1.1. Step 0: Read the man pages

The man pages distributed with SAMBA contain lots of useful info that will help to get you started. If you don't know how to read man pages then try something like:

$ nroff -man smbd.8 | more

Other sources of information are pointed to by the Samba web site, http://www.samba.org

1.2. Step 1: Building the Binaries

To do this, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual needs then you may wish to run

root# ./configure --help

first to see what special options you can enable. Then executing

root# make

will create the binaries. Once it's successfully compiled you can use

root# make install

to install the binaries and manual pages. You can separately install the binaries and/or man pages using

root# make installbin

and

root# make installman

Note that if you are upgrading for a previous version of Samba you might like to know that the old versions of the binaries will be renamed with a ".old" extension. You can go back to the previous version with

root# make revert

if you find this version a disaster!

1.3. Step 2: The all important step

At this stage you must fetch yourself a coffee or other drink you find stimulating. Getting the rest of the install right can sometimes be tricky, so you will probably need it.

If you have installed samba before then you can skip this step.

1.4. Step 3: Create the smb configuration file.

There are sample configuration files in the examples subdirectory in the distribution. I suggest you read them carefully so you can see how the options go together in practice. See the man page for all the options.

The simplest useful configuration file would be something like this:

[global] workgroup = MYGROUP [homes] guest ok = no read only = no

which would allow connections by anyone with an account on the server, using either their login name or "homes" as the service name. (Note that I also set the workgroup that Samba is part of. See BROWSING.txt for details)

Note that make install will not install a smb.conf file. You need to create it yourself.

Make sure you put the smb.conf file in the same place you specified in theMakefile (the default is to look for it in /usr/local/samba/lib/).

For more information about security settings for the [homes] share please refer to the document UNIX_SECURITY.txt.

1.5. Step 4: Test your config file with testparm

It's important that you test the validity of your smb.conf file using the testparm program. If testparm runs OK then it will list the loaded services. If not it will give an error message.

Make sure it runs OK and that the services look reasonable before proceeding.

1.6. Step 5: Starting the smbd and nmbd

You must choose to start smbd and nmbd either as daemons or from inetd. Don't try to do both! Either you can put them in inetd.conf and have them started on demand by inetd, or you can start them as daemons either from the command line or in /etc/rc.local. See the man pages for details on the command line options. Take particular care to read the bit about what user you need to be in order to start Samba. In many cases you must be root.

The main advantage of starting smbd and nmbd using the recommended daemon method is that they will respond slightly more quickly to an initial connection request.

1.7. Step 6: Try listing the shares available on your server

$ smbclient -L yourhostname

You should get back a list of shares available on your server. If you don't then something is incorrectly setup. Note that this method can also be used to see what shares are available on other LanManager clients (such as WfWg).

If you choose user level security then you may find that Samba requests a password before it will list the shares. See the smbclient man page for details. (you can force it to list the shares without a password by adding the option -U% to the command line. This will not work with non-Samba servers)

1.8. Step 7: Try connecting with the unix client

$ smbclient //yourhostname/aservice

Typically the yourhostname would be the name of the host where you installed smbd. The aservice is any service you have defined in the smb.conf file. Try your user name if you just have a [homes] section in smb.conf.

For example if your unix host is bambi and your login name is fred you would type:

$ smbclient //bambi/fred

1.9. Step 8: Try connecting from a DOS, WfWg, Win9x, WinNT, Win2k, OS/2, etc... client

Try mounting disks. eg:

C:\WINDOWS\> net use d: \\servername\service

Try printing. eg:

C:\WINDOWS\> net use lpt1: \\servername\spoolservice

C:\WINDOWS\> print filename

Celebrate, or send me a bug report!

1.10. What If Things Don't Work?

If nothing works and you start to think "who wrote this pile of trash" then I suggest you do step 2 again (and again) till you calm down.

Then you might read the file DIAGNOSIS.txt and the FAQ. If you are still stuck then try the mailing list or newsgroup (look in the README for details). Samba has been successfully installed at thousands of sites worldwide, so maybe someone else has hit your problem and has overcome it. You could also use the WWW site to scan back issues of the samba-digest.

When you fix the problem PLEASE send me some updates to the documentation (or source code) so that the next person will find it easier.

2.1. Introduction

This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem is if it fails any one of these steps. If it passes all these tests then it is probably working fine.

