1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
|
<HTML
><HEAD
><TITLE
>The Samba 2.2 PDC HowTo </TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
><BODY
CLASS="BOOK"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="BOOK"
><A
NAME="SAMBA-PDC-HOWTO"
></A
><DIV
CLASS="TITLEPAGE"
><H1
CLASS="TITLE"
><A
NAME="SAMBA-PDC-HOWTO"
>The Samba 2.2 PDC HowTo</A
></H1
><H3
CLASS="AUTHOR"
><A
NAME="AEN4"
>David Bannon</A
></H3
><DIV
CLASS="AFFILIATION"
><SPAN
CLASS="ORGNAME"
>La Trobe University<BR></SPAN
></DIV
><HR></DIV
><HR><H1
><A
NAME="AEN10"
></A
></H1
><P
>Comments, corrections and additions to <TT
CLASS="EMAIL"
><<A
HREF="mailto:dbannon@samba.org"
>dbannon@samba.org</A
>></TT
></P
><P
> This document explains how to setup Samba as a Primary Domain Controller and
applies to version 2.2.0.
Before
using these functions make sure you understand what the controller can and cannot do.
Please read the sections below in the Introduction.
As 2.2.0 is incrementally updated
this document will change or become out of date very quickly, make sure you are
reading the most current version.
</P
><P
>Please note this document does not apply to Samba2.2alpha0, Samba2.2alpha1,
Samba 2.0.7, TNG nor HEAD branch.</P
><P
>It does apply to the current (post November 27th) cvs.</P
><P
> Also available is an updated version of Jerry Carter's NTDom <A
HREF="samba-pdc-faq.html"
TARGET="_top"
> FAQ</A
> that will answer lots of
the special 'tuning' questions that are not covered here. Over the next couple of weeks
some of the items here will be moved to the FAQ.
</P
><DIV
CLASS="TOC"
><DL
><DT
><B
>Table of Contents</B
></DT
><DT
>1. <A
HREF="#AEN20"
>Introduction</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN28"
>What can we do ?</A
></DT
><DT
><A
HREF="#AEN44"
>What can't we do ?</A
></DT
></DL
></DD
><DT
>2. <A
HREF="#AEN55"
>Installing</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN59"
>Start Up Script</A
></DT
><DT
><A
HREF="#AEN66"
>Config File</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN68"
>A sample conf file</A
></DT
><DT
><A
HREF="#AEN79"
>PDC Config Parameters</A
></DT
></DL
></DD
><DT
><A
HREF="#AEN115"
>Special directories</A
></DT
></DL
></DD
><DT
>3. <A
HREF="#AEN126"
>User and Machine Accounts</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN128"
>Logon Accounts</A
></DT
><DT
><A
HREF="#MACHINEACCOUNT"
>Machine Accounts</A
></DT
><DT
><A
HREF="#AEN163"
>Joining the Domain</A
></DT
><DT
><A
HREF="#AEN211"
>User Accounts</A
></DT
><DT
><A
HREF="#AEN223"
>Domain Admin Accounts</A
></DT
></DL
></DD
><DT
>4. <A
HREF="#AEN231"
>Profiles, Policies and Logon Scripts</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN233"
>Profiles</A
></DT
><DT
><A
HREF="#AEN240"
>Policies</A
></DT
><DT
><A
HREF="#AEN251"
>Logon Scripts</A
></DT
></DL
></DD
><DT
>5. <A
HREF="#AEN272"
>Passwords and Authentication</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN278"
></A
></DT
><DD
><DL
><DT
><A
HREF="#AEN280"
>Syncing Passwords</A
></DT
><DT
><A
HREF="#AEN286"
>Using PAM</A
></DT
><DT
><A
HREF="#AEN292"
>Authenticating other Samba Servers</A
></DT
></DL
></DD
></DL
></DD
><DT
>6. <A
HREF="#AEN298"
>Background</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN300"
