
></DT
></DL
></DD
><DT
>31. <A
HREF="#SWAT"
>SWAT - The Samba Web Admininistration Tool</A
></DT
><DD
><DL
><DT
>31.1. <A
HREF="#AEN4645"
>SWAT Features and Benefits</A
></DT
></DL
></DD
><DT
>32. <A
HREF="#SPEED"
>Samba performance issues</A
></DT
><DD
><DL
><DT
>32.1. <A
HREF="#AEN4687"
>Comparisons</A
></DT
><DT
>32.2. <A
HREF="#AEN4693"
>Socket options</A
></DT
><DT
>32.3. <A
HREF="#AEN4700"
>Read size</A
></DT
><DT
>32.4. <A
HREF="#AEN4705"
>Max xmit</A
></DT
><DT
>32.5. <A
HREF="#AEN4710"
>Log level</A
></DT
><DT
>32.6. <A
HREF="#AEN4713"
>Read raw</A
></DT
><DT
>32.7. <A
HREF="#AEN4718"
>Write raw</A
></DT
><DT
>32.8. <A
HREF="#AEN4722"
>Slow Clients</A
></DT
><DT
>32.9. <A
HREF="#AEN4726"
>Slow Logins</A
></DT
><DT
>32.10. <A
HREF="#AEN4729"
>Client tuning</A
></DT
></DL
></DD
><DT
>33. <A
HREF="#DIAGNOSIS"
>The samba checklist</A
></DT
><DD
><DL
><DT
>33.1. <A
HREF="#AEN4781"
>Introduction</A
></DT
><DT
>33.2. <A
HREF="#AEN4786"
>Assumptions</A
></DT
><DT
>33.3. <A
HREF="#AEN4805"
>The tests</A
></DT
><DT
>33.4. <A
HREF="#AEN4972"
>Still having troubles?</A
></DT
></DL
></DD
><DT
>34. <A
HREF="#PROBLEMS"
>Analysing and solving samba problems</A
></DT
><DD
><DL
><DT
>34.1. <A
HREF="#AEN5004"
>Diagnostics tools</A
></DT
><DT
>34.2. <A
HREF="#AEN5019"
>Installing 'Network Monitor' on an NT Workstation or a Windows 9x box</A
></DT
><DT
>34.3. <A
HREF="#AEN5048"
>Useful URL's</A
></DT
><DT
>34.4. <A
HREF="#AEN5072"
>Getting help from the mailing lists</A
></DT
><DT
>34.5. <A
HREF="#AEN5102"
>How to get off the mailinglists</A
></DT
></DL
></DD
><DT
>35. <A
HREF="#BUGREPORT"
>Reporting Bugs</A
></DT
><DD
><DL
><DT
>35.1. <A
HREF="#AEN5125"
>Introduction</A
></DT
><DT
>35.2. <A
HREF="#AEN5135"
>General info</A
></DT
><DT
>35.3. <A
HREF="#AEN5141"
>Debug levels</A
></DT
><DT
>35.4. <A
HREF="#AEN5162"
>Internal errors</A
></DT
><DT
>35.5. <A
HREF="#AEN5176"
>Attaching to a running process</A
></DT
><DT
>35.6. <A
HREF="#AEN5184"
>Patches</A
></DT
></DL
></DD
></DL
></DD
></DL
></DIV
><DIV
CLASS="PART"
><A
NAME="INTRODUCTION"
></A
><DIV
CLASS="TITLEPAGE"
><H1
CLASS="TITLE"
>I. General installation</H1
></DIV
><DIV
CLASS="PARTINTRO"
><A
NAME="AEN44"
></A
><H1
>Introduction</H1
><P
>This part contains general info on how to install samba 
and how to configure the parts of samba you will most likely need.
PLEASE read this.</P
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="INTROSMB"
></A
>Chapter 1. Introduction to Samba</H1
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>"If you understand what you're doing, you're not learning anything." 
-- Anonymous</I
></SPAN
></P
><P
>Samba is a file and print server for Windows-based clients using TCP/IP as the underlying
transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of Samba's big
strengths is that you can use it to blend your mix of Windows and Linux machines together
without requiring a separate Windows NT/2000/2003 Server.  Samba is actively being developed
by a global team of about 30 active programmers and was originally developed by Andrew Tridgell.</P
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN61"
>1.1. Background</A
></H2
><P
>Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed
Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was
originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only
ran over UDP. When there was a need to run it over TCP so that it would be compatible
with DECnet 3.0, it was redesigned, submitted to The Open Group, and officially became
known as DCE/RPC. Microsoft came along and decided, rather than pay $20 per seat to
license this technology, to reimplement DCE/RPC themselves as MSRPC. From this, the
concept continued in the form of SMB (Server Message Block, or the "what") using the
NetBIOS (Network Basic Input/Output System, or the "how") compatibility layer. You can
run SMB (i.e., transport) over several different protocols; many different implementations
arose as a result, including NBIPX (NetBIOS over IPX, NwLnkNb, or NWNBLink) and NBT
(NetBIOS over TCP/IP, or NetBT). As the years passed, NBT became the most common form
of implementation until the advance of "Direct-Hosted TCP" -- the Microsoft marketing
term for eliminating NetBIOS entirely and running SMB by itself across TCP port 445
only. As of yet, direct-hosted TCP has yet to catch on.</P
><P
>Perhaps the best summary of the origins of SMB are voiced in the 1997 article titled, CIFS:
Common Insecurities Fail Scrutiny:</P
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Several megabytes of NT-security archives, random whitepapers, RFCs, the CIFS spec, the Samba
stuff, a few MS knowledge-base articles, strings extracted from binaries, and packet dumps have
been dutifully waded through during the information-gathering stages of this project, and there
are *still* many missing pieces... While often tedious, at least the way has been generously
littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they
thinking?</I
></SPAN
></P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN67"
>1.2. Terminology</A
></H2
><P
></P
><UL
><LI
><P
>	SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol.
	</P
></LI
><LI
><P
>	CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently
	decided that SMB needed the word "Internet" in it, so they changed it to CIFS.  
	</P
></LI
><LI
><P
>	Direct-Hosted: A method of providing file/printer sharing services over port 445/tcp
	only using DNS for name resolution instead of WINS.
	</P
></LI
><LI
><P
>	IPC: Acronym for "Inter-Process Communication". A method to communicate specific
	information between programs.
	</P
></LI
><LI
><P
>	Marshalling: - A method of serializing (i.e., sequential ordering of) variable data
	suitable for transmission via a network connection or storing in a file. The source
	data can be re-created using a similar process called unmarshalling.
	</P
></LI
><LI
><P
>	NetBIOS: Acronym for "Network Basic Input/Output System". This is not a protocol;
	it is a method of communication across an existing protocol. This is a standard which
	was originally developed for IBM by Sytek in 1983. To exaggerate the analogy a bit,
	it can help to think of this in comparison your computer's BIOS -- it controls the
	essential functions of your input/output hardware -- whereas NetBIOS controls the
	essential functions of your input/output traffic via the network. Again, this is a bit
	of an exaggeration but it should help that paradigm shift. What is important to realize
	is that NetBIOS is a transport standard, not a protocol. Unfortunately, even technically
	brilliant people tend to interchange NetBIOS with terms like NetBEUI without a second
	thought; this will cause no end (and no doubt) of confusion.
	</P
></LI
><LI
><P
>	NetBEUI: Acronym for the "NetBIOS Extended User Interface". Unlike NetBIOS, NetBEUI
	is a protocol, not a standard. It is also not routable, so traffic on one side of a
	router will be unable to communicate with the other side. Understanding NetBEUI is
	not essential to deciphering SMB; however it helps to point out that it is not the
	same as NetBIOS and to improve your score in trivia at parties. NetBEUI was originally
	referred to by Microsoft as "NBF", or "The Windows NT NetBEUI Frame protocol driver".
	It is not often heard from these days.
	</P
></LI
><LI
><P
>	NBT: Acronym for "NetBIOS over TCP"; also known as "NetBT". Allows the continued use
	of NetBIOS traffic proxied over TCP/IP. As a result, NetBIOS names are made 
	to IP addresses and NetBIOS name types are conceptually equivalent to TCP/IP ports.
	This is how file and printer sharing are accomplished in Windows 95/98/ME. They 
	traditionally rely on three ports: NetBIOS Name Service (nbname) via UDP port 137, 
	NetBIOS Datagram Service (nbdatagram) via UDP port 138, and NetBIOS Session Service 
	(nbsession) via TCP port 139. All name resolution is done via WINS, NetBIOS broadcasts, 
	and DNS. NetBIOS over TCP is documented in RFC 1001 (Concepts and methods) and RFC 1002 
	(Detailed specifications).
	</P
></LI
><LI
><P
>	W2K: Acronym for Windows 2000 Professional or Server
	</P
></LI
><LI
><P
>	W3K: Acronym for Windows 2003 Server
	</P
></LI
></UL
><P
>If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at 
http://www.samba.org).  Optionally, you could just search mailing.unix.samba at http://groups.google.com</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN91"
>1.3. Related Projects</A
></H2
><P
>Currently, there are two projects that are directly related to Samba: SMBFS and CIFS network
client file systems for Linux, both available in the Linux kernel itself.</P
><P
></P
><UL
><LI
><P
>	SMBFS (Server Message Block File System) allows you to mount SMB shares (the protocol
	that Microsoft Windows and OS/2 Lan Manager use to share files and printers 
	over local networks) and access them just like any other Unix directory. This is useful 
	if you just want to mount such filesystems without being a SMBFS server.
	</P
></LI
><LI
><P
>	CIFS (Common Internet File System) is the successor to SMB, and is actively being worked
	on in the upcoming version of the Linux kernel. The intent of this module is to 
	provide advanced network file system functionality including support for dfs (heirarchical 
	name space), secure per-user session establishment, safe distributed caching (oplock), 
	optional packet signing, Unicode and other internationalization improvements, and optional 
	Winbind (nsswitch) integration.
	</P
></LI
></UL
><P
>Again, it's important to note that these are implementations for client filesystems, and have
nothing to do with acting as a file and print server for SMB/CIFS clients.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN100"
>1.4. SMB Methodology</A
></H2
><P
>Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns),
UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS
session service, or netbios-ssn). Anyone looking at their network with a good
packet sniffer will be amazed at the amount of traffic generated by just opening
up a single file. In general, SMB sessions are established in the following order:</P
><P
></P
><UL
><LI
><P
>	"TCP Connection" - establish 3-way handshake (connection) to port 139/tcp
    or 445/tcp.
	</P
></LI
><LI
><P
>	"NetBIOS Session Request" - using the following "Calling Names": The local
    machine's NetBIOS name plus the 16th character 0x00; The server's NetBIOS
    name plus the 16th character 0x20
	</P
></LI
><LI
><P
>	"SMB Negotiate Protocol" - determine the protocol dialect to use, which will
    be one of the following: PC Network Program 1.0 (Core) - share level security
    mode only; Microsoft Networks 1.03 (Core Plus) - share level security
    mode only; Lanman1.0 (LAN Manager 1.0) - uses Challenge/Response
    Authentication; Lanman2.1 (LAN Manager 2.1) - uses Challenge/Response
    Authentication; NT LM 0.12 (NT LM 0.12) - uses Challenge/Response
    Authentication
	</P
></LI
><LI
><P
>	SMB Session Startup. Passwords are encrypted (or not) according to one of
    the following methods: Null (no encryption); Cleartext (no encryption); LM
    and NTLM; NTLM; NTLMv2
	</P
></LI
><LI
><P
>	SMB Tree Connect: Connect to a share name (e.g., \\servername\share); Connect
    to a service type (e.g., IPC$ named pipe)
	</P
></LI
></UL
><P
>A good way to examine this process in depth is to try out SecurityFriday's SWB program
at http://www.securityfriday.com/ToolDownload/SWB/swb_doc.html.  It allows you to
walk through the establishment of a SMB/CIFS session step by step.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN115"
>1.5. Additional Resources</A
></H2
><P
></P
><UL
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>CIFS: Common Insecurities Fail Scrutiny</I
></SPAN
> by "Hobbit", 
	http://hr.uoregon.edu/davidrl/cifs.txt
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Doing the Samba on Windows</I
></SPAN
> by Financial Review,
	http://afr.com/it/2002/10/01/FFXDF43AP6D.html
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Implementing CIFS</I
></SPAN
> by Christopher R. Hertel,
	http://ubiqx.org/cifs/
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Just What Is SMB?</I
></SPAN
> by Richard Sharpe,
	http://samba.anu.edu.au/cifs/docs/what-is-smb.html
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Opening Windows Everywhere</I
></SPAN
> by Mike Warfield,
	http://www.linux-mag.com/1999-05/samba_01.html
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>SMB HOWTO</I
></SPAN
> by David Wood,
	http://www.tldp.org/HOWTO/SMB-HOWTO.html
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>SMB/CIFS by The Root</I
></SPAN
> by "ledin",
	http://www.phrack.org/phrack/60/p60-0x0b.txt
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>The Story of Samba</I
></SPAN
> by Christopher R. Hertel,
	http://www.linux-mag.com/1999-09/samba_01.html
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>The Unofficial Samba HOWTO</I
></SPAN
> by David Lechnyr,
	http://hr.uoregon.edu/davidrl/samba/
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Understanding the Network Neighborhood</I
></SPAN
> by Christopher R. Hertel,
	http://www.linux-mag.com/2001-05/smb_01.html
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Using Samba as a PDC</I
></SPAN
> by Andrew Bartlett,
	http://www.linux-mag.com/2002-02/samba_01.html
	</P
></LI
></UL
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN151"
>1.6. Epilogue</A
></H2
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>"What's fundamentally wrong is that nobody ever had any taste when they
did it. Microsoft has been very much into making the user interface look good,
but internally it's just a complete mess. And even people who program for Microsoft
and who have had years of experience, just don't know how it works internally.
Worse, nobody dares change it. Nobody dares to fix bugs because it's such a
mess that fixing one bug might just break a hundred programs that depend on
that bug. And Microsoft isn't interested in anyone fixing bugs -- they're interested
in making money. They don't have anybody who takes pride in Windows 95 as an
operating system.</I
></SPAN
></P
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>People inside Microsoft know it's a bad operating system and they still
continue obviously working on it because they want to get the next version out
because they want to have all these new features to sell more copies of the
system.</I
></SPAN
></P
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>The problem with that is that over time, when you have this kind of approach,
and because nobody understands it, because nobody REALLY fixes bugs (other than
when they're really obvious), the end result is really messy. You can't trust
it because under certain circumstances it just spontaneously reboots or just
halts in the middle of something that shouldn't be strange. Normally it works
fine and then once in a blue moon for some completely unknown reason, it's dead,
and nobody knows why. Not Microsoft, not the experienced user and certainly
not the completely clueless user who probably sits there shivering thinking
"What did I do wrong?" when they didn't do anything wrong at all.</I
></SPAN
></P
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>That's what's really irritating to me."</I
></SPAN
></P
><P
>-- Linus Torvalds, from an interview with BOOT Magazine, Sept 1998
(http://hr.uoregon.edu/davidrl/boot.txt)</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN162"
>1.7. Miscellaneous</A
></H2
><P
>This chapter was lovingly handcrafted on a Dell Latitude C400 laptop running Slackware Linux 9.0,
in case anyone asks.</P
><P
>This chapter is Copyright © 2003 David Lechnyr (david at lechnyr dot com).
Permission is granted to copy, distribute and/or modify this document under the terms
of the GNU Free Documentation License, Version 1.2 or any later version published by the Free
Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt.</P
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="INSTALL"
></A
>Chapter 2. How to Install and Test SAMBA</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
NAME="AEN187"
>2.1. Obtaining and installing samba</A
></H2
><P
>Binary packages of samba are included in almost any Linux or 
	Unix distribution. There are also some packages available at 
	<A
HREF="http://samba.org/"
TARGET="_top"
>the samba homepage</A
>.
	</P
><P
>If you need to compile samba from source, check the 
	<A
HREF="#COMPILING"
>appropriate appendix chapter</A
>.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN193"
>2.2. Configuring samba</A
></H2
><P
>Samba's configuration is stored in the smb.conf file, 
	that usually resides in <TT
CLASS="FILENAME"
>/etc/samba/smb.conf</TT
> 
	or <TT
CLASS="FILENAME"
>/usr/local/samba/lib/smb.conf</TT
>. You can either 
	edit this file yourself or do it using one of the many graphical 
	tools that are available, such as the web-based interface swat, that 
	is included with samba.</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN198"
>2.2.1. Editing the <TT
CLASS="FILENAME"
>smb.conf</TT
> file</A
></H3
><P
>There are sample configuration files in the examples 
	subdirectory in the distribution. I suggest you read them 
	carefully so you can see how the options go together in 
	practice. See the man page for all the options.</P
><P
>The simplest useful configuration file would be 
	something like this:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>[global]
	workgroup = MYGROUP

[homes]
	guest ok = no
	read only = no
	</PRE
></P
><P
>which would allow connections by anyone with an 
	account on the server, using either their login name or 
	"<B
CLASS="COMMAND"
>homes</B
>" as the service name. (Note that I also set the 
	workgroup that Samba is part of. See BROWSING.txt for details)</P
><P
>Make sure you put the <TT
CLASS="FILENAME"
>smb.conf</TT
> file in the same place 
	you specified in the<TT
CLASS="FILENAME"
>Makefile</TT
> (the default is to 
	look for it in <TT
CLASS="FILENAME"
>/usr/local/samba/lib/</TT
>).</P
><P
>For more information about security settings for the 
	<B
CLASS="COMMAND"
>[homes]</B
> share please refer to the chapter 
	<A
HREF="#SECURING-SAMBA"
>Securing Samba</A
>.</P
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN214"
>2.2.1.1. Test your config file with 
	<B
CLASS="COMMAND"
>testparm</B
></A
></H4
><P
>It's important that you test the validity of your
	<TT
CLASS="FILENAME"
>smb.conf</TT
> file using the <SPAN
CLASS="APPLICATION"
>testparm</SPAN
> program. 
	If testparm runs OK then it will list the loaded services. If 
	not it will give an error message.</P
><P
>Make sure it runs OK and that the services look 
	reasonable before proceeding. </P
><P
>Always run testparm again when you change 
	<TT
CLASS="FILENAME"
>smb.conf</TT
>!</P
></DIV
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN223"
>2.2.2. SWAT</A
></H3
><P
>	SWAT is a web-based interface that helps you configure samba. 
	SWAT might not be available in the samba package on your platform, 
	but in a seperate package. Please read the swat manpage 
	on compiling, installing and configuring swat from source.
	</P
><P
>To launch SWAT just run your favorite web browser and 
	point it at "http://localhost:901/". Replace <VAR
CLASS="REPLACEABLE"
>localhost</VAR
> with the name of the computer you are running samba on if you 
	are running samba on a different computer then your browser.</P
><P
>Note that you can attach to SWAT from any IP connected 
	machine but connecting from a remote machine leaves your 
	connection open to password sniffing as passwords will be sent 
	in the clear over the wire. </P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN229"
>2.3. Try listing the shares available on your 
	server</A
></H2
><P
><SAMP
CLASS="PROMPT"
>$ </SAMP
><KBD
CLASS="USERINPUT"
>smbclient -L 
	<VAR
CLASS="REPLACEABLE"
>yourhostname</VAR
></KBD
></P
><P
>You should get back a list of shares available on 
	your server. If you don't then something is incorrectly setup. 
	Note that this method can also be used to see what shares 
	are available on other LanManager clients (such as WfWg).</P
><P
>If you choose user level security then you may find 
	that Samba requests a password before it will list the shares. 
	See the <B
CLASS="COMMAND"
>smbclient</B
> man page for details. (you 
	can force it to list the shares without a password by
	adding the option -U% to the command line. This will not work 
	with non-Samba servers)</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN238"
>2.4. Try connecting with the unix client</A
></H2
><P
><SAMP
CLASS="PROMPT"
>$ </SAMP
><KBD
CLASS="USERINPUT"
>smbclient <VAR
CLASS="REPLACEABLE"
>	//yourhostname/aservice</VAR
></KBD
></P
><P
>Typically the <VAR
CLASS="REPLACEABLE"
>yourhostname</VAR
> 
	would be the name of the host where you installed <SPAN
CLASS="APPLICATION"
>smbd</SPAN
>. 
	The <VAR
CLASS="REPLACEABLE"
>aservice</VAR
> is 
	any service you have defined in the <TT
CLASS="FILENAME"
>smb.conf</TT
>
	file. Try your user name if you just have a <B
CLASS="COMMAND"
>[homes]</B
>
	section
	in <TT
CLASS="FILENAME"
>smb.conf</TT
>.</P
><P
>For example if your unix host is <VAR
CLASS="REPLACEABLE"
>bambi</VAR
>
	and your login name is <VAR
CLASS="REPLACEABLE"
>fred</VAR
> you would type:</P
><P
><SAMP
CLASS="PROMPT"
>$ </SAMP
><KBD
CLASS="USERINPUT"
>smbclient //<VAR
CLASS="REPLACEABLE"
>bambi</VAR
>/<VAR
CLASS="REPLACEABLE"
>fred</VAR
>
	</KBD
></P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN259"
>2.5. Try connecting from a DOS, WfWg, Win9x, WinNT, 
	Win2k, OS/2, etc... client</A
></H2
><P
>Try mounting disks. eg:</P
><P
><SAMP
CLASS="PROMPT"
>C:\WINDOWS\&#62; </SAMP
><KBD
CLASS="USERINPUT"
>net use d: \\servername\service
	</KBD
></P
><P
>Try printing. eg:</P
><P
><SAMP
CLASS="PROMPT"
>C:\WINDOWS\&#62; </SAMP
><KBD
CLASS="USERINPUT"
>net use lpt1:
	\\servername\spoolservice</KBD
></P
><P
><SAMP
CLASS="PROMPT"
>C:\WINDOWS\&#62; </SAMP
><KBD
CLASS="USERINPUT"
>print filename
	</KBD
></P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN272"
>2.6. What If Things Don't Work?</A
></H2
><P
>Then you might read the file chapter 
	<A
HREF="#DIAGNOSIS"
>Diagnosis</A
> and the 
	FAQ. If you are still stuck then try to follow 
	the <A
HREF="#PROBLEMS"
>Analysing and Solving Problems chapter</A
>
	Samba has been successfully installed at thousands of sites worldwide,
	so maybe someone else has hit your problem and has overcome it. </P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN277"
>2.6.1. Scope IDs</A
></H3
><P
>By default Samba uses a blank scope ID. This means 
		all your windows boxes must also have a blank scope ID. 
		If you really want to use a non-blank scope ID then you will 
		need to use the 'netbios scope' smb.conf option.
        All your PCs will need to have the same setting for 
		this to work. I do not recommend scope IDs.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN280"
>2.6.2. Locking</A
></H3
><P
>One area which sometimes causes trouble is locking.</P
><P
>There are two types of locking which need to be 
		performed by a SMB server. The first is "record locking" 
		which allows a client to lock a range of bytes in a open file. 
		The second is the "deny modes" that are specified when a file 
		is open.</P
><P
>Record locking semantics under Unix is very
		different from record locking under Windows. Versions
		of Samba before 2.2 have tried to use the native
		fcntl() unix system call to implement proper record
		locking between different Samba clients. This can not
		be fully correct due to several reasons. The simplest
		is the fact that a Windows client is allowed to lock a
		byte range up to 2^32 or 2^64, depending on the client
		OS. The unix locking only supports byte ranges up to
		2^31. So it is not possible to correctly satisfy a
		lock request above 2^31. There are many more
		differences, too many to be listed here.</P
><P
>Samba 2.2 and above implements record locking
		completely independent of the underlying unix
		system. If a byte range lock that the client requests
		happens to fall into the range 0-2^31, Samba hands
		this request down to the Unix system. All other locks
		can not be seen by unix anyway.</P
><P
>Strictly a SMB server should check for locks before 
		every read and write call on a file. Unfortunately with the 
		way fcntl() works this can be slow and may overstress the 
		rpc.lockd. It is also almost always unnecessary as clients 
		are supposed to independently make locking calls before reads 
		and writes anyway if locking is important to them. By default 
		Samba only makes locking calls when explicitly asked
		to by a client, but if you set "strict locking = yes" then it will
		make lock checking calls on every read and write. </P
><P
>You can also disable by range locking completely 
		using "locking = no". This is useful for those shares that 
		don't support locking or don't need it (such as cdroms). In 
		this case Samba fakes the return codes of locking calls to 
		tell clients that everything is OK.</P
><P
>The second class of locking is the "deny modes". These 
		are set by an application when it opens a file to determine 
		what types of access should be allowed simultaneously with 
		its open. A client may ask for DENY_NONE, DENY_READ, DENY_WRITE 
		or DENY_ALL. There are also special compatibility modes called 
		DENY_FCB and  DENY_DOS.</P
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="BROWSING-QUICK"
></A
>Chapter 3. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide</H1
><P
>This document should be read in conjunction with Browsing and may
be taken as the fast track guide to implementing browsing across subnets
and / or across workgroups (or domains). WINS is the best tool for resolution
of NetBIOS names to IP addesses. WINS is NOT involved in browse list handling
except by way of name to address mapping.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>MS Windows 2000 and later can be configured to operate with NO NetBIOS 
over TCP/IP. Samba-3 and later also supports this mode of operation.</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN305"
>3.1. Discussion</A
></H2
><P
>Firstly, all MS Windows networking is based on SMB (Server Message
Block) based messaging. SMB messaging may be implemented using NetBIOS or 
without NetBIOS. Samba implements NetBIOS by encapsulating it over TCP/IP.
MS Windows products can do likewise. NetBIOS based networking uses broadcast
messaging to affect browse list management. When running NetBIOS over
TCP/IP this uses UDP based messaging. UDP messages can be broadcast or unicast.</P
><P
>Normally, only unicast UDP messaging can be forwarded by routers. The
<B
CLASS="COMMAND"
>remote announce</B
>
parameter to smb.conf helps to project browse announcements
to remote network segments via unicast UDP. Similarly, the 
<B
CLASS="COMMAND"
>remote browse sync</B
> parameter of <TT
CLASS="FILENAME"
>smb.conf</TT
>
implements browse list collation using unicast UDP.</P
><P
>Secondly, in those networks where Samba is the only SMB server technology
wherever possible <SPAN
CLASS="APPLICATION"
>nmbd</SPAN
> should be configured on one (1) machine as the WINS
server. This makes it easy to manage the browsing environment. If each network
segment is configured with it's own Samba WINS server, then the only way to
get cross segment browsing to work is by using the 
<B
CLASS="COMMAND"
>remote announce</B
> and the <B
CLASS="COMMAND"
>remote browse sync</B
>
parameters to your <TT
CLASS="FILENAME"
>smb.conf</TT
> file.</P
><P
>If only one WINS server is used for an entire multi-segment network then
the use of the <B
CLASS="COMMAND"
>remote announce</B
> and the 
<B
CLASS="COMMAND"
>remote browse sync</B
> parameters should NOT be necessary.</P
><P
>As of Samba 3 WINS replication is being worked on. The bulk of the code has
been committed, but it still needs maturation.</P
><P
>Right now samba WINS does not support MS-WINS replication. This means that
when setting up Samba as a WINS server there must only be one <SPAN
CLASS="APPLICATION"
>nmbd</SPAN
> configured
as a WINS server on the network. Some sites have used multiple Samba WINS
servers for redundancy (one server per subnet) and then used 
<B
CLASS="COMMAND"
>remote browse sync</B
> and <B
CLASS="COMMAND"
>remote announce</B
>
to affect browse list collation across all
segments. Note that this means clients will only resolve local names,
and must be configured to use DNS to resolve names on other subnets in
order to resolve the IP addresses of the servers they can see on other
subnets. This setup is not recommended, but is mentioned as a practical
consideration (ie: an 'if all else fails' scenario).</P
><P
>Lastly, take note that browse lists are a collection of unreliable broadcast
messages that are repeated at intervals of not more than 15 minutes. This means
that it will take time to establish a browse list and it can take up to 45
minutes to stabilise, particularly across network segments.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN326"
>3.2. How browsing functions and how to deploy stable and 
dependable browsing using Samba</A
></H2
><P
>As stated above, MS Windows machines register their NetBIOS names 
(i.e.: the machine name for each service type in operation) on start 
up. Also, as stated above, the exact method by which this name registration 
takes place is determined by whether or not the MS Windows client/server 
has been given a WINS server address, whether or not LMHOSTS lookup 
is enabled, or if DNS for NetBIOS name resolution is enabled, etc.</P
><P
>In the case where there is no WINS server all name registrations as 
well as name lookups are done by UDP broadcast. This isolates name 
resolution to the local subnet, unless LMHOSTS is used to list all 
names and IP addresses. In such situations Samba provides a means by 
which the samba server name may be forcibly injected into the browse 
list of a remote MS Windows network (using the 
<B
CLASS="COMMAND"
>remote announce</B
> parameter).</P
><P
>Where a WINS server is used, the MS Windows client will use UDP 
unicast to register with the WINS server. Such packets can be routed 
and thus WINS allows name resolution to function across routed networks.</P
><P
>During the startup process an election will take place to create a 
local master browser if one does not already exist. On each NetBIOS network 
one machine will be elected to function as the domain master browser. This 
domain browsing has nothing to do with MS security domain control. 
Instead, the domain master browser serves the role of contacting each local 
master browser (found by asking WINS or from LMHOSTS) and exchanging browse 
list contents. This way every master browser will eventually obtain a complete 
list of all machines that are on the network. Every 11-15 minutes an election 
is held to determine which machine will be the master browser. By the nature of 
the election criteria used, the machine with the highest uptime, or the 
most senior protocol version, or other criteria, will win the election 
as domain master browser.</P
><P
>Clients wishing to browse the network make use of this list, but also depend 
on the availability of correct name resolution to the respective IP 
address/addresses. </P
><P
>Any configuration that breaks name resolution and/or browsing intrinsics 
will annoy users because they will have to put up with protracted 
inability to use the network services.</P
><P
>Samba supports a feature that allows forced synchonisation 
of browse lists across routed networks using the <B
CLASS="COMMAND"
>remote 
browse sync</B
> parameter in the <TT
CLASS="FILENAME"
>smb.conf</TT
> file. 
This causes Samba to contact the local master browser on a remote network and 
to request browse list synchronisation. This effectively bridges 
two networks that are separated by routers. The two remote 
networks may use either broadcast based name resolution or WINS 
based name resolution, but it should be noted that the <B
CLASS="COMMAND"
>remote 
browse sync</B
> parameter provides browse list synchronisation - and 
that is distinct from name to address resolution, in other 
words, for cross subnet browsing to function correctly it is 
essential that a name to address resolution mechanism be provided. 
This mechanism could be via DNS, <TT
CLASS="FILENAME"
>/etc/hosts</TT
>, 
and so on.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN340"
>3.3. Use of the <B
CLASS="COMMAND"
>Remote Announce</B
> parameter</A
></H2
><P
>The <B
CLASS="COMMAND"
>remote announce</B
> parameter of 
<TT
CLASS="FILENAME"
>smb.conf</TT
> can be used to forcibly ensure
that all the NetBIOS names on a network get announced to a remote network.
The syntax of the <B
CLASS="COMMAND"
>remote announce</B
> parameter is:
<PRE
CLASS="PROGRAMLISTING"
>	remote announce = <VAR
CLASS="REPLACEABLE"
>a.b.c.d [e.f.g.h]</VAR
> ...</PRE
>
_or_
<PRE
CLASS="PROGRAMLISTING"
>	remote announce = <VAR
CLASS="REPLACEABLE"
>a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP]</VAR
> ...</PRE
>

where:
<P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
><VAR
CLASS="REPLACEABLE"
>a.b.c.d</VAR
> and 
<VAR
CLASS="REPLACEABLE"
>e.f.g.h</VAR
></DT
><DD
><P
>is either the LMB (Local Master Browser) IP address
or the broadcst address of the remote network.
ie: the LMB is at 192.168.1.10, or the address
could be given as 192.168.1.255 where the netmask
is assumed to be 24 bits (255.255.255.0).
When the remote announcement is made to the broadcast
address of the remote network every host will receive
our announcements. This is noisy and therefore
undesirable but may be necessary if we do NOT know
the IP address of the remote LMB.</P
></DD
><DT
><VAR
CLASS="REPLACEABLE"
>WORKGROUP</VAR
></DT
><DD
><P
>is optional and can be either our own workgroup
or that of the remote network. If you use the
workgroup name of the remote network then our
NetBIOS machine names will end up looking like
they belong to that workgroup, this may cause
name resolution problems and should be avoided.</P
></DD
></DL
></DIV
></P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN363"
>3.4. Use of the <B
CLASS="COMMAND"
>Remote Browse Sync</B
> parameter</A
></H2
><P
>The <B
CLASS="COMMAND"
>remote browse sync</B
> parameter of 
<TT
CLASS="FILENAME"
>smb.conf</TT
> is used to announce to
another LMB that it must synchronise it's NetBIOS name list with our
Samba LMB. It works ONLY if the Samba server that has this option is
simultaneously the LMB on it's network segment.</P
><P
>The syntax of the <B
CLASS="COMMAND"
>remote browse sync</B
> parameter is:

<PRE
CLASS="PROGRAMLISTING"
>remote browse sync = <VAR
CLASS="REPLACEABLE"
>a.b.c.d</VAR
></PRE
>

where <VAR
CLASS="REPLACEABLE"
>a.b.c.d</VAR
> is either the IP address of the remote LMB or else is the network broadcast address of the remote segment.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN374"
>3.5. Use of WINS</A
></H2
><P
>Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly
recommended. Every NetBIOS machine registers it's name together with a
name_type value for each of of several types of service it has available.
eg: It registers it's name directly as a unique (the type 0x03) name.
It also registers it's name if it is running the lanmanager compatible
server service (used to make shares and printers available to other users)
by registering the server (the type 0x20) name.</P
><P
>All NetBIOS names are up to 15 characters in length. The name_type variable
is added to the end of the name - thus creating a 16 character name. Any
name that is shorter than 15 characters is padded with spaces to the 15th
character. ie: All NetBIOS names are 16 characters long (including the
name_type information).</P
><P
>WINS can store these 16 character names as they get registered. A client
that wants to log onto the network can ask the WINS server for a list
of all names that have registered the NetLogon service name_type. This saves
broadcast traffic and greatly expedites logon processing. Since broadcast
name resolution can not be used across network segments this type of
information can only be provided via WINS _or_ via statically configured
<TT
CLASS="FILENAME"
>lmhosts</TT
> files that must reside on all clients in the
absence of WINS.</P
><P
>WINS also serves the purpose of forcing browse list synchronisation by all
LMB's. LMB's must synchronise their browse list with the DMB (domain master
browser) and WINS helps the LMB to identify it's DMB. By definition this
will work only within a single workgroup. Note that the domain master browser
has NOTHING to do with what is referred to as an MS Windows NT Domain. The
later is a reference to a security environment while the DMB refers to the
master controller for browse list information only.</P
><P
>Use of WINS will work correctly only if EVERY client TCP/IP protocol stack
has been configured to use the WINS server/s. Any client that has not been
configured to use the WINS server will continue to use only broadcast based
name registration so that WINS may NEVER get to know about it. In any case,
machines that have not registered with a WINS server will fail name to address
lookup attempts by other clients and will therefore cause workstation access
errors.</P
><P
>To configure Samba as a WINS server just add 
<B
CLASS="COMMAND"
>wins support = yes</B
> to the <TT
CLASS="FILENAME"
>smb.conf</TT
>
file [globals] section.</P
><P
>To configure Samba to register with a WINS server just add
"wins server = a.b.c.d" to your smb.conf file [globals] section.</P
><DIV
CLASS="IMPORTANT"
><P
></P
><TABLE
CLASS="IMPORTANT"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/important.gif"
HSPACE="5"
ALT="Important"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Never use both <B
CLASS="COMMAND"
>wins support = yes</B
> together
with <B
CLASS="COMMAND"
>wins server = a.b.c.d</B
>
particularly not using it's own IP address.
Specifying both will cause <SPAN
CLASS="APPLICATION"
>nmbd</SPAN
> to refuse to start!</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN391"
>3.5.1. WINS Replication</A
></H3
><P
>Samba-3 permits WINS replication through the use of the <TT
CLASS="FILENAME"
>wrepld</TT
> utility.
This tool is not currently capable of being used as it is still in active development.
As soon as this tool becomes moderately functional we will prepare man pages and enhance this
section of the documentation to provide usage and technical details.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN395"
>3.5.2. Static WINS Entries</A
></H3
><P
>New to Samba-3 is a tool called <TT
CLASS="FILENAME"
>winsedit</TT
> that may be used to add
static WINS entries to the WINS database. This tool can be used also to modify entries
existing in the WINS database.</P
><P
>The development of the winsedit tool was made necessary due to the migration
of the older style wins.dat file into a new tdb binary backend data store.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN400"
>3.6. Do NOT use more than one (1) protocol on MS Windows machines</A
></H2
><P
>A very common cause of browsing problems results from installing more than
one protocol on an MS Windows machine.</P
><P
>Every NetBIOS machine takes part in a process of electing the LMB (and DMB)
every 15 minutes. A set of election criteria is used to determine the order
of precidence for winning this election process. A machine running Samba or
Windows NT will be biased so that the most suitable machine will predictably
win and thus retain it's role.</P
><P
>The election process is "fought out" so to speak over every NetBIOS network
interface. In the case of a Windows 9x machine that has both TCP/IP and IPX
installed and has NetBIOS enabled over both protocols the election will be
decided over both protocols. As often happens, if the Windows 9x machine is
the only one with both protocols then the LMB may be won on the NetBIOS
interface over the IPX protocol. Samba will then lose the LMB role as Windows
9x will insist it knows who the LMB is. Samba will then cease to function
as an LMB and thus browse list operation on all TCP/IP only machines will
fail.</P
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Windows 95, 98, 98se, Me are referred to generically as Windows 9x.
The Windows NT4, 2000, XP and 2003 use common protocols. These are roughly
referred to as the WinNT family, but it should be recognised that 2000 and
XP/2003 introduce new protocol extensions that cause them to behave 
differently from MS Windows NT4. Generally, where a server does NOT support
the newer or extended protocol, these will fall back to the NT4 protocols.</I
></SPAN
></P
><P
>The safest rule of all to follow it this - USE ONLY ONE PROTOCOL!</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN408"
>3.7. Name Resolution Order</A
></H2
><P
>Resolution of NetBIOS names to IP addresses can take place using a number
of methods. The only ones that can provide NetBIOS name_type information
are:</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>WINS: the best tool!</TD
></TR
><TR
><TD
>LMHOSTS: is static and hard to maintain.</TD
></TR
><TR
><TD
>Broadcast: uses UDP and can not resolve names across remote segments.</TD
></TR
></TBODY
></TABLE
><P
></P
><P
>Alternative means of name resolution includes:</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>/etc/hosts: is static, hard to maintain, and lacks name_type info</TD
></TR
><TR
><TD
>DNS: is a good choice but lacks essential name_type info.</TD
></TR
></TBODY
></TABLE
><P
></P
><P
>Many sites want to restrict DNS lookups and want to avoid broadcast name
resolution traffic. The "name resolve order" parameter is of great help here.
The syntax of the "name resolve order" parameter is:
<PRE
CLASS="PROGRAMLISTING"
>name resolve order = wins lmhosts bcast host</PRE
>
_or_
<PRE
CLASS="PROGRAMLISTING"
>name resolve order = wins lmhosts  	(eliminates bcast and host)</PRE
>
The default is:
<PRE
CLASS="PROGRAMLISTING"
>name  resolve order = host lmhost wins bcast</PRE
>.
where "host" refers the the native methods used by the Unix system
to implement the gethostbyname() function call. This is normally
controlled by <TT
CLASS="FILENAME"
>/etc/host.conf</TT
>, <TT
CLASS="FILENAME"
>/etc/nsswitch.conf</TT
> and <TT
CLASS="FILENAME"
>/etc/resolv.conf</TT
>.</P
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="PASSDB"
></A
>Chapter 4. User information database</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
NAME="AEN468"
>4.1. Introduction</A
></H2
><P
>Old windows clients send plain text passwords over the wire. 
	Samba can check these passwords by crypting them and comparing them 
	to the hash stored in the unix user database.
	</P
><P
>	Newer windows clients send encrypted passwords (so-called 
	Lanman and NT hashes) over 
	the wire, instead of plain text passwords. The newest clients 
	will only send encrypted passwords and refuse to send plain text 
	passwords, unless their registry is tweaked.
	</P
><P
>These passwords can't be converted to unix style encrypted 
	passwords. Because of that you can't use the standard unix 
	user database, and you have to store the Lanman and NT hashes 
	somewhere else. </P
><P
>Next to a differently encrypted passwords, 
	windows also stores certain data for each user 
	that is not stored in a unix user database, e.g. 
	workstations the user may logon from, the location where his/her 
	profile is stored, etc.
	Samba retrieves and stores this information using a "passdb backend".
	Commonly
	available backends are LDAP, plain text file, MySQL and nisplus.
	For more information, see the documentation about the 
	<B
CLASS="COMMAND"
>passdb backend = </B
> parameter.
	</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN475"
>4.2. Important Notes About Security</A
></H2
><P
>The unix and SMB password encryption techniques seem similar 
	on the surface. This similarity is, however, only skin deep. The unix 
	scheme typically sends clear text passwords over the network when 
	logging in. This is bad. The SMB encryption scheme never sends the 
	cleartext password over the network but it does store the 16 byte 
	hashed values on disk. This is also bad. Why? Because the 16 byte hashed 
	values are a "password equivalent". You cannot derive the user's 
	password from them, but they could potentially be used in a modified 
	client to gain access to a server. This would require considerable 
	technical knowledge on behalf of the attacker but is perfectly possible. 
	You should thus treat the data stored in whatever 
	passdb backend you use (smbpasswd file, ldap, mysql) as though it contained the 
	cleartext passwords of all your users. Its contents must be kept 
	secret, and the file should be protected accordingly.</P
><P
>Ideally we would like a password scheme which neither requires 
	plain text passwords on the net or on disk. Unfortunately this 
	is not available as Samba is stuck with being compatible with 
	other SMB systems (WinNT, WfWg, Win95 etc). </P
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Note that Windows NT 4.0 Service pack 3 changed the 
		default for permissible authentication so that plaintext 
		passwords are <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>never</I
></SPAN
> sent over the wire. 
		The solution to this is either to switch to encrypted passwords 
		with Samba or edit the Windows NT registry to re-enable plaintext 
		passwords. See the document WinNT.txt for details on how to do 
		this.</P
><P
>Other Microsoft operating systems which also exhibit 
		this behavior includes</P
><P
> These versions of MS Windows do not support full domain
		security protocols, although they may log onto a domain environment.
		Of these Only MS Windows XP Home does NOT support domain logons.</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>MS DOS Network client 3.0 with 
			the basic network redirector installed</TD
></TR
><TR
><TD
>Windows 95 with the network redirector 
			update installed</TD
></TR
><TR
><TD
>Windows 98 [se]</TD
></TR
><TR
><TD
>Windows Me</TD
></TR
><TR
><TD
>Windows XP Home</TD
></TR
></TBODY
></TABLE
><P
></P
><P
> The following versions of MS Windows fully support domain
		security protocols.</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>Windows NT 3.5x</TD
></TR
><TR
><TD
>Windows NT 4.0</TD
></TR
><TR
><TD
>Windows 2000 Professional</TD
></TR
><TR
><TD
>Windows 200x Server/Advanced Server</TD
></TR
><TR
><TD
>Windows XP Professional</TD
></TR
></TBODY
></TABLE
><P
></P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>All current release of 
	Microsoft SMB/CIFS clients support authentication via the
	SMB Challenge/Response mechanism described here.  Enabling
	clear text authentication does not disable the ability
	of the client to participate in encrypted authentication.</P
></TD
></TR
></TABLE
></DIV
><P
>MS Windows clients will cache the encrypted password alone.
	Even when plain text passwords are re-enabled, through the appropriate
	registry change, the plain text password is NEVER cached. This means that
	in the event that a network connections should become disconnected (broken)
	only the cached (encrypted) password will be sent to the resource server
	to affect a auto-reconnect. If the resource server does not support encrypted
	passwords the auto-reconnect will fail. <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>USE OF ENCRYPTED PASSWORDS
	IS STRONGLY ADVISED.</I
></SPAN
></P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN501"
>4.2.1. Advantages of SMB Encryption</A
></H3
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>Plain text passwords are not passed across 
			the network. Someone using a network sniffer cannot just 
			record passwords going to the SMB server.</TD
></TR
><TR
><TD
>WinNT doesn't like talking to a server 
			that SM not support encrypted passwords. It will refuse 
			to browse the server if the server is also in user level 
			security mode. It will insist on prompting the user for the 
			password on each connection, which is very annoying. The
			only things you can do to stop this is to use SMB encryption.
			</TD
></TR
><TR
><TD
>Encrypted password support allows automatic share
			(resource) reconnects.</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN507"
>4.2.2. Advantages of non-encrypted passwords</A
></H3
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>Plain text passwords are not kept 
			on disk, and are NOT cached in memory. </TD
></TR
><TR
><TD
>Uses same password file as other unix 
			services such as login and ftp</TD
></TR
><TR
><TD
>Use of other services (such as telnet and ftp) which
			send plain text passwords over the net, so sending them for SMB
			isn't such a big deal.</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN513"
>4.3. The smbpasswd Command</A
></H2
><P
>The smbpasswd utility is a utility similar to the 
	<B
CLASS="COMMAND"
>passwd</B
> or <B
CLASS="COMMAND"
>yppasswd</B
> programs.
	It maintains the two 32 byte password fields in the passdb backend. </P
><P
><B
CLASS="COMMAND"
>smbpasswd</B
> works in a client-server mode 
	where it contacts the local smbd to change the user's password on its 
	behalf. This has enormous benefits - as follows.</P
><P
><B
CLASS="COMMAND"
>smbpasswd</B
> has the capability 
	to change passwords on Windows NT servers (this only works when 
	the request is sent to the NT Primary Domain Controller if you 
	are changing an NT Domain user's password).</P
><P
>To run smbpasswd as a normal user just type :</P
><P
><SAMP
CLASS="PROMPT"
>$ </SAMP
><KBD
CLASS="USERINPUT"
>smbpasswd</KBD
></P
><P
><SAMP
CLASS="PROMPT"
>Old SMB password: </SAMP
><KBD
CLASS="USERINPUT"
>&#60;type old value here - 
	or hit return if there was no old password&#62;</KBD
></P
><P
><SAMP
CLASS="PROMPT"
>New SMB Password: </SAMP
><KBD
CLASS="USERINPUT"
>&#60;type new value&#62;
	</KBD
></P
><P
><SAMP
CLASS="PROMPT"
>Repeat New SMB Password: </SAMP
><KBD
CLASS="USERINPUT"
>&#60;re-type new value
	</KBD
></P
><P
>If the old value does not match the current value stored for 
	that user, or the two new values do not match each other, then the 
	password will not be changed.</P
><P
>If invoked by an ordinary user it will only allow the user 
	to change his or her own Samba password.</P
><P
>If run by the root user smbpasswd may take an optional 
	argument, specifying the user name whose SMB password you wish to 
	change.  Note that when run as root smbpasswd does not prompt for 
	or check the old password value, thus allowing root to set passwords 
	for users who have forgotten their passwords.</P
><P
><B
CLASS="COMMAND"
>smbpasswd</B
> is designed to work in the same way 
	and be familiar to UNIX users who use the <B
CLASS="COMMAND"
>passwd</B
> or 
	<B
CLASS="COMMAND"
>yppasswd</B
> commands.</P
><P
>For more details on using <B
CLASS="COMMAND"
>smbpasswd</B
> refer 
	to the man page which will always be the definitive reference.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN544"
>4.4. Plain text</A
></H2
><P
>Older versions of samba retrieved user information from the unix user database 
and eventually some other fields from the file <TT
CLASS="FILENAME"
>/etc/samba/smbpasswd</TT
>
or <TT
CLASS="FILENAME"
>/etc/smbpasswd</TT
>. When password encryption is disabled, no 
data is stored at all.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN549"
>4.5. TDB</A
></H2
><P
>Samba can also store the user data in a "TDB" (Trivial Database). Using this backend 
doesn't require any additional configuration. This backend is recommended for new installations who 
don't require LDAP.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN552"
>4.6. LDAP</A
></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
NAME="AEN554"
>4.6.1. Introduction</A
></H3
><P
>This document describes how to use an LDAP directory for storing Samba user
account information traditionally stored in the smbpasswd(5) file.  It is
assumed that the reader already has a basic understanding of LDAP concepts
and has a working directory server already installed.  For more information
on LDAP architectures and Directories, please refer to the following sites.</P
><P
></P
><UL
><LI
><P
>OpenLDAP - <A
HREF="http://www.openldap.org/"
TARGET="_top"
>http://www.openldap.org/</A
></P
></LI
><LI
><P
>iPlanet Directory Server - <A
HREF="http://iplanet.netscape.com/directory"
TARGET="_top"
>http://iplanet.netscape.com/directory</A
></P
></LI
></UL
><P
>Note that <A
HREF="http://www.ora.com/"
TARGET="_top"
>O'Reilly Publishing</A
> is working on
a guide to LDAP for System Administrators which has a planned release date of
early summer, 2002.</P
><P
>Two additional Samba resources which may prove to be helpful are</P
><P
></P
><UL
><LI
><P
>The <A
HREF="http://www.unav.es/cti/ldap-smb/ldap-smb-3-howto.html"
TARGET="_top"
>Samba-PDC-LDAP-HOWTO</A
>
	maintained by Ignacio Coupeau.</P
></LI
><LI
><P
>The NT migration scripts from <A
HREF="http://samba.idealx.org/"
TARGET="_top"
>IDEALX</A
> that are
	geared to manage users and group in such a Samba-LDAP Domain Controller configuration.
	</P
></LI
></UL
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN574"
>4.6.2. Introduction</A
></H3
><P
>Traditionally, when configuring <A
HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
TARGET="_top"
>"encrypt
passwords = yes"</A
> in Samba's <TT
CLASS="FILENAME"
>smb.conf</TT
> file, user account
information such as username, LM/NT password hashes, password change times, and account
flags have been stored in the <TT
CLASS="FILENAME"
>smbpasswd(5)</TT
> file.  There are several
disadvantages to this approach for sites with very large numbers of users (counted
in the thousands).</P
><P
></P
><UL
><LI
><P
>The first is that all lookups must be performed sequentially.  Given that
there are approximately two lookups per domain logon (one for a normal
session connection such as when mapping a network drive or printer), this
is a performance bottleneck for lareg sites.  What is needed is an indexed approach
such as is used in databases.</P
></LI
><LI
><P
>The second problem is that administrators who desired to replicate a
smbpasswd file to more than one Samba server were left to use external
tools such as <B
CLASS="COMMAND"
>rsync(1)</B
> and <B
CLASS="COMMAND"
>ssh(1)</B
>
and wrote custom, in-house scripts.</P
></LI
><LI
><P
>And finally, the amount of information which is stored in an
smbpasswd entry leaves no room for additional attributes such as
a home directory, password expiration time, or even a Relative
Identified (RID).</P
></LI
></UL
><P
>As a result of these defeciencies, a more robust means of storing user attributes
used by smbd was developed.  The API which defines access to user accounts
is commonly referred to as the samdb interface (previously this was called the passdb
API, and is still so named in the CVS trees). </P
><P
>There are a few points to stress about what the ldapsam
does not provide.  The LDAP support referred to in the this documentation does not
include:</P
><P
></P
><UL
><LI
><P
>A means of retrieving user account information from
	an Windows 2000 Active Directory server.</P
></LI
><LI
><P
>A means of replacing /etc/passwd.</P
></LI
></UL
><P
>The second item can be accomplished by using LDAP NSS and PAM modules.  LGPL
versions of these libraries can be obtained from PADL Software
(<A
HREF="http://www.padl.com/"
TARGET="_top"
>http://www.padl.com/</A
>).  However,
the details of configuring these packages are beyond the scope of this document.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN598"
>4.6.3. Supported LDAP Servers</A
></H3
><P
>The LDAP samdb code in 2.2.3 (and later) has been developed and tested
using the OpenLDAP 2.0 server and client libraries. 
The same code should be able to work with Netscape's Directory Server
and client SDK. However, due to lack of testing so far, there are bound
to be compile errors and bugs.  These should not be hard to fix.
If you are so inclined, please be sure to forward all patches to
<A
HREF="mailto:samba-patches@samba.org"
TARGET="_top"
>samba-patches@samba.org</A
> and
<A
HREF="mailto:jerry@samba.org"
TARGET="_top"
>jerry@samba.org</A
>.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN603"
>4.6.4. Schema and Relationship to the RFC 2307 posixAccount</A
></H3
><P
>Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in
<TT
CLASS="FILENAME"
>examples/LDAP/samba.schema</TT
>.  The sambaAccount objectclass is given here:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL
     DESC 'Samba Account'
     MUST ( uid $ rid )
     MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
            logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
            displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
            description $ userWorkstations $ primaryGroupID $ domain ))</PRE
></P
><P
>The samba.schema file has been formatted for OpenLDAP 2.0.  The OID's are
owned by the Samba Team and as such is legal to be openly published.
If you translate the schema to be used with Netscape DS, please
submit the modified schema file as a patch to <A
HREF="mailto:jerry@samba.org"
TARGET="_top"
>jerry@samba.org</A
></P
><P
>Just as the smbpasswd file is mean to store information which supplements a
user's <TT
CLASS="FILENAME"
>/etc/passwd</TT
> entry, so is the sambaAccount object
meant to supplement the UNIX user account information.  A sambaAccount is a
<CODE
CLASS="CONSTANT"
>STRUCTURAL</CODE
> objectclass so it can be stored individually
in the directory.  However, there are several fields (e.g. uid) which overlap
with the posixAccount objectclass outlined in RFC2307.  This is by design.</P
><P
>In order to store all user account information (UNIX and Samba) in the directory,
it is necessary to use the sambaAccount and posixAccount objectclasses in
combination.  However, smbd will still obtain the user's UNIX account
information via the standard C library calls (e.g. getpwnam(), et. al.).
This means that the Samba server must also have the LDAP NSS library installed
and functioning correctly.  This division of information makes it possible to
store all Samba account information in LDAP, but still maintain UNIX account
information in NIS while the network is transitioning to a full LDAP infrastructure.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN615"
>4.6.5. Configuring Samba with LDAP</A
></H3
><DIV
CLASS="SECT3"
><H4
CLASS="SECT3"
><A
NAME="AEN617"
>4.6.5.1. OpenLDAP configuration</A
></H4
><P
>To include support for the sambaAccount object in an OpenLDAP directory
server, first copy the samba.schema file to slapd's configuration directory.</P
><P
><SAMP
CLASS="PROMPT"
>root# </SAMP
><KBD
CLASS="USERINPUT"
>cp samba.schema /etc/openldap/schema/</KBD
></P
><P
>Next, include the <TT
CLASS="FILENAME"
>samba.schema</TT
> file in <TT
CLASS="FILENAME"
>slapd.conf</TT
>.
The sambaAccount object contains two attributes which depend upon other schema
files.  The 'uid' attribute is defined in <TT
CLASS="FILENAME"
>cosine.schema</TT
> and
the 'displayName' attribute is defined in the <TT
CLASS="FILENAME"
>inetorgperson.schema</TT
>
file.  Both of these must be included before the <TT
CLASS="FILENAME"
>samba.schema</TT
> file.</P
><P
><PRE
CLASS="PROGRAMLISTING"
>## /etc/openldap/slapd.conf

## schema files (core.schema is required by default)
include	           /etc/openldap/schema/core.schema

## needed for sambaAccount
include            /etc/openldap/schema/cosine.schema
include            /etc/openldap/schema/inetorgperson.schema
include            /etc/openldap/schema/samba.schema
include            /etc/openldap/schema/nis.schema

....</PRE
></P
><P
>It is recommended that you maintain some indices on some of the most usefull attributes,
like in the following example, to speed up searches made on sambaAccount objectclasses
(and possibly posixAccount and posixGroup as well).</P
><P
><PRE
CLASS="PROGRAMLISTING"
># Indices to maintain
## required by OpenLDAP 2.0
index objectclass   eq

## support pb_getsampwnam()
index uid           pres,eq
## support pdb_getsambapwrid()
index rid           eq

## uncomment these if you are storing posixAccount and
## posixGroup entries in the directory as well
##index uidNumber     eq
##index gidNumber     eq
##index cn            eq
##index memberUid     eq</PRE
></P
></DIV
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN634"
>4.6.5.2. Configuring Samba</A
></H4
><P
>The following parameters are available in smb.conf only with <VAR
CLASS="PARAMETER"
>--with-ldapsam</VAR
>
was included with compiling Samba.</P
><P
></P
><UL
><LI
><P
><A
HREF="smb.conf.5.html#LDAPSSL"
TARGET="_top"
>ldap ssl</A
></P
></LI
><LI
><P
><A
HREF="smb.conf.5.html#LDAPSERVER"
TARGET="_top"
>ldap server</A
></P
></LI
><LI
><P
><A
HREF="smb.conf.5.html#LDAPADMINDN"
TARGET="_top"
>ldap admin dn</A
></P
></LI
><LI
><P
><A
HREF="smb.conf.5.html#LDAPSUFFIX"
TARGET="_top"
>ldap suffix</A
></P
></LI
><LI
><P
><A
HREF="smb.conf.5.html#LDAPFILTER"
TARGET="_top"
>ldap filter</A
></P
></LI
><LI
><P
><A
HREF="smb.conf.5.html#LDAPPORT"
TARGET="_top"
>ldap port</A
></P
></LI
></UL
><P
>These are described in the <A
HREF="smb.conf.5.html"
TARGET="_top"
>smb.conf(5)</A
> man
page and so will not be repeated here.  However, a sample smb.conf file for
use with an LDAP directory could appear as</P
><P
><PRE
CLASS="PROGRAMLISTING"
>## /usr/local/samba/lib/smb.conf
[global]
     security = user
     encrypt passwords = yes

     netbios name = TASHTEGO
     workgroup = NARNIA

     # ldap related parameters

     # define the DN to use when binding to the directory servers
     # The password for this DN is not stored in smb.conf.  Rather it
     # must be set by using 'smbpasswd -w <VAR
CLASS="REPLACEABLE"
>secretpw</VAR
>' to store the
     # passphrase in the secrets.tdb file.  If the "ldap admin dn" values
     # changes, this password will need to be reset.
     ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"

     #  specify the LDAP server's hostname (defaults to locahost)
     ldap server = ahab.samba.org

     # Define the SSL option when connecting to the directory
     # ('off', 'start tls', or 'on' (default))
     ldap ssl = start tls

     # define the port to use in the LDAP session (defaults to 636 when
     # "ldap ssl = on")
     ldap port = 389

     # specify the base DN to use when searching the directory
     ldap suffix = "ou=people,dc=samba,dc=org"

     # generally the default ldap search filter is ok
     # ldap filter = "(&#38;(uid=%u)(objectclass=sambaAccount))"</PRE
></P
></DIV
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN662"
>4.6.6. Accounts and Groups management</A
></H3
><P
>As users accounts are managed thru the sambaAccount objectclass, you should
modify you existing administration tools to deal with sambaAccount attributes.</P
><P
>Machines accounts are managed with the sambaAccount objectclass, just
like users accounts. However, it's up to you to stored thoses accounts
in a different tree of you LDAP namespace: you should use
"ou=Groups,dc=plainjoe,dc=org" to store groups and
"ou=People,dc=plainjoe,dc=org" to store users. Just configure your
NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration
file).</P
><P
>In Samba release 3.0, the group management system is based on posix
groups. This means that Samba make usage of the posixGroup objectclass.
For now, there is no NT-like group system management (global and local
groups).</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN667"
>4.6.7. Security and sambaAccount</A
></H3
><P
>There are two important points to remember when discussing the security
of sambaAccount entries in the directory.</P
><P
></P
><UL
><LI
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Never</I
></SPAN
> retrieve the lmPassword or
	ntPassword attribute values over an unencrypted LDAP session.</P
></LI
><LI
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Never</I
></SPAN
> allow non-admin users to
	view the lmPassword or ntPassword attribute values.</P
></LI
></UL
><P
>These password hashes are clear text equivalents and can be used to impersonate
the user without deriving the original clear text strings.  For more information
on the details of LM/NT password hashes, refer to the <A
HREF="#PASSDB"
>User Database</A
> of the Samba-HOWTO-Collection.</P
><P
>To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults
to require an encrypted session (<B
CLASS="COMMAND"
>ldap ssl = on</B
>) using
the default port of 636
when contacting the directory server.  When using an OpenLDAP 2.0 server, it
is possible to use the use the StartTLS LDAP extended  operation in the place of
LDAPS.  In either case, you are strongly discouraged to disable this security
(<B
CLASS="COMMAND"
>ldap ssl = off</B
>).</P
><P
>Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS
extended operation.  However, the OpenLDAP library still provides support for
the older method of securing communication between clients and servers.</P
><P
>The second security precaution is to prevent non-administrative users from
harvesting password hashes from the directory.  This can be done using the
following ACL in <TT
CLASS="FILENAME"
>slapd.conf</TT
>:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>## allow the "ldap admin dn" access, but deny everyone else
access to attrs=lmPassword,ntPassword
     by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write
     by * none</PRE
></P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN687"
>4.6.8. LDAP specials attributes for sambaAccounts</A
></H3
><P
>The sambaAccount objectclass is composed of the following attributes:</P
><P
></P
><UL
><LI
><P
><CODE
CLASS="CONSTANT"
>lmPassword</CODE
>: the LANMAN password 16-byte hash stored as a character
	representation of a hexidecimal string.</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>ntPassword</CODE
>: the NT password hash 16-byte stored as a character
	representation of a hexidecimal string.</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>pwdLastSet</CODE
>: The integer time in seconds since 1970 when the
	<CODE
CLASS="CONSTANT"
>lmPassword</CODE
> and <CODE
CLASS="CONSTANT"
>ntPassword</CODE
> attributes were last set.
	</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>acctFlags</CODE
>: string of 11 characters surrounded by square brackets []
	representing account flags such as U (user), W(workstation), X(no password expiration), and
	D(disabled).</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>logonTime</CODE
>: Integer value currently unused</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>logoffTime</CODE
>: Integer value currently unused</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>kickoffTime</CODE
>: Integer value currently unused</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>pwdCanChange</CODE
>: Integer value currently unused</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>pwdMustChange</CODE
>: Integer value currently unused</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>homeDrive</CODE
>: specifies the drive letter to which to map the
	UNC path specified by homeDirectory. The drive letter must be specified in the form "X:"
	where X is the letter of the drive to map. Refer to the "logon drive" parameter in the
	smb.conf(5) man page for more information.</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>scriptPath</CODE
>: The scriptPath property specifies the path of
	the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path
	is relative to the netlogon share.  Refer to the "logon script" parameter in the
	smb.conf(5) man page for more information.</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>profilePath</CODE
>: specifies a path to the user's profile.
	This value can be a null string, a local absolute path, or a UNC path.  Refer to the
	"logon path" parameter in the smb.conf(5) man page for more information.</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>smbHome</CODE
>: The homeDirectory property specifies the path of
	the home directory for the user. The string can be null. If homeDrive is set and specifies
	a drive letter, homeDirectory should be a UNC path. The path must be a network
	UNC path of the form \\server\share\directory. This value can be a null string.
	Refer to the "logon home" parameter in the smb.conf(5) man page for more information.
	</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>userWorkstation</CODE
>: character string value currently unused.
	</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>rid</CODE
>: the integer representation of the user's relative identifier
	(RID).</P
></LI
><LI
><P
><CODE
CLASS="CONSTANT"
>primaryGroupID</CODE
>: the relative identifier (RID) of the primary group
	of the user.</P
></LI
></UL
><P
>The majority of these parameters are only used when Samba is acting as a PDC of
a domain (refer to the <A
HREF="Samba-PDC-HOWTO.html"
TARGET="_top"
>Samba-PDC-HOWTO</A
> for details on
how to configure Samba as a Primary Domain Controller). The following four attributes
are only stored with the sambaAccount entry if the values are non-default values:</P
><P
></P
><UL
><LI
><P
>smbHome</P
></LI
><LI
><P
>scriptPath</P
></LI
><LI
><P
>logonPath</P
></LI
><LI
><P
>homeDrive</P
></LI
></UL
><P
>These attributes are only stored with the sambaAccount entry if
the values are non-default values.  For example, assume TASHTEGO has now been
configured as a PDC and that <B
CLASS="COMMAND"
>logon home = \\%L\%u</B
> was defined in
its <TT
CLASS="FILENAME"
>smb.conf</TT
> file. When a user named "becky" logons to the domain,
the <VAR
CLASS="PARAMETER"
>logon home</VAR
> string is expanded to \\TASHTEGO\becky.
If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org",
this value is used.  However, if this attribute does not exist, then the value
of the <VAR
CLASS="PARAMETER"
>logon home</VAR
> parameter is used in its place.  Samba
will only write the attribute value to the directory entry is the value is
something other than the default (e.g. \\MOBY\becky).</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN757"
>4.6.9. Example LDIF Entries for a sambaAccount</A
></H3
><P
>The following is a working LDIF with the inclusion of the posixAccount objectclass:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>dn: uid=guest2, ou=people,dc=plainjoe,dc=org
ntPassword: 878D8014606CDA29677A44EFA1353FC7
pwdMustChange: 2147483647
primaryGroupID: 1201
lmPassword: 552902031BEDE9EFAAD3B435B51404EE
pwdLastSet: 1010179124
logonTime: 0
objectClass: sambaAccount
uid: guest2
kickoffTime: 2147483647
acctFlags: [UX         ]
logoffTime: 2147483647
rid: 19006
pwdCanChange: 0</PRE
></P
><P
>The following is an LDIF entry for using both the sambaAccount and
posixAccount objectclasses:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
logonTime: 0
displayName: Gerald Carter
lmPassword: 552902031BEDE9EFAAD3B435B51404EE
primaryGroupID: 1201
objectClass: posixAccount
objectClass: sambaAccount
acctFlags: [UX         ]
userPassword: {crypt}BpM2ej8Rkzogo
uid: gcarter
uidNumber: 9000
cn: Gerald Carter
loginShell: /bin/bash
logoffTime: 2147483647
gidNumber: 100
kickoffTime: 2147483647
pwdLastSet: 1010179230
rid: 19000
homeDirectory: /home/tashtego/gcarter
pwdCanChange: 0
pwdMustChange: 2147483647
ntPassword: 878D8014606CDA29677A44EFA1353FC7</PRE
></P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN765"
>4.7. MySQL</A
></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
NAME="AEN767"
>4.7.1. Creating the database</A
></H3
><P
>You either can set up your own table and specify the field names to pdb_mysql (see below
for the column names) or use the default table. The file <TT
CLASS="FILENAME"
>examples/pdb/mysql/mysql.dump</TT
> 
contains the correct queries to create the required tables. Use the command :

<B
CLASS="COMMAND"
>mysql -u<VAR
CLASS="REPLACEABLE"
>username</VAR
> -h<VAR
CLASS="REPLACEABLE"
>hostname</VAR
> -p<VAR
CLASS="REPLACEABLE"
>password</VAR
> <VAR
CLASS="REPLACEABLE"
>databasename</VAR
> &#60; <TT
CLASS="FILENAME"
>/path/to/samba/examples/pdb/mysql/mysql.dump</TT
></B
>&#13;</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN777"
>4.7.2. Configuring</A
></H3
><P
>This plugin lacks some good documentation, but here is some short info:</P
><P
>Add a the following to the <B
CLASS="COMMAND"
>passdb backend</B
> variable in your <TT
CLASS="FILENAME"
>smb.conf</TT
>:
<PRE
CLASS="PROGRAMLISTING"
>passdb backend = [other-plugins] mysql:identifier [other-plugins]</PRE
></P
><P
>The identifier can be any string you like, as long as it doesn't collide with 
the identifiers of other plugins or other instances of pdb_mysql. If you 
specify multiple pdb_mysql.so entries in 'passdb backend', you also need to 
use different identifiers!</P
><P
>Additional options can be given thru the smb.conf file in the [global] section.</P
><P
><PRE
CLASS="PROGRAMLISTING"
>identifier:mysql host                     - host name, defaults to 'localhost'
identifier:mysql password
identifier:mysql user                     - defaults to 'samba'
identifier:mysql database                 - defaults to 'samba'
identifier:mysql port                     - defaults to 3306
identifier:table                          - Name of the table containing users</PRE
></P
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Since the password for the mysql user is stored in the 
smb.conf file, you should make the the smb.conf file 
readable only to the user that runs samba. This is considered a security 
bug and will be fixed soon.</P
></TD
></TR
></TABLE
></DIV
><P
>Names of the columns in this table(I've added column types those columns should have first):</P
><P
><PRE
CLASS="PROGRAMLISTING"
>identifier:logon time column             - int(9)
identifier:logoff time column            - int(9)
identifier:kickoff time column           - int(9)
identifier:pass last set time column     - int(9)
identifier:pass can change time column   - int(9)
identifier:pass must change time column  - int(9)
identifier:username column               - varchar(255) - unix username
identifier:domain column                 - varchar(255) - NT domain user is part of
identifier:nt username column            - varchar(255) - NT username
identifier:fullname column            - varchar(255) - Full name of user
identifier:home dir column               - varchar(255) - Unix homedir path
identifier:dir drive column              - varchar(2) - Directory drive path (eg: 'H:')
identifier:logon script column           - varchar(255) - Batch file to run on client side when logging on
identifier:profile path column           - varchar(255) - Path of profile
identifier:acct desc column              - varchar(255) - Some ASCII NT user data
identifier:workstations column           - varchar(255) - Workstations user can logon to (or NULL for all)
identifier:unknown string column         - varchar(255) - unknown string
identifier:munged dial column            - varchar(255) - ?
identifier:uid column                    - int(9) - Unix user ID (uid)
identifier:gid column                    - int(9) - Unix user group (gid)
identifier:user sid column               - varchar(255) - NT user SID
identifier:group sid column              - varchar(255) - NT group ID
identifier:lanman pass column            - varchar(255) - encrypted lanman password
identifier:nt pass column                - varchar(255) - encrypted nt passwd
identifier:plain pass column             - varchar(255) - plaintext password
identifier:acct control column           - int(9) - nt user data
identifier:unknown 3 column              - int(9) - unknown
identifier:logon divs column             - int(9) - ?
identifier:hours len column              - int(9) - ?
identifier:unknown 5 column              - int(9) - unknown
identifier:unknown 6 column              - int(9) - unknown</PRE
></P
><P
>Eventually, you can put a colon (:) after the name of each column, which 
should specify the column to update when updating the table. You can also
specify nothing behind the colon - then the data from the field will not be 
updated. </P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN794"
>4.7.3. Using plaintext passwords or encrypted password</A
></H3
><P
>I strongly discourage the use of plaintext passwords, however, you can use them:</P
><P
>If you would like to use plaintext passwords, set 'identifier:lanman pass column' and 'identifier:nt pass column' to 'NULL' (without the quotes) and 'identifier:plain pass column' to the name of the column containing the plaintext passwords. </P
><P
>If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN799"
>4.7.4. Getting non-column data from the table</A
></H3
><P
>It is possible to have not all data in the database and making some 'constant'.</P
><P
>For example, you can set 'identifier:fullname column' to : 
<B
CLASS="COMMAND"
>CONCAT(First_name,' ',Sur_name)</B
></P
><P
>Or, set 'identifier:workstations column' to :
<B
CLASS="COMMAND"
>NULL</B
></P
><P
>See the MySQL documentation for more language constructs.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN807"
>4.8. XML</A
></H2
><P
>This module requires libxml2 to be installed.</P
><P
>The usage of pdb_xml is pretty straightforward. To export data, use:

<KBD
CLASS="USERINPUT"
>pdbedit -e xml:filename</KBD
>

(where filename is the name of the file to put the data in)</P
><P
>To import data, use:
<KBD
CLASS="USERINPUT"
>pdbedit -i xml:filename -e current-pdb</KBD
>

