diff options
| author | John Terpstra <jht@samba.org> | 2003-06-14 22:25:31 +0000 |
|---|---|---|
| committer | John Terpstra <jht@samba.org> | 2003-06-14 22:25:31 +0000 |
| commit | a1b6e7007b6257bc001e661c20fd20d4643b1eca (patch) | |
| tree | aa6bab8e51c0d0ed5e92887067ab201c2598fce6 /docs/htmldocs/StandAloneServer.html | |
| parent | 7c65b3fc629e8ada61fb5ac16fcdcb6ef05d8b61 (diff) | |
| download | samba-a1b6e7007b6257bc001e661c20fd20d4643b1eca.tar.gz samba-a1b6e7007b6257bc001e661c20fd20d4643b1eca.tar.xz samba-a1b6e7007b6257bc001e661c20fd20d4643b1eca.zip | |
Adding missing docs to tree.
These docs are needed for SWAT Support. Also, not everyone can build the docs
so we do need to include them.
Diffstat (limited to 'docs/htmldocs/StandAloneServer.html')
| -rw-r--r-- | docs/htmldocs/StandAloneServer.html | 144 |
1 files changed, 144 insertions, 0 deletions
diff --git a/docs/htmldocs/StandAloneServer.html b/docs/htmldocs/StandAloneServer.html new file mode 100644 index 00000000000..02e112ac94d --- /dev/null +++ b/docs/htmldocs/StandAloneServer.html @@ -0,0 +1,144 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> +<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Stand-Alone Servers</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><link rel="home" href="index.html" title="SAMBA Project Documentation"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="previous" href="domain-member.html" title="Chapter 7. Domain Membership"><link rel="next" href="ClientConfig.html" title="Chapter 9. MS Windows Network Configuration Guide"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Stand-Alone Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="domain-member.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="ClientConfig.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="StandAloneServer"></a>Chapter 8. Stand-Alone Servers</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="StandAloneServer.html#id2901785">Features and Benefits</a></dt><dt><a href="StandAloneServer.html#id2901823">Background</a></dt><dt><a href="StandAloneServer.html#id2901891">Example Configuration</a></dt><dd><dl><dt><a href="StandAloneServer.html#id2900494">Reference Documentation Server</a></dt><dt><a href="StandAloneServer.html#id2900541">Central Print Serving</a></dt></dl></dd><dt><a href="StandAloneServer.html#id2900747">Common Errors</a></dt></dl></div><p> +Stand-Alone servers are independant of Domain Controllers on the network. +They are NOT domain members and function more like workgroup servers. In many +cases a stand-alone server is configured with a minimum of security control +with the intent that all data served will be readilly accessible to all users. +</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2901785"></a>Features and Benefits</h2></div></div><div></div></div><p> +Stand-Alone servers can be as secure or as insecure as needs dictate. They can +have simple or complex configurations. Above all, despite the hoopla about +Domain security they remain a very common installation. +</p><p> +If all that is needed is a server for read-only files, or for +printers alone, it may not make sense to affect a complex installation. +For example: A drafting office needs to store old drawings and reference +standards. No-one can write files to the server as it is legislatively +important that all documents remain unaltered. A share mode read-only stand-alone +server is an ideal solution. +</p><p> +Another situation that warrants simplicity is an office that has many printers +that are queued off a single central server. Everyone needs to be able to print +to the printers, there is no need to affect any access controls and no files will +be served from the print server. Again a share mode stand-alone server makes +a great solution. +</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2901823"></a>Background</h2></div></div><div></div></div><p> +The term <span class="emphasis"><em>stand-alone server</em></span> means that the server +will provide local authentication and access control for all resources +that are available from it. In general this means that there will be a +local user database. In more technical terms, it means that resources +on the machine will be made available in either SHARE mode or in +USER mode. +</p><p> +No special action is needed other than to create user accounts. Stand-alone +servers do NOT provide network logon services. This means that machines that +use this server do NOT perform a domain log onto it. Whatever logon facility +the workstations are subject to is independant of this machine. It is however +necessary to accomodate any network user so that the logon name they use will +be translated (mapped) locally on the stand-alone server to a locally known +user name. There are several ways this cane be done. +</p><p> +Samba tends to blur the distinction a little in respect of what is +a stand-alone server. This is because the authentication database may be +local or on a remote server, even if from the samba protocol perspective +the samba server is NOT a member of a domain security context. +</p><p> +Through the use of PAM (Pluggable Authentication Modules) and nsswitch +(the name service switcher) the source of authentication may reside on +another server. We would be inclined to call this the authentication