></A
></DT
><DD
><DL
><DT
><A
HREF="#AEN302"
>History</A
></DT
><DT
><A
HREF="#AEN310"
>The Future</A
></DT
><DT
><A
HREF="#AEN322"
>Getting further help</A
></DT
></DL
></DD
></DL
></DD
></DL
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN20"
>Chapter 1. Introduction</A
></H1
><P
>This document will show you one way of making Version 2.2.0
of Samba perform some of the tasks of a
NT Primary Domain Controller. The facilities described are built into Samba as a result of
development work done over a number of years by a large number of people. These facilities
are only just beginning to be officially supported and although they do appear to work reliably,
if you use them then you take the risks upon your self. This document does not cover the
developmental versions of Samba, particularly
<A
HREF="http://www.samba-tng.org/"
TARGET="_top"
><I
CLASS="CITETITLE"
>Samba-TNG</I
></A
>
</P
><P
>Note that <A
HREF="http://bioserve.latrobe.edu.au/samba"
TARGET="_top"
>Samba 2.0.7</A
>
supports significently less of the NT Domain facilities compared with 2.2.0
</P
><P
> This document does not replace the text files DOMAIN_CONTROL.txt, DOMAIN.txt (by
John H Terpstra) or NTDOMAIN.txt (by Luke Kenneth Casson Leighton). Those documents provide
more detail and an insight to the development
cycle and should be considered 'further reading'. </P
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN28"
>What can we do ?</A
></H1
><P
></P
><UL
><LI
><P
>Permit 'domain logons' for Win95/98, NT4 and W2K workstations from one central
password database. WRT W2K, please see the section about adding machine
accounts and the Intro in the <A
HREF="samba-pdc-faq.html"
TARGET="_top"
>FAQ</A
>.</P
></LI
><LI
><P
>Grant Administrator privileges to particular domain users on an
NT or W2K workstation.</P
></LI
><LI
><P
>Apply policies from a domain policy file to NT and W2K (?)
workstation.</P
></LI
><LI
><P
>Run the appropriate logon script when a user logs on to the domain
.</P
></LI
><LI
><P
>Maintain a user's local profile on the server.</P
></LI
><LI
><P
>Validate a user using another system via smb (such as smb_pam) and
soon winbind (?).</P
></LI
></UL
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN44"
>What can't we do ?</A
></H1
><P
></P
><UL
><LI
><P
> Become or work with a Backup Domain Controller (a BDC).</P
></LI
><LI
><P
> Participate in any sort of trust relationship (with either Samba or NT
Servers).</P
></LI
><LI
><P
> Offer a list of domain users to User Manager for Domains
on the Security Tab etc).</P
></LI
><LI
><P
>Be a W2K type of Domain Controller. Samba PDC will behave like
an NT PDC, W2K workstations connect in legacy mode.</P
></LI
></UL
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN55"
>Chapter 2. Installing</A
></H1
><P
>Installing consists of the usual download, configure, make and make
install process. These steps are well documented elsewhere.
The <A
HREF="samba-pdc-faq.html"
TARGET="_top"
>FAQ</A
> discusses getting pre-release versions via CVS.
Then you need to configure the server.</P
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN59"
>Start Up Script</A
></H1
><P
>Skip this section if you have a working Samba already.