You should do ALL the tests, in the order shown. I have tried to carefully choose them so later tests only use capabilities verified in the earlier tests.

If you send me an email saying "it doesn't work" and you have not followed this test procedure then you should not be surprised if I ignore your email.

2.2. Assumptions

In all of the tests I assume you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP. I also assume the PC is running windows for workgroups with a recent copy of the microsoft tcp/ip stack. Alternatively, your PC may be running Windows 95 or Windows NT (Workstation or Server).

The procedure is similar for other types of clients.

I also assume you know the name of an available share in your smb.conf. I will assume this share is called "tmp". You can add a "tmp" share like by adding the following to smb.conf:

[tmp] comment = temporary files path = /tmp read only = yes

THESE TESTS ASSUME VERSION 2.0.6 OR LATER OF THE SAMBA SUITE. SOME COMMANDS SHOWN DID NOT EXIST IN EARLIER VERSIONS

Please pay attention to the error messages you receive. If any error message reports that your server is being unfriendly you should first check that you IP name resolution is correctly set up. eg: Make sure your /etc/resolv.conf file points to name servers that really do exist.

Also, if you do not have DNS server access for name resolution please check that the settings for your smb.conf file results in "dns proxy = no". The best way to check this is with "testparm smb.conf"

2.3. Tests

2.4. Still having troubles?

Try the mailing list or newsgroup, or use the ethereal utility to sniff the problem. The official samba mailing list can be reached at samba@samba.org. To find out more about samba and how to subscribe to the mailing list check out the samba web page at http://samba.org/samba

Also look at the other docs in the Samba package!

3.1. Agenda

To identify the key functional mechanisms of MS Windows networking to enable the deployment of Samba as a means of extending and/or replacing MS Windows NT/2000 technology.

We will examine:

1. Name resolution in a pure Unix/Linux TCP/IP environment

2. Name resolution as used within MS Windows networking

3. How browsing functions and how to deploy stable and dependable browsing using Samba

4. MS Windows security options and how to configure Samba for seemless integration

5. Configuration of Samba as:

   1. A stand-alone server

   2. An MS Windows NT 3.x/4.0 security domain member

   3. An alternative to an MS Windows NT 3.x/4.0 Domain Controller

3.2. Name Resolution in a pure Unix/Linux world

The key configuration files covered in this section are:

• /etc/hosts

• /etc/resolv.conf

• /etc/host.conf

• /etc/nsswitch.conf

3.3. Name resolution as used within MS Windows networking

MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as the "computer name", "machine name", "networking name", "netbios name", "SMB name". All terms mean the same thing with the exception of "netbios name" which can apply also to the name of the workgroup or the domain name. The terms "workgroup" and "domain" are really just a simply name with which the machine is associated. All NetBIOS names are exactly 16 characters in length. The 16th character is reserved. It is used to store a one byte value that indicates service level information for the NetBIOS name that is registered. A NetBIOS machine name is therefore registered for each service type that is provided by the client/server.

The following are typical NetBIOS name/service type registrations:

Unique NetBIOS Names: MACHINENAME<00> = Server Service is running on MACHINENAME MACHINENAME<03> = Generic Machine Name (NetBIOS name) MACHINENAME<20> = LanMan Server service is running on MACHINENAME WORKGROUP<1b> = Domain Master Browser Group Names: WORKGROUP<03> = Generic Name registered by all members of WORKGROUP WORKGROUP<1c> = Domain Controllers / Netlogon Servers WORKGROUP<1d> = Local Master Browsers WORKGROUP<1e> = Internet Name Resolvers

It should be noted that all NetBIOS machines register their own names as per the above. This is in vast contrast to TCP/IP installations where traditionally the system administrator will determine in the /etc/hosts or in the DNS database what names are associated with each IP address.

One further point of clarification should be noted, the /etc/hosts file and the DNS records do not provide the NetBIOS name type information that MS Windows clients depend on to locate the type of service that may be needed. An example of this is what happens when an MS Windows client wants to locate a domain logon server. It find this service and the IP address of a server that provides it by performing a lookup (via a NetBIOS broadcast) for enumeration of all machines that have registered the name type *<1c>. A logon request is then sent to each IP address that is returned in the enumerated list of IP addresses. Which ever machine first replies then ends up providing the logon services.

