summaryrefslogtreecommitdiffstats
path: root/docs/Samba3-ByExample/SBE-TheSmallOffice.xml
blob: ca39af306313763bd72d9aa45e26f1702d93e9a6 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
<chapter id="small">
  <title>Small Office Networking</title>

	<para>
	<link linkend="simple"/> focused on the basics of simple yet effective
	network solutions. Network administrators who take pride in their work
	(that's most of us, right?) take care to deliver what our users want,
	but not too much more. If we make things too complex, we confound our users
	and increase costs of network ownership. A professional network manager
	avoids the temptation to put too much pizazz into the way that the network
	operates. Some creativity is helpful, but keep it under control &smbmdash;
	good advice that the following two scenarios illustrate.
	</para>

	<para>
	<indexterm><primary>Netware</primary></indexterm>
	In one case the network administrator of a mid-sized company spent three
	months building a new network to replace an old Netware server. What he
	delivered had all the bells and whistles he could muster. There were a
	few teething problems during the changeover, nothing serious but a little
	disruptive all the same. Users were exposed to many changes at once. The
	network administrator was asked to resign two months after implementing
	the new system because so many staff complained they had lost time and
	were not happy with the new network.  Everything was automated, and he
	delivered more features than any advanced user could think of. He was
	just too smart for his own good.
	</para>

	<para>
	In the case of the other company, a new network manager was appointed
	to oversee the replacement of a LanTastic network with an MS Windows
	NT 4.0 network. He had the replacement installed and operational within
	two weeks. Before installation and changeover, he called a meeting to
	explain to all users what was going to happen, how it would affect them,
	and that he would be available 24 hours a day to help them transition.
	One week after conversion, he held another meeting asking for cooperation
	in the introduction of a few new features that would help to make life
	easier. Network users were thrilled with the help he provided. The network
	he implemented was nowhere near as complex as in the first example, had fewer
	features, and yet he had happy users. Months later he was still adding
	new innovations. He always asked the users if a
	particular feature was what they wanted. He asked his boss for a raise
	and got it. He often told me, <quote>Always keep a few new tricks up your
	sleeves for when you need them.</quote> Was he smart? You decide. Let's
	get on with our next exercise.
	</para>

<sect1>
	<title>Introduction</title>

	<para>
	Abmas Accounting has grown. Mr. Meany likes you and says he knew you
	were the right person for the job. That's why he asked you to install the
	new server. The past few months have been hard work. You advised Mr. Meany
	that it is time for a change. Abmas now has 52 users, having acquired an
	investment consulting business recently. The new users were added to the
	network without any problems.
	</para>

	<para>
	Some of the Windows clients are nearly past their use-by date.  You found damaged and unusable software on
	some of the workstations that came with the acquired business and found some machines in need of both
	hardware and software maintenance.
	</para>

	<sect2>
		<title>Assignment Tasks</title>

		<para>
		<indexterm><primary>Windows XP</primary></indexterm>
		Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure
		that the business is running efficiently. Many of the new staff want notebook
		computers.  They visit customer business premises and need to use local network
		facilities; these users are technically competent. The company uses a
		business application that requires Windows XP Professional. In short, a complete
		client upgrade is about to happen. Mr. Meany told you that he is working
		on another business acquisition and that by the time he retires there will be
		80 to 100 users.
		</para>

		<para>
		Mr. Meany is not concerned about security. He wants to make it easier for
		staff to do their work. He has hired you to help him appoint a full-time
		network manager before he retires. Above all, he says he is investing in
		the ability to grow. He is determined to live his lifelong dream and
		hand the business over to a bright and capable executive who can make
		things happen. This means your network design must cope well with
		growth.
		</para>

		<para>
		In a few months, Abmas will require an Internet connection for email and so
		that staff can easily obtain software updates. Mr. Meany is warming up to
		the installation of antivirus software but is not yet ready to approve
		this expense. He told you to spend the money a virus scanner costs
		on better quality notebook computers for mobile users.
		</para>

		<para>
		One of Mr. Meany's golfing partners convinced him to buy new laser
		printers, one black only, the other a color laser printer. Staff support
		the need for a color printer so they can present more attractive proposals
		and reports.
		</para>

		<para>
		Mr. Meany also asked if it would be possible for one of the staff to manage
		user accounts from the Windows desktop. That person will be responsible for
		basic operations.
		</para>

	</sect2>
</sect1>

<sect1>
	<title>Dissection and Discussion</title>

	<para>
	What are the key requirements in this business example? A quick review indicates
	a need for
	</para>

	<itemizedlist>
		<listitem><para>
		Scalability, from 52 to over 100 users in 12 months
		</para></listitem>

		<listitem><para>
		Mobile computing capability
		<indexterm><primary>mobile computing</primary></indexterm>
		</para></listitem>

		<listitem><para>
		Improved reliability and usability
		</para></listitem>

		<listitem><para>
		Easier administration
		</para></listitem>
	</itemizedlist>

	<para>
	In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server
	(as in <link linkend="AccountingOffice"/>).