Everyone has their own favourite startup script. Here is mine, offered with no warrantee
at all !</P
><PRE
CLASS="PROGRAMLISTING"
>
#!/bin/sh
# Script to control Samba server, David Bannon, 14-6-96
#
#
PATH=/bin:/usr/sbin:/usr/bin
export PATH
case "$1" in
'start')
if [ -f /usr/local/samba/bin/smbd ]
then
/usr/local/samba/bin/smbd -D
/usr/local/samba/bin/nmbd -D
echo "Starting Samba Server"
fi
;;
'conf')
if [ -f /usr/local/samba/lib/smb.conf ]
then
vi /usr/local/samba/lib/smb.conf
fi
;;
'pw')
if [ -f /usr/local/samba/private/smbpasswd ]
then
vi /usr/local/samba/private/smbpasswd
fi
;;
'who')
/usr/local/samba/bin/smbstatus -b
;;
'restart')
psline=`/bin/ps x | grep smbd | grep -v grep`
if [ "$psline" != "" ]
then
while [ "$psline" != "" ]
do
psline=`/bin/ps x | fgrep smbd | grep -v grep`
if [ "$psline" ]
then
set -- $psline
pid=$1
/bin/kill -HUP $pid
echo "Stopped $pid line = $psline"
sleep 2
fi
done
fi
echo "Stopped Samba servers"
;;
'stop')
psline=`/bin/ps x | grep smbd | grep -v grep`
if [ "$psline" != "" ]
then
while [ "$psline" != "" ]
do
psline=`/bin/ps x | fgrep smbd | grep -v grep`
if [ "$psline" ]
then
set -- $psline
pid=$1
/bin/kill -9 $pid
echo "Stopped $pid line = $psline"
sleep 2
fi
done
fi
echo "Stopped Samba servers"
psline=`/bin/ps x | grep nmbd | grep -v grep`
if [ "$psline" ]
then
set -- $psline
pid=$1
/bin/kill -9 $pid
echo "Stopped Name Server "
fi
echo "Stopped Name Servers"
;;
*)
echo "usage: samba {start | restart |stop | conf | pw | who}"
;;
esac
</PRE
><P
> Use this script, or some other one, you will need to ensure its used while the machine
is booting. (This typically involves <TT
CLASS="FILENAME"
>/etc/rc.d</TT
>, we'll be
assuming that there is a script called
samba in <TT
CLASS="FILENAME"
>/etc/rc.d/init.d</TT
> further down in this document.)</P
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN66"
>Config File</A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN68"
>A sample conf file</A
></H2
><P
>Here is a fairly minimal config file to do PDC. It will also make the server
become the browse master for the
specified domain (not necessary but usually desirable). You will need to change only
two parameters to make this
file work, <TT
CLASS="FILENAME"
>wins server</TT
> and <TT
CLASS="FILENAME"
>workgroup</TT
>, plus
you will need to put your own name (not mine!) in the <TT
CLASS="FILENAME"
>domain admin users</TT
> fields.
Some of the parameters are discussed further down this document.</P
><P
>Assuming you have used the default install directories, this file should appear as
<TT
CLASS="FILENAME"
>/usr/local/samba/lib/smb.conf</TT
>. It should not be
writable by anyone except root.</P
><DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Note: </B
>The 'add user script' parameter is a work-around, watch for changes !</P
></BLOCKQUOTE
></DIV
><PRE
CLASS="PROGRAMLISTING"
>
[global]
security = user
status = yes
workgroup = { Your domain name here }
wins server = { ip of a wins server if you have one }
encrypt passwords = yes
domain logons =yes
logon script = scripts\%U.bat
domain admin group = @adm
add user script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %m$
guest account = ftp
share modes=no
os level=65
[homes]
guest ok = no
read only = no
create mask = 0700
directory mask = 0700
oplocks = false
locking = no
[netlogon]
path = /usr/local/samba/netlogon
writeable = no
guest ok = no
</PRE
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN79"
>PDC Config Parameters</A
></H2
><P
></P
><DIV
CLASS="VARIABLELIST"
><P
><B
>There are a huge range of parameters that may appear in a smb.conf file. Some
that may be of interest to a PDC are :</B
></P
><DL
><DT
>add user script</DT
><DD
><P
>This parameter specifies a script (or program) that will be run
to add a user to the system. Here it is being used to add a machine, not a user.
This is probably not very nice and may change. But it does work !</P
><P
>For this example, I have a group called 'machines', entries can be added to
<TT
CLASS="FILENAME"
>/etc/passwd</TT
> using a programme called <TT
CLASS="FILENAME"
>/usr/adduser</TT
> and
the other parameters are chosen as suitable for a machine account. Works for
RH Linux, your system may require changes.</P
></DD
><DT
>domain admin group = @adm</DT
><DD
><P
>This parameter specifies a unix group whose members will be granted
admin privileges on a NT workstation when
logged onto that workstation. See the section called <A
HREF="#AEN223"
> Domain Admin</A
> Accounts.</P
></DD
><DT
>domain admin users = user1 users2</DT
><DD
><P
>It appears that this parameter does not funtion correctly at present.