The name "workgroup" or "domain" really can be confusing since these have the added significance of indicating what is the security architecture of the MS Windows network. The term "workgroup" indicates that the primary nature of the network environment is that of a peer-to-peer design. In a WORKGROUP all machines are responsible for their own security, and generally such security is limited to use of just a password (known as SHARE MODE security). In most situations with peer-to-peer networking the users who control their own machines will simply opt to have no security at all. It is possible to have USER MODE security in a WORKGROUP environment, thus requiring use of a user name and a matching password.

MS Windows networking is thus predetermined to use machine names for all local and remote machine message passing. The protocol used is called Server Message Block (SMB) and this is implemented using the NetBIOS protocol (Network Basic Input Output System). NetBIOS can be encapsulated using LLC (Logical Link Control) protocol - in which case the resulting protocol is called NetBEUI (Network Basic Extended User Interface). NetBIOS can also be run over IPX (Internetworking Packet Exchange) protocol as used by Novell NetWare, and it can be run over TCP/IP protocols - in which case the resulting protocol is called NBT or NetBT, the NetBIOS over TCP/IP.

MS Windows machines use a complex array of name resolution mechanisms. Since we are primarily concerned with TCP/IP this demonstration is limited to this area.

3.4. How browsing functions and how to deploy stable and dependable browsing using Samba

As stated above, MS Windows machines register their NetBIOS names (i.e.: the machine name for each service type in operation) on start up. Also, as stated above, the exact method by which this name registration takes place is determined by whether or not the MS Windows client/server has been given a WINS server address, whether or not LMHOSTS lookup is enabled, or if DNS for NetBIOS name resolution is enabled, etc.

In the case where there is no WINS server all name registrations as well as name lookups are done by UDP broadcast. This isolates name resolution to the local subnet, unless LMHOSTS is used to list all names and IP addresses. In such situations Samba provides a means by which the samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the "remote announce" parameter).

Where a WINS server is used, the MS Windows client will use UDP unicast to register with the WINS server. Such packets can be routed and thus WINS allows name resolution to function across routed networks.

During the startup process an election will take place to create a local master browser if one does not already exist. On each NetBIOS network one machine will be elected to function as the domain master browser. This domain browsing has nothing to do with MS security domain control. Instead, the domain master browser serves the role of contacting each local master browser (found by asking WINS or from LMHOSTS) and exchanging browse list contents. This way every master browser will eventually obtain a complete list of all machines that are on the network. Every 11-15 minutes an election is held to determine which machine will be the master browser. By the nature of the election criteria used, the machine with the highest uptime, or the most senior protocol version, or other criteria, will win the election as domain master browser.

Clients wishing to browse the network make use of this list, but also depend on the availability of correct name resolution to the respective IP address/addresses.

Any configuration that breaks name resolution and/or browsing intrinsics will annoy users because they will have to put up with protracted inability to use the network services.

Samba supports a feature that allows forced synchonisation of browse lists across routed networks using the "remote browse sync" parameter in the smb.conf file. This causes Samba to contact the local master browser on a remote network and to request browse list synchronisation. This effectively bridges two networks that are separated by routers. The two remote networks may use either broadcast based name resolution or WINS based name resolution, but it should be noted that the "remote browse sync" parameter provides browse list synchronisation - and that is distinct from name to address resolution, in other words, for cross subnet browsing to function correctly it is essential that a name to address resolution mechanism be provided. This mechanism could be via DNS, /etc/hosts, and so on.

3.5. MS Windows security options and how to configure Samba for seemless integration

MS Windows clients may use encrypted passwords as part of a challenege/response authentication model (a.k.a. NTLMv1) or alone, or clear text strings for simple password based authentication. It should be realized that with the SMB protocol the password is passed over the network either in plain text or encrypted, but not both in the same authentication requets.

When encrypted passwords are used a password that has been entered by the user is encrypted in two ways:

• An MD4 hash of the UNICODE of the password string. This is known as the NT hash.

• The password is converted to upper case, and then padded or trucated to 14 bytes. This string is then appended with 5 bytes of NULL characters and split to form two 56 bit DES keys to encrypt a "magic" 8 byte value. The resulting 16 bytes for the LanMan hash.

You should refer to the Password Encryption chapter in this HOWTO collection for more details on the inner workings

MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 pre-service pack 3 will use either mode of password authentication. All versions of MS Windows that follow these versions no longer support plain text passwords by default.

MS Windows clients have a habit of dropping network mappings that have been idle for 10 minutes or longer. When the user attempts to use the mapped drive connection that has been dropped, the client re-establishes the connection using a cached copy of the password.