	</para>


	<sect2>
		<title>Technical Issues</title>

		<para>
		<indexterm><primary>smbpasswd</primary></indexterm>
		<indexterm><primary>DHCP</primary></indexterm>
		<indexterm><primary>DNS</primary></indexterm>
		<indexterm><primary>WINS</primary></indexterm>
		<indexterm><primary>Domain</primary></indexterm>
		It is time to implement a domain security environment. You will use the <constant>
		smbpasswd</constant> (default) backend. You should implement a DHCP server. There is no need to
		run DNS at this time, but the system will use WINS. The domain name will be <constant>
		BILLMORE</constant>. This time, the name of the server will be <constant>SLEETH</constant>.
		</para>

                <para>
		All printers will be configured as DHCP clients. The DHCP server will assign
		the printer a fixed IP address by way of its Ethernet interface (MAC) address.
		See <link linkend="dhcp01"/>.
                </para>

		<note><para>
		The &smb.conf; file you are creating in this exercise can be used with equal effectiveness
		with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is
		possible to start with the installation that you have created here, migrate it
		to a Samba-3 configuration, and then secure the system further. Configurations following
		this one utilize features that may not be supported in Samba-2.2.x releases.
		However, you should note that the examples in each chapter start with the assumption
		that a fresh new installation is being effected.
		</para></note>

		<para>
		Later on, when the Internet connection is implemented, you will add DNS as well as
		other enhancements. It is important that you plan accordingly.
		</para>

		<para>
		<indexterm><primary>Ethernet switch</primary></indexterm>
		You have split the network into two separate areas. Each has its own Ethernet switch.
		There are 20 users on the accounting network and 32 users on the financial services
		network. The server has two network interfaces, one serving each network. The
		network printers will be located in a central area. You plan to install the new
		printers and keep the old printer in use also.
		</para>

		<para>
		You will provide separate file storage areas for each business entity. The old system
		will go away, accounting files will be handled under a single directory, and files will
		be stored under customer name, not under a personal work area. Staff will be made
		responsible for file location, so the old share point must be maintained.
		</para>

		<para>
		Given that DNS will not be used, you will configure WINS name resolution for UNIX
		hostname name resolution.
		</para>

		<para>
		<indexterm><primary>Domain</primary><secondary>groups</secondary></indexterm>
		<indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
		It is necessary to map Windows Domain Groups to UNIX groups. It is
		advisable to also map Windows Local Groups to UNIX groups. Additionally, the two
		key staff groups in the firm are accounting staff and financial services staff.
		For these, it is necessary to create UNIX groups as well as Windows Domain Groups.
		</para>

		<para>
		In the sample &smb.conf; file, you have configured Samba to call the UNIX
		<command>groupadd</command> to add group entries. This utility does not permit
		the addition of group names that contain uppercase characters or spaces. This
		is considered a bug. The <command>groupadd</command> is part of the
		<command>shadow-utils</command> open source software package.  A later release
		of this package may have been patched to resolve this bug.  If your operating
		platform has this bug, it means that attempts to add a Windows Domain Group that
		has either a space or uppercase characters in it will fail. See
		<emphasis>TOSHARG2</emphasis>, Chapter 11, Section 11.3.1, Example 11.1, for
		more information.
		</para>

		<para>
		<indexterm><primary>CUPS</primary></indexterm>
		Vendor-supplied printer drivers will be installed on each client. The CUPS print
		spooler on the UNIX host will be operated in <constant>raw</constant> mode.
		</para>

	</sect2>

	<sect2>
		<title>Political Issues</title>

		<para>
		Mr. Meany is an old-school manager. He sets the rules and wants to see compliance.
		He is willing to spend money on things he believes are of value. You need more
		time to convince him of real priorities.
		</para>

		<para>
		Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be
		supplied with antivirus software? Above all, demonstrate good purchase value and remember
		to make your users happy.
		</para>

	</sect2>

</sect1>

<sect1>
	<title>Implementation</title>

	<para>
	<indexterm><primary>migration</primary></indexterm>
	In this example, the assumption is made that this server is being configured from a clean start.
	The alternate approach could be to demonstrate the migration of the system that is documented
	in <link linkend="AcctgNet"/> to meet the new requirements. The decision to treat this case, as with
	future examples, as a new installation is based on the premise that you can determine
	the migration steps from the information provided in <link linkend="ntmigration"/>.
	Additionally, a fresh installation makes the example easier to follow.
	</para>

	<para>
	<indexterm><primary>group membership</primary></indexterm>
	Each user will be given a home directory on the UNIX system, which will be available as a private
	share. Two additional shares will be created, one for the accounting department and the other for
	the financial services department. Network users will be given access to these shares by way
	of group membership.
	</para>

	<para>
	<indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
	UNIX group membership is the primary mechanism by which Windows Domain users will be granted
	rights and privileges within the Windows environment.
	</para>

	<para>
	<indexterm><primary>sticky bit</primary></indexterm>
	The user <command>alanm</command> will be made the owner of all files. This will be preserved
	by setting the sticky bit (set UID/GID) on the top-level directories.
	</para>

	<figure id="acct2net">
		<title>Abmas Accounting &smbmdash; 52-User Network Topology</title>
		<imagefile scale="100">acct2net</imagefile>
	</figure>

	<procedure>
	<title>Server Installation Steps</title>

		<step><para>
		Using UNIX/Linux system tools, name the server <constant>sleeth</constant>.
		</para></step>

		<step><para>
		<indexterm><primary>/etc/hosts</primary></indexterm>
		Place an entry for the machine <constant>sleeth</constant> in the <filename>/etc/hosts</filename>.
		The printers are network attached, so there should be entries for the
		network printers also. An example <filename>/etc/hosts</filename> file is shown here:
<screen>
192.168.1.1     sleeth sleeth1
192.168.2.1     sleeth2
192.168.1.10    hplj6
192.168.1.11    hplj4
192.168.2.10    qms
</screen>
		</para></step>