Where filename is the name to read the data from and current-pdb to put it in.</P
></DIV
></DIV
></DIV
><DIV
CLASS="PART"
><A
NAME="TYPE"
></A
><DIV
CLASS="TITLEPAGE"
><H1
CLASS="TITLE"
>II. Type of installation</H1
></DIV
><DIV
CLASS="PARTINTRO"
><A
NAME="AEN816"
></A
><H1
>Introduction</H1
><P
>Samba can operate in various SMB networks. This part contains information on configuring samba 
for various environments.</P
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="SERVERTYPE"
></A
>Chapter 5. Nomenclature of Server Types</H1
><P
>Adminstrators of Microsoft networks often refer to there being three
different type of servers:</P
><P
></P
><UL
><LI
><P
>Stand Alone Server</P
></LI
><LI
><P
>Domain Member Server</P
></LI
><LI
><P
>Domain Controller</P
><P
></P
><UL
><LI
><P
>Primary Domain Controller</P
></LI
><LI
><P
>Backup Domain Controller</P
></LI
><LI
><P
>ADS Domain Controller</P
></LI
></UL
></LI
></UL
><P
>A network administrator who is familiar with these terms and who
wishes to migrate to or use Samba will want to know what these terms mean
within a Samba context.</P
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN846"
>5.1. Stand Alone Server</A
></H2
><P
>The term <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>stand alone server</I
></SPAN
> means that the server
will provide local authentication and access control for all resources
that are available from it. In general this means that there will be a
local user database. In more technical terms, it means that resources
on the machine will either be made available in either SHARE mode or in
USER mode. SHARE mode and USER mode security are documented under
discussions regarding "security mode". The smb.conf configuration parameters
that control security mode are: "security = user" and "security = share".</P
><P
>No special action is needed other than to create user accounts. Stand-alone
servers do NOT provide network logon services, meaning that machines that
use this server do NOT perform a domain logon but instead make use only of
the MS Windows logon which is local to the MS Windows workstation/server.</P
><P
>Samba tends to blur the distinction a little in respect of what is
a stand alone server. This is because the authentication database may be
local or on a remote server, even if from the samba protocol perspective
the samba server is NOT a member of a domain security context.</P
><P
>Through the use of PAM (Pluggable Authentication Modules) and nsswitch
(the name service switcher) the source of authentication may reside on 
another server. We would be inclined to call this the authentication server.
This means that the samba server may use the local Unix/Linux system
password database (/etc/passwd or /etc/shadow), may use a local smbpasswd
file (/etc/samba/smbpasswd or /usr/local/samba/lib/private/smbpasswd), or
may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB
server for authentication.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN853"
>5.2. Domain Member Server</A
></H2
><P
>This mode of server operation involves the samba machine being made a member
of a domain security context. This means by definition that all user authentication
will be done from a centrally defined authentication regime. The authentication
regime may come from an NT3/4 style (old domain technology) server, or it may be
provided from an Active Directory server (ADS) running on MS Windows 2000 or later.</P
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Of course it should be clear that the authentication back end itself could be from any
distributed directory architecture server that is supported by Samba. This can be
LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory Server, etc.</I
></SPAN
></P
><P
>Please refer to the section on Howto configure Samba as a Primary Domain Controller
and for more information regarding how to create a domain machine account for a
domain member server as well as for information regading how to enable the samba
domain member machine to join the domain and to be fully trusted by it.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN859"
>5.3. Domain Controller</A
></H2
><P
>Over the years public perceptions of what Domain Control really is has taken on an
almost mystical nature. Before we branch into a brief overview of what Domain Control
is the following types of controller are known:</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN862"
>5.3.1. Domain Controller Types</A
></H3
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>Primary Domain Controller</TD
></TR
><TR
><TD
>Backup Domain Controller</TD
></TR
><TR
><TD
>ADS Domain Controller</TD
></TR
></TBODY
></TABLE
><P
></P
><P
>The <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Primary Domain Controller</I
></SPAN
> or PDC plays an important role in the MS 
Windows NT3 and NT4 Domain Control architecture, but not in the manner that so many
expect. The PDC seeds the Domain Control database (a part of the Windows registry) and
it plays a key part in synchronisation of the domain authentication database. </P
><P
>New to Samba-3.0.0 is the ability to use a back-end file that holds the same type of data as
the NT4 style SAM (Security Account Manager) database (one of the registry files).
The samba-3.0.0 SAM can be specified via the smb.conf file parameter "passwd backend" and
valid options include <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
> smbpasswd tdbsam ldapsam nisplussam plugin unixsam</I
></SPAN
>.
The smbpasswd, tdbsam and ldapsam options can have a "_nua" suffix to indicate that No Unix
Accounts need to be created. In other words, the Samba SAM will be independant of Unix/Linux
system accounts, provided a uid range is defined from which SAM accounts can be created.</P
><P
>The <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Backup Domain Controller</I
></SPAN
> or BDC plays a key role in servicing network
authentication requests. The BDC is biased to answer logon requests so that on a network segment
that has a BDC and a PDC the BDC will be most likely to service network logon requests. The PDC will
answer network logon requests when the BDC is too busy (high load). A BDC can be promoted to
a PDC. If the PDC is on line at the time that the BDC is promoted to PDC the previous PDC is
automatically demoted to a BDC.</P
><P
>At this time Samba is NOT capable of acting as an <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>ADS Domain Controller</I
></SPAN
>.</P
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="SECURITYLEVELS"
></A
>Chapter 6. Samba as Stand-Alone Server</H1
><P
>In this section the function and purpose of Samba's <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>security</I
></SPAN
>
modes are described.</P
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN896"
>6.1. User and Share security level</A
></H2
><P
>A SMB server tells the client at startup what "security level" it is
running. There are two options "share level" and "user level". Which
of these two the client receives affects the way the client then tries
to authenticate itself. It does not directly affect (to any great
extent) the way the Samba server does security. I know this is
strange, but it fits in with the client/server approach of SMB. In SMB
everything is initiated and controlled by the client, and the server
can only tell the client what is available and whether an action is
allowed. </P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN899"
>6.1.1. User Level Security</A
></H3
><P
>I'll describe user level security first, as its simpler. In user level
security the client will send a "session setup" command directly after
the protocol negotiation. This contains a username and password. The
server can either accept or reject that username/password
combination. Note that at this stage the server has no idea what
share the client will eventually try to connect to, so it can't base
the "accept/reject" on anything other than:</P
><P
></P
><OL
TYPE="1"
><LI
><P
>the username/password</P
></LI
><LI
><P
>the machine that the client is coming from</P
></LI
></OL
><P
>If the server accepts the username/password then the client expects to
be able to mount any share (using a "tree connection") without
specifying a password. It expects that all access rights will be as
the username/password specified in the "session setup". </P
><P
>It is also possible for a client to send multiple "session setup"
requests. When the server responds it gives the client a "uid" to use
as an authentication tag for that username/password. The client can
maintain multiple authentication contexts in this way (WinDD is an
example of an application that does this)</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN909"
>6.1.2. Share Level Security</A
></H3
><P
>Ok, now for share level security. In share level security the client
authenticates itself separately for each share. It will send a
password along with each "tree connection" (share mount). It does not
explicitly send a username with this operation. The client is
expecting a password to be associated with each share, independent of
the user. This means that samba has to work out what username the
client probably wants to use. It is never explicitly sent the
username. Some commercial SMB servers such as NT actually associate
passwords directly with shares in share level security, but samba
always uses the unix authentication scheme where it is a
username/password that is authenticated, not a "share/password".</P
><P
>Many clients send a "session setup" even if the server is in share
level security. They normally send a valid username but no
password. Samba records this username in a list of "possible
usernames". When the client then does a "tree connection" it also adds
to this list the name of the share they try to connect to (useful for
home directories) and any users listed in the <B
CLASS="COMMAND"
>user =</B
> <TT
CLASS="FILENAME"
>smb.conf</TT
>
line. The password is then checked in turn against these "possible
usernames". If a match is found then the client is authenticated as
that user.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN915"
>6.1.3. Server Level Security</A
></H3
><P
>Finally "server level" security. In server level security the samba
server reports to the client that it is in user level security. The
client then does a "session setup" as described earlier. The samba
server takes the username/password that the client sends and attempts
to login to the "password server" by sending exactly the same
username/password that it got from the client. If that server is in
user level security and accepts the password then samba accepts the
clients connection. This allows the samba server to use another SMB
server as the "password server". </P
><P
>You should also note that at the very start of all this, where the
server tells the client what security level it is in, it also tells
the client if it supports encryption. If it does then it supplies the
client with a random "cryptkey". The client will then send all
passwords in encrypted form. You have to compile samba with encryption
enabled to support this feature, and you have to maintain a separate
smbpasswd file with SMB style encrypted passwords. It is
cryptographically impossible to translate from unix style encryption
to SMB style encryption, although there are some fairly simple management
schemes by which the two could be kept in sync.</P
><P
>"security = server" means that Samba reports to clients that
it is running in "user mode" but actually passes off all authentication
requests to another "user mode" server. This requires an additional
parameter "password server =" that points to the real authentication server.
That real authentication server can be another Samba server or can be a
Windows NT server, the later natively capable of encrypted password support.</P
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN920"
>6.1.3.1. Configuring Samba for Seemless Windows Network Integration</A
></H4
><P
>MS Windows clients may use encrypted passwords as part of a challenege/response
authentication model (a.k.a. NTLMv1) or alone, or clear text strings for simple
password based authentication. It should be realized that with the SMB protocol
the password is passed over the network either in plain text or encrypted, but
not both in the same authentication requests.</P
><P
>When encrypted passwords are used a password that has been entered by the user
is encrypted in two ways:</P
><P
></P
><UL
><LI
><P
>An MD4 hash of the UNICODE of the password
	string.  This is known as the NT hash.
	</P
></LI
><LI
><P
>The password is converted to upper case,
	and then padded or trucated to 14 bytes.  This string is 
	then appended with 5 bytes of NULL characters and split to
	form two 56 bit DES keys to encrypt a "magic" 8 byte value.
	The resulting 16 bytes for the LanMan hash.
	</P
></LI
></UL
><P
>MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0
pre-service pack 3 will use either mode of password authentication. All
versions of MS Windows that follow these versions no longer support plain
text passwords by default.</P
><P
>MS Windows clients have a habit of dropping network mappings that have been idle
for 10 minutes or longer. When the user attempts to use the mapped drive
connection that has been dropped, the client re-establishes the connection using
a cached copy of the password.</P
><P
>When Microsoft changed the default password mode, support was dropped for caching
of the plain text password. This means that when the registry parameter is changed
to re-enable use of plain text passwords it appears to work, but when a dropped
service connection mapping attempts to revalidate it will fail if the remote
authentication server does not support encrypted passwords.  This means that it
is definitely not a good idea to re-enable plain text password support in such clients.</P
><P
>The following parameters can be used to work around the issue of Windows 9x client
upper casing usernames and password before transmitting them to the SMB server
when using clear text authentication.</P
><P
><PRE
CLASS="PROGRAMLISTING"
>	<A
HREF="smb.conf.5.html#PASSWORDLEVEL"
TARGET="_top"
>passsword level</A
> = <VAR
CLASS="REPLACEABLE"
>integer</VAR
>
	<A
HREF="smb.conf.5.html#USERNAMELEVEL"
TARGET="_top"
>username level</A
> = <VAR
CLASS="REPLACEABLE"
>integer</VAR
></PRE
></P
><P
>By default Samba will lower case the username before attempting to lookup the user
in the database of local system accounts.  Because UNIX usernames conventionally
only contain lower case character, the <VAR
CLASS="PARAMETER"
>username level</VAR
> parameter
is rarely needed.</P
><P
>However, passwords on UNIX systems often make use of mixed case characters. 
This means that in order for a user on a Windows 9x client to connect to a Samba
server using clear text authentication, the <VAR
CLASS="PARAMETER"
>password level</VAR
>
must be set to the maximum number of upper case letter which <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>could</I
></SPAN
>
appear is a password.  Note that is the server OS uses the traditional DES version
of crypt(), then a <VAR
CLASS="PARAMETER"
>password level</VAR
> of 8 will result in case
insensitive passwords as seen from Windows users.  This will also result in longer
login times as Samba hash to compute the permutations of the password string and 
try them one by one until a match is located (or all combinations fail).</P
><P
>The best option to adopt is to enable support for encrypted passwords 
where ever Samba is used. There are three configuration possibilities 
for support of encrypted passwords:</P
></DIV
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN946"
>6.1.3.2. Use MS Windows NT as an authentication server</A
></H4
><P
>This method involves the additions of the following parameters in the <TT
CLASS="FILENAME"
>smb.conf</TT
> file:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>	encrypt passwords = Yes
	security = server
	password server = "NetBIOS_name_of_PDC"</PRE
></P
><P
>There are two ways of identifying whether or not a username and 
password pair was valid or not. One uses the reply information provided 
as part of the authentication messaging process, the other uses 
just and error code.</P
><P
>The down-side of this mode of configuration is the fact that 
for security reasons Samba will send the password server a bogus 
username and a bogus password and if the remote server fails to 
reject the username and password pair then an alternative mode 
of identification of validation is used. Where a site uses password 
lock out after a certain number of failed authentication attempts 
this will result in user lockouts.</P
><P
>Use of this mode of authentication does require there to be 
a standard Unix account for the user, this account can be blocked 
to prevent logons by other than MS Windows clients.</P
></DIV
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN955"
>6.1.4. Domain Level Security</A
></H3
><P
>When samba is operating in <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>security = domain</I
></SPAN
> mode this means that
the Samba server has a domain security trust account (a machine account) and will cause
all authentication requests to be passed through to the domain controllers.</P
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN959"
>6.1.4.1. Samba as a member of an MS Windows NT security domain</A
></H4
><P
>This method involves additon of the following paramters in the <TT
CLASS="FILENAME"
>smb.conf</TT
> file:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>	encrypt passwords = Yes
	security = domain
	workgroup = "name of NT domain"
	password server = *</PRE
></P
><P
>The use of the "*" argument to <B
CLASS="COMMAND"
>password server</B
> will cause samba to locate the
domain controller in a way analogous to the way this is done within MS Windows NT.
This is the default behaviour.</P
><P
>In order for this method to work the Samba server needs to join the 
MS Windows NT security domain. This is done as follows:</P
><P
></P
><UL
><LI
><P
>On the MS Windows NT domain controller using 
	the Server Manager add a machine account for the Samba server.
	</P
></LI
><LI
><P
>Next, on the Linux system execute: 
	<B
CLASS="COMMAND"
>smbpasswd -r PDC_NAME -j DOMAIN_NAME</B
>
	</P
></LI
></UL
><P
>Use of this mode of authentication does require there to be a standard Unix account
for the user in order to assign a uid once the account has been authenticated by
the remote Windows DC.  This account can be blocked to prevent logons by other than
MS Windows clients by things such as setting an invalid shell in the
<TT
CLASS="FILENAME"
>/etc/passwd</TT
> entry. </P
><P
>An alternative to assigning UIDs to Windows users on a Samba member server is
presented in the <A
HREF="winbind.html"
TARGET="_top"
>Winbind Overview</A
> chapter
in this HOWTO collection.</P
></DIV
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN978"
>6.1.5. ADS Level Security</A
></H3
><P
>For information about the configuration option please refer to the entire section entitled
<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Samba as an ADS Domain Member.</I
></SPAN
></P
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="SAMBA-PDC"
></A
>Chapter 7. Samba as an NT4 or Win2k Primary Domain Controller</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
NAME="AEN1009"
>7.1. Prerequisite Reading</A
></H2
><P
>Before you continue reading in this chapter, please make sure 
that you are comfortable with configuring basic files services
in smb.conf and how to enable and administer password 
encryption in Samba.  Theses two topics are covered in the
<TT
CLASS="FILENAME"
>smb.conf</TT
> manpage.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1013"
>7.2. Background</A
></H2
><P
>This article outlines the steps necessary for configuring Samba as a PDC.
It is necessary to have a working Samba server prior to implementing the
PDC functionality.</P
><P
></P
><UL
><LI
><P
>	Domain logons for Windows NT 4.0 / 200x / XP Professional clients.
	</P
></LI
><LI
><P
>	Placing Windows 9x / Me clients in user level security
	</P
></LI
><LI
><P
>	Retrieving a list of users and groups from a Samba PDC to
	Windows 9x / Me / NT / 200x / XP Professional clients
	</P
></LI
><LI
><P
>	Roaming Profiles
	</P
></LI
><LI
><P
>	Network/System Policies
	</P
></LI
></UL
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Roaming Profiles and System/Network policies are advanced network administration topics
that are covered separately in this document.</P
></TD
></TR
></TABLE
></DIV
><P
>The following functionalities are new to the Samba 3.0 release:</P
><P
></P
><UL
><LI
><P
>	Windows NT 4 domain trusts
	</P
></LI
><LI
><P
>	Adding users via the User Manager for Domains
	</P
></LI
></UL
><P
>The following functionalities are NOT provided by Samba 3.0:</P
><P
></P
><UL
><LI
><P
>	SAM replication with Windows NT 4.0 Domain Controllers
	(i.e. a Samba PDC and a Windows NT BDC or vice versa) 
	</P
></LI
><LI
><P
>	Acting as a Windows 2000 Domain Controller (i.e. Kerberos and 
	Active Directory)
	</P
></LI
></UL
><P
>Please note that Windows 9x / Me / XP Home clients are not true members of a domain
for reasons outlined in this article.  Therefore the protocol for
support Windows 9x-style domain logons is completely different
from NT4 / Win2k type domain logons and has been officially supported for some 
time.</P
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>MS Windows XP Home edition is NOT able to join a domain and does not permit
the use of domain logons.</I
></SPAN
></P
><P
>Implementing a Samba PDC can basically be divided into 3 broad
steps.</P
><P
></P
><OL
TYPE="1"
><LI
><P
>	Configuring the Samba PDC
	</P
></LI
><LI
><P
>	Creating machine trust accounts	and joining clients to the domain
	</P
></LI
><LI
><P
>	Adding and managing domain user accounts
	</P
></LI
></OL
><P
>There are other minor details such as user profiles, system
policies, etc...  However, these are not necessarily specific
to a Samba PDC as much as they are related to Windows NT networking
concepts.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1053"
>7.3. Configuring the Samba Domain Controller</A
></H2
><P
>The first step in creating a working Samba PDC is to 
understand the parameters necessary in smb.conf. Here we
attempt to explain the parameters that are covered in
the <TT
CLASS="FILENAME"
>smb.conf</TT
> man page.</P
><P
>Here is an example <TT
CLASS="FILENAME"
>smb.conf</TT
> for acting as a PDC:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>[global]
    ; Basic server settings
    <A
HREF="smb.conf.5.html#NETBIOSNAME"
TARGET="_top"
>netbios name</A
> = <VAR
CLASS="REPLACEABLE"
>POGO</VAR
>
    <A
HREF="smb.conf.5.html#WORKGROUP"
TARGET="_top"
>workgroup</A
> = <VAR
CLASS="REPLACEABLE"
>NARNIA</VAR
>

    ; we should act as the domain and local master browser
    <A
HREF="smb.conf.5.html#OSLEVEL"
TARGET="_top"
>os level</A
> = 64
    <A
HREF="smb.conf.5.html#PERFERREDMASTER"
TARGET="_top"
>preferred master</A
> = yes
    <A
HREF="smb.conf.5.html#DOMAINMASTER"
TARGET="_top"
>domain master</A
> = yes
    <A
HREF="smb.conf.5.html#LOCALMASTER"
TARGET="_top"
>local master</A
> = yes
    
    ; security settings (must user security = user)
    <A
HREF="smb.conf.5.html#SECURITYEQUALSUSER"
TARGET="_top"
>security</A
> = user
    
    ; encrypted passwords are a requirement for a PDC
    <A
HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
TARGET="_top"
>encrypt passwords</A
> = yes
    
    ; support domain logons
    <A
HREF="smb.conf.5.html#DOMAINLOGONS"
TARGET="_top"
>domain logons</A
> = yes
    
    ; where to store user profiles?
    <A
HREF="smb.conf.5.html#LOGONPATH"
TARGET="_top"
>logon path</A
> = \\%N\profiles\%u
    
    ; where is a user's home directory and where should it be mounted at?
    <A
HREF="smb.conf.5.html#LOGONDRIVE"
TARGET="_top"
>logon drive</A
> = H:
    <A
HREF="smb.conf.5.html#LOGONHOME"
TARGET="_top"
>logon home</A
> = \\homeserver\%u
    
    ; specify a generic logon script for all users
    ; this is a relative **DOS** path to the [netlogon] share
    <A
HREF="smb.conf.5.html#LOGONSCRIPT"
TARGET="_top"
>logon script</A
> = logon.cmd

; necessary share for domain controller
[netlogon]
    <A
HREF="smb.conf.5.html#PATH"
TARGET="_top"
>path</A
> = /usr/local/samba/lib/netlogon
    <A
HREF="smb.conf.5.html#READONLY"
TARGET="_top"
>read only</A
> = yes
    <A
HREF="smb.conf.5.html#WRITELIST"
TARGET="_top"
>write list</A
> = <VAR
CLASS="REPLACEABLE"
>ntadmin</VAR
>
    
; share for storing user profiles
[profiles]
    <A
HREF="smb.conf.5.html#PATH"
TARGET="_top"
>path</A
> = /export/smb/ntprofile
    <A
HREF="smb.conf.5.html#READONLY"
TARGET="_top"
>read only</A
> = no
    <A
HREF="smb.conf.5.html#CREATEMASK"
TARGET="_top"
>create mask</A
> = 0600
    <A
HREF="smb.conf.5.html#DIRECTORYMASK"
TARGET="_top"
>directory mask</A
> = 0700</PRE
></P
><P
>There are a couple of points to emphasize in the above configuration.</P
><P
></P
><UL
><LI
><P
>	Encrypted passwords must be enabled.  For more details on how 
	to do this, refer to <A
HREF="#PASSDB"
>the User Database chapter</A
>.
	</P
></LI
><LI
><P
>	The server must support domain logons and a
	<TT
CLASS="FILENAME"
>[netlogon]</TT
> share
	</P
></LI
><LI
><P
>	The server must be the domain master browser in order for Windows 
	client to locate the server as a DC.  Please refer to the various 
	Network Browsing documentation included with this distribution for 
	details.
	</P
></LI
></UL
><P
>Samba 3.0 offers a complete implementation of group mapping
between Windows NT groups and Unix groups (this is really quite
complicated to explain in a short space).</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1095"
>7.4. Creating Machine Trust Accounts and Joining Clients to the Domain</A
></H2
><P
>A machine trust account is a Samba account that is used to
authenticate a client machine (rather than a user) to the Samba
server.  In Windows terminology, this is known as a "Computer
Account."</P
><P
>The password of a machine trust account acts as the shared secret for
secure communication with the Domain Controller.  This is a security
feature to prevent an unauthorized machine with the same NetBIOS name
from joining the domain and gaining access to domain user/group
accounts.  Windows NT, 200x, XP Professional clients use machine trust
accounts, but Windows 9x / Me / XP Home clients do not.  Hence, a
Windows 9x / Me / XP Home  client is never a true member of a domain
because it does not possess a machine trust account, and thus has no
shared secret with the domain controller.</P
><P
>A Windows PDC stores each machine trust account in the Windows
Registry. A Samba-3 PDC also has to stoe machine trust account information
in a suitable back-end data store. With Samba-3 there can be multiple back-ends
for this including:</P
><P
></P
><UL
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>smbpaswd</I
></SPAN
> - the plain ascii file stored used by
	earlier versions of Samba. This file configuration option requires
	a Unix/Linux system account for EVERY entry (ie: both for user and for
	machine accounts). This file will be located in the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>private</I
></SPAN
>
	directory (default is /usr/local/samba/lib/private or on linux /etc/samba).
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>smbpasswd_nua</I
></SPAN
> - This file is independant of the
	system wide user accounts. The use of this back-end option requires
	specification of the "non unix account range" option also. It is called
	smbpasswd and will be located in the <TT
CLASS="FILENAME"
>private</TT
> directory.
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>tdbsam</I
></SPAN
> - a binary database backend that will be
	stored in the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>private</I
></SPAN
> directory in a file called
	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>passwd.tdb</I
></SPAN
>. The key benefit of this binary format
	file is that it can store binary objects that can not be accomodated
	in the traditional plain text smbpasswd file.
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>tdbsam_nua</I
></SPAN
> like the smbpasswd_nua option above, this
	file allows the creation of arbitrary user and machine accounts without
	requiring that account to be added to the system (/etc/passwd) file. It
	too requires the specification of the "non unix account range" option
	in the [globals] section of the <TT
CLASS="FILENAME"
>smb.conf</TT
> file.
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>ldapsam</I
></SPAN
> - An LDAP based back-end. Permits the
	LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>ldapsam_nua</I
></SPAN
> - LDAP based back-end with no unix
	account requirement, like smbpasswd_nua and tdbsam_nua above.
	</P
></LI
></UL
><P
>Read the chapter about the <A
HREF="#PASSDB"
>User Database</A
> 
for details.</P
><P
>A Samba PDC, however, stores each machine trust account in two parts,
as follows:

<P
></P
><UL
><LI
><P
>A Samba account, stored in the same location as user
    LanMan and NT password hashes (currently
    <TT
CLASS="FILENAME"
>smbpasswd</TT
>). The Samba account 
    possesses and uses only the NT password hash.</P
></LI
><LI
><P
>A corresponding Unix account, typically stored in
    <TT
CLASS="FILENAME"
>/etc/passwd</TT
>. (Future releases will alleviate the need to
    create <TT
CLASS="FILENAME"
>/etc/passwd</TT
> entries.) </P
></LI
></UL
></P
><P
>There are two ways to create machine trust accounts:</P
><P
></P
><UL
><LI
><P
> Manual creation. Both the Samba and corresponding
	Unix account are created by hand.</P
></LI
><LI
><P
> "On-the-fly" creation. The Samba machine trust
	account is automatically created by Samba at the time the client
	is joined to the domain. (For security, this is the
	recommended method.) The corresponding Unix account may be
	created automatically or manually. </P
></LI
></UL
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1141"
>7.4.1. Manual Creation of Machine Trust Accounts</A
></H3
><P
>The first step in manually creating a machine trust account is to
manually create the corresponding Unix account in
<TT
CLASS="FILENAME"
>/etc/passwd</TT
>.  This can be done using
<B
CLASS="COMMAND"
>vipw</B
> or other 'add user' command that is normally
used to create new Unix accounts.  The following is an example for a
Linux based Samba server:</P
><P
>  <SAMP
CLASS="PROMPT"
>root# </SAMP
><B
CLASS="COMMAND"
>/usr/sbin/useradd -g 100 -d /dev/null -c <VAR
CLASS="REPLACEABLE"
>"machine 
nickname"</VAR
> -s /bin/false <VAR
CLASS="REPLACEABLE"
>machine_name</VAR
>$ </B
></P
><P
><SAMP
CLASS="PROMPT"
>root# </SAMP
><B
CLASS="COMMAND"
>passwd -l <VAR
CLASS="REPLACEABLE"
>machine_name</VAR
>$</B
></P
><P
>On *BSD systems, this can be done using the 'chpass' utility:</P
><P
><SAMP
CLASS="PROMPT"
>root# </SAMP
><B
CLASS="COMMAND"
>chpass -a "<VAR
CLASS="REPLACEABLE"
>machine_name</VAR
>$:*:101:100::0:0:Workstation <VAR
CLASS="REPLACEABLE"
>machine_name</VAR
>:/dev/null:/sbin/nologin"</B
></P
><P
>The <TT
CLASS="FILENAME"
>/etc/passwd</TT
> entry will list the machine name 
with a "$" appended, won't have a password, will have a null shell and no 
home directory. For example a machine named 'doppy' would have an 
<TT
CLASS="FILENAME"
>/etc/passwd</TT
> entry like this:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>doppy$:x:505:501:<VAR
CLASS="REPLACEABLE"
>machine_nickname</VAR
>:/dev/null:/bin/false</PRE
></P
><P
>Above, <VAR
CLASS="REPLACEABLE"
>machine_nickname</VAR
> can be any
descriptive name for the client, i.e., BasementComputer.
<VAR
CLASS="REPLACEABLE"
>machine_name</VAR
> absolutely must be the NetBIOS
name of the client to be joined to the domain.  The "$" must be
appended to the NetBIOS name of the client or Samba will not recognize
this as a machine trust account.</P
><P
>Now that the corresponding Unix account has been created, the next step is to create 
the Samba account for the client containing the well-known initial 
machine trust account password.  This can be done using the <A
HREF="smbpasswd.8.html"
TARGET="_top"
><B
CLASS="COMMAND"
>smbpasswd(8)</B
></A
> command 
as shown here:</P
><P
><SAMP
CLASS="PROMPT"
>root# </SAMP
><KBD
CLASS="USERINPUT"
>smbpasswd -a -m <VAR
CLASS="REPLACEABLE"
>machine_name</VAR
></KBD
></P
><P
>where <VAR
CLASS="REPLACEABLE"
>machine_name</VAR
> is the machine's NetBIOS
name.  The RID of the new machine account is generated from the UID of 
the corresponding Unix account.</P
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>Join the client to the domain immediately</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>	Manually creating a machine trust account using this method is the 
	equivalent of creating a machine trust account on a Windows NT PDC using 
	the "Server Manager".  From the time at which the account is created
	to the time which the client joins the domain and changes the password,
	your domain is vulnerable to an intruder joining your domain using a
	a machine with the same NetBIOS name.  A PDC inherently trusts
	members of the domain and will serve out a large degree of user 
	information to such clients.  You have been warned!
	</P
></TD
></TR
></TABLE
></DIV
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1182"
>7.4.2. "On-the-Fly" Creation of Machine Trust Accounts</A
></H3
><P
>The second (and recommended) way of creating machine trust accounts is
simply to allow the Samba server to create them as needed when the client
is joined to the domain. </P
><P
>Since each Samba machine trust account requires a corresponding
Unix account, a method for automatically creating the
Unix account is usually supplied; this requires configuration of the
<A
HREF="smb.conf.5.html#ADDUSERSCRIPT"
TARGET="_top"
>add user script</A
> 
option in <TT
CLASS="FILENAME"
>smb.conf</TT
>.  This
method is not required, however; corresponding Unix accounts may also
be created manually.</P
><P
>Below is an example for a RedHat 6.2 Linux system.</P
><P
><PRE
CLASS="PROGRAMLISTING"
>[global]
   # &#60;...remainder of parameters...&#62;
   add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u </PRE
></P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1191"
>7.4.3. Joining the Client to the Domain</A
></H3
><P
>The procedure for joining a client to the domain varies with the
version of Windows.</P
><P
></P
><UL
><LI
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Windows 2000</I
></SPAN
></P
><P
> When the user elects to join the client to a domain, Windows prompts for
	an account and password that is privileged to join the domain.  A
	Samba administrative account (i.e., a Samba account that has root
	privileges on the Samba server) must be entered here; the
	operation will fail if an ordinary user account is given. 
	The password for this account should be
	set to a different password than the associated
	<TT
CLASS="FILENAME"
>/etc/passwd</TT
> entry, for security
	reasons. </P
><P
>The session key of the Samba administrative account acts as an
	encryption key for setting the password of the machine trust
	account. The machine trust account will be created on-the-fly, or
	updated if it already exists.</P
></LI
><LI
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Windows NT</I
></SPAN
></P
><P
> If the machine trust account was created manually, on the
	Identification Changes menu enter the domain name, but do not
	check the box "Create a Computer Account in the Domain."  In this case,
	the existing machine trust account is used to join the machine to
	the domain.</P
><P
> If the machine trust account is to be created
	on-the-fly, on the Identification Changes menu enter the domain
	name, and check the box "Create a Computer Account in the Domain."  In
	this case, joining the domain proceeds as above for Windows 2000
	(i.e., you must supply a Samba administrative account when
	prompted).</P
></LI
><LI
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Samba</I
></SPAN
></P
><P
>Joining a samba client to a domain is documented in 
	the <A
HREF="#DOMAIN-MEMBER"
>Domain Member</A
> chapter.</P
></LI
></UL
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1211"
>7.5. Common Problems and Errors</A
></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
NAME="AEN1213"
>7.5.1. I cannot include a '$' in a machine name</A
></H3
><P
>A 'machine name' in (typically) <TT
CLASS="FILENAME"
>/etc/passwd</TT
> 	
of the machine name with a '$' appended. FreeBSD (and other BSD 
systems?) won't create a user with a '$' in their name.</P
><P
>The problem is only in the program used to make the entry, once 
made, it works perfectly. So create a user without the '$' and 
use <B
CLASS="COMMAND"
>vipw</B
> to edit the entry, adding the '$'. Or create 
the whole entry with vipw if you like, make sure you use a 
unique User ID !</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1219"
>7.5.2. I get told "You already have a connection to the Domain...." 
or "Cannot join domain, the credentials supplied conflict with an 
existing set.." when creating a machine trust account.</A
></H3
><P
>This happens if you try to create a machine trust account from the 
machine itself and already have a connection (e.g. mapped drive) 
to a share (or IPC$) on the Samba PDC.  The following command
will remove all network drive connections:</P
><P
><SAMP
CLASS="PROMPT"
>C:\WINNT\&#62;</SAMP
> <B
CLASS="COMMAND"
>net use * /d</B
></P
><P
>Further, if the machine is a already a 'member of a workgroup' that 
is the same name as the domain you are joining (bad idea) you will 
get this message.  Change the workgroup name to something else, it 
does not matter what, reboot, and try again.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1226"
>7.5.3. The system can not log you on (C000019B)....</A
></H3
><P
>I joined the domain successfully but after upgrading 
to a newer version of the Samba code I get the message, "The system 
can not log you on (C000019B), Please try again or consult your 
system administrator" when attempting to logon.</P
><P
>This occurs when the domain SID stored in the secrets.tdb database
is changed. The most common cause of a change in domain SID is when
the domain name and/or the server name (netbios name) is changed.
The only way to correct the problem is to restore the original domain 
SID or remove the domain client from the domain and rejoin. The domain
SID may be reset using either the smbpasswd or rpcclient utilities.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1230"
>7.5.4. The machine trust account for this computer either does not 
exist or is not accessible.</A
></H3
><P
>When I try to join the domain I get the message "The machine account 
for this computer either does not exist or is not accessible". What's 
wrong?</P
><P
>This problem is caused by the PDC not having a suitable machine trust account. 
If you are using the <VAR
CLASS="PARAMETER"
>add user script</VAR
> method to create 
accounts then this would indicate that it has not worked. Ensure the domain 
admin user system is working.</P
><P
>Alternatively if you are creating account entries manually then they 
have not been created correctly. Make sure that you have the entry 
correct for the machine trust account in smbpasswd file on the Samba PDC. 
If you added the account using an editor rather than using the smbpasswd 
utility, make sure that the account name is the machine NetBIOS name 
with a '$' appended to it ( i.e. computer_name$ ). There must be an entry 
in both /etc/passwd and the smbpasswd file. Some people have reported 
that inconsistent subnet masks between the Samba server and the NT 
client have caused this problem.   Make sure that these are consistent 
for both client and server.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1236"
>7.5.5. When I attempt to login to a Samba Domain from a NT4/W2K workstation,
I get a message about my account being disabled.</A
></H3
><P
>At first be ensure to enable the useraccounts with <B
CLASS="COMMAND"
>smbpasswd -e 
%user%</B
>, this is normally done, when you create an account.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1240"
>7.6. Domain Control for Windows 9x/ME</A
></H2
><P
>A domain and a workgroup are exactly the same thing in terms of network
browsing.  The difference is that a distributable authentication
database is associated with a domain, for secure login access to a
network.  Also, different access rights can be granted to users if they
successfully authenticate against a domain logon server. Samba-3 does this
now in the same way that MS Windows NT/2K.</P
><P
>The SMB client logging on to a domain has an expectation that every other
server in the domain should accept the same authentication information.
Network browsing functionality of domains and workgroups is identical and
is explained in this documentation under the browsing discussions.
It should be noted, that browsing is totally orthogonal to logon support.</P
><P
>Issues related to the single-logon network model are discussed in this
section.  Samba supports domain logons, network logon scripts, and user
profiles for MS Windows for workgroups and MS Windows 9X/ME clients
which are the focus of this section.</P
><P
>When an SMB client in a domain wishes to logon it broadcast requests for a
logon server.  The first one to reply gets the job, and validates its
password using whatever mechanism the Samba administrator has installed.
It is possible (but very stupid) to create a domain where the user
database is not shared between servers, i.e. they are effectively workgroup
servers advertising themselves as participating in a domain.  This
demonstrates how authentication is quite different from but closely
involved with domains.</P
><P
>Using these features you can make your clients verify their logon via
the Samba server; make clients run a batch file when they logon to
the network and download their preferences, desktop and start menu.</P
><P
>Before launching into the configuration instructions, it is 
worthwhile lookingat how a Windows 9x/ME client performs a logon:</P
><P
></P
><OL
TYPE="1"
><LI
><P
>	The client broadcasts (to the IP broadcast address of the subnet it is in)
	a NetLogon request. This is sent to the NetBIOS name DOMAIN&#60;1c&#62; at the
	NetBIOS layer.  The client chooses the first response it receives, which
	contains the NetBIOS name of the logon server to use in the format of 
	\\SERVER.
	</P
></LI
><LI
><P
>	The client then connects to that server, logs on (does an SMBsessetupX) and
	then connects to the IPC$ share (using an SMBtconX).
	</P
></LI
><LI
><P
>	The client then does a NetWkstaUserLogon request, which retrieves the name
	of the user's logon script. 
	</P
></LI
><LI
><P
>	The client then connects to the NetLogon share and searches for this 	
	and if it is found and can be read, is retrieved and executed by the client.
	After this, the client disconnects from the NetLogon share.
	</P
></LI
><LI
><P
>	The client then sends a NetUserGetInfo request to the server, to retrieve
	the user's home share, which is used to search for profiles. Since the
	response to the NetUserGetInfo request does not contain much more 	
	the user's home share, profiles for Win9X clients MUST reside in the user
	home directory.
	</P
></LI
><LI
><P
>	The client then connects to the user's home share and searches for the 
	user's profile. As it turns out, you can specify the user's home share as
	a sharename and path. For example, \\server\fred\.profile.
	If the profiles are found, they are implemented.
	</P
></LI
><LI
><P
>	The client then disconnects from the user's home share, and reconnects to
	the NetLogon share and looks for CONFIG.POL, the policies file. If this is
	found, it is read and implemented.
	</P
></LI
></OL
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1263"
>7.6.1. Configuration Instructions:	Network Logons</A
></H3
><P
>The main difference between a PDC and a Windows 9x logon 
server configuration is that</P
><P
></P
><UL
><LI
><P
>Password encryption is not required for a Windows 9x logon server.</P
></LI
><LI
><P
>Windows 9x/ME clients do not possess machine trust accounts.</P
></LI
></UL
><P
>Therefore, a Samba PDC will also act as a Windows 9x logon 
server.</P
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>security mode and master browsers</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>There are a few comments to make in order to tie up some 
loose ends.  There has been much debate over the issue of whether
or not it is ok to configure Samba as a Domain Controller in security
modes other than <CODE
CLASS="CONSTANT"
>USER</CODE
>.  The only security mode 
which  will not work due to technical reasons is <CODE
CLASS="CONSTANT"
>SHARE</CODE
>
mode security.  <CODE
CLASS="CONSTANT"
>DOMAIN</CODE
> and <CODE
CLASS="CONSTANT"
>SERVER</CODE
>
mode security is really just a variation on SMB user level security.</P
><P
>Actually, this issue is also closely tied to the debate on whether 
or not Samba must be the domain master browser for its workgroup
when operating as a DC.  While it may technically be possible
to configure a server as such (after all, browsing and domain logons
are two distinctly different functions), it is not a good idea to
so.  You should remember that the DC must register the DOMAIN#1b NetBIOS 
name.  This is the name used by Windows clients to locate the DC.
Windows clients do not distinguish between the DC and the DMB.
For this reason, it is very wise to configure the Samba DC as the DMB.</P
><P
>Now back to the issue of configuring a Samba DC to use a mode other
than "security = user".  If a Samba host is configured to use 
another SMB server or DC in order to validate user connection 
requests, then it is a fact that some other machine on the network 
(the "password server") knows more about user than the Samba host.
99% of the time, this other host is a domain controller.  Now 
in order to operate in domain mode security, the "workgroup" parameter
must be set to the name of the Windows NT domain (which already 
has a domain controller, right?)</P
><P
>Therefore configuring a Samba box as a DC for a domain that 
already by definition has a PDC is asking for trouble.
Therefore, you should always configure the Samba DC to be the DMB
for its domain.</P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="SAMBA-BDC"
></A
>Chapter 8. Samba Backup Domain Controller to Samba Domain Control</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
NAME="AEN1293"
>8.1. Prerequisite Reading</A
></H2
><P
>Before you continue reading in this chapter, please make sure
that you are comfortable with configuring a Samba PDC
as described in the <A
HREF="Samba-PDC-HOWTO.html"
TARGET="_top"
>Samba-PDC-HOWTO</A
>.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1297"
>8.2. Background</A
></H2
><P
>What is a Domain Controller? It is a machine that is able to answer
logon requests from workstations in a Windows NT Domain. Whenever a
user logs into a Windows NT Workstation, the workstation connects to a
Domain Controller and asks him whether the username and password the
user typed in is correct.  The Domain Controller replies with a lot of
information about the user, for example the place where the users
profile is stored, the users full name of the user. All this
information is stored in the NT user database, the so-called SAM.</P
><P
>There are two kinds of Domain Controller in a NT 4 compatible Domain:
A Primary Domain Controller (PDC) and one or more Backup Domain
Controllers (BDC). The PDC contains the master copy of the
SAM. Whenever the SAM has to change, for example when a user changes
his password, this change has to be done on the PDC. A Backup Domain
Controller is a machine that maintains a read-only copy of the
SAM. This way it is able to reply to logon requests and authenticate
users in case the PDC is not available. During this time no changes to
the SAM are possible. Whenever changes to the SAM are done on the PDC,
all BDC receive the changes from the PDC.</P
><P
>Since version 2.2 Samba officially supports domain logons for all
current Windows Clients, including Windows 2000 and XP. This text
assumes the domain to be named SAMBA. To be able to act as a PDC, some
parameters in the [global]-section of the smb.conf have to be set:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>workgroup = SAMBA
domain master = yes
domain logons = yes</PRE
></P
><P
>Several other things like a [homes] and a [netlogon] share also may be
set along with settings for the profile path, the users home drive and
others. This will not be covered in this document.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1305"
>8.3. What qualifies a Domain Controller on the network?</A
></H2
><P
>Every machine that is a Domain Controller for the domain SAMBA has to
register the NetBIOS group name SAMBA#1c with the WINS server and/or
by broadcast on the local network. The PDC also registers the unique
NetBIOS name SAMBA#1b with the WINS server. The name type #1b is
normally reserved for the domain master browser, a role that has
nothing to do with anything related to authentication, but the
Microsoft Domain implementation requires the domain master browser to
be on the same machine as the PDC.</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1308"
>8.3.1. How does a Workstation find its domain controller?</A
></H3
><P
>A NT workstation in the domain SAMBA that wants a local user to be
authenticated has to find the domain controller for SAMBA. It does
this by doing a NetBIOS name query for the group name SAMBA#1c. It
assumes that each of the machines it gets back from the queries is a
domain controller and can answer logon requests. To not open security
holes both the workstation and the selected (TODO: How is the DC
chosen) domain controller authenticate each other. After that the
workstation sends the user's credentials (his name and password) to
the domain controller, asking for approval.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1311"
>8.3.2. When is the PDC needed?</A
></H3
><P
>Whenever a user wants to change his password, this has to be done on
the PDC. To find the PDC, the workstation does a NetBIOS name query
for SAMBA#1b, assuming this machine maintains the master copy of the
SAM. The workstation contacts the PDC, both mutually authenticate and
the password change is done.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1314"
>8.4. Can Samba be a Backup Domain Controller to an NT PDC?</A
></H2
><P
>With version 2.2, no. The native NT SAM replication protocols have
not yet been fully implemented. The Samba Team is working on
understanding and implementing the protocols, but this work has not
been finished for version 2.2.</P
><P
>With version 3.0, the work on both the replication protocols and a
suitable storage mechanism has progressed, and some form of NT4 BDC
support is expected soon.</P
><P
>Can I get the benefits of a BDC with Samba?  Yes. The main reason for
implementing a BDC is availability. If the PDC is a Samba machine,
a second Samba machine can be set up to
service logon requests whenever the PDC is down.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1319"
>8.5. How do I set up a Samba BDC?</A
></H2
><P
>Several things have to be done:</P
><P
></P
><UL
><LI
><P
>The domain SID has to be the same on the PDC and the BDC. This used to
be stored in the file private/MACHINE.SID. This file is not created
anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is
stored in the file private/secrets.tdb. Simply copying the secrets.tdb
from the PDC to the BDC does not work, as the BDC would
generate a new SID for itself and override the domain SID with this
new BDC SID.</P
><P
>To retrieve the domain SID from the PDC or an existing BDC and store it in the
secrets.tdb, execute 'net rpc getsid' on the BDC.</P
></LI
><LI
><P
>The Unix user database has to be synchronized from the PDC to the
BDC. This means that both the /etc/passwd and /etc/group have to be
replicated from the PDC to the BDC. This can be done manually
whenever changes are made, or the PDC is set up as a NIS master
server and the BDC as a NIS slave server. To set up the BDC as a
mere NIS client would not be enough, as the BDC would not be able to
access its user database in case of a PDC failure.</P
></LI
><LI
><P
>The Samba password database in the file private/smbpasswd has to be
replicated from the PDC to the BDC. This is a bit tricky, see the
next section.</P
></LI
><LI
><P
>Any netlogon share has to be replicated from the PDC to the
BDC. This can be done manually whenever login scripts are changed,
or it can be done automatically together with the smbpasswd
synchronization.</P
></LI
></UL
><P
>Finally, the BDC has to be found by the workstations. This can be done
by setting</P
><P
><PRE
CLASS="PROGRAMLISTING"
>workgroup = samba
domain master = no
domain logons = yes</PRE
></P
><P
>in the [global]-section of the smb.conf of the BDC. This makes the BDC
only register the name SAMBA#1c with the WINS server. This is no
problem as the name SAMBA#1c is a NetBIOS group name that is meant to
be registered by more than one machine. The parameter 'domain master =
no' forces the BDC not to register SAMBA#1b which as a unique NetBIOS
name is reserved for the Primary Domain Controller.</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1336"
>8.5.1. How do I replicate the smbpasswd file?</A
></H3
><P
>Replication of the smbpasswd file is sensitive. It has to be done
whenever changes to the SAM are made. Every user's password change is
done in the smbpasswd file and has to be replicated to the BDC. So
replicating the smbpasswd file very often is necessary.</P
><P
>As the smbpasswd file contains plain text password equivalents, it
must not be sent unencrypted over the wire. The best way to set up
smbpasswd replication from the PDC to the BDC is to use the utility
rsync. rsync can use ssh as a transport. ssh itself can be set up to
accept *only* rsync transfer without requiring the user to type a
password.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1340"
>8.5.2. Can I do this all with LDAP?</A
></H3
><P
>The simple answer is YES.  Samba's pdb_ldap code supports
binding to a replica LDAP server, and will also follow referrals and
rebind to the master if it ever needs to make a modification to the
database.  (Normally BDCs are read only, so this will not occur
often).</P
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="ADS"
></A
>Chapter 9. Samba as a ADS domain member</H1
><P
>This is a rough guide to setting up Samba 3.0 with kerberos authentication against a
Windows2000 KDC. </P
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1363"
>9.1. Setup your <TT
CLASS="FILENAME"
>smb.conf</TT
></A
></H2
><P
>You must use at least the following 3 options in smb.conf:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>  realm = YOUR.KERBEROS.REALM
  security = ADS
  encrypt passwords = yes</PRE
></P
><P
>In case samba can't figure out your ads server using your realm name, use the 
<B
CLASS="COMMAND"
>ads server</B
> option in <TT
CLASS="FILENAME"
>smb.conf</TT
>:
<PRE
CLASS="PROGRAMLISTING"
>  ads server = your.kerberos.server</PRE
></P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>You do *not* need a smbpasswd file, and older clients will
  be authenticated as if <B
CLASS="COMMAND"
>security = domain</B
>,
  although it won't do any harm
  and allows you to have local users not in the domain.
  I expect that the above required options will change soon when we get better
  active directory integration.</P
></TD
></TR
></TABLE
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1376"
>9.2. Setup your <TT
CLASS="FILENAME"
>/etc/krb5.conf</TT
></A
></H2
><P
>The minimal configuration for <TT
CLASS="FILENAME"
>krb5.conf</TT
> is:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>[realms]
    YOUR.KERBEROS.REALM = {
	kdc = your.kerberos.server
    }</PRE
></P
><P
>Test your config by doing a <KBD
CLASS="USERINPUT"
>kinit <VAR
CLASS="REPLACEABLE"
>USERNAME</VAR
>@<VAR
CLASS="REPLACEABLE"
>REALM</VAR
></KBD
> and making sure that
  your password is accepted by the Win2000 KDC. </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>The realm must be uppercase. </P
></TD
></TR
></TABLE
></DIV
><P
>You also must ensure that you can do a reverse DNS lookup on the IP
address of your KDC. Also, the name that this reverse lookup maps to
must either be the netbios name of the KDC (ie. the hostname with no
domain attached) or it can alternatively be the netbios name
followed by the realm. </P
><P
>The easiest way to ensure you get this right is to add a 
<TT
CLASS="FILENAME"
>/etc/hosts</TT
> entry mapping the IP address of your KDC to 
its netbios name. If you don't get this right then you will get a 
"local error" when you try to join the realm.</P
><P
>If all you want is kerberos support in <SPAN
CLASS="APPLICATION"
>smbclient</SPAN
> then you can skip
straight to <A
HREF="#ADS-TEST-SMBCLIENT"
>Test with <SPAN
CLASS="APPLICATION"
>smbclient</SPAN
></A
> now. 
<A
HREF="#ADS-CREATE-MACHINE-ACCOUNT"
>Creating a computer account</A
> 
and <A
HREF="#ADS-TEST-SERVER"
>testing your servers</A
>
is only needed if you want kerberos
support for <SPAN
CLASS="APPLICATION"
>smbd</SPAN
> and <SPAN
CLASS="APPLICATION"
>winbindd</SPAN
>.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="ADS-CREATE-MACHINE-ACCOUNT"
>9.3. Create the computer account</A
></H2
><P
>As a user that has write permission on the Samba private directory
(usually root) run:
<KBD
CLASS="USERINPUT"
>net ads join</KBD
></P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1404"
>9.3.1. Possible errors</A
></H3
><P
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>"ADS support not compiled in"</DT
><DD
><P
>Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the kerberos libs and headers are installed.</P
></DD
></DL
></DIV
></P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="ADS-TEST-SERVER"
>9.4. Test your server setup</A
></H2
><P
>On a Windows 2000 client try <KBD
CLASS="USERINPUT"
>net use * \\server\share</KBD
>. You should
be logged in with kerberos without needing to know a password. If
this fails then run <KBD
CLASS="USERINPUT"
>klist tickets</KBD
>. Did you get a ticket for the
server? Does it have an encoding type of DES-CBC-MD5 ? </P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="ADS-TEST-SMBCLIENT"
>9.5. Testing with <SPAN
CLASS="APPLICATION"
>smbclient</SPAN
></A
></H2
><P
>On your Samba server try to login to a Win2000 server or your Samba
server using <SPAN
CLASS="APPLICATION"
>smbclient</SPAN
> and kerberos. Use <SPAN
CLASS="APPLICATION"
>smbclient</SPAN
> as usual, but
specify the <VAR
CLASS="PARAMETER"
>-k</VAR
> option to choose kerberos authentication.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1424"
>9.6. Notes</A
></H2
><P
>You must change administrator password at least once after DC 
install, to create the right encoding types</P
><P
>w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in
   their defaults DNS setup. Maybe fixed in service packs?</P
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="DOMAIN-MEMBER"
></A
>Chapter 10. Samba as a NT4 or Win2k domain member</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
NAME="AEN1447"
>10.1. Joining an NT Domain with Samba 3.0</A
></H2
><P
>Assume you have a Samba 3.0 server with a NetBIOS name of 
	<CODE
CLASS="CONSTANT"
>SERV1</CODE
> and are joining an or Win2k NT domain called
	<CODE
CLASS="CONSTANT"
>DOM</CODE
>, which has a PDC with a NetBIOS name
	of <CODE
CLASS="CONSTANT"
>DOMPDC</CODE
> and two backup domain controllers 
	with NetBIOS names <CODE
CLASS="CONSTANT"
>DOMBDC1</CODE
> and <CODE
CLASS="CONSTANT"
>DOMBDC2
	</CODE
>.</P
><P
>Firstly, you must edit your <TT
CLASS="FILENAME"
>smb.conf</TT
> file to tell Samba it should
	now use domain security.</P
><P
>Change (or add) your <A
HREF="smb.conf.5.html#SECURITY"
TARGET="_top"
>	<VAR
CLASS="PARAMETER"
>security =</VAR
></A
> line in the [global] section 
	of your <TT
CLASS="FILENAME"
>smb.conf</TT
> to read:</P
><P
><B
CLASS="COMMAND"
>security = domain</B
></P
><P
>Next change the <A
HREF="smb.conf.5.html#WORKGROUP"
TARGET="_top"
><VAR
CLASS="PARAMETER"
>	workgroup =</VAR
></A
> line in the [global] section to read: </P
><P
><B
CLASS="COMMAND"
>workgroup = DOM</B
></P
><P
>as this is the name of the domain we are joining. </P
><P
>You must also have the parameter <A
HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
TARGET="_top"
>	<VAR
CLASS="PARAMETER"
>encrypt passwords</VAR
></A
> set to <CODE
CLASS="CONSTANT"
>yes
	</CODE
> in order for your users to authenticate to the NT PDC.</P
><P
>Finally, add (or modify) a <A
HREF="smb.conf.5.html#PASSWORDSERVER"
TARGET="_top"
>	<VAR
CLASS="PARAMETER"
>password server =</VAR
></A
> line in the [global]
	section to read: </P
><P
><B
CLASS="COMMAND"
>password server = DOMPDC DOMBDC1 DOMBDC2</B
></P
><P
>These are the primary and backup domain controllers Samba 
	will attempt to contact in order to authenticate users. Samba will 
	try to contact each of these servers in order, so you may want to 
	rearrange this list in order to spread out the authentication load 
	among domain controllers.</P
><P
>Alternatively, if you want smbd to automatically determine 
	the list of Domain controllers to use for authentication, you may 
	set this line to be :</P
><P
><B
CLASS="COMMAND"
>password server = *</B
></P
><P
>This method, allows Samba to use exactly the same
        mechanism that NT does. This 
	method either broadcasts or uses a WINS database in order to
	find domain controllers to authenticate against.</P
><P
>In order to actually join the domain, you must run this
        command:</P
><P
><SAMP
CLASS="PROMPT"
>root# </SAMP
><KBD
CLASS="USERINPUT"
>net rpc join -S DOMPDC
	-U<VAR
CLASS="REPLACEABLE"
>Administrator%password</VAR
></KBD
></P
><P
>as we are joining the domain DOM and the PDC for that domain 
	(the only machine that has write access to the domain SAM database) 
	is DOMPDC. The <VAR
CLASS="REPLACEABLE"
>Administrator%password</VAR
> is 
	the login name and password for an account which has the necessary 
	privilege to add machines to the domain.  If this is successful 
	you will see the message:</P
><P
><SAMP
CLASS="COMPUTEROUTPUT"
>Joined domain DOM.</SAMP
>
	or <SAMP
CLASS="COMPUTEROUTPUT"
>Joined 'SERV1' to realm 'MYREALM'</SAMP
>
	</P
><P
>in your terminal window. See the <A
HREF="net.8.html"
TARGET="_top"
>	net(8)</A
> man page for more details.</P
><P
>This process joins the server to thedomain
	without having to create the machine trust account on the PDC
	beforehand.</P
><P
>This command goes through the machine account password 
	change protocol, then writes the new (random) machine account 
	password for this Samba server into a file in the same directory 
	in which an smbpasswd file would be stored - normally :</P
><P
><TT
CLASS="FILENAME"
>/usr/local/samba/private/secrets.tdb</TT
></P
><P
>This file is created and owned by root and is not 
	readable by any other user. It is the key to the domain-level 
	security for your system, and should be treated as carefully 
	as a shadow password file.</P
><P
>Finally, restart your Samba daemons and get ready for 
	clients to begin using domain security!</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1501"
>10.2. Why is this better than security = server?</A
></H2
><P
>Currently, domain security in Samba doesn't free you from 
	having to create local Unix users to represent the users attaching 
	to your server. This means that if domain user <CODE
CLASS="CONSTANT"
>DOM\fred
	</CODE
> attaches to your domain security Samba server, there needs 
	to be a local Unix user fred to represent that user in the Unix 
	filesystem. This is very similar to the older Samba security mode 
	<A
HREF="smb.conf.5.html#SECURITYEQUALSSERVER"
TARGET="_top"
>security = server</A
>, 
	where Samba would pass through the authentication request to a Windows 
	NT server in the same way as a Windows 95 or Windows 98 server would.
	</P
><P
>Please refer to the <A
HREF="winbind.html"
TARGET="_top"
>Winbind 
	paper</A
> for information on a system to automatically
	assign UNIX uids and gids to Windows NT Domain users and groups.
	This code is available in development branches only at the moment,
	but will be moved to release branches soon.</P
><P
>The advantage to domain-level security is that the 
	authentication in domain-level security is passed down the authenticated 
	RPC channel in exactly the same way that an NT server would do it. This 
	means Samba servers now participate in domain trust relationships in 
	exactly the same way NT servers do (i.e., you can add Samba servers into 
	a resource domain and have the authentication passed on from a resource
	domain PDC to an account domain PDC.</P
><P
>In addition, with <B
CLASS="COMMAND"
>security = server</B
> every Samba 
	daemon on a server has to keep a connection open to the 
	authenticating server for as long as that daemon lasts. This can drain 
	the connection resources on a Microsoft NT server and cause it to run 
	out of available connections. With <B
CLASS="COMMAND"
>security = domain</B
>, 
	however, the Samba daemons connect to the PDC/BDC only for as long 
	as is necessary to authenticate the user, and then drop the connection, 
	thus conserving PDC connection resources.</P
><P
>And finally, acting in the same manner as an NT server 
	authenticating to a PDC means that as part of the authentication 
	reply, the Samba server gets the user identification information such 
	as the user SID, the list of NT groups the user belongs to, etc. </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
> Much of the text of this document 
	was first published in the Web magazine <A
HREF="http://www.linuxworld.com"
TARGET="_top"
> 	
	LinuxWorld</A
> as the article <A
HREF="http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html"
TARGET="_top"
>Doing 
	the NIS/NT Samba</A
>.</P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
></DIV
><DIV
CLASS="PART"
><A
NAME="OPTIONAL"
></A
><DIV
CLASS="TITLEPAGE"
><H1
CLASS="TITLE"
>III. Advanced Configuration</H1
></DIV
><DIV
CLASS="PARTINTRO"
><A
NAME="AEN1519"
></A
><H1
>Introduction</H1
><P
>Samba has several features that you might want or might not want to use. The chapters in this part each cover one specific feature.</P
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="UNIX-PERMISSIONS"
></A
>Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
NAME="AEN1533"
>11.1. Viewing and changing UNIX permissions using the NT 
	security dialogs</A
></H2
><P
>Windows NT clients can use their native security settings 
	dialog box to view and modify the underlying UNIX permissions.</P
><P
>Note that this ability is careful not to compromise 
	the security of the UNIX host Samba is running on, and 
	still obeys all the file permission rules that a Samba 
	administrator can set.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>	All access to Unix/Linux system file via Samba is controlled at
	the operating system file access control level. When trying to
	figure out file access problems it is vitally important to identify
	the identity of the Windows user as it is presented by Samba at
	the point of file access. This can best be determined from the
	Samba log files.
	</P
></TD
></TR
></TABLE
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1539"
>11.2. How to view file security on a Samba share</A
></H2
><P
>From an NT4/2000/XP client, single-click with the right 
	mouse button on any file or directory in a Samba mounted 
	drive letter or UNC path. When the menu pops-up, click 
	on the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Properties</I
></SPAN
> entry at the bottom of 
	the menu. This brings up the file properties dialog
	box. Click on the tab <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Security</I
></SPAN
> and you 
	will see three buttons, <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Permissions</I
></SPAN
>, 	
	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Auditing</I
></SPAN
>, and <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Ownership</I
></SPAN
>. 
	The <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Auditing</I
></SPAN
> button will cause either 
	an error message <SPAN
CLASS="ERRORNAME"
>A requested privilege is not held 
	by the client</SPAN
> to appear if the user is not the 
	NT Administrator, or a dialog which is intended to allow an 
	Administrator to add auditing requirements to a file if the 
	user is logged on as the NT Administrator. This dialog is 
	non-functional with a Samba share at this time, as the only 
	useful button, the <B
CLASS="COMMAND"
>Add</B
> button will not currently 
	allow a list of users to be seen.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1550"
>11.3. Viewing file ownership</A
></H2
><P
>Clicking on the <B
CLASS="COMMAND"
>"Ownership"</B
> button 
	brings up a dialog box telling you who owns the given file. The 
	owner name will be of the form :</P
><P
><B
CLASS="COMMAND"
>"SERVER\user (Long name)"</B
></P
><P
>Where <VAR
CLASS="REPLACEABLE"
>SERVER</VAR
> is the NetBIOS name of 
	the Samba server, <VAR
CLASS="REPLACEABLE"
>user</VAR
> is the user name of 
	the UNIX user who owns the file, and <VAR
CLASS="REPLACEABLE"
>(Long name)</VAR
>
	is the descriptive string identifying the user (normally found in the
	GECOS field of the UNIX password database). Click on the <B
CLASS="COMMAND"
>Close
	</B
> button to remove this dialog.</P
><P
>If the parameter <VAR
CLASS="PARAMETER"
>nt acl support</VAR
>
	is set to <CODE
CLASS="CONSTANT"
>false</CODE
> then the file owner will 
	be shown as the NT user <B
CLASS="COMMAND"
>"Everyone"</B
>.</P
><P
>The <B
CLASS="COMMAND"
>Take Ownership</B
> button will not allow 
	you to change the ownership of this file to yourself (clicking on 
	it will display a dialog box complaining that the user you are 
	currently logged onto the NT client cannot be found). The reason 
	for this is that changing the ownership of a file is a privileged 
	operation in UNIX, available only to the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>root</I
></SPAN
> 
	user. As clicking on this button causes NT to attempt to change 
	the ownership of a file to the current user logged into the NT 
	client this will not work with Samba at this time.</P
><P
>There is an NT chown command that will work with Samba 
	and allow a user with Administrator privilege connected 
	to a Samba server as root to change the ownership of 
	files on both a local NTFS filesystem or remote mounted NTFS 
	or Samba drive. This is available as part of the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Seclib
	</I
></SPAN
> NT security library written by Jeremy Allison of 
	the Samba Team, available from the main Samba ftp site.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1570"
>11.4. Viewing file or directory permissions</A
></H2
><P
>The third button is the <B
CLASS="COMMAND"
>"Permissions"</B
> 
	button. Clicking on this brings up a dialog box that shows both 
	the permissions and the UNIX owner of the file or directory. 
	The owner is displayed in the form :</P
><P
><B
CLASS="COMMAND"
>"SERVER\user (Long name)"</B
></P
><P
>Where <VAR
CLASS="REPLACEABLE"
>SERVER</VAR
> is the NetBIOS name of 
	the Samba server, <VAR
CLASS="REPLACEABLE"
>user</VAR
> is the user name of 
	the UNIX user who owns the file, and <VAR
CLASS="REPLACEABLE"
>(Long name)</VAR
>
	is the descriptive string identifying the user (normally found in the
	GECOS field of the UNIX password database).</P
><P
>If the parameter <VAR
CLASS="PARAMETER"
>nt acl support</VAR
>
	is set to <CODE
CLASS="CONSTANT"
>false</CODE
> then the file owner will 
	be shown as the NT user <B
CLASS="COMMAND"
>"Everyone"</B
> and the 
	permissions will be shown as NT "Full Control".</P
><P
>The permissions field is displayed differently for files 
	and directories, so I'll describe the way file permissions 
	are displayed first.</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1585"
>11.4.1. File Permissions</A
></H3
><P
>The standard UNIX user/group/world triple and 
		the corresponding "read", "write", "execute" permissions 
		triples are mapped by Samba into a three element NT ACL 
		with the 'r', 'w', and 'x' bits mapped into the corresponding 
		NT permissions. The UNIX world permissions are mapped into 
		the global NT group <B
CLASS="COMMAND"
>Everyone</B
>, followed 
		by the list of permissions allowed for UNIX world. The UNIX 
		owner and group permissions are displayed as an NT 
		<B
CLASS="COMMAND"
>user</B
> icon and an NT <B
CLASS="COMMAND"
>local 
		group</B
> icon respectively followed by the list 
	 	of permissions allowed for the UNIX user and group.</P
><P
>As many UNIX permission sets don't map into common 
		NT names such as <B
CLASS="COMMAND"
>"read"</B
>, <B
CLASS="COMMAND"
>		"change"</B
> or <B
CLASS="COMMAND"
>"full control"</B
> then 
		usually the permissions will be prefixed by the words <B
CLASS="COMMAND"
>		"Special Access"</B
> in the NT display list.</P
><P
>But what happens if the file has no permissions allowed 
		for a particular UNIX user group or world component ? In order 
		to  allow "no permissions" to be seen and modified then Samba 
		overloads the NT <B
CLASS="COMMAND"
>"Take Ownership"</B
> ACL attribute 
		(which has no meaning in UNIX) and reports a component with 
		no permissions as having the NT <B
CLASS="COMMAND"
>"O"</B
> bit set. 
		This was chosen of course to make it look like a zero, meaning 
		zero permissions. More details on the decision behind this will 
		be given below.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1599"
>11.4.2. Directory Permissions</A
></H3
><P
>Directories on an NT NTFS file system have two 
		different sets of permissions. The first set of permissions 
		is the ACL set on the directory itself, this is usually displayed 
		in the first set of parentheses in the normal <B
CLASS="COMMAND"
>"RW"</B
> 
		NT style. This first set of permissions is created by Samba in 
		exactly the same way as normal file permissions are, described 
		above, and is displayed in the same way.</P
><P
>The second set of directory permissions has no real meaning 
		in the UNIX permissions world and represents the <B
CLASS="COMMAND"
>		"inherited"</B
> permissions that any file created within 
		this directory would inherit.</P
><P
>Samba synthesises these inherited permissions for NT by 
		returning as an NT ACL the UNIX permission mode that a new file 
		created by Samba on this share would receive.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1606"
>11.5. Modifying file or directory permissions</A
></H2
><P
>Modifying file and directory permissions is as simple 
	as changing the displayed permissions in the dialog box, and 
	clicking the <B
CLASS="COMMAND"
>OK</B
> button. However, there are 
	limitations that a user needs to be aware of, and also interactions 
	with the standard Samba permission masks and mapping of DOS 
	attributes that need to also be taken into account.</P
><P
>If the parameter <VAR
CLASS="PARAMETER"
>nt acl support</VAR
>
	is set to <CODE
CLASS="CONSTANT"
>false</CODE
> then any attempt to set 
	security permissions will fail with an <B
CLASS="COMMAND"
>"Access Denied"
	</B
> message.</P
><P
>The first thing to note is that the <B
CLASS="COMMAND"
>"Add"</B
> 
	button will not return a list of users in Samba (it will give 
	an error message of <B
CLASS="COMMAND"
>"The remote procedure call failed 
	and did not execute"</B
>). This means that you can only 
	manipulate the current user/group/world permissions listed in 
	the dialog box. This actually works quite well as these are the 
	only permissions that UNIX actually has.</P
><P
>If a permission triple (either user, group, or world) 
	is removed from the list of permissions in the NT dialog box, 
	then when the <B
CLASS="COMMAND"
>"OK"</B
> button is pressed it will 
	be applied as "no permissions" on the UNIX side. If you then 
	view the permissions again the "no permissions" entry will appear 
	as the NT <B
CLASS="COMMAND"
>"O"</B
> flag, as described above. This 
	allows you to add permissions back to a file or directory once 
	you have removed them from a triple component.</P
><P
>As UNIX supports only the "r", "w" and "x" bits of 
	an NT ACL then if other NT security attributes such as "Delete 
	access" are selected then they will be ignored when applied on 
	the Samba server.</P
><P
>When setting permissions on a directory the second 
	set of permissions (in the second set of parentheses) is 
	by default applied to all files within that directory. If this 
	is not what you want you must uncheck the <B
CLASS="COMMAND"
>"Replace 
	permissions on existing files"</B
> checkbox in the NT 
	dialog before clicking <B
CLASS="COMMAND"
>"OK"</B
>.</P
><P
>If you wish to remove all permissions from a 
	user/group/world  component then you may either highlight the 
	component and click the <B
CLASS="COMMAND"
>"Remove"</B
> button, 
	or set the component to only have the special <B
CLASS="COMMAND"
>"Take
	Ownership"</B
> permission (displayed as <B
CLASS="COMMAND"
>"O"
	</B
>) highlighted.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1628"
>11.6. Interaction with the standard Samba create mask 
	parameters</A
></H2
><P
>There are four parameters 
	to control interaction with the standard Samba create mask parameters.
	These are :</P
><P
><VAR
CLASS="PARAMETER"
>security mask</VAR
></P
><P
><VAR
CLASS="PARAMETER"
>force security mode</VAR
></P
><P
><VAR
CLASS="PARAMETER"
>directory security mask</VAR
></P
><P
><VAR
CLASS="PARAMETER"
>force directory security mode</VAR
></P
><P
>Once a user clicks <B
CLASS="COMMAND"
>"OK"</B
> to apply the 
	permissions Samba maps the given permissions into a user/group/world 
	r/w/x triple set, and then will check the changed permissions for a 
	file against the bits set in the <A
HREF="smb.conf.5.html#SECURITYMASK"
TARGET="_top"
> 
	<VAR
CLASS="PARAMETER"
>security mask</VAR
></A
> parameter. Any bits that 
	were changed that are not set to '1' in this parameter are left alone 
	in the file permissions.</P
><P
>Essentially, zero bits in the <VAR
CLASS="PARAMETER"
>security mask</VAR
>
	mask may be treated as a set of bits the user is <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>not</I
></SPAN
> 
	allowed to change, and one bits are those the user is allowed to change.
	</P
><P
>If not set explicitly this parameter is set to the same value as 
	the <A
HREF="smb.conf.5.html#CREATEMASK"
TARGET="_top"
><VAR
CLASS="PARAMETER"
>create mask
	</VAR
></A
> parameter. To allow a user to modify all the
	user/group/world permissions on a file, set this parameter 
	to 0777.</P
><P
>Next Samba checks the changed permissions for a file against 
	the bits set in the <A
HREF="smb.conf.5.html#FORCESECURITYMODE"
TARGET="_top"
>	<VAR
CLASS="PARAMETER"
>force security mode</VAR
></A
> parameter. Any bits 
	that were changed that correspond to bits set to '1' in this parameter 
	are forced to be set.</P
><P
>Essentially, bits set in the <VAR
CLASS="PARAMETER"
>force security mode
	</VAR
> parameter may be treated as a set of bits that, when 
	modifying security on a file, the user has always set to be 'on'.</P
><P
>If not set explicitly this parameter is set to the same value 
	as the <A
HREF="smb.conf.5.html#FORCECREATEMODE"
TARGET="_top"
><VAR
CLASS="PARAMETER"
>force 
	create mode</VAR
></A
> parameter.
	To allow a user to modify all the user/group/world permissions on a file
	with no restrictions set this parameter to 000.</P
><P
>The <VAR
CLASS="PARAMETER"
>security mask</VAR
> and <VAR
CLASS="PARAMETER"
>force 
	security mode</VAR
> parameters are applied to the change 
	request in that order.</P
><P
>For a directory Samba will perform the same operations as 
	described above for a file except using the parameter <VAR
CLASS="PARAMETER"
>	directory security mask</VAR
> instead of <VAR
CLASS="PARAMETER"
>security 
	mask</VAR
>, and <VAR
CLASS="PARAMETER"
>force directory security mode
	</VAR
> parameter instead of <VAR
CLASS="PARAMETER"
>force security mode
	</VAR
>.</P
><P
>The <VAR
CLASS="PARAMETER"
>directory security mask</VAR
> parameter 
	by default is set to the same value as the <VAR
CLASS="PARAMETER"
>directory mask
	</VAR
> parameter and the <VAR
CLASS="PARAMETER"
>force directory security 
	mode</VAR
> parameter by default is set to the same value as 
 	the <VAR
CLASS="PARAMETER"
>force directory mode</VAR
> parameter. </P
><P
>In this way Samba enforces the permission restrictions that 
	an administrator can set on a Samba share, whilst still allowing users 
	to modify the permission bits within that restriction.</P
><P
>If you want to set up a share that allows users full control
	in modifying the permission bits on their files and directories and
	doesn't force any particular bits to be set 'on', then set the following
	parameters in the <TT
CLASS="FILENAME"
>smb.conf</TT
> file in that share specific section :</P
><P
><VAR
CLASS="PARAMETER"
>security mask = 0777</VAR
></P
><P
><VAR
CLASS="PARAMETER"
>force security mode = 0</VAR
></P
><P
><VAR
CLASS="PARAMETER"
>directory security mask = 0777</VAR
></P
><P
><VAR
CLASS="PARAMETER"
>force directory security mode = 0</VAR
></P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1681"
>11.7. Interaction with the standard Samba file attribute 
	mapping</A
></H2
><P
>Samba maps some of the DOS attribute bits (such as "read 
	only") into the UNIX permissions of a file. This means there can 
	be a conflict between the permission bits set via the security 
	dialog and the permission bits set by the file attribute mapping.
	</P
><P
>One way this can show up is if a file has no UNIX read access
	for the owner it will show up as "read only" in the standard 
	file attributes tabbed dialog. Unfortunately this dialog is
	the same one that contains the security info in another tab.</P
><P
>What this can mean is that if the owner changes the permissions
	to allow themselves read access using the security dialog, clicks
	<B
CLASS="COMMAND"
>"OK"</B
> to get back to the standard attributes tab 
	dialog, and then clicks <B
CLASS="COMMAND"
>"OK"</B
> on that dialog, then 
	NT will set the file permissions back to read-only (as that is what 
	the attributes still say in the dialog). This means that after setting 
	permissions and clicking <B
CLASS="COMMAND"
>"OK"</B
> to get back to the 
	attributes dialog you should always hit <B
CLASS="COMMAND"
>"Cancel"</B
> 
	rather than <B
CLASS="COMMAND"
>"OK"</B
> to ensure that your changes 
	are not overridden.</P
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="GROUPMAPPING"
></A
>Chapter 12. Configuring Group Mapping</H1
><P
> 
Starting with Samba 3.0 alpha 2, a new group mapping function is available. The
current method (likely to change) to manage the groups is a new command called
<SPAN
CLASS="APPLICATION"
>smbgroupedit</SPAN
>.</P
><P
>The first immediate reason to use the group mapping on a PDC, is that
the <B
CLASS="COMMAND"
>domain admin group</B
> of <TT
CLASS="FILENAME"
>smb.conf</TT
> is 
now gone. This parameter was used to give the listed users local admin rights 
on their workstations. It was some magic stuff that simply worked but didn't
scale very well for complex setups.</P
><P
>Let me explain how it works on NT/W2K, to have this magic fade away.
When installing NT/W2K on a computer, the installer program creates some users
and groups. Notably the 'Administrators' group, and gives to that group some
privileges like the ability to change the date and time or to kill any process
(or close too) running on the local machine. The 'Administrator' user is a
member of the 'Administrators' group, and thus 'inherit' the 'Administrators'
group privileges. If a 'joe' user is created and become a member of the
'Administrator' group, 'joe' has exactly the same rights as 'Administrator'.</P
><P
>When a NT/W2K machine is joined to a domain, during that phase, the "Domain
Administrators' group of the PDC is added to the 'Administrators' group of the
workstation. Every members of the 'Domain Administrators' group 'inherit' the
rights of the 'Administrators' group when logging on the workstation.</P
><P
>You are now wondering how to make some of your samba PDC users members of the
'Domain Administrators' ? That's really easy.</P
><P
></P
><OL
TYPE="1"
><LI
><P
>create a unix group (usually in <TT
CLASS="FILENAME"
>/etc/group</TT
>), let's call it domadm</P
></LI
><LI
><P
>add to this group the users that must be Administrators. For example if you want joe,john and mary, your entry in <TT
CLASS="FILENAME"
>/etc/group</TT
> will look like:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>domadm:x:502:joe,john,mary</PRE
></P
></LI
><LI
><P
>Map this domadm group to the <B
CLASS="COMMAND"
>domain admins</B
> group by running the command:</P
><P
><KBD
CLASS="USERINPUT"
>smbgroupedit -c "Domain Admins" -u domadm</KBD
></P
></LI
></OL
><P
>You're set, joe, john and mary are domain administrators !</P
><P
>Like the Domain Admins group, you can map any arbitrary Unix group to any NT
group. You can also make any Unix group a domain group. For example, on a domain
member machine (an NT/W2K or a samba server running winbind), you would like to
give access to a certain directory to some users who are member of a group on
your samba PDC. Flag that group as a domain group by running:</P
><P
><KBD
CLASS="USERINPUT"
>smbgroupedit -a unixgroup -td</KBD
></P
><P
>You can list the various groups in the mapping database like this</P
><P
><KBD
CLASS="USERINPUT"
>smbgroupedit -v</KBD
></P
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="PRINTING"
></A
>Chapter 13. Printing Support</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
NAME="AEN1744"
>13.1. Introduction</A
></H2
><P
>Beginning with the 2.2.0 release, Samba supports 
the native Windows NT printing mechanisms implemented via 
MS-RPC (i.e. the SPOOLSS named pipe).  Previous versions of 
Samba only supported LanMan printing calls.</P
><P
>The additional functionality provided by the new 
SPOOLSS support includes:</P
><P
></P
><UL
><LI
><P
>Support for downloading printer driver 
	files to Windows 95/98/NT/2000 clients upon demand.
	</P
></LI
><LI
><P
>Uploading of printer drivers via the 
	Windows NT Add Printer Wizard (APW) or the 
	Imprints tool set (refer to <A
HREF="http://imprints.sourceforge.net"
TARGET="_top"
>http://imprints.sourceforge.net</A
>). 
	</P
></LI
><LI
><P
>Support for the native MS-RPC printing 
	calls such as StartDocPrinter, EnumJobs(), etc...  (See 
	the MSDN documentation at <A
HREF="http://msdn.microsoft.com/"
TARGET="_top"
>http://msdn.microsoft.com/</A
> 
	for more information on the Win32 printing API)
	</P
></LI
><LI
><P
>Support for NT Access Control Lists (ACL) 
	on printer objects</P
></LI
><LI
><P
>Improved support for printer queue manipulation 
	through the use of an internal databases for spooled job 
	information</P
></LI
></UL
><P
>There has been some initial confusion about what all this means
and whether or not it is a requirement for printer drivers to be 
installed on a Samba host in order to support printing from Windows 
clients. As a side note, Samba does not use these drivers in any way to process 
spooled files.  They are utilized entirely by the clients.</P
><P
>The following MS KB article, may be of some help if you are dealing with
Windows 2000 clients:  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>How to Add Printers with No User 
Interaction in Windows 2000</I
></SPAN
></P
><P
><A
HREF="http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP"
TARGET="_top"
>http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP</A
></P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1766"
>13.2. Configuration</A
></H2
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>[print$] vs. [printer$]</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Previous versions of Samba recommended using a share named [printer$].  
This name was taken from the printer$ service created by Windows 9x 
clients when a printer was shared.  Windows 9x printer servers always have 
a printer$ service which provides read-only access via no 
password in order to support printer driver downloads.</P
><P
>However, the initial implementation allowed for a 
parameter named <VAR
CLASS="PARAMETER"
>printer driver location</VAR
> 
to be used on a per share basis to specify the location of 
the driver files associated with that printer.  Another 
parameter named <VAR
CLASS="PARAMETER"
>printer driver</VAR
> provided 
a means of defining the printer driver name to be sent to 
the client.</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1774"
>13.2.1. Creating [print$]</A
></H3
><P
>In order to support the uploading of printer driver 
files, you must first configure a file share named [print$].  
The name of this share is hard coded in Samba's internals so 
the name is very important (print$ is the service used by 
Windows NT print servers to provide support for printer driver 
download).</P
><P
>You should modify the server's smb.conf file to add the global
parameters and to create the 
following file share (of course, some of the parameter values,
such as 'path' are arbitrary and should be replaced with
appropriate values for your site):</P
><P
><PRE
CLASS="PROGRAMLISTING"
>[global]
    ; members of the ntadmin group should be able
    ; to add drivers and set printer properties
    ; root is implicitly a 'printer admin'
    printer admin = @ntadmin