Use the 'domain admin group' instread. This parameter specifies a unix user who will
be granted admin privileges
on a NT workstation when
logged onto that workstation. See the section called <A
HREF="#AEN223"
> Domain Admin</A
> Accounts.</P
></DD
><DT
>encrypt passwords = yes</DT
><DD
><P
>This parameter must be 'yes' to allow any of the recent service pack NTs to logon. There are some reg hacks that
turn off encrypted passwords on the NTws itself but if you are going to use the smbpasswd system (and you
should) you must use encrypted passwords.</P
></DD
><DT
>logon script = scripts\%U.bat</DT
><DD
><P
>This will make samba look for a logon script named after the user
(eg joeblow.bat).
See the section further on called <A
HREF="#AEN251"
>Logon Scripts</A
></P
><DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Note: </B
>Note that the slash is like this '\', not like this '/'.
NT is happy with both, win95 is not !</P
></BLOCKQUOTE
></DIV
></DD
><DT
>logon path</DT
><DD
><P
>Lets you specify where you would like users profiles kept. The default, that is in the users
home directory, does encourage a bit of fiddling.</P
></DD
></DL
></DIV
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN115"
>Special directories</A
></H1
><P
>You need to create a couple of special files and directories. Its nice
to have some of the binaries handy too, so I create links to them. Assuming
you have used the default samba location and have not
changed the locations mentioned in the sample config file, do the following :</P
><PRE
CLASS="PROGRAMLISTING"
>
mkdir /usr/local/samba/netlogon
mkdir /usr/local/samba/netlogon/scripts
mkdir /usr/local/samba/private
touch /usr/local/samba/private/smbpasswd
chmod go-rwx /usr/local/samba/private/smbpasswd
cd /usr/local/sbin
ln -s /usr/local/samba/bin/smbpasswd
ln -s /usr/local/samba/bin/smbclient
ln -s /etc/rc.d/init.d/samba</PRE
><P
>Make sure permissions are appropriate !</P
><P
>OK, if you have used the scripts above and have a path to where the links are do this to start up
the Samba Server :</P
><P
><B
CLASS="COMMAND"
>samba start</B
></P
><P
>Instead, you might like to reboot the machine to make sure that you
got the init stuff right. Any way, a quick look in the logs
<TT
CLASS="FILENAME"
>/usr/local/samba/var/log.smbd</TT
> and <TT
CLASS="FILENAME"
> /usr/local/samba/var/log/nmbd</TT
>
will give you an idea of what's happening. Assuming all is well, lets create
some accounts...</P
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN126"
>Chapter 3. User and Machine Accounts</A
></H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN128"
>Logon Accounts</A
></H1
><P
><I
CLASS="EMPHASIS"
>This section is very nearly out of date already !</I
> It
appears that while you are reading it, Jean Francois Micou is making it
redundant ! Jean Francois is adding facilities to add users
(via User Manager) and machines (when joining the domain) and it looks like these facilities will
make it into the official release of 2.2.</P
><P
>Every user and NTws (and other samba servers) that will be on the domain
must have its own passwd entry in both <TT
CLASS="FILENAME"
>/etc/passwd</TT
> and
<TT
CLASS="FILENAME"
>/usr/local/samba/private/smbpasswd</TT
> .
The <TT
CLASS="FILENAME"
>/etc/passwd</TT
> entry is really
only to reserve a user ID. The NT encrypted password is stored in
<TT
CLASS="FILENAME"
>/usr/local/samba/private/smbpasswd</TT
>.
(Note that win95/98 machines don't need an account as they don't do
any security aware things.)</P
><P
>Samba 2.2 will now create these entries for us. Carefull set up is required
and there may well be some changes to this system before its released.