		<step><para>
		Install the Samba-3 binary RPM from the Samba-Team FTP site.
		</para></step>

		<step><para>
		Install the ISC DHCP server using the UNIX/Linux system tools available to you.
		</para></step>

		<step><para>
		<indexterm><primary>/etc/rc.d/rc.local</primary></indexterm>
		<indexterm><primary>IP forwarding</primary></indexterm>
		<indexterm><primary>router</primary></indexterm>
		<indexterm><primary>/proc/sys/net/ipv4/ip_forward</primary></indexterm>
		Because Samba will be operating over two network interfaces and clients on each side
		may want to be able to reach clients on the other side, it is imperative that IP forwarding
		is enabled. Use the system tool of your choice to enable IP forwarding. In the
		absence of such a tool on the Linux system, add to the <filename>/etc/rc.d/rc.local</filename>
		file an entry as follows:
<screen>
echo 1 > /proc/sys/net/ipv4/ip_forward
</screen>
		This causes the Linux kernel to forward IP packets so that it acts as a router.
		</para></step>

		<step><para>
		Install the &smb.conf; file as shown in <link linkend="acct2conf"/> and
		<link linkend="acct3conf"/>. Combine these two examples to form a single
		<filename>/etc/samba/smb.conf</filename> file.
		</para></step>

		<step><para>
		<indexterm><primary>smbpasswd</primary></indexterm>
		Add the user <command>root</command> to the Samba password backend:
<screen>
&rootprompt; smbpasswd -a root
New SMB password: XXXXXXX
Retype new SMB password: XXXXXXX
&rootprompt;
</screen>
		<indexterm><primary>administrator</primary></indexterm>
		This is the Windows Domain Administrator password. Never delete this account from
		the password backend after Windows Domain Groups have been initialized. If you delete
		this account, your system is crippled. You cannot restore this account,
		and your Samba server can no longer be administered.
		</para></step>

		<step><para>
		<indexterm><primary>username map</primary></indexterm>
		Create the username map file to permit the <constant>root</constant> account to be called
		<constant>Administrator</constant> from the Windows network environment. To do this, create
		the file <filename>/etc/samba/smbusers</filename> with the following contents:
<screen>
####
# User mapping file
####
# File Format
# -----------
# Unix_ID = Windows_ID
#
# Examples:
# root = Administrator
# janes = "Jane Smith"
# jimbo = Jim Bones
#
# Note: If the name contains a space it must be double quoted.
#       In the example above the name 'jimbo' will be mapped to Windows
#       user names 'Jim' and 'Bones' because the space was not quoted.
#######################################################################
root = Administrator
####
# End of File
####
</screen>
		</para></step>

		<step><para>
		<indexterm><primary>initGrps.sh</primary></indexterm>
		Create and map Windows Domain Groups to UNIX groups. A sample script is provided in
		<link linkend="initGrps"/>. Create a file containing this script. We called ours
		<filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed,
		and then execute the script. Sample output should be as follows:

<example id="initGrps">
<title>Script to Map Windows NT Groups to UNIX Groups</title>
<indexterm><primary>initGrps.sh</primary></indexterm>
<screen>
#!/bin/bash
#
# initGrps.sh
#

# Create UNIX groups
groupadd acctsdep
groupadd finsrvcs

# Map Windows Domain Groups to UNIX groups
net groupmap add ntgroup="Domain Admins"  unixgroup=root type=d
net groupmap add ntgroup="Domain Users"   unixgroup=users type=d
net groupmap add ntgroup="Domain Guests"  unixgroup=nobody type=d

# Add Functional Domain Groups
net groupmap add ntgroup="Accounts Dept"  unixgroup=acctsdep type=d
net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
</screen>
</example>

<screen>
&rootprompt; chmod 755 initGrps.sh
&rootprompt; cd /etc/samba
&rootprompt; ./initGrps.sh
Updated mapping entry for Domain Admins
Updated mapping entry for Domain Users
Updated mapping entry for Domain Guests
No rid or sid specified, choosing algorithmic mapping
Successfully added group Accounts Dept to the mapping db
No rid or sid specified, choosing algorithmic mapping
Successfully added group Domain Guests to the mapping db

&rootprompt; cd /etc/samba
&rootprompt; net groupmap list | sort
Account Operators (S-1-5-32-548) -> -1
Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep
Administrators (S-1-5-32-544) -> -1
Backup Operators (S-1-5-32-551) -> -1
Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root
Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody
Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users
Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs
Guests (S-1-5-32-546) -> -1
Power Users (S-1-5-32-547) -> -1
Print Operators (S-1-5-32-550) -> -1
Replicators (S-1-5-32-552) -> -1
System Operators (S-1-5-32-549) -> -1
Users (S-1-5-32-545) -> -1
</screen>
		</para></step>

		<step><para>
		<indexterm><primary>/etc/passwd</primary></indexterm>
		<indexterm><primary>password</primary><secondary>backend</secondary></indexterm>
		<indexterm><primary>smbpasswd</primary></indexterm>
		For each user who needs to be given a Windows Domain account, make an entry in the
		<filename>/etc/passwd</filename> file as well as in the Samba password backend.
		Use the system tool of your choice to create the UNIX system accounts, and use the Samba
		<command>smbpasswd</command> program to create the Domain user accounts.
		</para>