[print$]
    path = /usr/local/samba/printers
    guest ok = yes
    browseable = yes
    read only = yes
    ; since this share is configured as read only, then we need
    ; a 'write list'.  Check the file system permissions to make
    ; sure this account can copy files to the share.  If this
    ; is setup to a non-root account, then it should also exist
    ; as a 'printer admin'
    write list = @ntadmin,root</PRE
></P
><P
>The <A
HREF="smb.conf.5.html#WRITELIST"
TARGET="_top"
><VAR
CLASS="PARAMETER"
>write list</VAR
></A
> is used to allow administrative 
level user accounts to have write access in order to update files 
on the share.  See the <A
HREF="smb.conf.5.html"
TARGET="_top"
>smb.conf(5) 
man page</A
> for more information on configuring file shares.</P
><P
>The requirement for <A
HREF="smb.conf.5.html#GUESTOK"
TARGET="_top"
><B
CLASS="COMMAND"
>guest 
ok = yes</B
></A
> depends upon how your
site is configured.  If users will be guaranteed to have 
an account on the Samba host, then this is a non-issue.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>Author's Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>The non-issue is that if all your Windows NT users are guaranteed to be 
authenticated by the Samba server (such as a domain member server and the NT 
user has already been validated by the Domain Controller in 
order to logon to the Windows NT console), then guest access 
is not necessary.  Of course, in a workgroup environment where 
you just want to be able to print without worrying about 
silly accounts and security, then configure the share for 
guest access.  You'll probably want to add <A
HREF="smb.conf.5.html#MAPTOGUEST"
TARGET="_top"
><B
CLASS="COMMAND"
>map to guest = Bad User</B
></A
> in the [global] section as well.  Make sure 
you understand what this parameter does before using it 
though. --jerry</P
></TD
></TR
></TABLE
></DIV
><P
>In order for a Windows NT print server to support 
the downloading of driver files by multiple client architectures,
it must create subdirectories within the [print$] service
which correspond to each of the supported client architectures.
Samba follows this model as well.</P
><P
>Next create the directory tree below the [print$] share 
for each architecture you wish to support.</P
><P
><SAMP
CLASS="COMPUTEROUTPUT"
>[print$]-----
        |-W32X86           ; "Windows NT x86"
        |-WIN40            ; "Windows 95/98"
        |-W32ALPHA         ; "Windows NT Alpha_AXP"
        |-W32MIPS          ; "Windows NT R4000"
        |-W32PPC           ; "Windows NT PowerPC"</SAMP
></P
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>ATTENTION!  REQUIRED PERMISSIONS</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>In order to currently add a new driver to you Samba host, 
one of two conditions must hold true:</P
><P
></P
><UL
><LI
><P
>The account used to connect to the Samba host 
	must have a uid of 0 (i.e. a root account)</P
></LI
><LI
><P
>The account used to connect to the Samba host
	must be a member of the <A
HREF="smb.conf.5.html#PRINTERADMIN"
TARGET="_top"
><VAR
CLASS="PARAMETER"
>printer 
	admin</VAR
></A
> list.</P
></LI
></UL
><P
>Of course, the connected account must still possess access
to add files to the subdirectories beneath [print$]. Remember
that all file shares are set to 'read only' by default.</P
></TD
></TR
></TABLE
></DIV
><P
>Once you have created the required [print$] service and 
associated subdirectories, simply log onto the Samba server using 
a root (or <VAR
CLASS="PARAMETER"
>printer admin</VAR
>) account
from a Windows NT 4.0/2k client.  Open "Network Neighbourhood" or
"My Network Places" and browse for the Samba host.  Once you have located
the server, navigate to the "Printers..." folder.
You should see an initial listing of printers
that matches the printer shares defined on your Samba host.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1809"
>13.2.2. Setting Drivers for Existing Printers</A
></H3
><P
>The initial listing of printers in the Samba host's 
Printers folder will have no real printer driver assigned 
to them. This defaults to a NULL string to allow the use
of the local Add Printer Wizard on NT/2000 clients.
Attempting to view the printer properties for a printer
which has this default driver assigned will result in 
the error message:</P
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Device settings cannot be displayed.  The driver 
for the specified printer is not installed, only spooler 
properties will be displayed.  Do you want to install the 
driver now?</I
></SPAN
></P
><P
>Click "No" in the error dialog and you will be presented with
the printer properties window.  The way to assign a driver to a 
printer is to either</P
><P
></P
><UL
><LI
><P
>Use the "New Driver..." button to install 
	a new printer driver, or</P
></LI
><LI
><P
>Select a driver from the popup list of 
	installed drivers.  Initially this list will be empty.</P
></LI
></UL
><P
>If you wish to install printer drivers for client 
operating systems other than "Windows NT x86", you will need 
to use the "Sharing" tab of the printer properties dialog.</P
><P
>Assuming you have connected with a root account, you 
will also be able modify other printer properties such as 
ACLs and device settings using this dialog box.</P
><P
>A few closing comments for this section, it is possible 
on a Windows NT print server to have printers
listed in the Printers folder which are not shared.  Samba does
not make this distinction.  By definition, the only printers of
which Samba is aware are those which are specified as shares in
<TT
CLASS="FILENAME"
>smb.conf</TT
>.</P
><P
>Another interesting side note is that Windows NT clients do
not use the SMB printer share, but rather can print directly 
to any printer on another Windows NT host using MS-RPC.  This
of course assumes that the printing client has the necessary
privileges on the remote host serving the printer.  The default
permissions assigned by Windows NT to a printer gives the "Print"
permissions to the "Everyone" well-known group.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1825"
>13.2.3. Support a large number of printers</A
></H3
><P
>One issue that has arisen during the development
phase of Samba 2.2 is the need to support driver downloads for
100's of printers.  Using the Windows NT APW is somewhat 
awkward to say the list.  If more than one printer are using the 
same driver, the <A
HREF="rpcclient.1.html"
TARGET="_top"
><B
CLASS="COMMAND"
>rpcclient's
setdriver command</B
></A
> can be used to set the driver
associated with an installed driver.  The following is example
of how this could be accomplished:</P
><P
><SAMP
CLASS="PROMPT"
>$ </SAMP
><KBD
CLASS="USERINPUT"
>rpcclient pogo -U root%secret -c "enumdrivers"</KBD
>
<PRE
CLASS="PROGRAMLISTING"
> 
Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
 
[Windows NT x86]
Printer Driver Info 1:
     Driver Name: [HP LaserJet 4000 Series PS]
 
Printer Driver Info 1:
     Driver Name: [HP LaserJet 2100 Series PS]
 
Printer Driver Info 1:
     Driver Name: [HP LaserJet 4Si/4SiMX PS]</PRE
>				  
<SAMP
CLASS="PROMPT"
>$ </SAMP
><KBD
CLASS="USERINPUT"
>rpcclient pogo -U root%secret -c "enumprinters"</KBD
>
<PRE
CLASS="PROGRAMLISTING"
>Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
     flags:[0x800000]
     name:[\\POGO\hp-print]
     description:[POGO\\POGO\hp-print,NO DRIVER AVAILABLE FOR THIS PRINTER,]
     comment:[]
				  </PRE
>
<SAMP
CLASS="PROMPT"
>$ </SAMP
><KBD
CLASS="USERINPUT"
>rpcclient pogo -U root%secret -c "setdriver hp-print \"HP LaserJet 4000 Series PS\""</KBD
>
<PRE
CLASS="PROGRAMLISTING"
>Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
Successfully set hp-print to driver HP LaserJet 4000 Series PS.</PRE
></P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1840"
>13.2.4. Adding New Printers via the Windows NT APW</A
></H3
><P
>By default, Samba offers all printer shares defined in <TT
CLASS="FILENAME"
>smb.conf</TT
>
in the "Printers..." folder.  Also existing in this folder is the Windows NT 
Add Printer Wizard icon.  The APW will be show only if</P
><P
></P
><UL
><LI
><P
>The connected user is able to successfully
	execute an OpenPrinterEx(\\server) with administrative
	privileges (i.e. root or <VAR
CLASS="PARAMETER"
>printer admin</VAR
>).
	</P
></LI
><LI
><P
><A
HREF="smb.conf.5.html#SHOWADDPRINTERWIZARD"
TARGET="_top"
><VAR
CLASS="PARAMETER"
>show 
	add printer wizard = yes</VAR
></A
> (the default).
	</P
></LI
></UL
><P
>In order to be able to use the APW to successfully add a printer to a Samba 
server, the <A
HREF="smb.conf.5.html#ADDPRINTERCOMMAND"
TARGET="_top"
><VAR
CLASS="PARAMETER"
>add 
printer command</VAR
></A
> must have a defined value.  The program
hook must successfully add the printer to the system (i.e. 
<TT
CLASS="FILENAME"
>/etc/printcap</TT
> or appropriate files) and 
<TT
CLASS="FILENAME"
>smb.conf</TT
> if necessary.</P
><P
>When using the APW from a client, if the named printer share does 
not exist, <B
CLASS="COMMAND"
>smbd</B
> will execute the <VAR
CLASS="PARAMETER"
>add printer 
command</VAR
> and reparse to the <TT
CLASS="FILENAME"
>smb.conf</TT
>
to attempt to locate the new printer share.  If the share is still not defined,
an error of "Access Denied" is returned to the client.  Note that the 
<VAR
CLASS="PARAMETER"
>add printer program</VAR
> is executed under the context
of the connected user, not necessarily a root account.</P
><P
>There is a complementary <A
HREF="smb.conf.5.html#DELETEPRINTERCOMMAND"
TARGET="_top"
><VAR
CLASS="PARAMETER"
>delete
printer command</VAR
></A
> for removing entries from the "Printers..."
folder.</P
><P
>The following is an example <A
HREF="smb.conf.5.html#ADDPRINTERCOMMAN"
TARGET="_top"
><VAR
CLASS="PARAMETER"
>add printer command</VAR
></A
> script. It adds the appropriate entries to <TT
CLASS="FILENAME"
>/etc/printcap.local</TT
> (change that to what you need) and returns a line of 'Done' which is needed for the whole process to work.</P
><PRE
CLASS="PROGRAMLISTING"
>#!/bin/sh

# Script to insert a new printer entry into printcap.local
#
# $1, printer name, used as the descriptive name
# $2, share name, used as the printer name for Linux
# $3, port name
# $4, driver name
# $5, location, used for the device file of the printer
# $6, win9x location

#
# Make sure we use the location that RedHat uses for local printer defs
PRINTCAP=/etc/printcap.local
DATE=`date +%Y%m%d-%H%M%S`
LP=lp
RESTART="service lpd restart"

# Keep a copy
cp $PRINTCAP $PRINTCAP.$DATE
# Add the printer to $PRINTCAP
echo ""				 			&#62;&#62; $PRINTCAP
echo "$2|$1:\\" 					&#62;&#62; $PRINTCAP
echo "  :sd=/var/spool/lpd/$2:\\" 			&#62;&#62; $PRINTCAP
echo "  :mx=0:ml=0:sh:\\" 				&#62;&#62; $PRINTCAP
echo "  :lp=/usr/local/samba/var/print/$5.prn:" 	&#62;&#62; $PRINTCAP

touch "/usr/local/samba/var/print/$5.prn" &#62;&#62; /tmp/printadd.$$ 2&#62;&#38;1
chown $LP "/usr/local/samba/var/print/$5.prn" &#62;&#62; /tmp/printadd.$$ 2&#62;&#38;1

mkdir /var/spool/lpd/$2
chmod 700 /var/spool/lpd/$2
chown $LP /var/spool/lpd/$2
#echo $1 &#62;&#62; "/usr/local/samba/var/print/$5.prn"
#echo $2 &#62;&#62; "/usr/local/samba/var/print/$5.prn"
#echo $3 &#62;&#62; "/usr/local/samba/var/print/$5.prn"
#echo $4 &#62;&#62; "/usr/local/samba/var/print/$5.prn"
#echo $5 &#62;&#62; "/usr/local/samba/var/print/$5.prn"
#echo $6 &#62;&#62; "/usr/local/samba/var/print/$5.prn"
$RESTART &#62;&#62; "/usr/local/samba/var/print/$5.prn"
# Not sure if this is needed
touch /usr/local/samba/lib/smb.conf
#
# You need to return a value, but I am not sure what it means.
#
echo "Done"
exit 0</PRE
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1870"
>13.2.5. Samba and Printer Ports</A
></H3
><P
>Windows NT/2000 print servers associate a port with each printer.  These normally
take the form of LPT1:, COM1:, FILE:, etc...  Samba must also support the
concept of ports associated with a printer.  By default, only one printer port,
named "Samba Printer Port", exists on a system.  Samba does not really a port in
order to print, rather it is a requirement of Windows clients.  </P
><P
>Note that Samba does not support the concept of "Printer Pooling" internally 
either.  This is when a logical printer is assigned to multiple ports as 
a form of load balancing or fail over.</P
><P
>If you require that multiple ports be defined for some reason,
<TT
CLASS="FILENAME"
>smb.conf</TT
> possesses a <A
HREF="smb.conf.5.html#ENUMPORTSCOMMAND"
TARGET="_top"
><VAR
CLASS="PARAMETER"
>enumports 
command</VAR
></A
> which can be used to define an external program 
that generates a listing of ports on a system.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1878"
>13.3. The Imprints Toolset</A
></H2
><P
>The Imprints tool set provides a UNIX equivalent of the 
	Windows NT Add Printer Wizard.  For complete information, please 
	refer to the Imprints web site at <A
HREF="http://imprints.sourceforge.net/"
TARGET="_top"
>	http://imprints.sourceforge.net/</A
> as well as the documentation 
	included with the imprints source distribution.  This section will 
	only provide a brief introduction to the features of Imprints.</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1882"
>13.3.1. What is Imprints?</A
></H3
><P
>Imprints is a collection of tools for supporting the goals 
		of</P
><P
></P
><UL
><LI
><P
>Providing a central repository information 
			regarding Windows NT and 95/98 printer driver packages</P
></LI
><LI
><P
>Providing the tools necessary for creating 
			the Imprints printer driver packages.</P
></LI
><LI
><P
>Providing an installation client which 
			will obtain and install printer drivers on remote Samba 
			and Windows NT 4 print servers.</P
></LI
></UL
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1892"
>13.3.2. Creating Printer Driver Packages</A
></H3
><P
>The process of creating printer driver packages is beyond
		the scope of this document (refer to Imprints.txt also included
		with the Samba distribution for more information).  In short,
		an Imprints driver package is a gzipped tarball containing the
		driver files, related INF files, and a control file needed by the
		installation client.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1895"
>13.3.3. The Imprints server</A
></H3
><P
>The Imprints server is really a database server that 
		may be queried via standard HTTP mechanisms.  Each printer 
		entry in the database has an associated URL for the actual
		downloading of the package.  Each package is digitally signed
		via GnuPG which can be used to verify that package downloaded
		is actually the one referred in the Imprints database.  It is 
		<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>not</I
></SPAN
> recommended that this security check 
		be disabled.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1899"
>13.3.4. The Installation Client</A
></H3
><P
>More information regarding the Imprints installation client 
		is available in the <TT
CLASS="FILENAME"
>Imprints-Client-HOWTO.ps</TT
> 
		file included with the imprints source package.</P
><P
>The Imprints installation client comes in two forms.</P
><P
></P
><UL
><LI
><P
>a set of command line Perl scripts</P
></LI
><LI
><P
>a GTK+ based graphical interface to 
			the command line perl scripts</P
></LI
></UL
><P
>The installation client (in both forms) provides a means
		of querying the Imprints database server for a matching
		list of known printer model names as well as a means to 
		download and install the drivers on remote Samba and Windows
		NT print servers.</P
><P
>The basic installation process is in four steps and 
		perl code is wrapped around <B
CLASS="COMMAND"
>smbclient</B
> 
		and <B
CLASS="COMMAND"
>rpcclient</B
>.</P
><P
><PRE
CLASS="PROGRAMLISTING"
>	
foreach (supported architecture for a given driver)
{
     1.  rpcclient: Get the appropriate upload directory 
         on the remote server
     2.  smbclient: Upload the driver files
     3.  rpcclient: Issues an AddPrinterDriver() MS-RPC
}
	
4.  rpcclient: Issue an AddPrinterEx() MS-RPC to actually
    create the printer</PRE
></P
><P
>One of the problems encountered when implementing 
		the Imprints tool set was the name space issues between 
		various supported client architectures.  For example, Windows 
		NT includes a driver named "Apple LaserWriter II NTX v51.8" 
		and Windows 95 calls its version of this driver "Apple 
		LaserWriter II NTX"</P
><P
>The problem is how to know what client drivers have 
		been uploaded for a printer.  As astute reader will remember 
		that the Windows NT Printer Properties dialog only includes 
		space for one printer driver name.  A quick look in the 
		Windows NT 4.0 system registry at</P
><P
><TT
CLASS="FILENAME"
>HKLM\System\CurrentControlSet\Control\Print\Environment
		</TT
></P
><P
>will reveal that Windows NT always uses the NT driver 
		name.  This is ok as Windows NT always requires that at least 
		the Windows NT version of the printer driver is present.  
		However, Samba does not have the requirement internally.  
		Therefore, how can you use the NT driver name if is has not 
		already been installed?</P
><P
>The way of sidestepping this limitation is to require 
		that all Imprints printer driver packages include both the Intel 
		Windows NT and 95/98 printer drivers and that NT driver is 
		installed first.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN1921"
>13.4. Diagnosis</A
></H2
><DIV
CLASS="SECT2"
><H3
CLASS="SECT2"
><A
NAME="AEN1923"
>13.4.1. Introduction</A
></H3
><P
>This is a short description of how to debug printing problems with
Samba. This describes how to debug problems with printing from a SMB
client to a Samba server, not the other way around. For the reverse
see the examples/printing directory.</P
><P
>Ok, so you want to print to a Samba server from your PC. The first
thing you need to understand is that Samba does not actually do any
printing itself, it just acts as a middleman between your PC client
and your Unix printing subsystem. Samba receives the file from the PC
then passes the file to a external "print command". What print command
you use is up to you.</P
><P
>The whole things is controlled using options in smb.conf. The most
relevant options (which you should look up in the smb.conf man page)
are:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>      [global]
        print command     - send a file to a spooler
        lpq command       - get spool queue status
        lprm command      - remove a job
      [printers]
        path = /var/spool/lpd/samba</PRE
></P
><P
>The following are nice to know about:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>        queuepause command   - stop a printer or print queue
        queueresume command  - start a printer or print queue</PRE
></P
><P
>Example:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>        print command = /usr/bin/lpr -r -P%p %s
        lpq command   = /usr/bin/lpq    -P%p %s
        lprm command  = /usr/bin/lprm   -P%p %j
        queuepause command = /usr/sbin/lpc -P%p stop
        queuepause command = /usr/sbin/lpc -P%p start</PRE
></P
><P
>Samba should set reasonable defaults for these depending on your
system type, but it isn't clairvoyant. It is not uncommon that you
have to tweak these for local conditions.  The commands should
always have fully specified pathnames,  as the smdb may not have
the correct PATH values.</P
><P
>When you send a job to Samba to be printed,  it will make a temporary
copy of it in the directory specified in the [printers] section.
and it should be periodically cleaned out.  The lpr -r option
requests that the temporary copy be removed after printing; If
printing fails then you might find leftover files in this directory,
and it should be periodically cleaned out.  Samba used the lpq
command to determine the "job number" assigned to your print job
by the spooler.</P
><P
>The %&#62;letter&#60; are "macros" that get dynamically replaced with appropriate
values when they are used. The %s gets replaced with the name of the spool
file that Samba creates and the %p gets replaced with the name of the
printer. The %j gets replaced with the "job number" which comes from
the lpq output.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1939"
>13.4.2. Debugging printer problems</A
></H3
><P
>One way to debug printing problems is to start by replacing these
command with shell scripts that record the arguments and the contents
of the print file. A simple example of this kind of things might
be:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>	print command = /tmp/saveprint %p %s

    #!/bin/saveprint
    # we make sure that we are the right user
    /usr/bin/id -p &#62;/tmp/tmp.print
    # we run the command and save the error messages
    # replace the command with the one appropriate for your system
    /usr/bin/lpr -r -P$1 $2 2&#62;&#62;&#38;/tmp/tmp.print</PRE
></P
><P
>Then you print a file and try removing it.  You may find that the
print queue needs to be stopped in order to see the queue status
and remove the job:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>&#13;h4: {42} % echo hi &#62;/tmp/hi
h4: {43} % smbclient //localhost/lw4
added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0
Password: 
Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7]
smb: \&#62; print /tmp/hi
putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s)
smb: \&#62; queue
1049     3            hi-17534
smb: \&#62; cancel 1049
Error cancelling job 1049 : code 0
smb: \&#62; cancel 1049
Job 1049 cancelled
smb: \&#62; queue
smb: \&#62; exit</PRE
></P
><P
>The 'code 0' indicates that the job was removed.  The comment
by the  smbclient is a bit misleading on this.
You can observe the command output and then and look at the
/tmp/tmp.print file to see what the results are.  You can quickly
find out if the problem is with your printing system.  Often people
have problems with their /etc/printcap file or permissions on
various print queues.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1948"
>13.4.3. What printers do I have?</A
></H3
><P
>You can use the 'testprns' program to check to see if the printer
name you are using is recognized by Samba.  For example,  you can
use:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>    testprns printer /etc/printcap</PRE
></P
><P
>Samba can get its printcap information from a file or from a program.
You can try the following to see the format of the extracted
information:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>    testprns -a printer /etc/printcap

    testprns -a printer '|/bin/cat printcap'</PRE
></P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1956"
>13.4.4. Setting up printcap and print servers</A
></H3
><P
>You may need to set up some printcaps for your Samba system to use.
It is strongly recommended that you use the facilities provided by
the print spooler to set up queues and printcap information.</P
><P
>Samba requires either a printcap or program to deliver printcap
information.  This printcap information has the format:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>  name|alias1|alias2...:option=value:...</PRE
></P
><P
>For almost all printing systems, the printer 'name' must be composed
only of alphanumeric or underscore '_' characters.  Some systems also
allow hyphens ('-') as well.  An alias is an alternative name for the
printer,  and an alias with a space in it is used as a 'comment'
about the printer.  The printcap format optionally uses a \ at the end of lines
to extend the printcap to multiple lines.</P
><P
>Here are some examples of printcap files:</P
><P
><P
></P
><OL
TYPE="1"
><LI
><P
>pr              just printer name</P
></LI
><LI
><P
>pr|alias        printer name and alias</P
></LI
><LI
><P
>pr|My Printer   printer name, alias used as comment</P
></LI
><LI
><P
>pr:sh:\        Same as pr:sh:cm= testing
  :cm= \ 
  testing</P
></LI
><LI
><P
>pr:sh           Same as pr:sh:cm= testing
  :cm= testing</P
></LI
></OL
></P
><P
>Samba reads the printcap information when first started.  If you make
changes in the printcap information, then you must do the following:</P
><P
></P
><OL
TYPE="1"
><LI
><P
>make sure that the print spooler is aware of these changes.
The LPRng system uses the 'lpc reread' command to do this.</P
></LI
><LI
><P
>make sure that the spool queues, etc., exist and have the
correct permissions.  The LPRng system uses the 'checkpc -f'
command to do this.</P
></LI
><LI
><P
>You now should send a SIGHUP signal to the smbd server to have
it reread the printcap information.</P
></LI
></OL
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1984"
>13.4.5. Job sent, no output</A
></H3
><P
>This is the most frustrating part of printing.  You may have sent the
job,  verified that the job was forwarded,  set up a wrapper around
the command to send the file,  but there was no output from the printer.</P
><P
>First,  check to make sure that the job REALLY is getting to the
right print queue.  If you are using a BSD or LPRng print spooler,
you can temporarily stop the printing of jobs.  Jobs can still be
submitted, but they will not be printed.  Use:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>  lpc -Pprinter stop</PRE
></P
><P
>Now submit a print job and then use 'lpq -Pprinter' to see if the
job is in the print queue.  If it is not in the print queue then
you will have to find out why it is not being accepted for printing.</P
><P
>Next, you may want to check to see what the format of the job really
was.  With the assistance of the system administrator you can view
the submitted jobs files.  You may be surprised to find that these
are not in what you would expect to call a printable format.
You can use the UNIX 'file' utitily to determine what the job
format actually is:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>    cd /var/spool/lpd/printer   # spool directory of print jobs
    ls                          # find job files
    file dfA001myhost</PRE
></P
><P
>You should make sure that your printer supports this format OR that
your system administrator has installed a 'print filter' that will
convert the file to a format appropriate for your printer.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN1995"
>13.4.6. Job sent, strange output</A
></H3
><P
>Once you have the job printing, you can then start worrying about
making it print nicely.</P
><P
>The most common problem is extra pages of output: banner pages
OR blank pages at the end.</P
><P
>If you are getting banner pages,  check and make sure that the
printcap option or printer option is configured for no banners.
If you have a printcap,  this is the :sh (suppress header or banner
page) option.  You should have the following in your printer.</P
><P
><PRE
CLASS="PROGRAMLISTING"
>   printer: ... :sh</PRE
></P
><P
>If you have this option and are still getting banner pages,  there
is a strong chance that your printer is generating them for you
automatically.  You should make sure that banner printing is disabled
for the printer.  This usually requires using the printer setup software
or procedures supplied by the printer manufacturer.</P
><P
>If you get an extra page of output,  this could be due to problems
with your job format,  or if you are generating PostScript jobs,
incorrect setting on your printer driver on the MicroSoft client.
For example, under Win95 there is a option:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>  Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|</PRE
></P
><P
>that allows you to choose if a Ctrl-D is appended to all jobs.
This is a very bad thing to do, as most spooling systems will
automatically add a ^D to the end of the job if it is detected as
PostScript.  The multiple ^D may cause an additional page of output.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2007"
>13.4.7. Raw PostScript printed</A
></H3
><P
>This is a problem that is usually caused by either the print spooling
system putting information at the start of the print job that makes
the printer think the job is a text file, or your printer simply
does not support PostScript.  You may need to enable 'Automatic
Format Detection' on your printer.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2010"
>13.4.8. Advanced Printing</A
></H3
><P
>Note that you can do some pretty magic things by using your
imagination with the "print command" option and some shell scripts.
Doing print accounting is easy by passing the %U option to a print
command shell script. You could even make the print command detect
the type of output and its size and send it to an appropriate
printer.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2013"
>13.4.9. Real debugging</A
></H3
><P
>If the above debug tips don't help, then maybe you need to bring in
the bug guns, system tracing. See Tracing.txt in this directory.</P
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="CUPS-PRINTING"
></A
>Chapter 14. CUPS Printing Support</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
NAME="AEN2034"
>14.1. Introduction</A
></H2
><P
>The Common Unix Print System (CUPS) has become very popular, but to many it is
a very mystical tool. There is a great deal of uncertainty regarding CUPS and how
it works. The result is seen in a large number of posting on the samba mailing lists
expressing frustration when MS Windows printers appear not to work with a CUPS
backr-end.</P
><P
>This is a good time to point out how CUPS can be used and what it does. CUPS is more
than just a print spooling system - it is a complete printer management system that
complies with HTTP and IPP protocols. It can be managed remotely via a web browser
and it can print using http and ipp protocols.</P
><P
>CUPS allows to creation of RAW printers (ie: NO file format translation) as well as
SMART printers (ie: CUPS does file format conversion as required for the printer). In
many ways this gives CUPS similar capabilities to the MS Windows print monitoring
system. Of course, if you are a CUPS advocate, you would agrue that CUPS is better!
In any case, let us now move on to explore how one may configure CUPS for interfacing
with MS Windows print clients via Samba.</P
><P
><A
HREF="http://www.cups.org/"
TARGET="_top"
>CUPS</A
> is a newcomer in the UNIX printing scene,
which has convinced many people upon first trial already. However, it has quite a few
new features, which make it different from other, more traditional printing systems.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2041"
>14.2. Configuring <TT
CLASS="FILENAME"
>smb.conf</TT
> for CUPS</A
></H2
><P
>Printing with CUPS in the most basic <TT
CLASS="FILENAME"
>smb.conf</TT
>
setup in Samba-3  only needs two settings: <B
CLASS="COMMAND"
>printing = cups</B
> and
<B
CLASS="COMMAND"
>printcap = cups</B
>. While CUPS itself doesn't need a printcap
anymore, the <TT
CLASS="FILENAME"
>cupsd.conf</TT
> configuration file knows two directives
(example: <B
CLASS="COMMAND"
>Printcap /etc/printcap</B
> and <B
CLASS="COMMAND"
>PrintcapFormat
BSD</B
>), which control if such a file should be created for the
convenience of third party applications. Make sure it is set! For details see
<B
CLASS="COMMAND"
>man cupsd.conf</B
> and other CUPS-related documentation.</P
><P
>If SAMBA is compiled against libcups, then <B
CLASS="COMMAND"
>printcap = cups</B
> uses the
CUPS API to list printers, submit jobs, etc. Otherwise it maps to the System V commands
with an additional <VAR
CLASS="PARAMETER"
>-oraw</VAR
> option for printing. On a Linux system,
you can use the <B
CLASS="COMMAND"
>ldd</B
> command to find out details (ldd may not be
present on other OS platforms, or its function may be embodied by a different command):</P
><P
><PRE
CLASS="PROGRAMLISTING"
>transmeta:/home/kurt # ldd `which smbd`
        libssl.so.0.9.6 =&#62; /usr/lib/libssl.so.0.9.6 (0x4002d000)
        libcrypto.so.0.9.6 =&#62; /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
        libcups.so.2 =&#62; /usr/lib/libcups.so.2 (0x40123000)
        libdl.so.2 =&#62; /lib/libdl.so.2 (0x401e8000)
        libnsl.so.1 =&#62; /lib/libnsl.so.1 (0x401ec000)
        libpam.so.0 =&#62; /lib/libpam.so.0 (0x40202000)
        libc.so.6 =&#62; /lib/libc.so.6 (0x4020b000)
        /lib/ld-linux.so.2 =&#62; /lib/ld-linux.so.2 (0x40000000)</PRE
></P
><P
>The line "libcups.so.2 =&#62; /usr/lib/libcups.so.2
(0x40123000)" shows there is CUPS support compiled into this version of
Samba. If this is the case, and <B
CLASS="COMMAND"
>printing = cups</B
> is set, then any
otherwise manually set print command in <TT
CLASS="FILENAME"
>smb.conf</TT
> is ignored.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2061"
>14.3. CUPS - RAW Print Through Mode</A
></H2
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>When used in raw print through mode is will be necessary to use the printer
vendor's drivers in each Windows client PC.</P
></TD
></TR
></TABLE
></DIV
><P
>When CUPS printers are configured for RAW print-through mode operation it is the
responsibility of the Samba client to fully render the print job (file) in a format
that is suitable for direct delivery to the printer. In this case CUPS will NOT
do any print file format conversion work.</P
><P
>The CUPS files that need to be correctly set for RAW mode printers to work are:

<P
></P
><UL
><LI
><P
><TT
CLASS="FILENAME"
>/etc/cups/mime.types</TT
></P
></LI
><LI
><P
><TT
CLASS="FILENAME"
>/etc/cups/mime.convs</TT
></P
></LI
></UL
>

Both contain entries that must be uncommented to allow <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>RAW</I
></SPAN
> mode
operation.</P
><P
>Firstly, to enable CUPS based printing from Samba the following options must be
enabled in your <TT
CLASS="FILENAME"
>smb.conf</TT
> file [globals] section:

<P
></P
><UL
><LI
><P
>printing = CUPS</P
></LI
><LI
><P
>printcap = CUPS</P
></LI
></UL
>

When these parameters are specified the print directives in <TT
CLASS="FILENAME"
>smb.conf</TT
> (as well as in
samba itself) will be ignored because samba will directly interface with CUPS through
it's application program interface (API) - so long as Samba has been compiled with
CUPS library (libcups) support. If samba has NOT been compiled with CUPS support then
printing will use the System V AT&#38;T command set with the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>-oraw</I
></SPAN
> 
option automatically passing through.</P
><P
>Cupsomatic (an enhanced printing utility that is part of some CUPS implementations) 
on the Samba/CUPS server does *not* add any features if a file is really
printed "raw".  However, if you have loaded the driver for the Windows client from
the CUPS server, using the "cupsaddsmb" utility, and if this driver is one using
a "Foomatic" PPD, the PJL header in question is already added on the Windows client,
at the time when the driver initially generated the PostScript data and CUPS in true
"-oraw" manner doesn't remove this PJL header and passes the file "as is" to its
printer communication backend.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>NOTE: editing in the "mime.convs" and the "mime.types" file does not *enforce*
"raw" printing, it only *allows* it.</P
></TD
></TR
></TABLE
></DIV
><P
>Print files that arrive from MS Windows printing are "auto-typed" by CUPS. This aids
the process of determining proper treatment while in the print queue system.