server. +This means that the samba server may use the local Unix/Linux system password database +(<tt class="filename">/etc/passwd</tt> or <tt class="filename">/etc/shadow</tt>), may use a +local smbpasswd file, or may use +an LDAP back end, or even via PAM and Winbind another CIFS/SMB server +for authentication. +</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2901891"></a>Example Configuration</h2></div></div><div></div></div><p> +The following examples are designed to inspire simplicity. It is too easy to +attempt a high level of creativity and to introduce too much complexity in +server and network design. +</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2900494"></a>Reference Documentation Server</h3></div></div><div></div></div><p> +Configuration of a read-only data server that EVERYONE can access is very simple. +Here is the smb.conf file that will do this. Assume that all the reference documents +are stored in the directory /export, that the documents are owned by a user other than +nobody. No home directories are shared, that are no users in the <tt class="filename">/etc/passwd</tt> +Unix system database. This is a very simple system to administer. +</p><pre class="programlisting"> + # Global parameters + [global] + workgroup = MYGROUP + netbios name = REFDOCS + security = SHARE + passdb backend = guest + wins server = 192.168.1.1 + + [data] + comment = Data + path = /export + guest only = Yes +</pre><p> +In the above example the machine name is set to REFDOCS, the workgroup is set to the name +of the local workgroup so that the machine will appear in with systems users are familiar +with. The only password backend required is the "guest" backend so as to allow default +unprivilidged account names to be used. Given that there is a WINS server on this network +we do use it. +</p></div><div xmlns:ns13="" class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2900541"></a>Central Print Serving</h3></div></div><div></div></div><p> +Configuration of a simple print server is very simple if you have all the right tools +on your system. +</p><div class="orderedlist"><p class="title"><b> Assumptions:</b></p><ol type="1"><li><p> + The print server must require no administration + </p></li><li><p> + The print spooling and processing system on our print server will be CUPS. + (Please refer to the chapter on printing for more information). + </p></li><li><p> + All printers will that the print server will service will be network + printers. They will be correctly configured, by the administrator, + in the CUPS environment. + </p></li><li><p> + All workstations will be installed using postscript drivers. The printer + of choice is the Apple Color LaserWriter. + </p></li></ol></div><p> +In this example our print server will spool all incoming print jobs to +<tt class="filename">/var/spool/samba</tt> until the job is ready to be submitted by +samba to the CUPS print processor. Since all incoming connections will be as +the anonymous (guest) user two things will be required: +</p><div class="itemizedlist"><p class="title"><b>Enablement for Anonymous Printing</b></p><ul type="disc"><li xmlns:ns11=""><ns11:p> + The Unix/Linux system must have a <b class="command">guest</b> account. + The default for this is usually the account <b class="command">nobody</b>. + To find the correct name to use for your version of Samba do the + following: + </ns11:p><pre class="screen"> +<tt class="prompt">$ </tt><b class="userinput"><tt>testparm -s -v | grep "guest account"</tt></b> + </pre><ns11:p> + Then make sure that this account exists in your system password + database (<tt class="filename">/etc/passwd</tt>). + </ns11:p></li><li xmlns:ns12=""><ns12:p> + The directory into which Samba will spool the file must have write + access for the guest account. The following commands will ensure that + this directory is available for use: + </ns12:p><pre class="screen"> +<tt class="prompt">root# </tt><b class="userinput"><tt>mkdir /var/spool/samba</tt></b> +<tt class="prompt">root# </tt><b class="userinput"><tt>chown nobody.nobody /var/spool/samba</tt></b> +<tt class="prompt">root# </tt><b class="userinput"><tt>chmod a+rwt /var/spool/samba</tt></b> + </pre><ns12:p> + </ns12:p></li></ul></div><ns13:p> +</ns13:p><pre class="programlisting"> + # Global parameters + [global] + workgroup = MYGROUP + netbios name = PTRSVR1 + security = SHARE + passdb backend = guest + wins server = 192.168.1.1 + + [printers] + comment = All Printers + path = /var/spool/samba + printer admin = root + guest ok = Yes + printable = Yes + printing = cups + use client driver = Yes + browseable = No +</pre><ns13:p> +</ns13:p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2900747"></a>Common Errors</h2></div></div><div></div></div><p> +The greatest mistake so often made is to make a network configuration too complex. +It pays to use the simplest solution that will meet the needs of the moment. +</p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="domain-member.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="type.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ClientConfig.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 7. Domain Membership </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 9. MS Windows Network Configuration Guide</td></tr></table></div></body></html> |