		<para>
		<indexterm><primary>useradd</primary></indexterm>
		<indexterm><primary>adduser</primary></indexterm>
		<indexterm><primary>user</primary><secondary>management</secondary></indexterm>
		There are a number of tools for user management under UNIX, such as
		<command>useradd</command> and <command>adduser</command>, as well as a plethora of custom
		tools. With the tool of your choice, create a home directory for each user.
		</para></step>

		<step><para>
		Using the preferred tool for your UNIX system, add each user to the UNIX groups created
		previously, as necessary. File system access control will be based on UNIX group membership.
		</para></step>

		<step><para>
		Create the directory mount point for the disk subsystem that is mounted to provide
		data storage for company files. In this case the mount point is indicated in the &smb.conf;
		file is <filename>/data</filename>. Format the file system as required, mount the formatted
		file system partition using <command>mount</command>,
		and make the appropriate changes in <filename>/etc/fstab</filename>.
		</para></step>

		<step><para>
		Create the top-level file storage directories are follows:
<screen>
&rootprompt; mkdir -p /data/{accounts,finsvcs}
&rootprompt; chown -R root:root /data
&rootprompt; chown -R alanm:accounts /data/accounts
&rootprompt; chown -R alanm:finsvcs /data/finsvcs
&rootprompt; chmod -R ug+rwx,o+rx-w /data
</screen>
		Each department is responsible for creating its own directory structure within its
		share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>.
		The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>.
		</para></step>

		<step><para>
		Configure the printers with the IP addresses as shown in <link linkend="acct2net"/>.
		Follow the instructions in the manufacturers' manuals to permit printing to port 9100.
		This allows the CUPS spooler to print using raw mode protocols.
		<indexterm><primary>CUPS</primary></indexterm>
		<indexterm><primary>raw printing</primary></indexterm>
		</para></step>

		<step><para>
		<indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm>
		<indexterm><primary>lpadmin</primary></indexterm>
		Configure the CUPS Print Queues as follows:
<screen>
&rootprompt; lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E
&rootprompt; lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E
&rootprompt; lpadmin -p qms -v socket://192.168.2.10:9100 -E
</screen>
		<indexterm><primary>print filter</primary></indexterm>
		This creates the necessary print queues with no assigned print filter.
		</para></step>

		<step><para>
		<indexterm><primary>mime type</primary></indexterm>
		<indexterm><primary>/etc/mime.convs</primary></indexterm>
		<indexterm><primary>application/octet-stream</primary></indexterm>
		Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
<screen>
application/octet-stream     application/vnd.cups-raw      0     -
</screen>
		</para></step>

		<step><para>
		<indexterm><primary>/etc/mime.types</primary></indexterm>
		Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
<screen>
application/octet-stream
</screen>
		</para></step>

		<step><para>
		<indexterm><primary>DHCP Server</primary></indexterm>
		Using your favorite system editor, create an <filename>/etc/dhcpd.conf</filename> with the
		contents as shown in <link linkend="dhcp01"/>.
<example id="dhcp01">
<title>Abmas Accounting DHCP Server Configuration File &smbmdash; <filename>/etc/dhcpd.conf</filename></title>
<indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
<screen>
default-lease-time 86400;
max-lease-time 172800;
default-lease-time 86400;

option ntp-servers 192.168.1.1;
option domain-name "abmas.biz";
option domain-name-servers 192.168.1.1, 192.168.2.1;
option netbios-name-servers 192.168.1.1, 192.168.2.1;
option netbios-node-type 8;
### NOTE ###
# netbios-node-type=8 means set clients to Hybrid Mode
#   so they will use Unicast communication with the WINS
#   server and thus reduce the level of UDP broadcast
#   traffic by up to 90%.
############

subnet 192.168.1.0 netmask 255.255.255.0 {
	range dynamic-bootp 192.168.1.128 192.168.1.254;
	option subnet-mask 255.255.255.0;
	option routers 192.168.1.1;
	allow unknown-clients;
	host hplj4 {
		hardware ethernet 08:00:46:7a:35:e4;
		fixed-address 192.168.1.10;
		}
	host hplj6 {
		hardware ethernet 00:03:47:cb:81:e0;
		fixed-address 192.168.1.11;
		}
	}
subnet 192.168.2.0 netmask 255.255.255.0 {
	range dynamic-bootp 192.168.2.128 192.168.2.254;
	option subnet-mask 255.255.255.0;
	option routers 192.168.2.1;
	allow unknown-clients;
	host qms {
		hardware ethernet 01:04:31:db:e1:c0;
		fixed-address 192.168.1.10;
		}
	}
subnet 127.0.0.0 netmask 255.0.0.0 {
	}
</screen>
</example>
		</para></step>


		<step><para>
		Use the standard system tool to start Samba and CUPS and configure them to start
		automatically at every system reboot. For example,
		</para>

		<para>
		<indexterm><primary>chkconfig</primary></indexterm>
		<indexterm><primary>starting dhcpd</primary></indexterm>
		<indexterm><primary>starting samba</primary></indexterm>
		<indexterm><primary>starting CUPS</primary></indexterm>
		<indexterm><primary>chkconfig</primary></indexterm>
<screen>
&rootprompt; chkconfig dhcp on
&rootprompt; chkconfig smb on
&rootprompt; chkconfig cups on
&rootprompt; /etc/rc.d/init.d/dhcp restart
&rootprompt; /etc/rc.d/init.d/smb restart
&rootprompt; /etc/rc.d/init.d/cups restart
</screen>
		</para></step>