<P
></P
><UL
><LI
><P
>	Files generated by PCL drivers and directed at PCK printers get auto-typed as
	<TT
CLASS="FILENAME"
>application/octet-stream</TT
>. Unknown file format types also
	get auto-typed with this tag.
	</P
></LI
><LI
><P
>	Files generated by a Postscript driver and directed at a Postscript printer
	are auto-typed depending on the auto-detected most suitable MIME type as:

	<P
></P
><UL
><LI
><P
>* application/postscript</P
></LI
><LI
><P
>* application/vnd.cups-postscript</P
></LI
></UL
>
	</P
></LI
></UL
></P
><P
>"application/postscript" first goes thru the "pstops" filter (where the page counting
and accounting takes place). The outcome will be of MIME type
"application/vnd.cups-postscript". The pstopsfilter reads and uses information from
the PPD and inserts user-provided options into the PostScript file. As a consequence,
the filtered file could possibly have an unwanted PJL header.</P
><P
>"application/postscript" will be all files with a ".ps", ".ai", ".eps" suffix or which
have as their first character string one of "%!" or "&#62;04&#60;%".</P
><P
>"application/vnd.cups-postscript" will files which contain the string
"LANGUAGE=POSTSCRIPT" (or similar variations with different capitalization) in the
first 512 bytes, and also contain the "PJL super escape code" in the first 128 bytes
("&#62;1B&#60;%-12345X"). Very likely, most PostScript files generated on Windows using a CUPS
or other PPD, will have to be auto-typed as "vnd.cups-postscript".  A file produced
with a "Generic PostScript driver" will just be tagged "application/postscript".</P
><P
>Once the file is in "application/vnd.cups-postscript" format, either "pstoraster"
or "cupsomatic" will take over (depending on the printer configuration, as
determined by the PPD in use).</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>A printer queue with *no* PPD associated to it is a "raw" printer and all files
will go directly there as received by the spooler. The exeptions are file types
"application/octet-stream" which need "passthrough feature" enabled.
"Raw" queues don't do any filtering at all, they hand the file directly to the
CUPS backend. This backend is responsible for the sending of the data to the device
(as in the "device URI" notation as lpd://, socket://, smb://, ipp://, http://,
parallel:/, serial:/, usb:/ etc.)</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>"cupsomatic"/Foomatic are *not* native CUPS drivers and they don't ship with CUPS.
They are a Third Party add-on, developed at Linuxprinting.org.  As such, they are
a brilliant hack to make all models (driven by Ghostscript drivers/filters in
traditional spoolers) also work via CUPS, with the same (good or bad!) quality
as in these other spoolers. "cupsomatic" is only a vehicle to execute a ghostscript
commandline at that stage in the CUPS filtering chain, where "normally" the native
CUPS "pstoraster" filter would kick in.  cupsomatic by-passes pstoraster, "kidnaps"
the printfile from CUPS away and re-directs it to go through Ghostscipt. CUPS accepts this,
because the associated CUPS-O-Matic-/Foomatic-PPD specifies:</P
><PRE
CLASS="PROGRAMLISTING"
>   *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"</PRE
><P
>This line persuades CUPS to hand the file to cupsomatic, once it has successfully
converted it to the MIME type "application/vnd.cups-postscript". This conversion will not
happen for Jobs arriving from Windows which are auto-typed "application/octet-stream",
with the according changes in "/etc/cups/mime.types" in place.</P
></TD
></TR
></TABLE
></DIV
><P
>CUPS is widely configurable and flexible, even regarding its filtering mechanism.
Another workaround in some situations would be to have
in "/etc/cups/mime.types" entries as follows:</P
><PRE
CLASS="PROGRAMLISTING"
>   application/postscript           application/vnd.cups-raw  0  -
   application/vnd.cups-postscript  application/vnd.cups-raw  0  -</PRE
><P
>This would prevent all Postscript files from being filtered (rather, they will go
thru the virtual "nullfilter" denoted with "-"). This could only be useful for
PS printers. If you want to print PS code on non-PS printers an entry as follows
could be useful:</P
><PRE
CLASS="PROGRAMLISTING"
>   */*           application/vnd.cups-raw  0  -</PRE
><P
>and would effectively send *all* files to the backend without further processing.</P
><P
>Lastly, you could have the following entry:</P
><PRE
CLASS="PROGRAMLISTING"
>   application/vnd.cups-postscript  application/vnd.cups-raw  0  my_PJL_stripping_filter</PRE
><P
>You will need to write a "my_PJL_stripping_filter" (could be a shellscript) that
parses the PostScript and removes the unwanted PJL. This would need to conform to
CUPS filter design (mainly, receive and pass the parameters printername, job-id,
username, jobtitle, copies, print options and possibly the filename). It would
be installed as world executable into "/usr/lib/cups/filters/" and will be called
by CUPS if it encounters a MIME type "application/vnd.cups-postscript".</P
><P
>CUPS can handle "-o job-hold-until=indefinite". This keeps the job in the queue
"on hold". It will only be printed upon manual release by the printer operator.
This is a requirement in many "central reproduction departments", where a few
operators manage the jobs of hundreds of users on some big machine, where no
user is allowed to have direct access. (The operators often need to load the
proper paper type before running the 10.000 page job requested by marketing
for the mailing, etc.).</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2118"
>14.4. CUPS as a network PostScript RIP -- CUPS drivers working on server, Adobe
PostScript driver with CUPS-PPDs downloaded to clients</A
></H2
><P
>CUPS is perfectly able to use PPD files (PostScript
Printer Descriptions). PPDs can control all print device options. They
are usually provided by the manufacturer -- if you own a PostSript printer,
that is. PPD files are always a component of PostScript printer drivers on MS
Windows or Apple Mac OS systems. They are ASCII files containing
user-selectable print options, mapped to appropriate PostScript, PCL or PJL
commands for the target printer. Printer driver GUI dialogs translate these
options "on-the-fly" into buttons and drop-down lists for the user to
select.</P
><P
>CUPS can load, without any conversions, the PPD file from
any Windows (NT is recommended) PostScript driver and handle the options.
There is a web browser interface to the print options (select
http://localhost:631/printers/ and click on one "Configure Printer" button
to see it), a commandline interface (see <B
CLASS="COMMAND"
>man lpoptions</B
> or
try if you have <B
CLASS="COMMAND"
>lphelp</B
> on your system) plus some different GUI frontends on Linux
UNIX, which can present PPD options to the users. PPD options are normally
meant to become evaluated by the PostScript RIP on the real PostScript
printer.</P
><P
>CUPS doesn't stop at "real" PostScript printers in its
usage of PPDs. The CUPS developers have extended the PPD concept, to also
describe available device and driver options for non-PostScript printers
through  CUPS-PPDs.</P
><P
>This is logical, as CUPS includes a fully featured
PostScript interpreter (RIP). This RIP is based on Ghostscript. It can
process all received PostScript (and additionally many other file formats)
from clients. All CUPS-PPDs geared to non-PostScript printers contain an
additional line, starting with the keyword <VAR
CLASS="PARAMETER"
>*cupsFilter</VAR
>.
This line
tells the CUPS print system which printer-specific filter to use for the
interpretation of the accompanying PostScript. Thus CUPS lets all its
printers appear as PostScript devices to its clients, because it can act as a
PostScript RIP for those printers, processing the received PostScript code
into a proper raster print format.</P
><P
>CUPS-PPDs can also be used on Windows-Clients, on top of a
PostScript driver (recommended is the Adobe one).</P
><P
>This feature enables CUPS to do a few tricks no other
spooler can do:</P
><P
></P
><UL
><LI
><P
>act as a networked PostScript RIP (Raster Image Processor), handling
    printfiles from all client platforms in a uniform way;</P
></LI
><LI
><P
>act as a central accounting and billing server, as all files are passed
    through the <B
CLASS="COMMAND"
>pstops</B
> Filter and are therefor logged in
    the CUPS <TT
CLASS="FILENAME"
>page&lowbar;log</TT
>. - <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>NOTE: </I
></SPAN
>this
    can not happen with "raw" print jobs, which always remain unfiltered
    per definition;</P
></LI
><LI
><P
>enable clients to consolidate on a single PostScript driver, even for
    many different target printers.</P
></LI
></UL
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2139"
>14.5. Windows Terminal Servers (WTS) as CUPS clients</A
></H2
><P
>This setup may be of special interest to people
experiencing major problems in WTS environments. WTS need often a multitude
of non-PostScript drivers installed to run their clients' variety of
different printer models. This often imposes the price of much increased
instability. In many cases, in an attempt to overcome this problem, site
administrators have resorted to restrict the allowed drivers installed on
their WTS to one generic PCL- and one PostScript driver. This however
restricts the clients in the amount of printer options available for them --
often they can't get out more then simplex prints from one standard paper
tray, while their devices could do much better, if driven by a different
driver!</P
><P
>Using an Adobe PostScript driver, enabled with a CUPS-PPD,
seems to be a very elegant way to overcome all these shortcomings. The
PostScript driver is not known to cause major stability problems on WTS (even
if used with many different PPDs). The clients will be able to (again) chose
paper trays, duplex printing and other settings. However, there is a certain
price for this too: a  CUPS server acting as a PostScript RIP for its clients
requires more CPU and RAM than just to act as  a "raw spooling" device. Plus,
this setup is not yet widely tested, although the first feedbacks look very
promising...</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2143"
>14.6. Setting up CUPS for driver download</A
></H2
><P
>The <B
CLASS="COMMAND"
>cupsadsmb</B
> utility (shipped with all current
CUPS versions) makes the sharing of any (or all) installed CUPS printers very
easy. Prior to using it, you need the following settings in <TT
CLASS="FILENAME"
>smb.conf</TT
>:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>[global]
		 load printers = yes
		 printing = cups
		 printcap name = cups

	[printers]
		 comment = All Printers
		 path = /var/spool/samba
		 browseable = no
		 public = yes
		 guest ok = yes
		 writable = no
		 printable = yes
		 printer admin = root

	[print$]
		 comment = Printer Drivers
		 path = /etc/samba/drivers
		 browseable = yes
		 guest ok = no
		 read only = yes
		 write list = root
	</PRE
></P
><P
>For licensing reasons the necessary files of the Adobe
Postscript driver can not be distributed with either Samba or CUPS. You need
to download them yourself from the Adobe website. Once extracted, create a
<TT
CLASS="FILENAME"
>drivers</TT
> directory in the CUPS data directory (usually
<TT
CLASS="FILENAME"
>/usr/share/cups/</TT
>). Copy the Adobe files using
UPPERCASE filenames, to this directory as follows:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>		ADFONTS.MFM
		ADOBEPS4.DRV
		ADOBEPS4.HLP
		ADOBEPS5.DLL
		ADOBEPSU.DLL
		ADOBEPSU.HLP
		DEFPRTR2.PPD
		ICONLIB.DLL
	</PRE
></P
><P
>Users of the ESP Print Pro software are able to install
their "Samba Drivers" package for this purpose with no problem.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2156"
>14.7. Sources of CUPS drivers / PPDs</A
></H2
><P
>On the internet you can find now many thousand CUPS-PPD
files (with their companion filters), in many national languages,
supporting more than 1.000 non-PostScript models.</P
><P
></P
><UL
><LI
><P
><A
HREF="http://wwwl.easysw.com/printpro/"
TARGET="_top"
>ESP PrintPro
    (http://wwwl.easysw.com/printpro/)</A
>
    (commercial, non-Free) is packaged with more than 3.000 PPDs, ready for
    successful usage "out of the box" on Linux, IBM-AIX, HP-UX, Sun-Solaris,
    SGI-IRIX, Compaq Tru64, Digital Unix and some more commercial Unices (it
    is written by the CUPS developers themselves and its sales help finance
    the further development of CUPS, as they feed their creators)</P
></LI
><LI
><P
>the <A
HREF="http://gimp-print.sourceforge.net/"
TARGET="_top"
>Gimp-Print-Project
    (http://gimp-print.sourceforge.net/)</A
>
    (GPL, Free Software) provides around 120 PPDs (supporting nearly 300
    printers, many driven to photo quality output), to be used alongside the
    Gimp-Print CUPS filters;</P
></LI
><LI
><P
><A
HREF="http://www.turboprint.com/"
TARGET="_top"
>TurboPrint
    (http://www.turboprint.com/)</A
>
    (Shareware, non-Freee) supports roughly the same amount of printers in
    excellent quality;</P
></LI
><LI
><P
><A
HREF="http://www-124.ibm.com/developerworks/oss/linux/projects/omni/"
TARGET="_top"
>OMNI
    (http://www-124.ibm.com/developerworks/oss/linux/projects/omni/)</A
>
    (LPGL, Free) is a package made by IBM, now containing support for more
    than 400 printers, stemming from the inheritance of IBM OS/2 KnowHow
    ported over to Linux (CUPS support is in a Beta-stage at present);</P
></LI
><LI
><P
><A
HREF="http://hpinkjet.sourceforge.net/"
TARGET="_top"
>HPIJS
    (http://hpinkjet.sourceforge.net/)</A
>
    (BSD-style licnes, Free) supports around 120 of HP's own printers and is
    also providing excellent print quality now;</P
></LI
><LI
><P
><A
HREF="http://www.linuxprinting.org/"
TARGET="_top"
>Foomatic/cupsomatic (http://www.linuxprinting.org/)</A
>
    (LPGL, Free) from Linuxprinting.org are providing PPDs for practically every
    Ghostscript filter known to the world, now usable with CUPS.</P
></LI
></UL
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>NOTE: </I
></SPAN
>the cupsomatic trick from Linuxprinting.org is
working different from the other drivers. While the other drivers take the
generic CUPS raster (produced by CUPS' own pstoraster PostScript RIP) as
their input, cupsomatic "kidnaps" the PostScript inside CUPS, before
RIP-ping, deviates it to an external Ghostscript installation (which now
becomes the RIP) and gives it back to a CUPS backend once Ghostscript is
finished. -- CUPS versions from 1.1.15 and later will provide their pstoraster
PostScript RIP function again inside a system-wide Ghostscript
installation rather than in "their own" pstoraster filter. (This
CUPS-enabling Ghostscript version may be installed either as a
patch to GNU or AFPL Ghostscript, or as a complete ESP Ghostscript package).
However, this will not change the cupsomatic approach of guiding the printjob
along a different path through the filtering system than the standard CUPS
way...</P
><P
>Once you installed a printer inside CUPS with one of the
recommended methods (the lpadmin command, the web browser interface or one of
the available GUI wizards), you can use <B
CLASS="COMMAND"
>cupsaddsmb</B
> to share the
printer via Samba. <B
CLASS="COMMAND"
>cupsaddsmb</B
> prepares the driver files for
comfortable client download and installation upon their first contact with
this printer share.</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2183"
>14.7.1. <B
CLASS="COMMAND"
>cupsaddsmb</B
></A
></H3
><P
>The <B
CLASS="COMMAND"
>cupsaddsmb</B
> command copies the needed files
for convenient Windows client installations from the previously prepared CUPS
data directory to your [print$] share. Additionally, the PPD
associated with this printer is copied from <TT
CLASS="FILENAME"
>/etc/cups/ppd/</TT
> to
[print$].</P
><P
><PRE
CLASS="PROGRAMLISTING"
><SAMP
CLASS="PROMPT"
>root# </SAMP
> <B
CLASS="COMMAND"
>cupsaddsmb -U root infotec_IS2027</B
>
Password for root required to access localhost via SAMBA: <KBD
CLASS="USERINPUT"
>[type in password 'secret']</KBD
></PRE
></P
><P
>To share all printers and drivers, use the <VAR
CLASS="PARAMETER"
>-a</VAR
>
parameter instead of a printer name.</P
><P
>Probably you want to see what's going on. Use the
<VAR
CLASS="PARAMETER"
>-v</VAR
> parameter to get a more verbose output:</P
><P
>Probably you want to see what's going on. Use the
<VAR
CLASS="PARAMETER"
>-v</VAR
> parameter to get a more verbose output:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>Note: The following line shave been wrapped so that information is not lost.
 
<SAMP
CLASS="PROMPT"
>root# </SAMP
> cupsaddsmb -v -U root infotec_IS2027
    Password for root required to access localhost via SAMBA:
    Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put
       /var/spool/cups/tmp/3cd1cc66376c0 W32X86/infotec_IS2027.PPD;put /usr/share/cups/drivers/
       ADOBEPS5.DLL W32X86/ADOBEPS5.DLL;put /usr/share/cups/drivers/ADOBEPSU.DLLr
       W32X86/ADOBEPSU.DLL;put /usr/share/cups/drivers/ADOBEPSU.HLP W32X86/ADOBEPSU.HLP'
    added interface ip=10.160.16.45 bcast=10.160.31.255 nmask=255.255.240.0
    added interface ip=192.168.182.1 bcast=192.168.182.255 nmask=255.255.255.0
    added interface ip=172.16.200.1 bcast=172.16.200.255 nmask=255.255.255.0
    Domain=[TUX-NET] OS=[Unix] Server=[Samba 2.2.3a.200204262025cvs]
    NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
    putting file /var/spool/cups/tmp/3cd1cc66376c0 as \W32X86/infotec_IS2027.PPD (17394.6 kb/s)
      (average 17395.2 kb/s)
    putting file /usr/share/cups/drivers/ADOBEPS5.DLL as \W32X86/ADOBEPS5.DLL (10877.4 kb/s)
      (average 11343.0 kb/s)
    putting file /usr/share/cups/drivers/ADOBEPSU.DLL as \W32X86/ADOBEPSU.DLL (5095.2 kb/s)
      (average 9260.4 kb/s)
    putting file /usr/share/cups/drivers/ADOBEPSU.HLP as \W32X86/ADOBEPSU.HLP (8828.7 kb/s)
      (average 9247.1 kb/s)

    Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put
      /var/spool/cups/tmp/3cd1cc66376c0 WIN40/infotec_IS2027.PPD;put
      /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put
      /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put
      /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put
      /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put
      /usr/share/cups/drivers/ICONLIB.DLL WIN40/ICONLIB.DLL;put
      /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
    added interface ip=10.160.16.45 bcast=10.160.31.255 nmask=255.255.240.0
    added interface ip=192.168.182.1 bcast=192.168.182.255 nmask=255.255.255.0
    added interface ip=172.16.200.1 bcast=172.16.200.255 nmask=255.255.255.0
    Domain=[TUX-NET] OS=[Unix] Server=[Samba 2.2.3a.200204262025cvs]
    NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40
    putting file /var/spool/cups/tmp/3cd1cc66376c0 as \WIN40/infotec_IS2027.PPD (26091.5 kb/s)
      (average 26092.8 kb/s)
    putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (11241.6 kb/s)
      (average 11812.9 kb/s)
    putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (16640.6 kb/s)
      (average 14679.3 kb/s)
    putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (11285.6 kb/s)
      (average 14281.5 kb/s)
    putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (823.5 kb/s)
      (average 12944.0 kb/s)
    putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (19226.2 kb/s)
      (average 13169.7 kb/s)
    putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (18666.1 kb/s)
      (average 13266.7 kb/s)

    Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86"
       "infotec_IS2027:ADOBEPS5.DLL:infotec_IS2027.PPD:ADOBEPSU.DLL:ADOBEPSU.HLP:NULL:RAW:NULL"'
    cmd = adddriver "Windows NT x86" "infotec_IS2027:ADOBEPS5.DLL:infotec_IS2027.PPD:ADOBEPSU.DLL:
       ADOBEPSU.HLP:NULL:RAW:NULL"
    Printer Driver infotec_IS2027 successfully installed.

    Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0"
       "infotec_IS2027:ADOBEPS4.DRV:infotec_IS2027.PPD:NULL:ADOBEPS4.HLP:PSMON.DLL:RAW:
       ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
    cmd = adddriver "Windows 4.0" "infotec_IS2027:ADOBEPS4.DRV:infotec_IS2027.PPD:NULL:
       ADOBEPS4.HLP:PSMON.DLL:RAW:ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
    Printer Driver infotec_IS2027 successfully installed.

    Running command: rpcclient localhost -N -U'root%secret'
       -c 'setdriver infotec_IS2027 infotec_IS2027'
    cmd = setdriver infotec_IS2027 infotec_IS2027
    Succesfully set infotec_IS2027 to driver infotec_IS2027.

    <SAMP
CLASS="PROMPT"
>root# </SAMP
></PRE
></P
><P
>If you look closely, you'll discover your root password was transfered unencrypted over
the wire, so beware! Also, if you look further her, you'll discover error messages like
<CODE
CLASS="CONSTANT"
>NT_STATUS_OBJECT_NAME_COLLISION</CODE
> in between. They occur, because
the directories <TT
CLASS="FILENAME"
>WIN40</TT
> and <TT
CLASS="FILENAME"
>W32X86</TT
> already
existed in the [print$] driver download share (from a previous driver
installation). They are harmless here.</P
><P
>Now your printer is prepared for the clients to use. From
a client, browse to the CUPS/Samba server, open the "Printers"
share, right-click on this printer and select "Install..." or
"Connect..." (depending on the Windows version you use). Now their
should be a new printer in your client's local "Printers" folder,
named (in my case) "infotec_IS2027 on kdebitshop"</P
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>NOTE: </I
></SPAN
>
<B
CLASS="COMMAND"
>cupsaddsmb</B
> will only reliably work i
with CUPS version 1.1.15 or higher
and Samba from 2.2.4. If it doesn't work, or if the automatic printer
driver download to the clients doesn't succeed, you can still manually
install the CUPS printer PPD on top of the Adobe PostScript driver on
clients and then point the client's printer queue to the Samba printer
share for connection, should you desire to use the CUPS networked
PostScript RIP functions.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2212"
>14.8. The CUPS Filter Chains</A
></H2
><P
>The following diagrams reveal how CUPS handles print jobs.</P
><PRE
CLASS="PROGRAMLISTING"
>#########################################################################
#
# CUPS in and of itself has this (general) filter chain (CAPITAL
# letters are FILE-FORMATS or MIME types, other are filters (this is
# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
#
# <VAR
CLASS="REPLACEABLE"
>SOMETHNG</VAR
>-FILEFORMAT
#      |
#      |
#      V
#     <VAR
CLASS="REPLACEABLE"
>something</VAR
>tops
#      |
#      |
#      V
# APPLICATION/POSTSCRIPT
#      |
#      |
#      V
#     pstops
#      |
#      |
#      V
# APPLICATION/VND.CUPS-POSTSCRIPT
#      |
#      |
#      V
#     pstoraster   # as shipped with CUPS, independent from any Ghostscipt
#      |           # installation on the system
#      |  (= "postscipt interpreter")
#      |
#      V
# APPLICATION/VND.CUPS-RASTER
#      |
#      |
#      V
#     rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
>  (f.e. Gimp-Print filters may be plugged in here)
#      |   (= "raster driver")
#      |
#      V
# SOMETHING-DEVICE-SPECIFIC
#      |
#      |
#      V
#     backend
#
#
# ESP PrintPro has some enhanced "rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
>" filters as compared to
# CUPS, and also a somewhat improved "pstoraster" filter.
#
# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
#       CUPS and ESP PrintPro plug-in where rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
> is noted.
#
#########################################################################</PRE
><PRE
CLASS="PROGRAMLISTING"
>#########################################################################
#
# This is how "cupsomatic" comes into play:
# =========================================
#
# <VAR
CLASS="REPLACEABLE"
>SOMETHNG</VAR
>-FILEFORMAT
#      |
#      |
#      V
#    <VAR
CLASS="REPLACEABLE"
>something</VAR
>tops
#      |
#      |
#      V
# APPLICATION/POSTSCRIPT
#      |
#      |
#      V
#    pstops
#      |
#      |
#      V
# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
#      |                                          |
#      |                                          V
#      V                                         cupsomatic
#    pstoraster                                  (constructs complicated
#      |  (= "postscipt interpreter")            Ghostscript commandline
#      |                                         to let the file be
#      V                                         processed by a
# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=<VAR
CLASS="REPLACEABLE"
>s.th.</VAR
>"
#      |                                         call...)
#      |                                          |
#      V                                          |
#    rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
>                          V
#      |    (= "raster driver")     +-------------------------+
#      |                            | Ghostscript at work.... |
#      V                            |                         |
# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
#      |                                          |
#      |                                          |
#      V                                          |
#    backend &#62;------------------------------------+
#      |
#      |
#      V
#    THE PRINTER
#
#
# Note, that cupsomatic "kidnaps" the printfile after the
# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it through
# the CUPS-external, systemwide Ghostscript installation, bypassing the
# "pstoraster" filter (therefor also bypassing the CUPS-raster-drivers
# "rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
>", and hands the rasterized file directly to the CUPS
# backend...
#
# cupsomatic is not made by the CUPS developers. It is an independent
# contribution to printing development, made by people from
# Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
#
# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
#       CUPS and ESP PrintPro plug-in where rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
> is noted.
#
#########################################################################</PRE
><PRE
CLASS="PROGRAMLISTING"
>#########################################################################
#
# And this is how it works for ESP PrintPro from 4.3:
# ===================================================
#
# <VAR
CLASS="REPLACEABLE"
>SOMETHNG</VAR
>-FILEFORMAT
#      |
#      |
#      V
#     <VAR
CLASS="REPLACEABLE"
>something</VAR
>tops
#      |
#      |
#      V
# APPLICATION/POSTSCRIPT
#      |
#      |
#      V
#     pstops
#      |
#      |
#      V
# APPLICATION/VND.CUPS-POSTSCRIPT
#      |
#      |
#      V
#     gsrip
#      |  (= "postscipt interpreter")
#      |
#      V
# APPLICATION/VND.CUPS-RASTER
#      |
#      |
#      V
#     rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
>  (f.e. Gimp-Print filters may be plugged in here)
#      |   (= "raster driver")
#      |
#      V
# SOMETHING-DEVICE-SPECIFIC
#      |
#      |
#      V
#     backend
#
# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
#       CUPS and ESP PrintPro plug-in where rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
> is noted.
#
#########################################################################</PRE
><PRE
CLASS="PROGRAMLISTING"
>#########################################################################
#
# This is how "cupsomatic" would come into play with ESP PrintPro:
# ================================================================
#
#
# <VAR
CLASS="REPLACEABLE"
>SOMETHNG</VAR
>-FILEFORMAT
#      |
#      |
#      V
#    <VAR
CLASS="REPLACEABLE"
>something</VAR
>tops
#      |
#      |
#      V
# APPLICATION/POSTSCRIPT
#      |
#      |
#      V
#    pstops
#      |
#      |
#      V
# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
#      |                                          |
#      |                                          V
#      V                                         cupsomatic
#    gsrip                                       (constructs complicated
#      |  (= "postscipt interpreter")            Ghostscript commandline
#      |                                         to let the file be
#      V                                         processed by a
# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=<VAR
CLASS="REPLACEABLE"
>s.th.</VAR
>"
#      |                                         call...)
#      |                                          |
#      V                                          |
#    rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
>                          V
#      |   (= "raster driver")      +-------------------------+
#      |                            | Ghostscript at work.... |
#      V                            |                         |
# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
#      |                                          |
#      |                                          |
#      V                                          |
#    backend &#62;------------------------------------+
#      |
#      |
#      V
#    THE PRINTER
#
# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
#       CUPS and ESP PrintPro plug-in where rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
> is noted.
#
#########################################################################</PRE
><PRE
CLASS="PROGRAMLISTING"
>#########################################################################
#
# And this is how it works for CUPS from 1.1.15:
# ==============================================
#
# <VAR
CLASS="REPLACEABLE"
>SOMETHNG</VAR
>-FILEFORMAT
#      |
#      |
#      V
#     <VAR
CLASS="REPLACEABLE"
>something</VAR
>tops
#      |
#      |
#      V
# APPLICATION/POSTSCRIPT
#      |
#      |
#      V
#     pstops
#      |
#      |
#      V
# APPLICATION/VND.CUPS-POSTSCRIPT-----+
#                                     |
#                  +------------------v------------------------------+
#                  | Ghostscript                                     |
#                  | at work...                                      |
#                  | (with                                           |
#                  | "-sDEVICE=cups")                                |
#                  |                                                 |
#                  |         (= "postscipt interpreter")             |
#                  |                                                 |
#                  +------------------v------------------------------+
#                                     |
#                                     |
# APPLICATION/VND.CUPS-RASTER &#62;-------+
#      |
#      |
#      V
#     rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
>
#      |   (= "raster driver")
#      |
#      V
# SOMETHING-DEVICE-SPECIFIC
#      |
#      |
#      V
#     backend
#
#
# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to
#       Ghostscript. GNU Ghostscript needs to be patched to handle the
#       CUPS requirement; ESP Ghostscript has this builtin. In any case,
#       "gs -h" needs to show up a "cups" device. pstoraster is now a
#       calling an appropriate "gs -sDEVICE=cups..." commandline to do
#       the job. It will output "application/vnd.cup-raster", which will
#       be finally processed by a CUPS raster driver "rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
>"
#       Note the difference to "cupsomatic", which will *not* output
#       CUPS-raster, but a final version of the printfile, ready to be
#       sent to the printer. cupsomatic also doesn't use the "cups"
#       devicemode in Ghostscript, but one of the classical devicemodes....
#
# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
#       CUPS and ESP PrintPro plug-in where rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
> is noted.
#
#########################################################################</PRE
><PRE
CLASS="PROGRAMLISTING"
>#########################################################################
#
# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
# ========================================================================
#
# <VAR
CLASS="REPLACEABLE"
>SOMETHNG</VAR
>-FILEFORMAT
#      |
#      |
#      V
#     <VAR
CLASS="REPLACEABLE"
>something</VAR
>tops
#      |
#      |
#      V
# APPLICATION/POSTSCRIPT
#      |
#      |
#      V
#     pstops
#      |
#      |
#      V
# APPLICATION/VND.CUPS-POSTSCRIPT-----+
#                                     |
#                  +------------------v------------------------------+
#                  | Ghostscript        . Ghostscript at work....    |
#                  | at work...         . (with "-sDEVICE=           |
#                  | (with              .            <VAR
CLASS="REPLACEABLE"
>s.th.</VAR
>"        |
#                  | "-sDEVICE=cups")   .                            |
#                  |                    .                            |
#                  | (CUPS standard)    .      (cupsomatic)          |
#                  |                    .                            |
#                  |          (= "postscript interpreter")           |
#                  |                    .                            |
#                  +------------------v--------------v---------------+
#                                     |              |
#                                     |              |
# APPLICATION/VND.CUPS-RASTER &#62;-------+              |
#      |                                             |
#      |                                             |
#      V                                             |
#     rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
>                            |
#      |   (= "raster driver")                       |
#      |                                             |
#      V                                             |
# SOMETHING-DEVICE-SPECIFIC &#62;------------------------+
#      |
#      |
#      V
#     backend
#
#
# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
#       CUPS and ESP PrintPro plug-in where rasterto<VAR
CLASS="REPLACEABLE"
>something</VAR
> is noted.
#
##########################################################################</PRE
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2251"
>14.9. CUPS Print Drivers and Devices</A
></H2
><P
>CUPS ships with good support for HP LaserJet type printers. You can install
the driver as follows:

<P
></P
><UL
><LI
><P
>	lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
	</P
></LI
></UL
>

(The "-m" switch will retrieve the "laserjet.ppd" from the standard repository
for not-yet-installed-PPDs, which CUPS typically stores in 
<TT
CLASS="FILENAME"
>/usr/share/cups/model</TT
>. Alternatively, you may use
"-P /absolute/filesystem/path/to/where/there/is/PPD/your.ppd").</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2258"
>14.9.1. Further printing steps</A
></H3
><P
>Always also consult the database on linuxprinting.org for all recommendations
about which driver is best used for each printer:</P
><P
><A
HREF="http://www.linuxprinting.org/printer_list.cgi"
TARGET="_top"
>http://www.linuxprinting.org/printer_list.cgi</A
></P
><P
>There select your model and click on "Show". You'll arrive at a page listing
all drivers working with your model. There will always be *one* 
<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>recommended</I
></SPAN
> one. Try this one first. In your case
("HP LaserJet 4 Plus"), you'll arrive here:</P
><P
><A
HREF="http://www.linuxprinting.org/show_printer.cgi?recnum=75104"
TARGET="_top"
>http://www.linuxprinting.org/show_printer.cgi?recnum=75104</A
></P
><P
>The recommended driver is "ljet4". It has a link to the page for the ljet4
driver too:</P
><P
><A
HREF="http://www.linuxprinting.org/show_driver.cgi?driver=ljet4"
TARGET="_top"
>http://www.linuxprinting.org/show_driver.cgi?driver=ljet4</A
></P
><P
>On the driver's page, you'll find important and detailed info about how to use
that driver within the various available spoolers. You can generate a PPD for
CUPS. The PPD contains all the info about how to use your model and the driver;
this is, once installed, working transparently for the user -- you'll only
need to choose resolution, paper size etc. from the web-based menu or from
the print dialog GUI or from the commandline...</P
><P
>On the driver's page, choose to use the "PPD-O-Matic" online PPD generator
program. Select your model and click "Generate PPD file". When you safe the
appearing ASCII text file, don't use "cut'n'past" (as it could possiblly corrupt
line endings and tabs), but use "Save as..." in your browser's menu. Save it
at "/some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"</P
><P
>Then install the printer:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>    "lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E \
          -P /some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"</PRE
></P
><P
>Note, that for all the "Foomatic-PPDs" from Linuxprinting.org, you also need
a special "CUPS filter" named "cupsomatic". Get the latest version of
"cupsomatic" from:</P
><P
><A
HREF="http://www.linuxprinting.org/cupsomatic"
TARGET="_top"
>http://www.linuxprinting.org/cupsomatic</A
></P
><P
>This needs to be copied to <TT
CLASS="FILENAME"
>/usr/lib/cups/filter/cupsomatic</TT
>
and be made world executable. This filter is needed to read and act upon the
specially encoded Foomatic comments, embedded in the printfile, which in turn
are used to construct (transparently for you, the user) the complicated
ghostscript command line needed for your printer/driver combo.</P
><P
>You can have a look at all the options for the Ghostscript commandline supported
by your printer and the ljet4 driver by going to the section "Execution details",
selecting your model (Laserjet 4 Plus) and clicking on "Show execution details".
This will bring up this web page:</P
><P
><A
HREF="http://www.linuxprinting.org/execution.cgi?driver=ljet4&printer=75104&.submit=Show+execution+details"
TARGET="_top"
>http://www.linuxprinting.org/execution.cgi?driver=ljet4&#38;printer=75104&#38;.submit=Show+execution+details</A
></P
><P
>The ingenious thing is that the database is kept current. If there
is a bug fix and an improvement somewhere in the database, you will
always get the most current and stable and feature-rich driver by following
the steps described above.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Till Kamppeter from MandrakeSoft is doing an excellent job here that too few
people are aware of. (So if you use it often, please send him a note showing
your appreciation).</P
></TD
></TR
></TABLE
></DIV
><P
>The latest and greatest improvement now is support for "custom page sizes"
for all those printers which support it.</P
><P
>"cupsomatic" is documented here:</P
><P
><A
HREF="http://www.linuxprinting.org/cups-doc.html"
TARGET="_top"
>http://www.linuxprinting.org/cups-doc.html</A
></P
><P
>More printing tutorial info may be found here:</P
><P
><A
HREF="http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/"
TARGET="_top"
>http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/</A
></P
><P
>Note, that *all* the Foomatic drivers listed on Linuxprinting.org (now
approaching the "all-time high" number of 1.000 for the supported models)
are using a special filtering chain involving Ghostscript, as described
in this document.</P
><P
>Summary - You need:</P
><P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>A "foomatic+<VAR
CLASS="REPLACEABLE"
>something</VAR
>" PPD is not enough to print with CUPS (but it is *one* important component)</TD
></TR
><TR
><TD
>The "cupsomatic" filter script (Perl) in <TT
CLASS="FILENAME"
>/usr/lib/cups/filters/</TT
></TD
></TR
><TR
><TD
>Perl to make cupsomatic run</TD
></TR
><TR
><TD
>Ghostscript (because it is called and controlled by the PPD/cupsomatic combo in a way to fit your printermodel/driver combo.</TD
></TR
><TR
><TD
>Ghostscript *must*, depending on the driver/model, contain support for a certain "device" (as shown by "gs -h")</TD
></TR
></TBODY
></TABLE
><P
></P
></P
><P
>In the case of the "hpijs" driver, you need a Ghostscript version, which
has "ijs" amongst its supported devices in "gs -h". In the case of
"hpijs+foomatic", a valid ghostscript commandline would be reading like this:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>       gs -q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=ijs       \
             -sIjsServer=hpijs<VAR
CLASS="REPLACEABLE"
>PageSize</VAR
> -dDuplex=<VAR
CLASS="REPLACEABLE"
>Duplex</VAR
> <VAR
CLASS="REPLACEABLE"
>Model</VAR
>        \
             -r<VAR
CLASS="REPLACEABLE"
>Resolution</VAR
>,PS:MediaPosition=<VAR
CLASS="REPLACEABLE"
>InputSlot</VAR
> -dIjsUseOutputFD \
             -sOutputFile=- -</PRE
></P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Note, that with CUPS and the "hpijs+foomatic" PPD (plus Perl and cupsomatic)
you don't need to remember this. You can choose the available print options
thru a GUI print command (like "glp" from ESP's commercially supported
PrintPro software, or KDE's "kprinter", or GNOME's "gtklp" or the independent
"xpp") or the CUPS web interface via human-readable drop-down selection
menus.</P
></TD
></TR
></TABLE
></DIV
><P
>If you use "ESP Ghostscript" (also under the GPL, provided by Easy Software
Products, the makers of CUPS, downloadable from
<A
HREF="http://www.cups.org/software.html"
TARGET="_top"
>http://www.cups.org/software.html</A
>,
co-maintained by the developers of linuxprinting.org), you are guaranteed to
have in use the most uptodate, bug-fixed, enhanced and stable version of a Free
Ghostscript. It contains support for ~300 devices, whereas plain vanilla
GNU Ghostscript 7.05 only has ~200.</P
><P
>If you print only one CUPS test page, from the web interface and when you try to
print a windows test page, it acts like the job was never sent:

<P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>Can you print "standard" jobs from the CUPS machine?</TD
></TR
><TR
><TD
>Are the jobs from Windows visible in the Web interface on CUPS (http://localhost:631/)?</TD
></TR
><TR
><TD
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Most important:</I
></SPAN
> What kind of printer driver are you using on the Windows clients?</TD
></TR
></TBODY
></TABLE
><P
></P
>

You can try to get a more detailed debugging info by setting "LogLevel debug" in
<TT
CLASS="FILENAME"
>/etc/cups/cupsd.conf</TT
>, re-start cupsd and investigate <TT
CLASS="FILENAME"
>/var/log/cups/error_log</TT
>
for the whereabouts of your Windows-originating printjobs:</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>what does the "auto-typing" line say? which is the "MIME type" CUPS thinks is arriving from the Windows clients?</TD
></TR
><TR
><TD
>are there "filter" available for this MIME type?</TD
></TR
><TR
><TD
>are there "filter rules" defined in "/etc/cups/mime.convs" for this MIME type?</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2328"
>14.10. Limiting the number of pages users can print</A
></H2
><P
>The feature you want is dependent on the real print subsystem you're using.
Samba's part is always to receive the job files from the clients (filtered
*or* unfiltered) and hand it over to this printing subsystem.</P
><P
>Of course one could "hack" things with one's own scripts.</P
><P
>But there is CUPS (Common Unix Printing System). CUPS supports "quotas".
Quotas can be based on sizes of jobs or on the number of pages or both,
and are spanning any time period you want.</P
><P
>This is an example command how root would set a print quota in CUPS,
assuming an existing printer named "quotaprinter":</P
><PRE
CLASS="PROGRAMLISTING"
>  lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 \
       -o job-page-limit=100</PRE
><P
>This would limit every single user to print 100 pages or 1024 KB of
data (whichever comes first) within the last 604.800 seconds ( = 1 week).</P
><P
>For CUPS to count correctly, the printfile needs to pass the CUPS "pstops" filter,
otherwise it uses a "dummy" count of "1". Some printfiles don't pass it
(eg: image files) but then those are mostly 1 page jobs anyway. This also means,
proprietary drivers for the target printer running on the client computers and
CUPS/Samba then spooling these files as "raw" (i.e. leaving them untouched, not
filtering them), will be counted as "1-pagers" too!</P
><P
>You need to send PostScript from the clients (i.e. run a PostScript driver there)
for having the chance to get accounting done. If the printer is a non-PostScript model,
you need to let CUPS do the job to convert the file to a print-ready format for the
target printer. This will be working for currently ~1.000 different printer models, see</P
><PRE
CLASS="PROGRAMLISTING"
>     http://www.linuxprinting.org/printer_list.cgi</PRE
><P
>Before CUPS-1.1.16 your only option was to use the Adobe PostScript
Driver on the Windows clients. The output of this driver was not always
passed thru the "pstops" filter on the CUPS/Samba side, and therefor was
not counted correctly (the reason is that it often --- depending on the
"PPD" being used --- did write a "PJL"-header in front of the real
PostScript which made CUPS to skip the pstops and go directy to
the "pstoraster" stage).</P
><P
>From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver
for Windows NT/2K/XP clients" (it is tagged in the download area of
http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package).
It is *not* working for Win9x/ME clients. But it:</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>it guarantees to not write an PJL-header</TD
></TR
><TR
><TD
>it guarantees to still read and support all PJL-options named in the driver PPD with its own means</TD
></TR
><TR
><TD
>it guarantees the file going thru the "pstops" filter on the CUPS/Samba server</TD
></TR
><TR
><TD
>it guarantees to page-count correctly the printfile</TD
></TR
></TBODY
></TABLE
><P
></P
><P
>You can read more about the setup of this combination in the
manpage for "cupsaddsmb" (only present with CUPS installed, only
current with CUPS 1.1.16).</P
><P
>These are the items CUPS logs in the "page_log" for every single *page* of a job:</P
><P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>Printer name</TD
></TR
><TR
><TD
>User name</TD
></TR
><TR
><TD
>Job ID</TD
></TR
><TR
><TD
>Time of printing</TD
></TR
><TR
><TD
>the page number</TD
></TR
><TR
><TD
>the number of copies</TD
></TR
><TR
><TD
>a billing info string (optional)</TD
></TR
></TBODY
></TABLE
><P
></P
></P
><P
>Here is an extract of my CUPS server's page_log file to illustrate
the format and included items:</P
><P
><SAMP
CLASS="COMPUTEROUTPUT"
>	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 1 2  #marketing
	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 2 2  #marketing
	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 3 2  #marketing
	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 4 2  #marketing
	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 5 2  #marketing
	infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 6 2  #marketing</SAMP
></P
><P
>This was Job ID "40", printed on "infotec_IS2027" by user "kurt", a 6-page job
printed in 2 copies and billed to "#marketing"...</P
><P
>What flaws or shortcomings are there?</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>the ones named above</TD
></TR
><TR
><TD
>	CUPS really counts the job pages being *processsed in software*
	(going thru the "RIP") rather than the physical sheets successfully
	leaving the printing device -- if there is a jam while printing
	the 5th sheet out of 1000 and the job is aborted by the printer,
	the "page count" will still show the figure of 1000 for that job
	</TD
></TR
><TR
><TD
>	all quotas are the same for all users (no flexibility to give the
	boss a higher quota than the clerk) no support for groups
	</TD
></TR
><TR
><TD
>	no means to read out the current balance or "used-up" number of current quota
	</TD
></TR
><TR
><TD
>	a user having used up 99 sheets of 100 quota will still be able to send and print a 1.000 sheet job
	</TD
></TR
><TR
><TD
>	a user being denied a job because of a filled-up quota doesn't get a meaningful
	error message from CUPS other than "client-error-not-possible".
	</TD
></TR
></TBODY
></TABLE
><P
></P
><P
>But this is the best system out there currently. And there are
huge improvements under development:</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>page counting will go into the "backends" (these talk
	directly to the printer and will increase the count in sync with the
	 actual printing process -- a jam at the 5th sheet will lead to a stop in the counting)</TD
></TR
><TR
><TD
>quotas will be handled more flexibly</TD
></TR
><TR
><TD
>probably there will be support for users to inquire their "accounts" in advance</TD
></TR
><TR
><TD
>probably there will be support for some other tools around this topic</TD
></TR
></TBODY
></TABLE
><P
></P
><P
>Other than the current stage of the CUPS development, I don't
know any other ready-to-use tool which you could consider.</P
><P
>You can download the driver files from
<A
HREF="http://www.cups.org/software.html"
TARGET="_top"
>http://www.cups.org/software.html</A
>.
It is a separate package from the CUPS base software files, tagged as "CUPS 1.1.16
Windows NT/2k/XP Printer Driver for SAMBA (tar.gz, 192k)". The filename to
download is "cups-samba-1.1.16.tar.gz". Upon untar-/unzip-ping it will reveal
the files:</P
><P
>	<SAMP
CLASS="COMPUTEROUTPUT"
>	   cups-samba.install
	   cups-samba.license
	   cups-samba.readme
	   cups-samba.remove
	   cups-samba.ss
	</SAMP
>
	</P
><P
>These have been packaged with the ESP meta packager software "EPM". The
*.install and *.remove files are simple shell script, which untars the
*.ss (which is nothing else than a tar-archive) and puts its contents
into <TT
CLASS="FILENAME"
>/usr/share/cups/drivers/</TT
>. Its contents are 3 files:</P
><P
>	<SAMP
CLASS="COMPUTEROUTPUT"
>	   cupsdrvr.dll
	   cupsui.dll
	   cups.hlp
	</SAMP
>
	</P
><DIV
CLASS="CAUTION"
><P
></P
><TABLE
CLASS="CAUTION"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/caution.gif"
HSPACE="5"
ALT="Caution"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Due to a bug one CUPS release puts the <TT
CLASS="FILENAME"
>cups.hlp</TT
>
into <TT
CLASS="FILENAME"
>/usr/share/drivers/</TT
> instead of
<TT
CLASS="FILENAME"
>/usr/share/cups/drivers/</TT
>. To work around this, copy/move
the file after running the "./cups-samba.install" script manually to the right place:</P
><P
>	<KBD
CLASS="USERINPUT"
> cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
	</KBD
>
	</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>This new CUPS PostScript driver is currently binary-only, but free
no source code is provided (yet). The reason is this: it has
been developed with the help of the Microsoft Driver Developer Kit (DDK)
and compiled with Microsoft Visual Studio 6. It is not clear to the driver
developers if they are allowed to distribute the whole of the source code
as Free Software. However, they will likely release the "diff" in source
code under the GPL, so anybody with a license of Visual Studio and a DDK
will be able to compile for him/herself.</P
><P
>Once you have run the install script (and possibly manually moved the
"cups.hlp" file to "/usr/share/cups/drivers/"), the driver is ready to be
put into Samba's [print$] share (which often maps to "/etc/samba/drivers/"
and contains a subdir tree with WIN40 and W32X86 branches), by running
"cupsaddsmb" (see also "man cupsaddsmb" for CUPS 1.1.16). [Don't forget to
put root into the smbpasswd file by running "smbpasswd" should you run
this whole procedure for the first time.] Once the driver files are in the
[print$] share, they are ready to be downloaded and installed by the
Win NT/2k/XP clients.</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>	Win 9x/ME clients won't work with this driver. For these you'd
	still need to use the ADOBE*.* drivers as previously.
	</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>	It is not harming if you've still the ADOBE*.* driver files from
	previous installations in the "/usr/share/cups/drivers/" directory.
	The new cupsaddsmb (from 1.1.16) will automatically use the
	"newest" installed driver (which here then is the CUPS drivers).
	</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>	Should your Win clients have had the old ADOBE*.* files and the
	Adobe PostScript drivers installed, the download and installation
	of the new CUPS PostScript driver for Windows NT/2k/XP will fail
	at first.
	</P
><P
>	It is not enough to "delete" the printer (as the driver files
	will still be kept by the clients and re-used if you try to
	re-install the printer). To really get rid of the Adobe driver
	files on the clients, open the "Printers" folder (possibly via
	"Start --&#62; Settings --&#62; Control Panel --&#62; Printers"), right-click
	onto the folder background and select "Server Properties". A
	new dialog opens; select the "Drivers" tab; on the list select
	the driver you want to delete and click on the "Delete" button.
	(This will only work if there is no single printer left which
	uses that particular driver -- you need to "delete" all printers
	using this driver in the "Printers" folder first.)
	</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>	Once you have successfully downloaded the CUPS PostScript driver
	to a client, you can easily switch all printers to this one
	by proceeding as described elsewhere in the "Samba HOWTO
	Collection" to change a driver for an existing printer.
	</P
></TD
></TR
></TABLE
></DIV
><P
>What are the benefits with the "CUPS PostScript driver for Windows NT/2k/XP"
as compared to the Adobe drivers?</P
><P
><P
></P
><UL
><LI
><P
>	no hassle with the Adobe EULA
	</P
></LI
><LI
><P
>	no hassle with the question "where do I get the ADOBE*.* driver files from?"
	</P
></LI
><LI
><P
>	the Adobe drivers (depending on the printer PPD associated with them)
	often put a PJL header in front of the core PostScript part of the print
	file (thus the file starts with "<VAR
CLASS="REPLACEABLE"
>1B</VAR
>%-12345X" or "<VAR
CLASS="REPLACEABLE"
>escape</VAR
>%-12345X"
	instead of "%!PS"). This leads to the CUPS daemon autotyping the
	arriving file as a print-ready file, not requiring a pass thru the
	"pstops" filter (to speak more technical, it is not regarded as the
	generic MIME type "application/postscript", but as the more special
	MIME type "application/cups.vnd-postscript"), which therefore also
	leads to the page accounting in "/var/log/cups/page_log" not receiving
	the exact mumber of pages; instead the dummy page number of "1" is
	logged in a standard setup)
	</P
></LI
><LI
><P
>	the Adobe driver has more options to "mis-configure" the PostScript
	generated by it (like setting it inadvertedly to "Optimize for Speed",
	instead of "Optimize for Portability", which could lead to CUPS being
	unable to process it)
	</P
></LI
><LI
><P
>	the CUPS PostScript driver output sent by Windows clients to the CUPS
	server will be guaranteed to be auto-typed as generic MIME type
	"application/postscript", thusly passing thru the CUPS "pstops" filter
	and logging the correct number of pages in the page_log for accounting
	and quota purposes
	</P
></LI
><LI
><P
>	the CUPS PostScript driver supports the sending of additional print
	options by the Win NT/2k/XP clients, such as naming the CUPS standard
	banner pages (or the custom ones, should they be installed at the time
	of driver download), using the CUPS "page-label" option, setting a
	job-priority and setting the scheduled time of printing (with the option
	to support additional useful IPP job attributes in the future).
	</P
></LI
><LI
><P
>	the CUPS PostScript driver supports the inclusion of the new
	"*cupsJobTicket" comments at the beginnig of the PostScript file (which
	could be used in the future for all sort of beneficial extensions on
	the CUPS side, but which will not disturb any other application as those
	will regard it as a comment and simply ignore it).
	</P
></LI
><LI
><P
>	the CUPS PostScript driver will be the heart of the fully fledged CUPS
	IPP client for Windows NT/2k/XP to be released soon (probably alongside
	the first Beta release for CUPS 1.2).
	</P
></LI
></UL
></P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2424"
>14.11. Advanced Postscript Printing from MS Windows</A
></H2
><P
>Let the Windows Clients use a PostScript driver to deliver poistscript to
the samba print server (just like any Linux or Unix Client would also use
PostScript to send to the server)</P
><P
>Make the Unix printing subsystem to which Samba sends the job convert the
incoming PostScript files to the native print format of the target printers
(would be PCL if you have an HP printer)</P
><P
>Now if you are afraid that this would just mean using a *Generic* PostScript
driver for the clients that has no Simplex/Duplex selection, and no paper tray
choice, but you need them to be able to set up print jobs, with all the bells
and whistles of your printers:-</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>Not possible with traditional spooling systems</TD
></TR
><TR
><TD
>	But perfectly supported by CUPS (which uses "PPD" files to
	describe how to control the print options for PostScript and
	non-PostScript devices alike...
	</TD
></TR
></TBODY
></TABLE
><P
></P
><P
>CUPS PPDs are working perfectly on Windows clients who use Adobe PostScript
drivers (or the new CUPS PostScript driver for Windows NT/2K/XP). Clients can use
them to setup the job to their liking and CUPS will use the received job options
to make the (PCL-, ESC/P- or PostScript-) printer behave as required.</P
><P
>If you want to have the additional benefit of page count logging and accounting
then the CUPS PostScript driver is the best choice (better than the Adobe one).</P
><P
>If you want to make the drivers downloadable for the clients then "cupsaddsmb" is
your friend. It will setup the [print$] share on the Samba host to be ready to serve
the clients for a "point and print" driver installation.</P
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>What strings are attached?</P
></TD
></TR
></TABLE
></DIV
><P
>There are some. But, given the sheer CPU power you can buy nowadays,
these can be overcome easily. The strings:</P
><P
>Well, if the CUPS/Samba side will have to print to many printers serving many users,
you probably will need to set up a second server (which can do automatic load balancing
with the first one, plus a degree of fail-over mechanism). Converting the incoming
PostScript jobs, "interpreting" them for non-PostScript printers, amounts to the work
of a "RIP" (Raster Image Processor) done in software. This requires more CPU and RAM
than for the mere "raw spooling" task your current setup is solving. It all depends
on the avarage and peak printing load the server should be able to handle.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2439"
>14.12. Auto-Deletion of CUPS spool files</A
></H2
><P
>Samba print files pass thru two "spool" directories. One the incoming directory
managed by Samba, (set eg: in the <B
CLASS="COMMAND"
>path = /var/spool/samba</B
> directive in the [printers]
section of <TT
CLASS="FILENAME"
>smb.conf</TT
>). Second is the spool directory of your UNIX print subsystem.
For CUPS it is normally "/var/spool/cups/", as set by the cupsd.conf directive
"RequestRoot /var/spool/cups".</P
><P
>I am not sure, which one of your directories keeps the files.  From what you say,
it is most likely the Samba part.</P
><P
>For the CUPS part, you may want to consult:</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>http://localhost:631/sam.html#PreserveJobFiles</TD
></TR
><TR
><TD
>http://localhost:631/sam.html#PreserveJobHistory</TD
></TR
><TR
><TD
>http://localhost:631/sam.html#MaxJobs</TD
></TR
></TBODY
></TABLE
><P
></P
><P
>There are the settings described for your CUPS daemon, which could lead to completed
job files not being deleted.</P
><P
>"PreserveJobHistory Yes" -- keeps some details of jobs in
cupsd's mind (well it keeps the "c12345", "c12346" etc. files
in the CUPS spool directory, which do a similar job as the
old-fashioned BSD-LPD control files). This is set to "Yes"
as a default.</P
><P
>"PreserveJobFiles Yes" -- keeps the job files themselves in
cupsd's mind (well it keeps the "d12345", "d12346" etc. files
in the CUPS spool directory...). This is set to "No" as the
CUPS default.</P
><P
>"MaxJobs 500" -- this directive controls the maximum number
of jobs that are kept in memory. Once the number of jobs
reaches the limit, the oldest completed job is automatically
purged from the system to make room for the new one. If all
of the known jobs are still pending or active then the new
job will be rejected. Setting the maximum to 0 disables this
functionality. The default setting is 0.</P
><P
>(There are also additional settings for "MaxJobsPerUser" and
"MaxJobsPerPrinter"...)</P
><P
>For everything to work as announced, you need to have three things:</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>	a Samba-<SPAN
CLASS="APPLICATION"
>smbd</SPAN
> which is compiled against "libcups" (Check on Linux by running <KBD
CLASS="USERINPUT"
>ldd `which smbd`</KBD
>)
	</TD
></TR
><TR
><TD
>	a Samba-<TT
CLASS="FILENAME"
>smb.conf</TT
> setting of <B
CLASS="COMMAND"
>printing = cups</B
>
	</TD
></TR
><TR
><TD
>	another Samba-<TT
CLASS="FILENAME"
>smb.conf</TT
> setting of <B
CLASS="COMMAND"
>printcap = cups</B
>
	</TD
></TR
></TBODY
></TABLE
><P
></P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Note, that in this case all other manually set printing-related
commands (like "print command", "lpq command", "lprm command",
"lppause command" or "lpresume command") are ignored and they
should normally have no influence what-so-ever on your printing.</P
></TD
></TR
></TABLE
></DIV
><P
>If you want to do things manually, replace the "printing = cups"
by "printing = bsd". Then your manually set commands may work
(haven't tested this), and a "print command = lp -d %P %s; rm %s"
may do what you need.</P
><P
>You forgot to mention the CUPS version you're using. If you did
set things up as described in the man pages, then the Samba
spool files should be deleted. Otherwise it may be a bug. On
the CUPS side, you can control the behaviour as described
above.</P
><P
>If you have more problems, post the output of these commands:</P
><P
><KBD
CLASS="USERINPUT"
>   grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
   grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"</KBD
></P
><P
>(adapt paths as needed). These commands sanitize the files
and cut out the empty lines and lines with comments, providing
the "naked settings" in a compact way.</P
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="WINBIND"
></A
>Chapter 15. Unified Logons between Windows NT and UNIX using Winbind</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
NAME="AEN2515"
>15.1. Abstract</A
></H2
><P
>Integration of UNIX and Microsoft Windows NT through 
	a unified logon has been considered a "holy grail" in heterogeneous 
	computing environments for a long time. We present 
	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>winbind</I
></SPAN
>, a component of the Samba suite 
	of programs as a solution to the unified logon problem. Winbind 
	uses a UNIX implementation 
	of Microsoft RPC calls, Pluggable Authentication Modules, and the Name 
	Service Switch to allow Windows NT domain users to appear and operate 
	as UNIX users on a UNIX machine. This paper describes the winbind 
	system, explaining the functionality it provides, how it is configured, 
	and how it works internally.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2519"
>15.2. Introduction</A
></H2
><P
>It is well known that UNIX and Microsoft Windows NT have 
	different models for representing user and group information and 
	use different technologies for implementing them. This fact has 
	made it difficult to integrate the two systems in a satisfactory 
	manner.</P
><P
>One common solution in use today has been to create 
	identically named user accounts on both the UNIX and Windows systems 
	and use the Samba suite of programs to provide file and print services 
	between the two. This solution is far from perfect however, as 
	adding and deleting users on both sets of machines becomes a chore 
	and two sets of passwords are required both of which
	can lead to synchronization problems between the UNIX and Windows 
	systems and confusion for users.</P
><P
>We divide the unified logon problem for UNIX machines into 
	three smaller problems:</P
><P
></P
><UL
><LI
><P
>Obtaining Windows NT user and group information
		</P
></LI
><LI
><P
>Authenticating Windows NT users
		</P
></LI
><LI
><P
>Password changing for Windows NT users
		</P
></LI
></UL
><P
>Ideally, a prospective solution to the unified logon problem 
	would satisfy all the above components without duplication of 
	information on the UNIX machines and without creating additional 
	tasks for the system administrator when maintaining users and 
	groups on either system. The winbind system provides a simple 
	and elegant solution to all three components of the unified logon 
	problem.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2532"
>15.3. What Winbind Provides</A
></H2
><P
>Winbind unifies UNIX and Windows NT account management by 
	allowing a UNIX box to become a full member of a NT domain. Once 
	this is done the UNIX box will see NT users and groups as if 
	they were native UNIX users and groups, allowing the NT domain 
	to be used in much the same manner that NIS+ is used within 
	UNIX-only environments.</P
><P
>The end result is that whenever any 
	program on the UNIX machine asks the operating system to lookup 
	a user or group name, the query will be resolved by asking the 
	NT domain controller for the specified domain to do the lookup.
	Because Winbind hooks into the operating system at a low level 
	(via the NSS name resolution modules in the C library) this 
	redirection to the NT domain controller is completely 
	transparent.</P
><P
>Users on the UNIX machine can then use NT user and group 
	names as they would use "native" UNIX names. They can chown files 
	so that they are owned by NT domain users or even login to the 
	UNIX machine and run a UNIX X-Window session as a domain user.</P
><P
>The only obvious indication that Winbind is being used is 
	that user and group names take the form DOMAIN\user and 
	DOMAIN\group. This is necessary as it allows Winbind to determine 
	that redirection to a domain controller is wanted for a particular 
	lookup and which trusted domain is being referenced.</P
><P
>Additionally, Winbind provides an authentication service 
	that hooks into the Pluggable Authentication Modules (PAM) system 
	to provide authentication via a NT domain to any PAM enabled 
	applications. This capability solves the problem of synchronizing 
	passwords between systems since all passwords are stored in a single 
	location (on the domain controller).</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2539"
>15.3.1. Target Uses</A
></H3
><P
>Winbind is targeted at organizations that have an 
		existing NT based domain infrastructure into which they wish 
		to put UNIX workstations or servers. Winbind will allow these 
		organizations to deploy UNIX workstations without having to 
		maintain a separate account infrastructure. This greatly 
		simplifies the administrative overhead of deploying UNIX 
		workstations into a NT based organization.</P
><P
>Another interesting way in which we expect Winbind to 
		be used is as a central part of UNIX based appliances. Appliances 
		that provide file and print services to Microsoft based networks 
		will be able to use Winbind to provide seamless integration of 
		the appliance into the domain.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2543"
>15.4. How Winbind Works</A
></H2
><P
>The winbind system is designed around a client/server 
	architecture. A long running <B
CLASS="COMMAND"
>winbindd</B
> daemon 
	listens on a UNIX domain socket waiting for requests
	to arrive. These requests are generated by the NSS and PAM 
	clients and processed sequentially.</P
><P
>The technologies used to implement winbind are described 
	in detail below.</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2548"
>15.4.1. Microsoft Remote Procedure Calls</A
></H3
><P
>Over the last few years, efforts have been underway 
		by various Samba Team members to decode various aspects of 
		the Microsoft Remote Procedure Call (MSRPC) system. This 
		system is used for most network related operations between 
		Windows NT machines including remote management, user authentication
		and print spooling. Although initially this work was done 
		to aid the implementation of Primary Domain Controller (PDC) 
		functionality in Samba, it has also yielded a body of code which 
		can be used for other purposes.</P
><P
>Winbind uses various MSRPC calls to enumerate domain users 
		and groups and to obtain detailed information about individual 
		users or groups. Other MSRPC calls can be used to authenticate 
		NT domain users and to change user passwords. By directly querying 
		a Windows PDC for user and group information, winbind maps the 
		NT account information onto UNIX user and group names.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2552"
>15.4.2. Microsoft Active Directory Services</A
></H3
><P
>                Since late 2001, Samba has gained the ability to
                interact with Microsoft Windows 2000 using its 'Native
                Mode' protocols, rather than the NT4 RPC services.
                Using LDAP and Kerberos, a domain member running
                winbind can enumerate users and groups in exactly the
                same way as a Win2k client would, and in so doing
                provide a much more efficient and
                effective winbind implementation.  
                </P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2555"
>15.4.3. Name Service Switch</A
></H3
><P
>The Name Service Switch, or NSS, is a feature that is 
		present in many UNIX operating systems. It allows system 
		information such as hostnames, mail aliases and user information 
		to be resolved from different sources. For example, a standalone 
		UNIX workstation may resolve system information from a series of 
		flat files stored on the local filesystem. A networked workstation 
		may first attempt to resolve system information from local files, 
		and then consult a NIS database for user information or a DNS server 
		for hostname information.</P
><P
>The NSS application programming interface allows winbind 
		to present itself as a source of system information when 
		resolving UNIX usernames and groups.  Winbind uses this interface, 
		and information obtained from a Windows NT server using MSRPC 
		calls to provide a new source of account enumeration.  Using standard 
		UNIX library calls, one can enumerate the users and groups on
		a UNIX machine running winbind and see all users and groups in 
		a NT domain plus any trusted domain as though they were local 
		users and groups.</P
><P
>The primary control file for NSS is 
		<TT
CLASS="FILENAME"
>/etc/nsswitch.conf</TT
>. 
		When a UNIX application makes a request to do a lookup 
		the C library looks in <TT
CLASS="FILENAME"
>/etc/nsswitch.conf</TT
> 
		for a line which matches the service type being requested, for 
		example the "passwd" service type is used when user or group names 
		are looked up. This	config line species which implementations 
		of that service should be tried and in what order. If the passwd 
		config line is:</P
><P
><B
CLASS="COMMAND"
>passwd: files example</B
></P
><P
>then the C library will first load a module called 
		<TT
CLASS="FILENAME"
>/lib/libnss_files.so</TT
> followed by
		the module <TT
CLASS="FILENAME"
>/lib/libnss_example.so</TT
>. The 
		C library will dynamically load each of these modules in turn 
		and call resolver functions within the modules to try to resolve 
		the request. Once the request is resolved the C library returns the
		result to the application.</P
><P
>This NSS interface provides a very easy way for Winbind 
		to hook into the operating system. All that needs to be done 
		is to put <TT
CLASS="FILENAME"
>libnss_winbind.so</TT
> in <TT
CLASS="FILENAME"
>/lib/</TT
> 
		then add "winbind" into <TT
CLASS="FILENAME"
>/etc/nsswitch.conf</TT
> at 
		the appropriate place. The C library will then call Winbind to 
		resolve user and group names.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2571"
>15.4.4. Pluggable Authentication Modules</A
></H3
><P
>Pluggable Authentication Modules, also known as PAM, 
		is a system for abstracting authentication and authorization 
		technologies. With a PAM module it is possible to specify different 
		authentication methods for different system applications without 
		having to recompile these applications. PAM is also useful
		for implementing a particular policy for authorization. For example, 
		a system administrator may only allow console logins from users 
		stored in the local password file but only allow users resolved from 
		a NIS database to log in over the network.</P
><P
>Winbind uses the authentication management and password 
		management PAM interface to integrate Windows NT users into a 
		UNIX system. This allows Windows NT users to log in to a UNIX 
		machine and be authenticated against a suitable Primary Domain 
		Controller. These users can also change their passwords and have 
		this change take effect directly on the Primary Domain Controller.
		</P
><P
>PAM is configured by providing control files in the directory 
		<TT
CLASS="FILENAME"
>/etc/pam.d/</TT
> for each of the services that 
		require authentication. When an authentication request is made 
		by an application the PAM code in the C library looks up this
		control file to determine what modules to load to do the 
		authentication check and in what order. This interface makes adding 
		a new authentication service for Winbind very easy, all that needs 
		to be done is that the <TT
CLASS="FILENAME"
>pam_winbind.so</TT
> module 
		is copied to <TT
CLASS="FILENAME"
>/lib/security/</TT
> and the PAM 
		control files for relevant services are updated to allow 
		authentication via winbind. See the PAM documentation
		for more details.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2579"
>15.4.5. User and Group ID Allocation</A
></H3
><P
>When a user or group is created under Windows NT 
		is it allocated a numerical relative identifier (RID). This is 
		slightly different to UNIX which has a range of numbers that are 
		used to identify users, and the same range in which to identify 
		groups. It is winbind's job to convert RIDs to UNIX id numbers and
		vice versa.  When winbind is configured it is given part of the UNIX 
		user id space and a part of the UNIX group id space in which to 
		store Windows NT users and groups. If a Windows NT user is 
		resolved for the first time, it is allocated the next UNIX id from 
		the range. The same process applies for Windows NT groups. Over 
		time, winbind will have mapped all Windows NT users and groups
		to UNIX user ids and group ids.</P
><P
>The results of this mapping are stored persistently in 
		an ID mapping database held in a tdb database). This ensures that 
		RIDs are mapped to UNIX IDs in a consistent way.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2583"
>15.4.6. Result Caching</A
></H3
><P
>An active system can generate a lot of user and group 
		name lookups. To reduce the network cost of these lookups winbind 
		uses a caching scheme based on the SAM sequence number supplied 
		by NT domain controllers.  User or group information returned 
		by a PDC is cached by winbind along with a sequence number also 
		returned by the PDC. This sequence number is incremented by 
		Windows NT whenever any user or group information is modified. If 
		a cached entry has expired, the sequence number is requested from 
		the PDC and compared against the sequence number of the cached entry. 
		If the sequence numbers do not match, then the cached information 
		is discarded and up to date information is requested directly 
		from the PDC.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2586"
>15.5. Installation and Configuration</A
></H2
><P
>Many thanks to John Trostel <A
HREF="mailto:jtrostel@snapserver.com"
TARGET="_top"
>jtrostel@snapserver.com</A
>
for providing the HOWTO for this section.</P
><P
>This HOWTO describes how to get winbind services up and running 
to control access and authenticate users on your Linux box using 
the winbind services which come with SAMBA 2.2.2.</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2591"
>15.5.1. Introduction</A
></H3
><P
>This HOWTO describes the procedures used to get winbind up and 
running on my RedHat 7.1 system.  Winbind is capable of providing access 
and authentication control for Windows Domain users through an NT 
or Win2K PDC for 'regular' services, such as telnet a nd ftp, as
well for SAMBA services.</P
><P
>This HOWTO has been written from a 'RedHat-centric' perspective, so if 
you are using another distribution, you may have to modify the instructions 
somewhat to fit the way your distribution works.</P
><P
></P
><UL
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Why should I to this?</I
></SPAN
>
	</P
><P
>This allows the SAMBA administrator to rely on the 
	authentication mechanisms on the NT/Win2K PDC for the authentication 
	of domain members.  NT/Win2K users no longer need to have separate 
	accounts on the SAMBA server.
	</P
></LI
><LI
><P
>	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Who should be reading this document?</I
></SPAN
>
	</P
><P
>	This HOWTO is designed for system administrators.  If you are 
	implementing SAMBA on a file server and wish to (fairly easily) 
	integrate existing NT/Win2K users from your PDC onto the
	SAMBA server, this HOWTO is for you.  That said, I am no NT or PAM 
	expert, so you may find a better or easier way to accomplish 
	these tasks.
	</P
></LI
></UL
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2604"
>15.5.2. Requirements</A
></H3
><P
>If you have a samba configuration file that you are currently 
using... <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>BACK IT UP!</I
></SPAN
>  If your system already uses PAM, 
<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>back up the <TT
CLASS="FILENAME"
>/etc/pam.d</TT
> directory 
contents!</I
></SPAN
> If you haven't already made a boot disk, 
<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>MAKE ONE NOW!</I
></SPAN
></P
><P
>Messing with the pam configuration files can make it nearly impossible 
to log in to yourmachine. That's why you want to be able to boot back 
into your machine in single user mode and restore your 
<TT
CLASS="FILENAME"
>/etc/pam.d</TT
> back to the original state they were in if 
you get frustrated with the way things are going.  ;-)</P
><P
>The latest version of SAMBA (version 3.0 as of this writing), now 
includes a functioning winbindd daemon.  Please refer to the 
<A
HREF="http://samba.org/"
TARGET="_top"
>main SAMBA web page</A
> or, 
better yet, your closest SAMBA mirror site for instructions on 
downloading the source code.</P
><P
>To allow Domain users the ability to access SAMBA shares and 
files, as well as potentially other services provided by your 
SAMBA machine, PAM (pluggable authentication modules) must
be setup properly on your machine.  In order to compile the 
winbind modules, you should have at least the pam libraries resident 
on your system.  For recent RedHat systems (7.1, for instance), that 
means <TT
CLASS="FILENAME"
>pam-0.74-22</TT
>.  For best results, it is helpful to also
install the development packages in <TT
CLASS="FILENAME"
>pam-devel-0.74-22</TT
>.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2618"
>15.5.3. Testing Things Out</A
></H3
><P
>Before starting, it is probably best to kill off all the SAMBA 
related daemons running on your server.  Kill off all <B
CLASS="COMMAND"
>smbd</B
>, 
<B
CLASS="COMMAND"
>nmbd</B
>, and <B
CLASS="COMMAND"
>winbindd</B
> processes that may 
be running.  To use PAM, you will want to make sure that you have the 
standard PAM package (for RedHat) which supplies the <TT
CLASS="FILENAME"
>/etc/pam.d</TT
> 
directory structure, including the pam modules are used by pam-aware 
services, several pam libraries, and the <TT
CLASS="FILENAME"
>/usr/doc</TT
> 
and <TT
CLASS="FILENAME"
>/usr/man</TT
> entries for pam.  Winbind built better 
in SAMBA if the pam-devel package was also installed.  This package includes 
the header files needed to compile pam-aware applications. For instance, 
my RedHat system has both <TT
CLASS="FILENAME"
>pam-0.74-22</TT
> and
<TT
CLASS="FILENAME"
>pam-devel-0.74-22</TT
> RPMs installed.</P
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN2629"
>15.5.3.1. Configure and compile SAMBA</A
></H4
><P
>The configuration and compilation of SAMBA is pretty straightforward.
The first three steps may not be necessary depending upon
whether or not you have previously built the Samba binaries.</P
><P
><PRE
CLASS="PROGRAMLISTING"
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>autoconf</B
>
<SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>make clean</B
>
<SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>rm config.cache</B
>
<SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>./configure</B
>
<SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>make</B
>
<SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>make install</B
></PRE
></P
><P
>This will, by default, install SAMBA in <TT
CLASS="FILENAME"
>/usr/local/samba</TT
>.
See the main SAMBA documentation if you want to install SAMBA somewhere else.
It will also build the winbindd executable and libraries. </P
></DIV
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN2648"
>15.5.3.2. Configure <TT
CLASS="FILENAME"
>nsswitch.conf</TT
> and the 
winbind libraries</A
></H4
><P
>The libraries needed to run the <B
CLASS="COMMAND"
>winbindd</B
> daemon 
through nsswitch need to be copied to their proper locations, so</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>cp ../samba/source/nsswitch/libnss_winbind.so /lib</B
></P
><P
>I also found it necessary to make the following symbolic link:</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2</B
></P
><P
>And, in the case of Sun solaris:</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1</B
>
<SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1</B
>
<SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2</B
></P
><P
>Now, as root you need to edit <TT
CLASS="FILENAME"
>/etc/nsswitch.conf</TT
> to 
allow user and group entries to be visible from the <B
CLASS="COMMAND"
>winbindd</B
> 
daemon.  My <TT
CLASS="FILENAME"
>/etc/nsswitch.conf</TT
> file look like 
this after editing:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>	passwd:     files winbind
	shadow:     files 
	group:      files winbind</PRE
></P
><P
>	
The libraries needed by the winbind daemon will be automatically 
entered into the <B
CLASS="COMMAND"
>ldconfig</B
> cache the next time 
your system reboots, but it 
is faster (and you don't need to reboot) if you do it manually:</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>/sbin/ldconfig -v | grep winbind</B
></P
><P
>This makes <TT
CLASS="FILENAME"
>libnss_winbind</TT
> available to winbindd 
and echos back a check to you.</P
></DIV
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN2681"
>15.5.3.3. Configure smb.conf</A
></H4
><P
>Several parameters are needed in the smb.conf file to control 
the behavior of <B
CLASS="COMMAND"
>winbindd</B
>. Configure 
<TT
CLASS="FILENAME"
>smb.conf</TT
> These are described in more detail in 
the <A
HREF="winbindd.8.html"
TARGET="_top"
>winbindd(8)</A
> man page.  My 
<TT
CLASS="FILENAME"
>smb.conf</TT
> file was modified to
include the following entries in the [global] section:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>[global]
     &#60;...&#62;
     # separate domain and username with '+', like DOMAIN+username
     <A
HREF="winbindd.8.html#WINBINDSEPARATOR"
TARGET="_top"
>winbind separator</A
> = +
     # use uids from 10000 to 20000 for domain users
     <A
HREF="winbindd.8.html#WINBINDUID"
TARGET="_top"
>winbind uid</A
> = 10000-20000
     # use gids from 10000 to 20000 for domain groups
     <A
HREF="winbindd.8.html#WINBINDGID"
TARGET="_top"
>winbind gid</A
> = 10000-20000
     # allow enumeration of winbind users and groups
     <A
HREF="winbindd.8.html#WINBINDENUMUSERS"
TARGET="_top"
>winbind enum users</A
> = yes
     <A
HREF="winbindd.8.html#WINBINDENUMGROUP"
TARGET="_top"
>winbind enum groups</A
> = yes
     # give winbind users a real shell (only needed if they have telnet access)
     <A
HREF="winbindd.8.html#TEMPLATEHOMEDIR"
TARGET="_top"
>template homedir</A
> = /home/winnt/%D/%U
     <A
HREF="winbindd.8.html#TEMPLATESHELL"
TARGET="_top"
>template shell</A
> = /bin/bash</PRE
></P
></DIV
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN2697"
>15.5.3.4. Join the SAMBA server to the PDC domain</A
></H4
><P
>Enter the following command to make the SAMBA server join the 
PDC domain, where <VAR
CLASS="REPLACEABLE"
>DOMAIN</VAR
> is the name of 
your Windows domain and <VAR
CLASS="REPLACEABLE"
>Administrator</VAR
> is 
a domain user who has administrative privileges in the domain.</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>/usr/local/samba/bin/net join -S PDC -U Administrator</B
></P
><P
>The proper response to the command should be: "Joined the domain 
<VAR
CLASS="REPLACEABLE"
>DOMAIN</VAR
>" where <VAR
CLASS="REPLACEABLE"
>DOMAIN</VAR
> 
is your DOMAIN name.</P
></DIV
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN2708"
>15.5.3.5. Start up the winbindd daemon and test it!</A
></H4
><P
>Eventually, you will want to modify your smb startup script to 
automatically invoke the winbindd daemon when the other parts of 
SAMBA start, but it is possible to test out just the winbind
portion first.  To start up winbind services, enter the following 
command as root:</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>/usr/local/samba/bin/winbindd</B
></P
><P
>Winbindd can now also run in 'dual daemon mode'. This will make it 
run as 2 processes. The first will answer all requests from the cache,
thus making responses to clients faster. The other will
update the cache for the query that the first has just responded.
Advantage of this is that responses stay accurate and are faster. 
You can enable dual daemon mode by adding '-B' to the commandline:</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>/usr/local/samba/bin/winbindd -B</B
></P
><P
>I'm always paranoid and like to make sure the daemon 
is really running...</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>ps -ae | grep winbindd</B
></P
><P
>This command should produce output like this, if the daemon is running</P
><P
>3025 ?        00:00:00 winbindd</P
><P
>Now... for the real test, try to get some information about the 
users on your PDC</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>/usr/local/samba/bin/wbinfo -u</B
></P
><P
>	
This should echo back a list of users on your Windows users on 
your PDC.  For example, I get the following response:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>CEO+Administrator
CEO+burdell
CEO+Guest
CEO+jt-ad
CEO+krbtgt
CEO+TsInternetUser</PRE
></P
><P
>Obviously, I have named my domain 'CEO' and my <VAR
CLASS="PARAMETER"
>winbind
separator</VAR
> is '+'.</P
><P
>You can do the same sort of thing to get group information from 
the PDC:</P
><P
><PRE
CLASS="PROGRAMLISTING"
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>/usr/local/samba/bin/wbinfo -g</B
>
CEO+Domain Admins
CEO+Domain Users
CEO+Domain Guests
CEO+Domain Computers
CEO+Domain Controllers
CEO+Cert Publishers
CEO+Schema Admins
CEO+Enterprise Admins
CEO+Group Policy Creator Owners</PRE
></P
><P
>The function 'getent' can now be used to get unified 
lists of both local and PDC users and groups.
Try the following command:</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>getent passwd</B
></P
><P
>You should get a list that looks like your <TT
CLASS="FILENAME"
>/etc/passwd</TT
> 
list followed by the domain users with their new uids, gids, home 
directories and default shells.</P
><P
>The same thing can be done for groups with the command</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>getent group</B
></P
></DIV
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN2748"
>15.5.3.6. Fix the init.d startup scripts</A
></H4
><DIV
CLASS="SECT4"
><H5
CLASS="SECT4"
><A
NAME="AEN2750"
>15.5.3.6.1. Linux</A
></H5
><P
>The <B
CLASS="COMMAND"
>winbindd</B
> daemon needs to start up after the 
<B
CLASS="COMMAND"
>smbd</B
> and <B
CLASS="COMMAND"
>nmbd</B
> daemons are running.  
To accomplish this task, you need to modify the startup scripts of your system. They are located at <TT
CLASS="FILENAME"
>/etc/init.d/smb</TT
> in RedHat and 
<TT
CLASS="FILENAME"
>/etc/init.d/samba</TT
> in Debian.
script to add commands to invoke this daemon in the proper sequence.  My 
startup script starts up <B
CLASS="COMMAND"
>smbd</B
>, 
<B
CLASS="COMMAND"
>nmbd</B
>, and <B
CLASS="COMMAND"
>winbindd</B
> from the 
<TT
CLASS="FILENAME"
>/usr/local/samba/bin</TT
> directory directly.  The 'start' 
function in the script looks like this:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>start() {
        KIND="SMB"
        echo -n $"Starting $KIND services: "
        daemon /usr/local/samba/bin/smbd $SMBDOPTIONS
        RETVAL=$?
        echo
        KIND="NMB"
        echo -n $"Starting $KIND services: "
        daemon /usr/local/samba/bin/nmbd $NMBDOPTIONS
        RETVAL2=$?
        echo
        KIND="Winbind"
        echo -n $"Starting $KIND services: "
        daemon /usr/local/samba/bin/winbindd
        RETVAL3=$?
        echo
        [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] &#38;&#38; touch /var/lock/subsys/smb || \
           RETVAL=1
        return $RETVAL
}</PRE
></P
><P
>If you would like to run winbindd in dual daemon mode, replace 
the line 
<PRE
CLASS="PROGRAMLISTING"
>        daemon /usr/local/samba/bin/winbindd</PRE
>