When Microsoft changed the default password mode, they dropped support for caching of the plain text password. This means that when the registry parameter is changed to re-enable use of plain text passwords it appears to work, but when a dropped mapping attempts to revalidate it will fail if the remote authentication server does not support encrypted passwords. This means that it is definitely not a good idea to re-enable plain text password support in such clients.

The following parameters can be used to work around the issue of Windows 9x client upper casing usernames and password before transmitting them to the SMB server when using clear text authentication.

passsword level = integer username level = integer

By default Samba will lower case the username before attempting to lookup the user in the database of local system accounts. Because UNIX usernames conventionally only contain lower case character, the username level parameter is rarely even needed.

However, password on UNIX systems often make use of mixed case characters. This means that in order for a user on a Windows 9x client to connect to a Samba server using clear text authentication, the password level must be set to the maximum number of upper case letter which could appear is a password. Note that is the server OS uses the traditional DES version of crypt(), then a password level of 8 will result in case insensitive passwords as seen from Windows users. This will also result in longer login times as Samba hash to compute the permutations of the password string and try them one by one until a match is located (or all combinations fail).

The best option to adopt is to enable support for encrypted passwords where ever Samba is used. There are three configuration possibilities for support of encrypted passwords:

3.6. Conclusions

Samba provides a flexible means to operate as...

• A Stand-alone server - No special action is needed other than to create user accounts. Stand-alone servers do NOT provide network logon services, meaning that machines that use this server do NOT perform a domain logon but instead make use only of the MS Windows logon which is local to the MS Windows workstation/server.

• An MS Windows NT 3.x/4.0 security domain member.

• An alternative to an MS Windows NT 3.x/4.0 Domain Controller.

4.1. Samba and PAM

A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, authorization and resource control services. Prior to the introduction of PAM, a decision to use an alternative to the system password database (/etc/passwd) would require the provision of alternatives for all programs that provide security services. Such a choice would involve provision of alternatives to such programs as: login, passwd, chown, etc.

PAM provides a mechanism that disconnects these security programs from the underlying authentication/authorization infrastructure. PAM is configured either through one file /etc/pam.conf (Solaris), or by editing individual files that are located in /etc/pam.d.

The following is an example /etc/pam.d/login configuration file. This example had all options been uncommented is probably not usable as it stacks many conditions before allowing successful completion of the login process. Essentially all conditions can be disabled by commenting them out except the calls to pam_pwdb.so.

#%PAM-1.0 # The PAM configuration file for the `login' service # auth required pam_securetty.so auth required pam_nologin.so # auth required pam_dialup.so # auth optional pam_mail.so auth required pam_pwdb.so shadow md5 # account requisite pam_time.so account required pam_pwdb.so session required pam_pwdb.so # session optional pam_lastlog.so # password required pam_cracklib.so retry=3 password required pam_pwdb.so shadow md5

PAM allows use of replacable modules. Those available on a sample system include:

$ /bin/ls /lib/security pam_access.so pam_ftp.so pam_limits.so pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so pam_cracklib.so pam_group.so pam_listfile.so pam_nologin.so pam_rootok.so pam_tally.so pam_deny.so pam_issue.so pam_mail.so pam_permit.so pam_securetty.so pam_time.so pam_dialup.so pam_lastlog.so pam_mkhomedir.so pam_pwdb.so pam_shells.so pam_unix.so pam_env.so pam_ldap.so pam_motd.so pam_radius.so pam_smbpass.so pam_unix_acct.so pam_wheel.so pam_unix_auth.so pam_unix_passwd.so pam_userdb.so pam_warn.so pam_unix_session.so

The following example for the login program replaces the use of the pam_pwdb.so module which uses the system password database (/etc/passwd, /etc/shadow, /etc/group) with the module pam_smbpass.so which uses the Samba database which contains the Microsoft MD4 encrypted password hashes. This database is stored in either /usr/local/samba/private/smbpasswd, /etc/samba/smbpasswd, or in /etc/samba.d/smbpasswd, depending on the Samba implementation for your Unix/Linux system. The pam_smbpass.so module is provided by Samba version 2.2.1 or later. It can be compiled by specifying the --with-pam_smbpass options when running Samba's configure script. For more information on the pam_smbpass module, see the documentation in the source/pam_smbpass directory of the Samba source distribution.