		<step><para>
		<indexterm><primary>name service switch</primary></indexterm>
		<indexterm><primary>NSS</primary><see>same service switch</see></indexterm>
		<indexterm><primary>DNS</primary></indexterm>
		<indexterm><primary>DNS server</primary></indexterm>
		<indexterm><primary>WINS</primary></indexterm>
		<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
		Configure the name service switch (NSS) to handle WINS-based name resolution.
		Since this system does not use a DNS server, it is safe to remove this option from
		the NSS configuration. Edit the <filename>/etc/nsswitch.conf</filename> file so that
		the <constant>hosts:</constant> entry looks like this:
<screen>
hosts:	files wins
</screen>
		</para></step>

	</procedure>

<example id="acct2conf">
<title>Accounting Office Network &smb.conf; File &smbmdash; [globals] Section</title>
<smbconfblock>
<smbconfcomment>Global parameters</smbconfcomment>
<smbconfsection name="[global]"/>
<smbconfoption name="workgroup">BILLMORE</smbconfoption>
<smbconfoption name="passwd chat">*New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</smbconfoption>
<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
<smbconfoption name="syslog">0</smbconfoption>
<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
<smbconfoption name="printcap name">CUPS</smbconfoption>
<smbconfoption name="show add printer wizard">No</smbconfoption>
<smbconfoption name="add user script">/usr/sbin/useradd -m -G users '%u'</smbconfoption>
<smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption>
<smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
<smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption>
<smbconfoption name="add user to group script">/usr/sbin/usermod -A '%g' '%u'</smbconfoption>
<smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</smbconfoption>
<smbconfoption name="logon script">scripts\login.bat</smbconfoption>
<smbconfoption name="logon path"> </smbconfoption>
<smbconfoption name="logon drive">X:</smbconfoption>
<smbconfoption name="domain logons">Yes</smbconfoption>
<smbconfoption name="preferred master">Yes</smbconfoption>
<smbconfoption name="wins support">Yes</smbconfoption>
<smbconfoption name="printing">CUPS</smbconfoption>
</smbconfblock>
</example>

<example id="acct3conf">
<title>Accounting Office Network &smb.conf; File &smbmdash; Services and Shares Section</title>
<smbconfblock>
<smbconfsection name="[homes]"/>
<smbconfoption name="comment">Home Directories</smbconfoption>
<smbconfoption name="valid users">%S</smbconfoption>
<smbconfoption name="read only">No</smbconfoption>
<smbconfoption name="browseable">No</smbconfoption>

<smbconfsection name="[printers]"/>
<smbconfoption name="comment">SMB Print Spool</smbconfoption>
<smbconfoption name="path">/var/spool/samba</smbconfoption>
<smbconfoption name="printable">Yes</smbconfoption>
<smbconfoption name="guest ok">Yes</smbconfoption>
<smbconfoption name="use client driver">Yes</smbconfoption>
<smbconfoption name="browseable">No</smbconfoption>

<smbconfsection name="[netlogon]"/>
<smbconfoption name="comment">Network Logon Service</smbconfoption>
<smbconfoption name="path">/data/%U</smbconfoption>
<smbconfoption name="valid users">%S</smbconfoption>
<smbconfoption name="read only">No</smbconfoption>

<smbconfsection name="[accounts]"/>
<smbconfoption name="comment">Accounting Files</smbconfoption>
<smbconfoption name="path">/data/accounts</smbconfoption>
<smbconfoption name="valid users">%G</smbconfoption>
<smbconfoption name="read only">No</smbconfoption>

<smbconfsection name="[finsvcs]"/>
<smbconfoption name="comment">Financial Service Files</smbconfoption>
<smbconfoption name="path">/data/finsvcs</smbconfoption>
<smbconfoption name="valid users">%G</smbconfoption>
<smbconfoption name="read only">No</smbconfoption>
</smbconfblock>
</example>

		<sect2>
		<title>Validation</title>

		<para>
		Does everything function as it ought? That is the key question at this point.
		Here are some simple steps to validate your Samba server configuration.
		</para>

		<procedure>
		<title>Validation Steps</title>

			<step><para>
			<indexterm><primary>testparm</primary></indexterm>
			If your &smb.conf; file has bogus options or parameters, this may cause Samba
			to refuse to start. The first step should always be to validate the contents
			of this file by running:
<screen>
&rootprompt; testparm -s
Load smb config files from smb.conf
Processing section "[homes]"
Processing section "[printers]"
Processing section "[netlogon]"
Processing section "[accounts]"
Processing section "[service]"
Loaded services file OK.
# Global parameters
[global]
        workgroup = BILLMORE
        passwd chat = *New*Password* \
		%n\n *Re-enter*new*password* %n\n *Password*changed*
        username map = /etc/samba/smbusers
        syslog = 0
        name resolve order = wins bcast hosts
        printcap name = CUPS
        show add printer wizard = No
        add user script = /usr/sbin/useradd -m -G users '%u'
        delete user script = /usr/sbin/userdel -r '%u'
        add group script = /usr/sbin/groupadd '%g'
        delete group script = /usr/sbin/groupdel '%g'
        add user to group script = /usr/sbin/usermod -A '%g' '%u'
        add machine script = /usr/sbin/useradd
				-s /bin/false -d /var/lib/nobody '%u'
        logon script = scripts\logon.bat
        logon path =
        logon drive = X:
        domain logons = Yes
        preferred master = Yes
        wins support = Yes
...
### Remainder cut to save space ###
</screen>
			The inclusion of an invalid parameter (say one called dogbert) would generate an
			error as follows:
<screen>
Unknown parameter encountered: "dogbert"
Ignoring unknown parameter "dogbert"
</screen>
			Clear away all errors before proceeding, and start or restart samba as necessary.
			</para></step>