in the example above with:

<PRE
CLASS="PROGRAMLISTING"
>        daemon /usr/local/samba/bin/winbindd -B</PRE
>.</P
><P
>The 'stop' function has a corresponding entry to shut down the 
services and looks like this:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>stop() {
        KIND="SMB"
        echo -n $"Shutting down $KIND services: "
        killproc smbd
        RETVAL=$?
        echo
        KIND="NMB"
        echo -n $"Shutting down $KIND services: "
        killproc nmbd
        RETVAL2=$?
        echo
        KIND="Winbind"
        echo -n $"Shutting down $KIND services: "
        killproc winbindd
        RETVAL3=$?
        [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] &#38;&#38; rm -f /var/lock/subsys/smb
        echo ""
        return $RETVAL
}</PRE
></P
></DIV
><DIV
CLASS="SECT4"
><HR><H5
CLASS="SECT4"
><A
NAME="AEN2770"
>15.5.3.6.2. Solaris</A
></H5
><P
>On solaris, you need to modify the 
<TT
CLASS="FILENAME"
>/etc/init.d/samba.server</TT
> startup script. It usually 
only starts smbd and nmbd but should now start winbindd too. If you 
have samba installed in <TT
CLASS="FILENAME"
>/usr/local/samba/bin</TT
>, 
the file could contains something like this:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>##
## samba.server
##

if [ ! -d /usr/bin ]
then                    # /usr not mounted
        exit
fi

killproc() {            # kill the named process(es)
        pid=`/usr/bin/ps -e |
             /usr/bin/grep -w $1 |
             /usr/bin/sed -e 's/^  *//' -e 's/ .*//'`
        [ "$pid" != "" ] &#38;&#38; kill $pid
}
 
# Start/stop processes required for samba server

case "$1" in

'start')
#
# Edit these lines to suit your installation (paths, workgroup, host)
#
echo Starting SMBD
   /usr/local/samba/bin/smbd -D -s \
	/usr/local/samba/smb.conf

echo Starting NMBD
   /usr/local/samba/bin/nmbd -D -l \
	/usr/local/samba/var/log -s /usr/local/samba/smb.conf

echo Starting Winbind Daemon
   /usr/local/samba/bin/winbindd
   ;;

'stop')
   killproc nmbd
   killproc smbd
   killproc winbindd
   ;;

*)
   echo "Usage: /etc/init.d/samba.server { start | stop }"
   ;;
esac</PRE
></P
><P
>Again, if you would like to run samba in dual daemon mode, replace 
<PRE
CLASS="PROGRAMLISTING"
>   /usr/local/samba/bin/winbindd</PRE
>

in the script above with:

<PRE
CLASS="PROGRAMLISTING"
>   /usr/local/samba/bin/winbindd -B</PRE
></P
></DIV
><DIV
CLASS="SECT4"
><HR><H5
CLASS="SECT4"
><A
NAME="AEN2780"
>15.5.3.6.3. Restarting</A
></H5
><P
>If you restart the <B
CLASS="COMMAND"
>smbd</B
>, <B
CLASS="COMMAND"
>nmbd</B
>, 
and <B
CLASS="COMMAND"
>winbindd</B
> daemons at this point, you
should be able to connect to the samba server as a domain member just as
if you were a local user.</P
></DIV
></DIV
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN2786"
>15.5.3.7. Configure Winbind and PAM</A
></H4
><P
>If you have made it this far, you know that winbindd and samba are working
together.  If you want to use winbind to provide authentication for other 
services, keep reading.  The pam configuration files need to be altered in
this step.  (Did you remember to make backups of your original 
<TT
CLASS="FILENAME"
>/etc/pam.d</TT
> files? If not, do it now.)</P
><P
>You will need a pam module to use winbindd with these other services.  This 
module will be compiled in the <TT
CLASS="FILENAME"
>../source/nsswitch</TT
> directory
by invoking the command</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>make nsswitch/pam_winbind.so</B
></P
><P
>from the <TT
CLASS="FILENAME"
>../source</TT
> directory.  The
<TT
CLASS="FILENAME"
>pam_winbind.so</TT
> file should be copied to the location of
your other pam security modules.  On my RedHat system, this was the
<TT
CLASS="FILENAME"
>/lib/security</TT
> directory. On Solaris, the pam security 
modules reside in <TT
CLASS="FILENAME"
>/usr/lib/security</TT
>.</P
><P
><SAMP
CLASS="PROMPT"
>root#</SAMP
> <B
CLASS="COMMAND"
>cp ../samba/source/nsswitch/pam_winbind.so /lib/security</B
></P
><DIV
CLASS="SECT4"
><HR><H5
CLASS="SECT4"
><A
NAME="AEN2803"
>15.5.3.7.1. Linux/FreeBSD-specific PAM configuration</A
></H5
><P
>The <TT
CLASS="FILENAME"
>/etc/pam.d/samba</TT
> file does not need to be changed. I 
just left this fileas it was:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>auth    required        /lib/security/pam_stack.so service=system-auth
account required        /lib/security/pam_stack.so service=system-auth</PRE
></P
><P
>The other services that I modified to allow the use of winbind 
as an authentication service were the normal login on the console (or a terminal 
session), telnet logins, and ftp service.  In order to enable these 
services, you may first need to change the entries in 
<TT
CLASS="FILENAME"
>/etc/xinetd.d</TT
> (or <TT
CLASS="FILENAME"
>/etc/inetd.conf</TT
>).  
RedHat 7.1 uses the new xinetd.d structure, in this case you need 
to change the lines in <TT
CLASS="FILENAME"
>/etc/xinetd.d/telnet</TT
> 
and <TT
CLASS="FILENAME"
>/etc/xinetd.d/wu-ftp</TT
> from </P
><P
><PRE
CLASS="PROGRAMLISTING"
>enable = no</PRE
></P
><P
>to</P
><P
><PRE
CLASS="PROGRAMLISTING"
>enable = yes</PRE
></P
><P
>	
For ftp services to work properly, you will also need to either 
have individual directories for the domain users already present on 
the server, or change the home directory template to a general
directory for all domain users.  These can be easily set using 
the <TT
CLASS="FILENAME"
>smb.conf</TT
> global entry 
<B
CLASS="COMMAND"
>template homedir</B
>.</P
><P
>The <TT
CLASS="FILENAME"
>/etc/pam.d/ftp</TT
> file can be changed 
to allow winbind ftp access in a manner similar to the
samba file.  My <TT
CLASS="FILENAME"
>/etc/pam.d/ftp</TT
> file was 
changed to look like this:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>auth       required     /lib/security/pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
auth       sufficient   /lib/security/pam_winbind.so
auth       required     /lib/security/pam_stack.so service=system-auth
auth       required     /lib/security/pam_shells.so
account    sufficient   /lib/security/pam_winbind.so
account    required     /lib/security/pam_stack.so service=system-auth
session    required     /lib/security/pam_stack.so service=system-auth</PRE
></P
><P
>The <TT
CLASS="FILENAME"
>/etc/pam.d/login</TT
> file can be changed nearly the 
same way.  It now looks like this:</P
><P
><PRE
CLASS="PROGRAMLISTING"
>auth       required     /lib/security/pam_securetty.so
auth       sufficient   /lib/security/pam_winbind.so
auth       sufficient   /lib/security/pam_unix.so use_first_pass
auth       required     /lib/security/pam_stack.so service=system-auth
auth       required     /lib/security/pam_nologin.so
account    sufficient   /lib/security/pam_winbind.so
account    required     /lib/security/pam_stack.so service=system-auth
password   required     /lib/security/pam_stack.so service=system-auth
session    required     /lib/security/pam_stack.so service=system-auth
session    optional     /lib/security/pam_console.so</PRE
></P
><P
>In this case, I added the <B
CLASS="COMMAND"
>auth sufficient /lib/security/pam_winbind.so</B
> 
lines as before, but also added the <B
CLASS="COMMAND"
>required pam_securetty.so</B
> 
above it, to disallow root logins over the network.  I also added a 
<B
CLASS="COMMAND"
>sufficient /lib/security/pam_unix.so use_first_pass</B
>
line after the <B
CLASS="COMMAND"
>winbind.so</B
> line to get rid of annoying 
double prompts for passwords.</P
></DIV
><DIV
CLASS="SECT4"
><HR><H5
CLASS="SECT4"
><A
NAME="AEN2836"
>15.5.3.7.2. Solaris-specific configuration</A
></H5
><P
>The /etc/pam.conf needs to be changed. I changed this file so that my Domain
users can logon both locally as well as telnet.The following are the changes
that I made.You can customize the pam.conf file as per your requirements,but
be sure of those changes because in the worst case it will leave your system
nearly impossible to boot.</P
><P
><PRE
CLASS="PROGRAMLISTING"
>#
#ident	"@(#)pam.conf	1.14	99/09/16 SMI"
#
# Copyright (c) 1996-1999, Sun Microsystems, Inc.
# All Rights Reserved.
#
# PAM configuration
#
# Authentication management
#
login   auth required   /usr/lib/security/pam_winbind.so
login	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass 
login	auth required 	/usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass 
#
rlogin  auth sufficient /usr/lib/security/pam_winbind.so
rlogin  auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
rlogin	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
#
dtlogin auth sufficient /usr/lib/security/pam_winbind.so
dtlogin	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
#
rsh	auth required	/usr/lib/security/$ISA/pam_rhosts_auth.so.1
other   auth sufficient /usr/lib/security/pam_winbind.so
other	auth required	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
#
# Account management
#
login   account sufficient      /usr/lib/security/pam_winbind.so
login	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
login	account required	/usr/lib/security/$ISA/pam_unix.so.1 
#
dtlogin account sufficient      /usr/lib/security/pam_winbind.so
dtlogin	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
dtlogin	account required	/usr/lib/security/$ISA/pam_unix.so.1 
#
other   account sufficient      /usr/lib/security/pam_winbind.so
other	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
other	account required	/usr/lib/security/$ISA/pam_unix.so.1 
#
# Session management
#
other	session required	/usr/lib/security/$ISA/pam_unix.so.1 
#
# Password management
#
#other   password sufficient     /usr/lib/security/pam_winbind.so
other	password required	/usr/lib/security/$ISA/pam_unix.so.1 
dtsession auth required	/usr/lib/security/$ISA/pam_unix.so.1
#
# Support for Kerberos V5 authentication (uncomment to use Kerberos)
#
#rlogin	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#login	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#dtlogin	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#other	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#dtlogin	account optional /usr/lib/security/$ISA/pam_krb5.so.1
#other	account optional /usr/lib/security/$ISA/pam_krb5.so.1
#other	session optional /usr/lib/security/$ISA/pam_krb5.so.1
#other	password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass</PRE
></P
><P
>I also added a try_first_pass line after the winbind.so line to get rid of
annoying double prompts for passwords.</P
><P
>Now restart your Samba and try connecting through your application that you
configured in the pam.conf.</P
></DIV
></DIV
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2843"
>15.6. Limitations</A
></H2
><P
>Winbind has a number of limitations in its current 
	released version that we hope to overcome in future 
	releases:</P
><P
></P
><UL
><LI
><P
>Winbind is currently only available for 
		the Linux, Solaris and IRIX operating systems, although ports to other operating 
		systems are certainly possible. For such ports to be feasible, 
		we require the C library of the target operating system to 
		support the Name Service Switch and Pluggable Authentication
		Modules systems. This is becoming more common as NSS and 
		PAM gain	support among UNIX vendors.</P
></LI
><LI
><P
>The mappings of Windows NT RIDs to UNIX ids 
		is not made algorithmically and depends on the order in which 
		unmapped users or groups are seen by winbind. It may be difficult 
		to recover the mappings of rid to UNIX id mapping if the file 
		containing this information is corrupted or destroyed.</P
></LI
><LI
><P
>Currently the winbind PAM module does not take 
		into account possible workstation and logon time restrictions 
		that may be been set for Windows NT users, this is
		instead up to the PDC to enforce.</P
></LI
></UL
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2853"
>15.7. Conclusion</A
></H2
><P
>The winbind system, through the use of the Name Service 
	Switch, Pluggable Authentication Modules, and appropriate 
	Microsoft RPC calls have allowed us to provide seamless 
	integration of Microsoft Windows NT domain users on a
	UNIX system. The result is a great reduction in the administrative 
	cost of running a mixed UNIX and NT network.</P
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="ADVANCEDNETWORKMANAGEMENT"
></A
>Chapter 16. Advanced Network Manangement</H1
><P
>This section attempts to document peripheral issues that are of great importance to network
administrators who want to improve network resource access control, to automate the user
environment, and to make their lives a little easier.</P
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2869"
>16.1. Configuring Samba Share Access Controls</A
></H2
><P
>This section deals with how to configure Samba per share access control restrictions.
By default samba sets no restrictions on the share itself. Restrictions on the share itself
can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can
connect to a share. In the absence of specific restrictions the default setting is to allow
the global user <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Everyone</I
></SPAN
> Full Control (ie: Full control, Change and Read).</P
><P
>At this time Samba does NOT provide a tool for configuring access control setting on the Share
itself. Samba does have the capacity to store and act on access control settings, but  the only
way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for
Computer Management.</P
><P
>Samba stores the per share access control settings in a file called <TT
CLASS="FILENAME"
>share_info.tdb</TT
>.
The location of this file on your system will depend on how samba was compiled. The default location
for samba's tdb files is under <TT
CLASS="FILENAME"
>/usr/local/samba/var</TT
>. If the <TT
CLASS="FILENAME"
>tdbdump</TT
>
utility has been compiled and installed on your system then you can examine the contents of this file
by: <KBD
CLASS="USERINPUT"
>tdbdump share_info.tdb</KBD
>.</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2879"
>16.1.1. Share Permissions Management</A
></H3
><P
>The best tool for the task is platform dependant. Choose the best tool for your environmemt.</P
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN2882"
>16.1.1.1. Windows NT4 Workstation/Server</A
></H4
><P
>The tool you need to use to manage share permissions on a Samba server is the NT Server Manager.
Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation.
You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below.</P
><DIV
CLASS="PROCEDURE"
><P
><B
>Instructions</B
></P
><OL
TYPE="1"
><LI
><P
>Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu
select Computer, then click on the Shared Directories entry.</P
></LI
><LI
><P
>	Now click on the share that you wish to manage, then click on the Properties tab, next click on
	the Permissions tab. Now you can Add or change access control settings as you wish.</P
></LI
></OL
></DIV
></DIV
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN2891"
>16.1.1.2. Windows 200x/XP</A
></H4
><P
>On MS Windows NT4/200x/XP system access control lists on the share itself are set using native
tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder,
then select 'Sharing', then click on 'Permissions'. The default Windows NT4/200x permission allows
<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Everyone</I
></SPAN
> Full Control on the Share.</P
><P
>MS Windows 200x and later all comes with a tool called the 'Computer Management' snap-in for the
Microsoft Management Console (MMC). This tool is located by clicking on <TT
CLASS="FILENAME"
>Control Panel -&#62;
Administrative Tools -&#62; Computer Management</TT
>.</P
><DIV
CLASS="PROCEDURE"
><P
><B
>Instructions</B
></P
><OL
TYPE="1"
><LI
><P
>	After launching the MMC with the Computer Management snap-in, click on the menu item 'Action',
	select 'Connect to another computer'. If you are not logged onto a domain you will be prompted
	to enter a domain login user identifier and a password. This will authenticate you to the domain.
	If you where already logged in with administrative privilidge this step is not offered.</P
></LI
><LI
><P
>If the Samba server is not shown in the Select Computer box, then type in the name of the target
Samba server in the field 'Name:'. Now click on the [+] next to 'System Tools', then on the [+]
next to 'Shared Folders' in the left panel.</P
></LI
><LI
><P
>Now in the right panel, double-click on the share you wish to set access control permissions on.
Then click on the tab 'Share Permissions'. It is now possible to add access control entities
to the shared folder. Do NOT forget to set what type of access (full control, change, read) you
wish to assign for each entry.</P
></LI
></OL
></DIV
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Be careful. If you take away all permissions from the Everyone user without removing this user
then effectively no user will be able to access the share. This is a result of what is known as
ACL precidence. ie: Everyone with NO ACCESS means that MaryK who is part of the group Everyone
will have no access even if this user is given explicit full control access.</P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2907"
>16.2. Remote Server Administration</A
></H2
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>How do I get 'User Manager' and 'Server Manager'?</I
></SPAN
></P
><P
>Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains',
the 'Server Manager'?</P
><P
>Microsoft distributes a version of these tools called nexus for installation on Windows 9x / Me
systems.  The tools set includes:</P
><P
></P
><UL
><LI
><P
>Server Manager</P
></LI
><LI
><P
>User Manager for Domains</P
></LI
><LI
><P
>Event Viewer</P
></LI
></UL
><P
>Click here to download the archived file <A
HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE"
TARGET="_top"
>ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A
></P
><P
>The Windows NT 4.0 version of the 'User Manager for 
Domains' and 'Server Manager' are available from Microsoft via ftp 
from <A
HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE"
TARGET="_top"
>ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A
></P
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN2924"
>16.3. Network Logon Script Magic</A
></H2
><P
>This section needs work. Volunteer contributions most welcome. Please send your patches or updates
to <A
HREF="mailto:jht@samba.org"
TARGET="_top"
>John Terpstra</A
>.</P
><P
>There are several opportunities for creating a custom network startup configuration environment.</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>No Logon Script</TD
></TR
><TR
><TD
>Simple universal Logon Script that applies to all users</TD
></TR
><TR
><TD
>Use of a conditional Logon Script that applies per user or per group attirbutes</TD
></TR
><TR
><TD
>Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create
	a custom Logon Script and then execute it.</TD
></TR
><TR
><TD
>User of a tool such as KixStart</TD
></TR
></TBODY
></TABLE
><P
></P
><P
>The Samba source code tree includes two logon script generation/execution tools. See <TT
CLASS="FILENAME"
>examples</TT
> directory <TT
CLASS="FILENAME"
>genlogon</TT
> and <TT
CLASS="FILENAME"
>ntlogon</TT
> subdirectories.</P
><P
>The following listings are from the genlogon directory.</P
><P
>This is the genlogon.pl file:

<PRE
CLASS="PROGRAMLISTING"
>	#!/usr/bin/perl
	#
	# genlogon.pl
	#
	# Perl script to generate user logon scripts on the fly, when users
	# connect from a Windows client.  This script should be called from smb.conf
	# with the %U, %G and %L parameters. I.e:
	#
	#       root preexec = genlogon.pl %U %G %L
	#
	# The script generated will perform
	# the following:
	#
	# 1. Log the user connection to /var/log/samba/netlogon.log
	# 2. Set the PC's time to the Linux server time (which is maintained
	#    daily to the National Institute of Standard's Atomic clock on the
	#    internet.
	# 3. Connect the user's home drive to H: (H for Home).
	# 4. Connect common drives that everyone uses.
	# 5. Connect group-specific drives for certain user groups.
	# 6. Connect user-specific drives for certain users.
	# 7. Connect network printers.

	# Log client connection
	#($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
	($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
	open LOG, "&#62;&#62;/var/log/samba/netlogon.log";
	print LOG "$mon/$mday/$year $hour:$min:$sec - User $ARGV[0] logged into $ARGV[1]\n";
	close LOG;

	# Start generating logon script
	open LOGON, "&#62;/shared/netlogon/$ARGV[0].bat";
	print LOGON "\@ECHO OFF\r\n";

	# Connect shares just use by Software Development group
	if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev")
	{
		print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n";
	}

	# Connect shares just use by Technical Support staff
	if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support")
	{
		print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n";
	}

	# Connect shares just used by Administration staff
	If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin")
	{
		print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n";
		print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n";
	}

	# Now connect Printers.  We handle just two or three users a little
	# differently, because they are the exceptions that have desktop
	# printers on LPT1: - all other user's go to the LaserJet on the
	# server.
	if ($ARGV[0] eq 'jim'
	    || $ARGV[0] eq 'yvonne')
	{
		print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n";
		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
	}
	else
	{
		print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n";
		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
	}

	# All done! Close the output file.
	close LOGON;</PRE
></P
><P
>Those wishing to use more elaborate or capable logon processing system should check out the following sites:</P
><P
></P
><TABLE
BORDER="0"
><TBODY
><TR
><TD
>http://www.craigelachie.org/rhacer/ntlogon</TD
></TR
><TR
><TD
>http://www.kixtart.org</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="POLICYMGMT"
></A
>Chapter 17. System and Account Policies</H1
><DIV
CLASS="SECT1"
><H2
CLASS="SECT1"
><A
NAME="AEN2958"
>17.1. Creating and Managing System Policies</A
></H2
><P
>Under MS Windows platforms, particularly those following the release of MS Windows
NT4 and MS Windows 95) it is possible to create a type of file that would be placed
in the NETLOGON share of a domain controller. As the client logs onto the network
this file is read and the contents initiate changes to the registry of the client
machine. This file allows changes to be made to those parts of the registry that
affect users, groups of users, or machines.</P
><P
>For MS Windows 9x/Me this file must be called <TT
CLASS="FILENAME"
>Config.POL</TT
> and may
be generated using a tool called <TT
CLASS="FILENAME"
>poledit.exe</TT
>, better known as the
Policy Editor. The policy editor was provided on the Windows 98 installation CD, but
dissappeared again with the introduction of MS Windows Me (Millenium Edition). From
comments from MS Windows network administrators it would appear that this tool became
a part of the MS Windows Me Resource Kit.</P
><P
>MS Windows NT4 Server products include the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>System Policy Editor</I
></SPAN
>
under the <TT
CLASS="FILENAME"
>Start -&#62; Programs -&#62; Administrative Tools</TT
> menu item.
For MS Windows NT4 and later clients this file must be called <TT
CLASS="FILENAME"
>NTConfig.POL</TT
>.</P
><P
>New with the introduction of MS Windows 2000 was the Microsoft Management Console
or MMC.  This tool is the new wave in the ever changing landscape of Microsoft
methods for management of network access and security. Every new Microsoft product
or technology seems to obsolete the old rules and to introduce newer and more
complex tools and methods. To Microsoft's credit though, the MMC does appear to
be a step forward, but improved functionality comes at a great price.</P
><P
>Before embarking on the configuration of network and system policies it is highly
advisable to read the documentation available from Microsoft's web site regarding
<A
HREF="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp"
TARGET="_top"
>Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp</A
> available from Microsoft.
There are a large number of documents in addition to this old one that should also
be read and understood. Try searching on the Microsoft web site for "Group Policies".</P
><P
>What follows is a very brief discussion with some helpful notes. The information provided
here is incomplete - you are warned.</P
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2972"
>17.1.1. Windows 9x/Me Policies</A
></H3
><P
>You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me.
It can be found on the Original full product Win98 installation CD under
<TT
CLASS="FILENAME"
>tools/reskit/netadmin/poledit</TT
>.  Install this using the
Add/Remove Programs facility and then click on the 'Have Disk' tab.</P
><P
>Use the Group Policy Editor to create a policy file that specifies the location of
user profiles and/or the <TT
CLASS="FILENAME"
>My Documents</TT
> etc.  stuff. Then
save these settings in a file called <TT
CLASS="FILENAME"
>Config.POL</TT
> that needs to
be placed in the root of the [NETLOGON] share. If Win98 is configured to log onto
the Samba Domain, it will automatically read this file and update the Win9x/Me registry
of the machine as it logs on.</P
><P
>Further details are covered in the Win98 Resource Kit documentation.</P
><P
>If you do not take the right steps, then every so often Win9x/Me will check the
integrity of the registry and will restore it's settings from the back-up
copy of the registry it stores on each Win9x/Me machine. Hence, you will
occasionally notice things changing back to the original settings.</P
><P
>Install the group policy handler for Win9x to pick up group policies. Look on the
Win98 CD in <TT
CLASS="FILENAME"
>\tools\reskit\netadmin\poledit</TT
>.
Install group policies on a Win9x client by double-clicking
<TT
CLASS="FILENAME"
>grouppol.inf</TT
>. Log off and on again a couple of times and see
if Win98 picks up group policies.  Unfortunately this needs to be done on every
Win9x/Me machine that uses group policies.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN2984"
>17.1.2. Windows NT4 Style Policy Files</A
></H3
><P
>To create or edit <TT
CLASS="FILENAME"
>ntconfig.pol</TT
> you must use the NT Server
Policy Editor, <B
CLASS="COMMAND"
>poledit.exe</B
> which is included with NT4 Server
but <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>not NT Workstation</I
></SPAN
>. There is a Policy Editor on a NT4
Workstation but it is not suitable for creating <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Domain Policies</I
></SPAN
>.
Further, although the Windows 95 Policy Editor can be installed on an NT4
Workstation/Server, it will not work with NT clients. However, the files from
the NT Server will run happily enough on an NT4 Workstation.</P
><P
>You need <TT
CLASS="FILENAME"
>poledit.exe, common.adm</TT
> and <TT
CLASS="FILENAME"
>winnt.adm</TT
>.
It is convenient to put the two *.adm files in  the <TT
CLASS="FILENAME"
>c:\winnt\inf</TT
> 
directory which is where the binary will look for them unless told otherwise. Note also that that
directory is normally 'hidden'.</P
><P
>The Windows NT policy editor is also included with the Service Pack 3 (and
later) for Windows NT 4.0. Extract the files using <B
CLASS="COMMAND"
>servicepackname /x</B
>,
i.e. that's <B
CLASS="COMMAND"
>Nt4sp6ai.exe /x</B
> for service pack 6a.  The policy editor,
<B
CLASS="COMMAND"
>poledit.exe</B
> and the associated template files (*.adm) should
be extracted as well.  It is also possible to downloaded the policy template
files for Office97 and get a copy of the policy editor.  Another possible
location is with the Zero Administration Kit available for download from Microsoft.</P
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN2999"
>17.1.2.1. Registry Tattoos</A
></H4
><P
>	With NT4 style registry based policy changes, a large number of settings are not
	automatically reversed as the user logs off. Since the settings that were in the
	NTConfig.POL file were applied to the client machine registry and that apply to the
	hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known
	as tattooing. It can have serious consequences down-stream and the administrator must
	be extremely careful not to lock out the ability to manage the machine at a later date.
	</P
></DIV
></DIV
><DIV
CLASS="SECT2"
><HR><H3
CLASS="SECT2"
><A
NAME="AEN3002"
>17.1.3. MS Windows 200x / XP Professional Policies</A
></H3
><P
>Windows NT4 System policies allows setting of registry parameters specific to
users, groups and computers (client workstations) that are members of the NT4
style domain. Such policy file will work with MS Windows 2000 / XP clients also.</P
><P
>New to MS Windows 2000 Microsoft introduced a new style of group policy that confers
a superset of capabilities compared with NT4 style policies. Obviously, the tool used
to create them is different, and the mechanism for implementing them is much changed.</P
><P
>The older NT4 style registry based policies are known as <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Administrative Templates</I
></SPAN
>
in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security
configurations, enforce Internet Explorer browser settings, change and redirect aspects of the
users' desktop (including: the location of <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>My Documents</I
></SPAN
> files (directory), as
well as intrinsics of where menu items will appear in the Start menu). An additional new
feature is the ability to make available particular software Windows applications to particular
users and/or groups.</P
><P
>Remember: NT4 policy files are named <TT
CLASS="FILENAME"
>NTConfig.POL</TT
> and are stored in the root
of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password
and selects the domain name to which the logon will attempt to take place. During the logon
process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating
server, modifies the local registry values according to the settings in this file.</P
><P
>Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of
a Windows 200x policy file is stored in the Active Directory itself and the other part is stored
in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active
Directory domain controllers. The part that is stored in the Active Directory itself is called the
group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is
known as the group policy template (GPT).</P
><P
>With NT4 clients the policy file is read and executed upon only aas each user log onto the network.
MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine
startup (machine specific part) and when the user logs onto the network the user specific part
is applied. In MS Windows 200x style policy management each machine and/or user may be subject
to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows
the administrator to also set filters over the policy settings. No such equivalent capability
exists with NT4 style policy files.</P
><DIV
CLASS="SECT3"
><HR><H4
CLASS="SECT3"
><A
NAME="AEN3013"
>17.1.3.1. Administration of Win2K / XP Policies</A
></H4
><DIV
CLASS="PROCEDURE"
><P
><B
>Instructions</B
></P
><P
>Instead of using the tool called "The System Policy Editor", commonly called Poledit (from the
executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console
(MMC) snap-in as follows:</P
><OL
TYPE="1"
><LI
><P
>Go to the Windows 200x / XP menu <TT
CLASS="FILENAME"
>Start-&#62;Programs-&#62;Administrative Tools</TT
>
	and select the MMC snap-in called "Active Directory Users and Computers"</P
></LI
><LI
><P
>Select the domain or organizational unit (OU) that you wish to manage, then right click
to open the context menu for that object, select the properties item.</P
></LI
><LI
><P
>Now left click on the Group Policy tab, then left click on the New tab. Type a name
for the new policy you will create.</P
></LI
><LI
><P
>Now left click on the Edit tab to commence the steps needed to create the GPO.</P
></LI
></OL
></DIV
><P
>All policy configuration options are controlled through the use of policy administrative
templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP.
Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x.
The later introduces many new features as well as extended definition capabilities. It is
well beyond the scope of this documentation to explain how to program .adm files, for that
the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular
version of MS Windows.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used
to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you
use this powerful tool. Please refer to the resource kit manuals for specific usage information.</P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H2
CLASS="SECT1"
><A
NAME="AEN3030"
>17.2. Managing Account/User Policies</A
></H2
><P
>Policies can define a specific user's settings or the settings for a group of users. The resulting
policy file contains the registry settings for all users, groups, and computers that will be using
the policy file. Separate policy files for each user, group, or computer are not not necessary.</P
><P
>If you create a policy that will be automatically downloaded from validating domain controllers,
you should name the file NTconfig.POL. As system administrator, you have the option of renaming the
policy file and, by modifying the Windows NT-based workstation, directing the computer to update
the policy from a manual path. You can do this by either manually changing the registry or by using