#%PAM-1.0 # The PAM configuration file for the `login' service # auth required pam_smbpass.so nodelay account required pam_smbpass.so nodelay session required pam_smbpass.so nodelay password required pam_smbpass.so nodelay

The following is the PAM configuration file for a particular Linux system. The default condition uses pam_pwdb.so.

#%PAM-1.0 # The PAM configuration file for the `samba' service # auth required /lib/security/pam_pwdb.so nullok nodelay shadow audit account required /lib/security/pam_pwdb.so audit nodelay session required /lib/security/pam_pwdb.so nodelay password required /lib/security/pam_pwdb.so shadow md5

In the following example the decision has been made to use the smbpasswd database even for basic samba authentication. Such a decision could also be made for the passwd program and would thus allow the smbpasswd passwords to be changed using the passwd program.

#%PAM-1.0 # The PAM configuration file for the `samba' service # auth required /lib/security/pam_smbpass.so nodelay account required /lib/security/pam_pwdb.so audit nodelay session required /lib/security/pam_pwdb.so nodelay password required /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf

Note: PAM allows stacking of authentication mechanisms. It is also possible to pass information obtained within on PAM module through to the next module in the PAM stack. Please refer to the documentation for your particular system implementation for details regarding the specific capabilities of PAM in this environment. Some Linux implmentations also provide the pam_stack.so module that allows all authentication to be configured in a single central file. The pam_stack.so method has some very devoted followers on the basis that it allows for easier administration. As with all issues in life though, every decision makes trade-offs, so you may want examine the PAM documentation for further helpful information.

4.2. Distributed Authentication

The astute administrator will realize from this that the combination of pam_smbpass.so, winbindd, and rsync (see http://rsync.samba.org/) will allow the establishment of a centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware programs and applications. This arrangement can have particularly potent advantages compared with the use of Microsoft Active Directory Service (ADS) in so far as reduction of wide area network authentication traffic.

4.3. PAM Configuration in smb.conf

There is an option in smb.conf called obey pam restrictions. The following is from the on-line help for this option in SWAT;

When Samba 2.2 is configure to enable PAM support (i.e. --with-pam), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management. Note that Samba always ignores PAM for authentication in the case of encrypt passwords = yes. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption.

Default: obey pam restrictions = no

5.1. Instructions

The Distributed File System (or Dfs) provides a means of separating the logical view of files and directories that users see from the actual physical locations of these resources on the network. It allows for higher availability, smoother storage expansion, load balancing etc. For more information about Dfs, refer to Microsoft documentation.

This document explains how to host a Dfs tree on a Unix machine (for Dfs-aware clients to browse) using Samba.

To enable SMB-based DFS for Samba, configure it with the --with-msdfs option. Once built, a Samba server can be made a Dfs server by setting the global boolean host msdfs parameter in the smb.conf file. You designate a share as a Dfs root using the share level boolean msdfs root parameter. A Dfs root directory on Samba hosts Dfs links in the form of symbolic links that point to other servers. For example, a symbolic link junction->msdfs:storage1\share1 in the share directory acts as the Dfs junction. When Dfs-aware clients attempt to access the junction link, they are redirected to the storage location (in this case, \\storage1\share1).

Dfs trees on Samba work with all Dfs-aware clients ranging from Windows 95 to 2000.

Here's an example of setting up a Dfs tree on a Samba server.

# The smb.conf file: [global] netbios name = SAMBA host msdfs = yes [dfs] path = /export/dfsroot msdfs root = yes

In the /export/dfsroot directory we set up our dfs links to other servers on the network.

root# cd /export/dfsroot

root# chown root /export/dfsroot

root# chmod 755 /export/dfsroot

root# ln -s msdfs:storageA\\shareA linka

root# ln -s msdfs:serverB\\share,serverC\\share linkb

You should set up the permissions and ownership of the directory acting as the Dfs root such that only designated users can create, delete or modify the msdfs links. Also note that symlink names should be all lowercase. This limitation exists to have Samba avoid trying all the case combinations to get at the link name. Finally set up the symbolic links to point to the network shares you want, and start Samba.

Users on Dfs-aware clients can now browse the Dfs tree on the Samba server at \\samba\dfs. Accessing links linka or linkb (which appear as directories to the client) takes users directly to the appropriate shares on the network.

6.1. Viewing and changing UNIX permissions using the NT security dialogs

New in the Samba 2.0.4 release is the ability for Windows NT clients to use their native security settings dialog box to view and modify the underlying UNIX permissions.

Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and still obeys all the file permission rules that a Samba administrator can set.

In Samba 2.0.4 and above the default value of the parameter nt acl support has been changed from false to true, so manipulation of permissions is turned on by default.

6.2. How to view file security on a Samba share

From an NT 4.0 client, single-click with the right mouse button on any file or directory in a Samba mounted drive letter or UNC path. When the menu pops-up, click on the Properties entry at the bottom of the menu. This brings up the normal file properties dialog box, but with Samba 2.0.4 this will have a new tab along the top marked Security. Click on this tab and you will see three buttons, Permissions, Auditing, and Ownership. The Auditing button will cause either an error message A requested privilege is not held by the client to appear if the user is not the NT Administrator, or a dialog which is intended to allow an Administrator to add auditing requirements to a file if the user is logged on as the NT Administrator. This dialog is non-functional with a Samba share at this time, as the only useful button, the Add button will not currently allow a list of users to be seen.

6.3. Viewing file ownership

Clicking on the "Ownership" button brings up a dialog box telling you who owns the given file. The owner name will be of the form :

"SERVER\user (Long name)"

Where SERVER is the NetBIOS name of the Samba server, user is the user name of the UNIX user who owns the file, and (Long name) is the descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). Click on the Close button to remove this dialog.

If the parameter nt acl support is set to false then the file owner will be shown as the NT user "Everyone".

The Take Ownership button will not allow you to change the ownership of this file to yourself (clicking on it will display a dialog box complaining that the user you are currently logged onto the NT client cannot be found). The reason for this is that changing the ownership of a file is a privileged operation in UNIX, available only to the root user. As clicking on this button causes NT to attempt to change the ownership of a file to the current user logged into the NT client this will not work with Samba at this time.

There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected to a Samba 2.0.4 server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS or Samba drive. This is available as part of the Seclib NT security library written by Jeremy Allison of the Samba Team, available from the main Samba ftp site.

6.4. Viewing file or directory permissions

The third button is the "Permissions" button. Clicking on this brings up a dialog box that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed in the form :

"SERVER\user (Long name)"

Where SERVER is the NetBIOS name of the Samba server, user is the user name of the UNIX user who owns the file, and (Long name) is the descriptive string identifying the user (normally found in the GECOS field of the UNIX password database).

If the parameter nt acl support is set to false then the file owner will be shown as the NT user "Everyone" and the permissions will be shown as NT "Full Control".

The permissions field is displayed differently for files and directories, so I'll describe the way file permissions are displayed first.

6.5. Modifying file or directory permissions

Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and clicking the OK button. However, there are limitations that a user needs to be aware of, and also interactions with the standard Samba permission masks and mapping of DOS attributes that need to also be taken into account.

If the parameter nt acl support is set to false then any attempt to set security permissions will fail with an "Access Denied" message.

The first thing to note is that the "Add" button will not return a list of users in Samba 2.0.4 (it will give an error message of "The remote procedure call failed and did not execute"). This means that you can only manipulate the current user/group/world permissions listed in the dialog box. This actually works quite well as these are the only permissions that UNIX actually has.

If a permission triple (either user, group, or world) is removed from the list of permissions in the NT dialog box, then when the "OK" button is pressed it will be applied as "no permissions" on the UNIX side. If you then view the permissions again the "no permissions" entry will appear as the NT "O" flag, as described above. This allows you to add permissions back to a file or directory once you have removed them from a triple component.

As UNIX supports only the "r", "w" and "x" bits of an NT ACL then if other NT security attributes such as "Delete access" are selected then they will be ignored when applied on the Samba server.

When setting permissions on a directory the second set of permissions (in the second set of parentheses) is by default applied to all files within that directory. If this is not what you want you must uncheck the "Replace permissions on existing files" checkbox in the NT dialog before clicking "OK".

If you wish to remove all permissions from a user/group/world component then you may either highlight the component and click the "Remove" button, or set the component to only have the special "Take Ownership" permission (displayed as "O" ) highlighted.

6.6. Interaction with the standard Samba create mask parameters

Note that with Samba 2.0.5 there are four new parameters to control this interaction. These are :

security mask

force security mode

directory security mask

force directory security mode

Once a user clicks "OK" to apply the permissions Samba maps the given permissions into a user/group/world r/w/x triple set, and then will check the changed permissions for a file against the bits set in the security mask parameter. Any bits that were changed that are not set to '1' in this parameter are left alone in the file permissions.