			<step><para>
			<indexterm><primary>check samba daemons</primary></indexterm>
			<indexterm><primary>nmbd</primary></indexterm>
			<indexterm><primary>smbd</primary></indexterm>
			<indexterm><primary>winbindd</primary></indexterm>
			Check that the Samba server is running:
<screen>
&rootprompt; ps ax | grep mbd
14244 ?        S      0:00 /usr/sbin/nmbd -D
14245 ?        S      0:00 /usr/sbin/nmbd -D
14290 ?        S      0:00 /usr/sbin/smbd -D

$rootprompt; ps ax | grep winbind
14293 ?        S     0:00 /usr/sbin/winbindd -B
14295 ?        S     0:00 /usr/sbin/winbindd -B
</screen>
			The <command>winbindd</command> daemon is running in split mode (normal), so there are also
			two instances of it. For more information regarding <command>winbindd</command>, see
			<emphasis>TOSHARG2</emphasis>, Chapter 23, Section 23.3. The single instance of
			<command>smbd</command> is normal.
			</para></step>

			<step><para>
			<indexterm><primary>anonymous connection</primary></indexterm>
			Check that an anonymous connection can be made to the Samba server:
<screen>
&rootprompt; smbclient -L localhost -U%

        Sharename      Type      Comment
        ---------      ----      -------
        netlogon       Disk      Network Logon Service
        accounts       Disk      Accounting Files
        finsvcs        Disk      Financial Service Files
        IPC$           IPC       IPC Service (Samba3)
        ADMIN$         IPC       IPC Service (Samba3)
        hplj4          Printer   Hewlett-Packard LaserJet 4
        hplj6          Printer   Hewlett-Packard LaserJet 6
        qms            Printer   QMS Magicolor Laser Printer XXXX

        Server               Comment
        ---------            -------
        SLEETH               Samba 3.0.20

        Workgroup            Master
        ---------            -------
        BILLMORE             SLEETH
</screen>
			This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
			of browsing the server from a Windows client to obtain a list of shares on the server.
			The <constant>-U%</constant> argument means to send a <constant>NULL</constant> username and
			a <constant>NULL</constant> password.
			</para></step>

			<step><para>
			<indexterm><primary>dhcp client validation</primary></indexterm>
			<indexterm><primary>printer validation</primary></indexterm>
			<indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
			Verify that the printers have the IP addresses assigned in the DHCP server configuration file.
			The easiest way to do this is to ping the printer name. Immediately after the ping response
			has been received, execute <command>arp -a</command> to find the MAC address of the printer
			that has responded. Now you can compare the IP address and the MAC address of the printer
			with the configuration information in the <filename>/etc/dhcpd.conf</filename> file. They
			should, of course, match. For example,
<screen>
&rootprompt; ping hplj4
PING hplj4 (192.168.1.11) 56(84) bytes of data.
64 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms

&rootprompt; arp -a
hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0
</screen>
			The MAC address <constant>08:00:46:7A:35:E4</constant> matches that specified for the
			IP address from which the printer has responded and the entry for it in the
			<filename>/etc/dhcpd.conf</filename> file.
			</para></step>

			<step><para>
			<indexterm><primary>authenticated connection</primary></indexterm>
			Make an authenticated connection to the server using the <command>smbclient</command> tool:
<screen>
&rootprompt; smbclient //sleeth/accounts -U alanm
Password: XXXXXXX
smb: \&gt; dir
  .                          D        0  Sun Nov  9 01:28:34 2003
  ..                         D        0  Sat Aug 16 17:24:26 2003
  .mc                       DH        0  Sat Nov  8 21:57:38 2003
  .qt                       DH        0  Fri Sep  5 00:48:25 2003
  SMB                        D        0  Sun Oct 19 23:04:30 2003
  Documents                  D        0  Sat Nov  1 00:31:51 2003
  xpsp1a_en_x86.exe           131170400  Sun Nov  2 01:25:44 2003

           65387 blocks of size 65536. 28590 blocks available
smb: \> q
</screen>
			</para></step>

		</procedure>

		</sect2>


	<procedure>
	<title>Windows XP Professional Client Configuration</title>

		<step><para>
		Configure clients to the network settings shown in <link linkend="acct2net"/>.
		All clients use DHCP for TCP/IP protocol stack configuration.
		<indexterm><primary>WINS</primary></indexterm>
		<indexterm><primary>DHCP</primary></indexterm>
		DHCP configures all Windows clients to use the WINS Server address <constant>192.168.1.1</constant>.
		</para></step>