</P
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="MACHINEACCOUNT"
>Machine Accounts</A
></H1
><DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Note: </B
>There is an entry in the ntdom <A
HREF="samba-pdc-faq.html"
TARGET="_top"
>FAQ</A
> explaining how to create
machine entries manually.</P
></BLOCKQUOTE
></DIV
><P
></P
><DIV
CLASS="VARIABLELIST"
><P
><B
><I
CLASS="EMPHASIS"
>At present</I
> to have the machine accounts created when a machine joins
the domain a number of conditions must be met :</B
></P
><DL
><DT
>Only root can do it !</DT
><DD
><P
>There must be an entry in <TT
CLASS="FILENAME"
>/usr/local/samba/private/smbpasswd</TT
>
for root and root must be mentioned in <TT
CLASS="FILENAME"
>domain admins</TT
>. This may
be fixed some time in the future so any 'domain admin' can do it. If you don't
like having root as a windows logon account, make the machine
entries manually (both of them).</P
></DD
><DT
>Use the <TT
CLASS="FILENAME"
>add user script</TT
></DT
><DD
><P
>Again, this looks a bit like a 'work around'. Use a suitable
command line to add a machine account <A
HREF="#AEN68"
>see above</A
>,
and pass it %m$, that is %m to get machine name plus the '$'. Now, this
means you cannot use the <TT
CLASS="FILENAME"
>add user script</TT
> to really add users .... </P
></DD
><DT
>Only for W2K</DT
><DD
><P
>This automatic creation of machine accounts does not work for
NT4ws at present. Watch this space.</P
></DD
></DL
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN163"
>Joining the Domain</A
></H1
><P
>You must have either added the machine account entries manually (NT4 ws)
or set up the automatic system (W2K), <A
HREF="#MACHINEACCOUNT"
>see Machine Accounts</A
>
before proceeding.</P
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
><B
CLASS="COMMAND"
>Windows NT</B
></DT
><DD
><P
></P
><UL
><LI
><P
> (<I
CLASS="EMPHASIS"
>this step may not be necessary some time in the near future</I
>).
On the samba server that is the PDC, add a machine account manually
as per the instructions in the <A
HREF="samba-pdc-faq.html"
TARGET="_top"
>FAQ</A
>
Then give the command <B
CLASS="COMMAND"
>smbpasswd -a -m {machine}</B
> substituting in the
client machine name.</P
></LI
><LI
><P
> Logon to the NTws in question as a local admin, go to the
<B
CLASS="COMMAND"
>Control Panel, Network IdentificationTag</B
>.</P
></LI
><LI
><P
> Press the <B
CLASS="COMMAND"
>Change</B
> button.</P
></LI
><LI
><P
> Enter the Domain name (from the 'Workgroup' parameter, smb.conf)
in the Domain Field.</P
></LI
><LI
><P
> Press OK and after a few seconds you will get a 'Welcome to Whatever Domain'.
Allow to reboot.</P
></LI
></UL
></DD
><DT
><B
CLASS="COMMAND"
>Windows 2000</B
></DT
><DD
><P
></P
><UL
><LI
><P
>Logon to the W2k machine as Administrator, go to the Control
Panel and double click on <B
CLASS="COMMAND"
>Network and Dialup Connections</B
>.
</P
></LI
><LI
><P
>Pull down the <B
CLASS="COMMAND"
>Advanced</B
> menu and choose
<B
CLASS="COMMAND"
>Network Identification</B
>. Press <B
CLASS="COMMAND"
>Properties
</B
>. </P
></LI
><LI
><P
>Choose <B
CLASS="COMMAND"
>Domain</B
> and enter the domain name. Press 'OK'.</P
></LI
><LI
><P
>Now enter a user name and password for a Domain Admin
<I
CLASS="EMPHASIS"
>(Who must be root until a pre-release bug is fixed)</I
> and press
'OK'.</P
></LI
><LI
><P
>Wait for the confirmation, reboot when prompted.</P
></LI
></UL
><P
>To remove a W2K machine from the domain, follow the first two steps then
choose <B
CLASS="COMMAND"
>Workgroup</B
>, enter a work group name (or just WORKGROUP) and follow
the prompts.</P
></DD
></DL
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN211"
>User Accounts</A
></H1
><P
><I
CLASS="EMPHASIS"
>Again, doing it manually (cos' the auto way is not working pre-release).
</I
>
In our simple case every domain user should have an account on the PDC. The
account may have a null shell if they are not allowed to log on to the unix
prompt. Again they need an entry in both the <TT
CLASS="FILENAME"
>/etc/passwd</TT
> and
<TT
CLASS="FILENAME"
>/usr/local/samba/private/smbpasswd</TT
>. Again a password is
not necessary in <TT
CLASS="FILENAME"
>/etc/passwd</TT
> but the location
of the home directory is honoured.