Essentially, zero bits in the security mask mask may be treated as a set of bits the user is not allowed to change, and one bits are those the user is allowed to change.

If not set explicitly this parameter is set to the same value as the create mask parameter to provide compatibility with Samba 2.0.4 where this permission change facility was introduced. To allow a user to modify all the user/group/world permissions on a file, set this parameter to 0777.

Next Samba checks the changed permissions for a file against the bits set in the force security mode parameter. Any bits that were changed that correspond to bits set to '1' in this parameter are forced to be set.

Essentially, bits set in the force security mode parameter may be treated as a set of bits that, when modifying security on a file, the user has always set to be 'on'.

If not set explicitly this parameter is set to the same value as the force create mode parameter to provide compatibility with Samba 2.0.4 where the permission change facility was introduced. To allow a user to modify all the user/group/world permissions on a file with no restrictions set this parameter to 000.

The security mask and force security mode parameters are applied to the change request in that order.

For a directory Samba will perform the same operations as described above for a file except using the parameter directory security mask instead of security mask, and force directory security mode parameter instead of force security mode .

The directory security mask parameter by default is set to the same value as the directory mask parameter and the force directory security mode parameter by default is set to the same value as the force directory mode parameter to provide compatibility with Samba 2.0.4 where the permission change facility was introduced.

In this way Samba enforces the permission restrictions that an administrator can set on a Samba share, whilst still allowing users to modify the permission bits within that restriction.

If you want to set up a share that allows users full control in modifying the permission bits on their files and directories and doesn't force any particular bits to be set 'on', then set the following parameters in the smb.conf(5) file in that share specific section :

security mask = 0777

force security mode = 0

directory security mask = 0777

force directory security mode = 0

As described, in Samba 2.0.4 the parameters :

create mask

force create mode

directory mask

force directory mode

were used instead of the parameters discussed here.

6.7. Interaction with the standard Samba file attribute mapping

Samba maps some of the DOS attribute bits (such as "read only") into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security dialog and the permission bits set by the file attribute mapping.

One way this can show up is if a file has no UNIX read access for the owner it will show up as "read only" in the standard file attributes tabbed dialog. Unfortunately this dialog is the same one that contains the security info in another tab.

What this can mean is that if the owner changes the permissions to allow themselves read access using the security dialog, clicks "OK" to get back to the standard attributes tab dialog, and then clicks "OK" on that dialog, then NT will set the file permissions back to read-only (as that is what the attributes still say in the dialog). This means that after setting permissions and clicking "OK" to get back to the attributes dialog you should always hit "Cancel" rather than "OK" to ensure that your changes are not overridden.

7.1. Introduction

Beginning with the 2.2.0 release, Samba supports the native Windows NT printing mechanisms implemented via MS-RPC (i.e. the SPOOLSS named pipe). Previous versions of Samba only supported LanMan printing calls.

The additional functionality provided by the new SPOOLSS support includes:

• Support for downloading printer driver files to Windows 95/98/NT/2000 clients upon demand.

• Uploading of printer drivers via the Windows NT Add Printer Wizard (APW) or the Imprints tool set (refer to http://imprints.sourceforge.net).

• Support for the native MS-RPC printing calls such as StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation at http://msdn.microsoft.com/ for more information on the Win32 printing API)

• Support for NT Access Control Lists (ACL) on printer objects

• Improved support for printer queue manipulation through the use of an internal databases for spooled job information

There has been some initial confusion about what all this means and whether or not it is a requirement for printer drivers to be installed on a Samba host in order to support printing from Windows clients. A bug existed in Samba 2.2.0 which made Windows NT/2000 clients require that the Samba server possess a valid driver for the printer. This is fixed in Samba 2.2.1 and once again, Windows NT/2000 clients can use the local APW for installing drivers to be used with a Samba served printer. This is the same behavior exhibited by Windows 9x clients. As a side note, Samba does not use these drivers in any way to process spooled files. They are utilized entirely by the clients.

The following MS KB article, may be of some help if you are dealing with Windows 2000 clients: How to Add Printers with No User Interaction in Windows 2000

http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP

7.2. Configuration

7.3. The Imprints Toolset

The Imprints tool set provides a UNIX equivalent of the Windows NT Add Printer Wizard. For complete information, please refer to the Imprints web site at http://imprints.sourceforge.net/ as well as the documentation included with the imprints source distribution. This section will only provide a brief introduction to the features of Imprints.