		<step><para>
		Join the Windows Domain called <constant>BILLMORE</constant>. Use the Domain Administrator
		username <constant>root</constant> and the SMB password you assigned to this account.
		A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
		a Windows Domain is given in <link linkend="appendix"/>, <link linkend="domjoin"/>.
		Reboot the machine as prompted and then log on using a Domain User account.
		</para></step>

		<step><para>
		Verify on each client that the machine called <constant>SLEETH</constant>
		is visible in <guimenu>My Network Places</guimenu>, that it is
		possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>
		 and <guimenuitem>finsvcs</guimenuitem>,
		and that it is possible to open that share to reveal its contents.
		</para></step>

		<step><para>
		Instruct all users to log onto the workstation using their assigned username and password.
		</para></step>

		<step><para>
		Install a printer on each using the following steps:
		</para>

			<procedure>
				<step><para>
				Click <menuchoice>
					<guimenu>Start</guimenu>
					<guimenuitem>Settings</guimenuitem>
					<guimenuitem>Printers</guimenuitem>
					<guiicon>Add Printer</guiicon>
					<guibutton>Next</guibutton>
					</menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
					Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
				</para></step>

				<step><para>
				Click <guibutton>Next</guibutton>. In the
				<guimenuitem>Manufacturer:</guimenuitem> panel, select <constant>HP</constant>.
				In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
				<constant>HP LaserJet 4</constant>. Click <guibutton>Next</guibutton>.
				</para></step>

				<step><para>
				In the <guimenuitem>Available ports:</guimenuitem> panel, select
				<constant>FILE:</constant>. Accept the default printer name by clicking
				<guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
				test page?</quote>, click <guimenuitem>No</guimenuitem>. Click
				<guibutton>Finish</guibutton>.
				</para></step>

				<step><para>
				You may be prompted for the name of a file to print to. If so, close the
				dialog panel. Right-click <menuchoice>
					<guiicon>HP LaserJet 4</guiicon>
					<guimenuitem>Properties</guimenuitem>
					<guisubmenu>Details (Tab)</guisubmenu>
					<guimenuitem>Add Port</guimenuitem>
					</menuchoice>.
				</para></step>

				<step><para>
				In the <guimenuitem>Network</guimenuitem> panel, enter the name of
				the print queue on the Samba server as follows: <constant>\\SERVER\hplj4</constant>.
				Click <menuchoice>
					<guibutton>OK</guibutton>
					<guibutton>OK</guibutton>
					</menuchoice> to complete the installation.
				</para></step>

				<step><para>
				Repeat the printer installation steps above for the HP LaserJet 6 printer
				as well as for the QMS Magicolor XXXX laser printer.
				</para></step>
			</procedure>
		</step>
	</procedure>

	<sect2>
	<title>Notebook Computers: A Special Case</title>

	<para>
	As a network administrator, you already know how to create local machine accounts for Windows 200x/XP
	Professional systems. This is the preferred solution to provide continuity of work for notebook users
	so that absence from the office network environment does not become a barrier to productivity.
	</para>

	<para>
	By creating a local machine account that has the same username and password as you create for that
	user in the Windows Domain environment, the user can log onto the machine locally and still
	transparently access network resources as if logged onto the domain itself. There are some trade-offs
	that mean that as the network is more tightly secured, it becomes necessary to modify Windows client
	configuration somewhat.
	</para>

	</sect2>

	<sect2>
		<title>Key Points Learned</title>

		<para>
		In this network design and implementation exercise, you created a Windows NT4-style Domain
		Controller using Samba-3.0.20. Following these guidelines, you experienced
		and implemented several important aspects of Windows networking. In the next chapter,
		you build on the experience. These are the highlights from this chapter:
		</para>

		<itemizedlist>
			<listitem><para>
			<indexterm><primary>DHCP</primary></indexterm>
			You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary
			network configuration settings from this server.
			</para></listitem>

			<listitem><para>
			<indexterm><primary>Domain Controller</primary></indexterm>
			You created a Windows Domain Controller. You were able to use the network logon service
			and successfully joined Windows 200x/XP Professional clients to the Domain.
			</para></listitem>

			<listitem><para>
			<indexterm><primary>CUPS</primary></indexterm>
			You created raw print queues in the CUPS printing system. You maintained a simple
			printing system so that all users can share centrally managed printers. You installed
			native printer drivers on the Windows clients.
			</para></listitem>

			<listitem><para>
			You experienced the benefits of centrally managed user accounts on the server.
			</para></listitem>

			<listitem><para>
			You offered Mobile notebook users a solution that allows them to continue to work
			while away from the office and not connected to the corporate network.
			</para></listitem>
		</itemizedlist>

	</sect2>

</sect1>

<sect1>
	<title>Questions and Answers</title>

	<para>
	Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that
	may help.
	</para>

	<qandaset>
	<qandaentry>
	<question>

		<para>
		What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
		</para>

	</question>
	<answer>

		<para>
		First and foremost, portability. It means that notebook users can move between
		the Abmas office and client offices (so long as they, too, use DHCP) without having to manually
		reconfigure their machines. It also means that when they work from their home environments
		either using DHCP assigned addressing or when using dial-up networking, settings such as
		default routes and DNS server addresses that apply only to the Abmas office environment do
		not interfere with remote operations. This is an extremely important feature of DHCP.
		</para>

	</answer>
	</qandaentry>

	<qandaentry>
	<question>

		<para>
		Are there any DHCP server configuration parameters in the <filename>/etc/dhcpd.conf</filename>
		that should be noted in particular?
		</para>