To make an entry for a user called Joe Blow you would typically do the following :</P
><P
><B
CLASS="COMMAND"
>adduser -g users -c 'Joe Blow' -s /bin/false -n joeblow</B
></P
><P
><B
CLASS="COMMAND"
>smbpasswd -a joeblow</B
></P
><P
>And you will prompted to enter a password for Joe. Ideally he will be
hovering over your shoulder and will, when asked, type in a password of
his choice. There are a number of scripts and systems to ease the migration of users
from somewhere to samba. Better start looking !</P
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN223"
>Domain Admin Accounts</A
></H1
><P
>Certain operations demand that the logged on user has Administrator
privileges, typically installing software and
doing maintenance tasks. It is very simple to appoint some users as Domain Admins,
most likely yourself. Make
sure you trust the appointee !</P
><P
>Samba 2.2 recognizes particular users as being
domain admins and tells the NTws when it thinks that it has got one logged on.
In the smb.conf file we declare
that the <TT
CLASS="FILENAME"
>Domain Admin group = @adm</TT
>.
Any user who is a menber of the unix group 'adm' is treated as a Domain Admin by a NTws when
logged onto the Domain. They will have full Administrator rights
including the rights to change permissions on files and run the system
utilities such as Disk Administrator. Add users to the group by editing <TT
CLASS="FILENAME"
> /etc/group/</TT
>. You do not need to use the 'adm' group, choose any one you like.</P
><P
>Further, and this is very new, they will be allowed to create a
new machine account when first connecting a new NT or W2K machine to
the domain. <I
CLASS="EMPHASIS"
>However, at present, ie pre-release, only a Domain Admin who
also happens to be root can do so. </I
></P
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN231"
>Chapter 4. Profiles, Policies and Logon Scripts</A
></H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN233"
>Profiles</A
></H1
><P
>NT Profiles should work if you have followed the setup so far.
A user's profile contains a whole lot of their personal settings,
the contents of their desktop, personal 'My Documents' and so on.
When they log off, all of the profile is copied to their directory
on the server and is downloaded again when they logon on again, possibly
on another client machine.</P
><P
>Sounds great but can be a bit of a bug bear sometimes. Users let
their profiles get too big and then complain about how long it takes
to log on each time. This sample setup only supports NT profiles,
rumor has it that it is also possible to do the same on Win95, my
users don't know and I'm not telling them.</P
><DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Note: </B
>There is more info about Profiles (including for W95/98)
in the <A
HREF="samba-pdc-faq.html"
TARGET="_top"
>FAQ</A
>.</P
></BLOCKQUOTE
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN240"
>Policies</A
></H1
><P
>Policies are an easy way to make or enforce specific characteristics across your network. You create a ntconfig.pol
file and every time someone logs on with their NTws, the settings you put in ntconfig.pol are applied to the NTws.
Typical setting are things like making the date appear the way you want it (none of these 2 figure years here) or
maybe suppressing one of the splash screens. Perhaps you want to set the NTws so it does not keep users profiles
on the local machine. Cool. The only problem is making the ntconfig.pol file itself. You cannot use the policy editor
that comes with NTws.</P
><DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Note: </B
>See the <A
HREF="samba-pdc-faq.html"
TARGET="_top"
>FAQ</A
> for pointers on how to get a suitable Policy Editor.</P
></BLOCKQUOTE
></DIV
><P
>The Policy Editor (and associated files) will create a
<TT
CLASS="FILENAME"
>ntconfig.pol</TT
> file using the
parameters Microsoft thought of and parameters you specify by making your own
template file.</P
><P
>In our example configuration here, Samba will expect to find
the <TT
CLASS="FILENAME"
>ntconfig.pol</TT
> file in
<TT
CLASS="FILENAME"
>/usr/local/samba/netlogon</TT
>. Needless to say (I hope !),
it is vitally important that ordinary users don't have
write permission to the Policy files.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN251"
>Logon Scripts</A
></H1
><P
>In the sample config file above there is a line
<TT
CLASS="FILENAME"
>logon script = scripts\%U.bat</TT
></P
><DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Note: </B
>Note that the slash is like this '\' not like this '/'.
