From d9c05ef73f8fe825546f87980e8b62bb567b73f1 Mon Sep 17 00:00:00 2001 From: John Terpstra Date: Thu, 10 Mar 2005 01:31:22 +0000 Subject: Pre-Final Chap9. One more review to follow. (This used to be commit 6937f6c93420d499cde7622a7395c949bb7a3e54) --- docs/Samba-Guide/Chap08b-MigrateNW4Samba3.xml | 505 +++++++++++++++----------- docs/Samba-Guide/index.xml | 2 - 2 files changed, 293 insertions(+), 214 deletions(-) diff --git a/docs/Samba-Guide/Chap08b-MigrateNW4Samba3.xml b/docs/Samba-Guide/Chap08b-MigrateNW4Samba3.xml index 48fed62bf3..6d93c23ced 100644 --- a/docs/Samba-Guide/Chap08b-MigrateNW4Samba3.xml +++ b/docs/Samba-Guide/Chap08b-MigrateNW4Samba3.xml @@ -217,7 +217,11 @@ LDAP Server Configuration - The /etc/openldap/slapd.conf file Misty used is shown here: + The /etc/openldap/slapd.conf file Misty used is shown in . + + + +OpenLDAP Control File &smbmdash; slapd.conf Part A #/usr/local/etc/openldap/slapd.conf # @@ -249,6 +253,7 @@ modulepath /usr/lib/openldap/modules # Logging parameters ####################################################################### loglevel 256 + ####################################################################### # SASL and TLS options ####################################################################### @@ -256,11 +261,17 @@ sasl-host ldap.corp.abmas.org sasl-realm DIGEST-MD5 sasl-secprops none TLSCipherSuite HIGH:MEDIUM:+SSLV2 -TLSCertificateFile /etc/ssl/certs/private/abmas-cert.pem +TLSCertificateFile /etc/ssl/certs/private/abmas-cert.pem TLSCertificateKeyFile /etc/ssl/certs/private/abmas-key.pem password-hash {SSHA} defaultsearchbase "dc=abmas,dc=biz" + + + + +OpenLDAP Control File &smbmdash; slapd.conf Part B + ####################################################################### # bdb database definitions ####################################################################### @@ -303,7 +314,12 @@ replica host=ns.abmas.org:389 credentials=verysecret bindmethod=simple tls=yes + + + +OpenLDAP Control File &smbmdash; slapd.conf Part C + ####################################################################### # ACL section ####################################################################### @@ -348,10 +364,14 @@ access to * access to attrs=namingcontexts by anonymous read - + - The /etc/ldap.conf file used is listed here: + The /etc/ldap.conf file used is listed in . + + + +NSS LDAP Control File &smbmdash; /etc/ldap.conf # /etc/ldap.conf # This file is present on every *NIX client that authenticates to LDAP. @@ -392,10 +412,10 @@ ssl start_tls tls_cacertfile /etc/ssl/certs/private/abmas-cert.pem ... - + - The Name Server Switch control file has the following contents: + The Name Server Switch control file /etc/nsswitch.conf has the following contents: # /etc/nsswitch.conf # This file controls the resolve order for system databases. @@ -458,196 +478,208 @@ shadow: files ldap - The Samba &smb.conf; file was configured as shown here: - -# Global parameters -[global] - workgroup = CORP - netbios name = CORPSRV - server string = Corp File Server - passdb backend = ldapsam:ldap://localhost - pam password change = Yes - username map = /etc/samba/smbusers - log level = 1 - log file = /data/samba/log/%m.log - name resolve order = wins host bcast - time server = Yes - printcap name = cups - show add printer wizard = No - add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u" - add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g" - add user to group script = - /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g" - delete user from group script = - /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g" - set primary group script = - /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u" - add machine script = /usr/local/sbin/smbldap-useradd -w "%m" - logon script = logon.bat - logon path = \\%L\profiles\%U\%a - logon drive = H: - logon home = \\%L\%U - domain logons = Yes - wins support = Yes - ldap admin dn = cn=Manager,dc=abmas,dc=biz - ldap group suffix = ou=Groups - ldap idmap suffix = ou=People - ldap machine suffix = ou=People - ldap passwd sync = Yes - ldap suffix = ou=CORP,dc=abmas,dc=biz - ldap ssl = no - ldap user suffix = ou=People - remote announce = 192.168.2.255/CORP - remote browse sync = 192.168.2.255 - admin users = root, "@Domain Admins" - printer admin = "@Domain Admins" - force printername = Yes - -[netlogon] - comment = Network logon service - path = /data/samba/netlogon - write list = "@Domain Admins" - guest ok = Yes - -[profiles] - comment = Roaming Profile Share - path = /data/samba/profiles/ - read only = No - profile acls = Yes - veto files = desktop.ini - browseable = No - -[homes] - comment = Home Directories - valid users = %S - read only = No - create mask = 0770 - veto files = desktop.ini - hide files = desktop.ini - browseable = No - -[software] - comment = Software for %a computers - path = /data/samba/shares/software/%a - guest ok = Yes - -[public] - comment = Public Files - path = /data/samba/shares/public - read only = No - guest ok = Yes - -[PDF] - comment = Location of documents printed to PDFCreator printer - path = /data/samba/shares/pdf - guest ok = Yes - -[EVERYTHING] - comment = All shares - path = /data/samba - valid users = "@Domain Admins" - read only = No - -[CDROM] - comment = CD-ROM on CORPSRV - path = /mnt - guest ok = Yes - -[print$] - comment = Printer Drivers Share - path = /data/samba/drivers - write list = root - browseable = No - -[printers] - comment = All Printers - path = /data/samba/spool - create mask = 0644 - printable = Yes - browseable = No - -[acct_hp8500] - comment = "Accounting Color Laser Printer" - path = /data/samba/spool/private - valid users = @acct, @acct_admin, @hr, "@Domain Admins",\ - @Receptionist, dwayne, terri, danae, jerry - create mask = 0644 - printable = Yes - copy = printers - -[plotter] - comment = Engineering Plotter - path = /data/samba/spool - create mask = 0644 - printable = Yes - use client driver = Yes - copy = printers - -[APPS] - path = /data/samba/shares/Apps - force group = "Domain Users" - read only = No - -[ACCT] - path = /data/samba/shares/Accounting - valid users = @acct, "@Domain Admins" - force group = acct - read only = No - create mask = 0660 - directory mask = 0770 - -[ACCT_ADMIN] - path = /data/samba/shares/Acct_Admin - valid users = @”acct_admin” - force group = acct_admin - -[HR_PR] - path = /data/samba/shares/HR_PR - valid users = @hr, @acct_admin - force group = hr - -[ENGR] - path = /data/samba/shares/Engr - valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri - force group = engr - read only = No - create mask = 0770 - -[DATA] - path = /data/samba/shares/DATA - valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri - force group = engr - read only = No - create mask = 0770 - copy = engr - -[X] - path = /data/samba/shares/X - valid users = @engr, @acct - force group = engr - read only = No - create mask = 0770 - copy = engr - -[NETWORK] - path = /data/samba/shares/network - valid users = "@Domain Users" - read only = No - create mask = 0770 - guest ok = Yes - -[UTILS] - path = /data/samba/shares/Utils - write list = "@Domain Admins" - -[SYS] - path = /data/samba/shares/SYS - valid users = chad - read only = No - browseable = No - + The Samba &smb.conf; file was configured as shown in . + +Samba Configuration File &smbmdash; smb.conf Part A +Global parameters +[global] +workgroupMEGANET2 +netbios nameMASSIVE +server stringCorp File Server +passdb backendldapsam:ldap://localhost +pam password changeYes +username map/etc/samba/smbusers +log level1 +log file/data/samba/log/%m.log +name resolve orderwins host bcast +time serverYes +printcap namecups +show add printer wizardNo +add user script/opt/IDEALX/sbin/smbldap-useradd -m "%u" +add group script/opt/IDEALX/sbin/smbldap-groupadd -p "%g" +add user to group script +/opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g" +delete user from group script +/opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g" +set primary group script +/opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u" +add machine script/usr/local/sbin/smbldap-useradd -w "%m" +logon scriptlogon.bat +logon path\\%L\profiles\%U\%a +logon driveH: +logon home\\%L\%U +domain logonsYes +wins supportYes +ldap admin dncn=Manager,dc=abmas,dc=biz +ldap group suffixou=Groups +ldap idmap suffixou=People +ldap machine suffixou=People +ldap passwd syncYes +ldap suffixou=MEGANET2,dc=abmas,dc=biz +ldap sslno +ldap user suffixou=People +admin usersroot, "@Domain Admins" +printer admin"@Domain Admins" +force printernameYes + + + +Samba Configuration File &smbmdash; smb.conf Part B +[netlogon] +commentNetwork logon service +path/data/samba/netlogon +write list"@Domain Admins" +guest okYes + +[profiles] +commentRoaming Profile Share +path/data/samba/profiles/ +read onlyNo +profile aclsYes +veto filesdesktop.ini +browseableNo + +[homes] +commentHome Directories +valid users%S +read onlyNo +create mask0770 +veto filesdesktop.ini +hide filesdesktop.ini +browseableNo + +[software] +commentSoftware for %a computers +path/data/samba/shares/software/%a +guest okYes + +[public] +commentPublic Files +path/data/samba/shares/public +read onlyNo +guest okYes + +[PDF] +commentLocation of documents printed to PDFCreator printer +path/data/samba/shares/pdf +guest okYes + + + +Samba Configuration File &smbmdash; smb.conf Part C +[EVERYTHING] +commentAll shares +path/data/samba +valid users"@Domain Admins" +read onlyNo + +[CDROM] +commentCD-ROM on MASSIVE +path/mnt +guest okYes + +[print$] +commentPrinter Drivers Share +path/data/samba/drivers +write listroot +browseableNo + +[printers] +commentAll Printers +path/data/samba/spool +create mask0644 +printableYes +browseableNo + +[acct_hp8500] +comment"Accounting Color Laser Printer" +path/data/samba/spool/private +valid users@acct, @acct_admin, @hr, "@Domain Admins",\ +@Receptionist, dwayne, terri, danae, jerry +create mask0644 +printableYes +copyprinters + +[plotter] +commentEngineering Plotter +path/data/samba/spool +create mask0644 +printableYes +use client driverYes +copyprinters + + + +Samba Configuration File &smbmdash; smb.conf Part D +[APPS] +path/data/samba/shares/Apps +force group"Domain Users" +read onlyNo + +[ACCT] +path/data/samba/shares/Accounting +valid users@acct, "@Domain Admins" +force groupacct +read onlyNo +create mask0660 +directory mask0770 + +[ACCT_ADMIN] +path/data/samba/shares/Acct_Admin +valid users@”acct_admin” +force groupacct_admin + +[HR_PR] +path/data/samba/shares/HR_PR +valid users@hr, @acct_admin +force grouphr + +[ENGR] +path/data/samba/shares/Engr +valid users@engr, @receptionist, @truss, "@Domain Admins", cheri +force groupengr +read onlyNo +create mask0770 + +[DATA] +path/data/samba/shares/DATA +valid users@engr, @receptionist, @truss, "@Domain Admins", cheri +force groupengr +read onlyNo +create mask0770 +copyengr + + + +Samba Configuration File &smbmdash; smb.conf Part E +[X] +path/data/samba/shares/X +valid users@engr, @acct +force groupengr +read onlyNo +create mask0770 +copyengr + +[NETWORK] +path/data/samba/shares/network +valid users"@Domain Users" +read onlyNo +create mask0770 +guest okYes + +[UTILS] +path/data/samba/shares/Utils +write list"@Domain Admins" + +[SYS] +path/data/samba/shares/SYS +valid userschad +read onlyNo +browseableNo + + Most of these shares are only used by one company group, but they are required because of some ancient Qbasic and Rbase applications were that written expecting @@ -692,8 +724,16 @@ undesirable actions from occuring un-noticed. Now Samba is ready for use. Now configure the smbldap-tools. There are two relevant files, which are usually put into the directory /etc/smbldap-tools. The main file, - smbldap.conf is shown here: + smbldap.conf is shown in . + + + +Idealx smbldap-tools Control File &smbmdash; Part A +######### +# +# located in /etc/smbldap-tools/smbldap.conf +# ############################################################################## # # General Configuration @@ -735,7 +775,12 @@ ldapTLS="0" # How to verify the server's certificate (none, optional or require) # see "man Net::LDAP" in start_tls section for more details verify="" + + + +Idealx smbldap-tools Control File &smbmdash; Part B + # CA certificate # see "man Net::LDAP" in start_tls section for more details cafile="" @@ -749,7 +794,7 @@ clientkey="" # LDAP Suffix # Ex: suffix=dc=IDEALX,dc=ORG -suffix="ou=CORP,dc=abmas,dc=biz" +suffix="ou=MEGANET2,dc=abmas,dc=biz" # Where are stored Users # Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG" @@ -771,7 +816,12 @@ sambaUnixIdPooldn="ou=People,${suffix}" # Default scope Used scope="sub" + + + +Idealx smbldap-tools Control File &smbmdash; Part C + # Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) hash_encrypt="SSHA" @@ -811,7 +861,12 @@ skeletonDir="/etc/skel" # you don't want password to be enable for defaultMaxPasswordAge days (be # careful to the sambaPwdMustChange attribute's value) defaultMaxPasswordAge="45" + + + +Idealx smbldap-tools Control