	</question>
	<answer>

		<para>
		Yes. The configuration you created automatically provides each client with the IP address
		of your WINS server. It also configures the client to preferentially register NetBIOS names
		with the WINS server, and then instructs the client to first query the WINS server when a
		NetBIOS machine name needs to be resolved to an IP Address. This configuration
		results in far lower UDP broadcast traffic than would be the case if WINS was not used.
		</para>

	</answer>
	</qandaentry>

	<qandaentry>
	<question>

		<para>
		Is it possible to create a Windows Domain account that is specifically called <constant>Administrator</constant>?
		</para>

	</question>
	<answer>

		<para>
		You can surely create a Windows Domain account called <constant>Administrator</constant>. It is also
		possible to map that account so that it has the effective UNIX UID of 0. This way it isn't
		necessary to use the <parameter>username map</parameter> facility to map this account to the UNIX
		account called <constant>root</constant>.
		</para>

	</answer>
	</qandaentry>

	<qandaentry>
	<question>

		<para>
		Why is it necessary to give the Windows Domain <constant>Administrator</constant> a UNIX UID of 0?
		</para>

	</question>
	<answer>

		<para>
		The Windows Domain <constant>Administrator</constant> account is the most privileged account that
		exists on the Windows platform. This user can change any setting, add, delete, or modify user
		accounts, and completely reconfigure the system. The equivalent to this account in the UNIX
		environment is the <constant>root</constant> account. If you want to permit the Windows Domain
		Administrator to manage accounts as well as permissions, privileges, and security
		settings within the Domain and on the Samba server, equivalent rights must be assigned. This is
		achieved with the <constant>root</constant> UID equal to 0.
		</para>

	</answer>
	</qandaentry>

	<qandaentry>
	<question>

		<para>
		One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
		<constant>root</constant> access. How can we do this?
		</para>

	</question>
	<answer>

		<para>
		Users who are members of the <constant>Domain Admins</constant> group can add machines to the
		Domain. This group is mapped to the UNIX group account called <constant>root</constant>
		(or the equivalent <constant>wheel</constant> on some UNIX systems) that has a GID of 0.
		This must be the primary GID of the account of the user who is a member of the Windows <constant>
		Domain Admins</constant> account.
		</para>

	</answer>
	</qandaentry>

	<qandaentry>
	<question>

		<para>
		Why must I map Windows Domain Groups to UNIX groups?
		</para>

	</question>
	<answer>

		<para>
		Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
		has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are
		<guimenu>Domain Guests</guimenu>, <guimenu>Domain Users</guimenu>, and <guimenu>Domain Admins</guimenu>.
		</para>

	</answer>
	</qandaentry>

	<qandaentry>
	<question>

		<para>
		I deleted my <constant>root</constant> account and now I cannot add it back! What can I do?
		</para>

	</question>
	<answer>

		<para>
		This is a nasty problem. Fortunately, there is a solution.
		</para>

		<procedure>
			<step><para>
			Back up your existing configuration files in case you need to restore them.
			</para></step>

			<step><para>
			Rename the <filename>group_mapping.tdb</filename> file.
			</para></step>

			<step><para>
			Use the <command>smbpasswd</command> to add the root account.
			</para></step>

			<step><para>
			Restore the <filename>group_mapping.tdb</filename> file.
			</para></step>
		</procedure>

	</answer>
	</qandaentry>

	<qandaentry>
	<question>

		<para>
		When I run <command>net groupmap list</command>, it reports a group called <guimenu>Administrators</guimenu>
		as well as <guimenu>Domain Admins</guimenu>. What is the difference between them?
		</para>

	</question>
	<answer>

		<para>
		The group called <guimenu>Administrators</guimenu> is representative of the same account that would be
		present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain
		Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This
		may change at some later date. These accounts are provided only so that security objects are correctly shown.
		</para>

	</answer>
	</qandaentry>

	<qandaentry>
	<question>

		<para>
		What is the effect of changing the name of a Samba server or of changing the Domain name?
		</para>

	</question>
	<answer>

		<para>
		If you elect to change the name of the Samba server, on restarting <command>smbd</command>,
		Windows security identifiers are changed. In the case of a standalone server or a Domain Member server,
		the machine SID is changed. This may break Domain membership. In the case of a change of the Domain name
		(Workgroup name), the Domain SID is changed. This affects all Domain memberships.
		</para>

		<para>
		If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective
		SID before the change is made. You can back up the SID using the <command>net getlocalsid</command> (Samba-3)
		or the <command>smbpasswd</command> (Samba-2.2.x). To change the SID, you use the same tool. Be sure
		to check the man page for this command for detailed instructions regarding the steps involved.
		</para>

	</answer>
	</qandaentry>

	<qandaentry>
	<question>

		<para>
		How can I manage user accounts from my Windows XP Professional workstation?
		</para>

	</question>
	<answer>

		<para>
		Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot
		be managed using tools present on a Windows XP Professional installation. You may download from the
		Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use
		it. This package extracts the tools: <command>User Manager for Domains</command>, <command>Server Manager</command>, and <command>Event
		Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba-3
		Domain user and group accounts. Of course, you do need to be logged on as the <constant>Administrator</constant>
		for the Samba-3 Domain. It may help to log on as the <constant>root</constant> account.
		</para>

	</answer>
	</qandaentry>

	</qandaset>

</sect1>

</chapter>