NT is happy with both, win95 is not !</P
></BLOCKQUOTE
></DIV
><P
>This allows you to run a dos batch file every time someone logs on. The batch
file is located on the server, in the sample install mentioned here,
its in <TT
CLASS="FILENAME"
>/usr/local/samba/netlogon/scripts</TT
> and
is named after the user with <TT
CLASS="FILENAME"
>.bat</TT
> appended, eg Joe
Blow's script is called <TT
CLASS="FILENAME"
>/usr/local/samba/netlogon/scripts/joeblow.bat</TT
>.</P
><DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Note: </B
>There is a suggestion that user names longer than 8 characters may cause
problems with some systems being unable to run logon scripts. This is confirmed in earlier
versions when connecting using W95, comments about other combinations ??</P
></BLOCKQUOTE
></DIV
><P
>You could use a line like this <TT
CLASS="FILENAME"
>logon script = default.bat</TT
> and samba
will supply <TT
CLASS="FILENAME"
>/usr/local/samba/netlogon/default.bat</TT
> for any client and every
user. Maybe you could use %m and get a client machine dependant logon script.
You get the idea...</P
><P
>Note that the file is a dos batch file not a Unix script. It runs dos commands on the client
computer with the logon user's permissions. It must be a dos file with each line ending with
the dos cr/lf not a nice clean newline. Generally,
its best to create the initial file on a DOS system and copy it across.</P
><P
>There is lots of very clever uses of the Samba replaceable variables such
( %U = user, %G = primary group, %H = client machine, see the 'man 5 smb.conf') to
give you control over which script runs when a particular person logs
on. (Gee, it would be nice to have a default.bat run when nothing else is available.)</P
><P
>Again, it is vitally important that ordinary users don't have write
permission to other peoples, or even probably their own, logon script files.</P
><P
>A typical logon script is reproduced below. Note that it runs separate
commands for win95 and NT, that's because NT has slightly different behaviour
when using the <TT
CLASS="FILENAME"
>net use ..</TT
> command. Its useful for lots of
other situations too. I don't know what syntax to use for win98, I don't use it
here.</P
><PRE
CLASS="PROGRAMLISTING"
>
rem Default logon script, create links to this file.
net time \\bioserve /set /yes
@echo off
if %OS%.==Windows_NT. goto WinNT
:Win95
net use k: \\trillion\bio_prog
net use p: \\bcfile\homes
goto end
:WinNT
net use k: \\trillion\bio_prog /persistent:no
net use p: \\bcfile\homes /persistent:no
:end
</PRE
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN272"
>Chapter 5. Passwords and Authentication</A
></H1
><P
>So far our configuration assumes that ordinary users don't have unix logon access. A change
to the <A
HREF="#AEN211"
><TT
CLASS="FILENAME"
>adduser</TT
></A
> line above would allow unix logon
but it would be with passwords that may
be different from the NT logon. Clearly that won't suit everyone. Trying to explain to users
that they need to change their passwords in two seperate places is not fun.
Further, even if they cannot do a unix logon there are other processes that
might require authentication. We have a nice securely encrypted password in
<TT
CLASS="FILENAME"
>/usr/local/samba/private/smbpasswd</TT
>, why not use it ?</P
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN278"
></A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN280"
>Syncing Passwords</A
></H2
><P
>Yes, its possible and seems the easiest way (initially anyway).
The <A
HREF="samba-pdc-faq.html"
TARGET="_top"
>FAQ</A
> details how to
do so in the sections <I
CLASS="EMPHASIS"
>What is password sync and should I use it ?</I
> and <I
CLASS="EMPHASIS"
> How do I get remote password (unix and SMB) changing working ?</I
></P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN286"
>Using PAM</A
></H2
><P
>Pam enabled systems have a much better solution available. The Samba
PDC server will offer to authenticate domain users to other processes
(either on this server or on the domain). With a suitable pam stack
such as <A
HREF="http://www.csn.ul.ie/~airlied/pam_smb/"
TARGET="_top"
> Pam_smb</A
>
you can get any pam aware application looking to the samba password and
can leave the password field in <TT
CLASS="FILENAME"
>/etc/shadow</TT
>
or <TT
CLASS="FILENAME"
>/etc/passwd</TT
> invalid.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN292"
>Authenticating other Samba Servers</A
></H2
><P
>In a domain that has a number of servers you only need one password database.