File &smbmdash; Part D + ############################################################################## # # SAMBA Configuration @@ -856,7 +911,7 @@ mailDomain="abmas.org" with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" - + NOTES: I chose not to take advantage of the TLS capability of this. @@ -889,7 +944,7 @@ masterPw="verysecret" - We can now run the “smbldap-populate command which will populate + We can now run the smbldap-populate command which will populate the LDAP tree with the appropriate default users, groups, and UID and GID pools. It will create a user called Administrator with UID=0 and GID=0 matching the Domain Admins group. This is fine you can still log in a root to a Windows system, @@ -1027,10 +1082,10 @@ loginShell: /bin/false - Then I went over to a spare Windows NT machine and joined it to the CORP domain. + Then I went over to a spare Windows NT machine and joined it to the MEGANET2 domain. It worked, and the machine's account entry under OU=COMPUTERS looks like this: -dn:uid=w2kengrspare$,ou=Computers,ou=CORP,dc=abmas,dc=biz +dn:uid=w2kengrspare$,ou=Computers,ou=MEGANET2,dc=abmas,dc=biz objectClass: top objectClass: inetOrgPerson objectClass: posixAccount @@ -1079,9 +1134,13 @@ kxrpc.exe <-- Probably useless as it has to run on the server and can - I then wrote the following logon.kix file. - I chose to keep it all in one file, but it can be split up and - linked via include directives. + I then wrote the logon.kix file that is shown in + . I chose to keep it all in one file, but it + can be split up and linked via include directives. + + + +Kixstart Control File &smbmdash; Part A break on @@ -1120,8 +1179,13 @@ ENDIF $RETURNCODE = EXISTKEY("HKEY_CURRENT_USER\Abmas\FIRST_LOGIN") IF NOT $RETURNCODE = 0 + + - IF NOT INGROUP("CORPSRV\Laptop") + +Kixstart Control File &smbmdash; Part B + + IF NOT INGROUP("MASSIVE\Laptop") $RETURNCODE=EXISTKEY("HKEY_CURRENT_USER\Abmas\profile_copied") IF NOT $RETURNCODE = 0 IF EXIST("\\corpsrv\profiles\@userID\WinXP") @@ -1156,6 +1220,12 @@ CurrentVersion\Explorer\User Shell Folders", "My Music", Windows\CurrentVersion\Explorer\User Shell Folders", "My eBooks", "\\corpsrv\@userID\My eBooks", "REG_SZ") ENDIF + + + + +Kixstart Control File &smbmdash; Part C + $SELECTION =MESSAGEBOX("Changes were made to your registry. You must now log out. Please save any open files and click OK", "Log Out Necessary", 0) @@ -1167,7 +1237,7 @@ You must now log out. Please save any open files and click OK", ENDIF ENDIF -IF INGROUP("CORP\Domain Admins") +IF INGROUP("MEGANET2\Domain Admins") USE Z: \\corpsrv\everything SETCONSOLE("show") ELSE @@ -1176,12 +1246,12 @@ ELSE ENDIF -IF INGROUP("CORPSRV\Acct_Admin","CORPSRV\HR") - USE I: \\CORP\HR_PR +IF INGROUP("MASSIVE\Acct_Admin","MASSIVE\HR") + USE I: \\MEGANET2\HR_PR ; Eventually ABRA mapping will be here ENDIF -IF INGROUP("CORP\Acct") +IF INGROUP("MEGANET2\Acct") ; Set up printer $RETURNVALUE = existkey("HKEY_CURRENT_USER\Printers\,,corpsrv,acct_hp8500") IF NOT $RETURNVALUE = 0 @@ -1192,8 +1262,13 @@ ENDIF USE M: \\corpsrv\ACCT ENDIF + + -IF INGROUP("CORP\Engr","CORP\Truss","CORP\Receptionist") + +Kixstart Control File &smbmdash; Part D + +IF INGROUP("MEGANET2\Engr","MEGANET2\Truss","MEGANET2\Receptionist") $RETURNVALUE = EXISTKEY("HKEY_CURRENT_USER\Printers\,,corpsrv,engr_hp1300") IF NOT $RETURNVALUE = 0 ADDPRINTERCONNECTION("\\corpsrv\engr_hp1300") @@ -1222,8 +1297,13 @@ USE LPT3: "\\corpsrv\engr_legacy_printer" ;SET "PATH=L:\ENGINEER\MATLST;u:;h:;g:\ifsapp\runtime; c:\orawin95\bin;%PATH%;" ENDIF + + -IF INGROUP("CORP\Truss") + +Kixstart Control File &smbmdash; Part E + +IF INGROUP("MEGANET2\Truss") ; Don't set up a default printer, they choose which one they want $RETURNVALUE = EXISTKEY("HKEY_CURRENT_USER\Printers\Connections\,,corpsrv,truss_hp4") @@ -1251,7 +1331,8 @@ IF $RETURNVALUE = 0 DELKEY("HKEY_CURRENT_USER\Abmas\FIRST_LOGIN") ENDIF - + + As you can see in the script, I redirect the My Documents to the user's home @@ -1316,7 +1397,7 @@ ENDIF Select the user's local profile (COMPUTERNAME\username), - and click the Copy To”button. + and click the Copy To button. diff --git a/docs/Samba-Guide/index.xml b/docs/Samba-Guide/index.xml index a7dd6d32ac..549f8e50e7 100644 --- a/docs/Samba-Guide/index.xml +++ b/docs/Samba-Guide/index.xml @@ -42,9 +42,7 @@ - -- cgit