The machines that don't have their own ask the PDC to check for them.
This will work fine for a domain controlled by either a Samba or NT machine.</P
><P
>To do so the Samba machine must be told to refer to the PDC and where the PDC is.
See the section in the NTDom <A
HREF="samba-pdc-faq.html"
TARGET="_top"
>FAQ</A
> called <I
CLASS="EMPHASIS"
>How do I get my samba server to
become a member ( not PDC ) of an NT domain?</I
></P
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN298"
>Chapter 6. Background</A
></H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN300"
></A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN302"
>History</A
></H2
><P
>It might help you understand the limitations of the PDC in Samba if you
read something of its history. Well, the history as I understand it anyway.</P
><P
>For many years the Samba team have been developing Samba, some time ago
a number of people, possibly lead by Luke Leighton started contributing NT
PDC stuff. This was added to the 'head' stream (that would eventually
become the next version) and later to a seperate stream (NTDom). They did so
much that eventually this development stream was so mutated that it could not
be merged back into the main stream and was abandoned towards the end of 1999.
And that was very sad because many users, myself include had become heavily
dependant on the NTController facilities it offered. Oh well...</P
><P
>The NTDom team continued on with their new found knowledge however and
built the TNG stream. Intended to be carefully controlled so that it can be
merged back into the main stream and benefiting from what they learnt, it is
a very different product to the origional NTDom product. However, for a
number of reasons, the merge did not take place and now TNG is being developed
at <A
HREF="http://www.samba-tng.org"
TARGET="_top"
>http://www.samba-tng.org</A
>.</P
><P
>Now, the NTDom things that the main strean 2.0.x version does is based more
on the old (initial version) abandoned code than on the TNG ideas. It appears
that version 2.2.0 will also include an improved version of the 2.0.7 domain
controller charactistics, not the TNG ways. The developers have indicated
that 2.2.0 will be further developed incrementally and the ideas from TNG
incorporated into it.</P
><P
>One more little wriggle is worth mentioning. At one stage the NTDom
stream was called Samba 2.1.0-prealpha and similar names. This is most
unfortunate because at least one book published advises people who want to
use NTDom Samba to get version 2.1.0 or later. As main stream Samba will soon
be called 2.2.0 and NOT officially supporting NTDom Controlling functions,
the potential for confusion is certainly there.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN310"
>The Future</A
></H2
><P
>There is a document on the Samba mirrors called <I
CLASS="EMPHASIS"
>'Development'
</I
>. It offers the 'best guess' of what is planned for future releases
of Samba.</P
><P
>The future of Samba as a Primary Domain Controller appears rosie, however
be aware that its the future, not the present. The developers are strongly committed
to building a full featured PDC into Samba but it will take time. If this
version does not meet your requirements then you should consider (in no particular
order) :</P
><P
></P
><UL
><LI
><P
> Wait. No, we don't know how long. Repeated asking won't help.</P
></LI
><LI
><P
>Investigate the development versions, TNG perhaps or HEAD where new code is being added
all the time. Realise that development code is often unstable, poorly documented and subject to change.
You will need to use cvs to download development versions.</P
></LI
><LI
><P
>Join one of the Samba mailing lists so that you can find out
what is happening on the 'bleeding edge'.</P
></LI
></UL
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN322"
>Getting further help</A
></H2
><P
>This document cannot possibly answer all your questions. Please understand that its very
likely that someone has been confrounted by the same problem that you have. The
<A
HREF="samba-pdc-faq.html"
TARGET="_top"
>FAQ</A
>
discusses a number of possible paths to take to get further help :</P
><P
></P
><UL
><LI
><P
>Documents on the Samba Sites.</P
></LI
><LI
><P
>Other web sites.</P
></LI
><LI
><P
>Mailing list.</P
></LI
></UL
><P
>There is some discussion about guide lines for using the Mailing Lists on the
accompanying <A
HREF="samba-pdc-faq.html"
TARGET="_top"
>FAQ</A
>,
please read them before posting.</P
></DIV
></DIV
></DIV
></DIV
></BODY
></HTML
>
|