7.4. Migration to from Samba 2.0.x to 2.2.x

Given that printer driver management has changed (we hope improved) in 2.2 over prior releases, migration from an existing setup to 2.2 can follow several paths. Here are the possible scenarios for migration:

• If you do not desire the new Windows NT print driver support, nothing needs to be done. All existing parameters work the same.

• If you want to take advantage of NT printer driver support but do not want to migrate the 9x drivers to the new setup, the leave the existing printers.def file. When smbd attempts to locate a 9x driver for the printer in the TDB and fails it will drop down to using the printers.def (and all associated parameters). The make_printerdef tool will also remain for backwards compatibility but will be removed in the next major release.

• If you install a Windows 9x driver for a printer on your Samba host (in the printing TDB), this information will take precedence and the three old printing parameters will be ignored (including print driver location).

• If you want to migrate an existing printers.def file into the new setup, the current only solution is to use the Windows NT APW to install the NT drivers and the 9x drivers. This can be scripted using smbclient and rpcclient. See the Imprints installation client at http://imprints.sourceforge.net/ for an example.

The have been two new parameters add in Samba 2.2.2 to for better support of Samba 2.0.x backwards capability (disable spoolss) and for using local printers drivers on Windows NT/2000 clients (use client driver). Both of these options are described in the smb.coinf(5) man page and are disabled by default.

8.1. Introduction

This is a short description of how to debug printing problems with Samba. This describes how to debug problems with printing from a SMB client to a Samba server, not the other way around. For the reverse see the examples/printing directory.

Ok, so you want to print to a Samba server from your PC. The first thing you need to understand is that Samba does not actually do any printing itself, it just acts as a middleman between your PC client and your Unix printing subsystem. Samba receives the file from the PC then passes the file to a external "print command". What print command you use is up to you.

The whole things is controlled using options in smb.conf. The most relevant options (which you should look up in the smb.conf man page) are:

[global] print command - send a file to a spooler lpq command - get spool queue status lprm command - remove a job [printers] path = /var/spool/lpd/samba

The following are nice to know about:

queuepause command - stop a printer or print queue queueresume command - start a printer or print queue

Example:

print command = /usr/bin/lpr -r -P%p %s lpq command = /usr/bin/lpq -P%p %s lprm command = /usr/bin/lprm -P%p %j queuepause command = /usr/sbin/lpc -P%p stop queuepause command = /usr/sbin/lpc -P%p start

Samba should set reasonable defaults for these depending on your system type, but it isn't clairvoyant. It is not uncommon that you have to tweak these for local conditions. The commands should always have fully specified pathnames, as the smdb may not have the correct PATH values.

When you send a job to Samba to be printed, it will make a temporary copy of it in the directory specified in the [printers] section. and it should be periodically cleaned out. The lpr -r option requests that the temporary copy be removed after printing; If printing fails then you might find leftover files in this directory, and it should be periodically cleaned out. Samba used the lpq command to determine the "job number" assigned to your print job by the spooler.

The %>letter< are "macros" that get dynamically replaced with appropriate values when they are used. The %s gets replaced with the name of the spool file that Samba creates and the %p gets replaced with the name of the printer. The %j gets replaced with the "job number" which comes from the lpq output.

8.2. Debugging printer problems

One way to debug printing problems is to start by replacing these command with shell scripts that record the arguments and the contents of the print file. A simple example of this kind of things might be:

print command = /tmp/saveprint %p %s #!/bin/saveprint # we make sure that we are the right user /usr/bin/id -p >/tmp/tmp.print # we run the command and save the error messages # replace the command with the one appropriate for your system /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print

Then you print a file and try removing it. You may find that the print queue needs to be stopped in order to see the queue status and remove the job:

h4: {42} % echo hi >/tmp/hi h4: {43} % smbclient //localhost/lw4 added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0 Password: Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7] smb: \> print /tmp/hi putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s) smb: \> queue 1049 3 hi-17534 smb: \> cancel 1049 Error cancelling job 1049 : code 0 smb: \> cancel 1049 Job 1049 cancelled smb: \> queue smb: \> exit

The 'code 0' indicates that the job was removed. The comment by the smbclient is a bit misleading on this. You can observe the command output and then and look at the /tmp/tmp.print file to see what the results are. You can quickly find out if the problem is with your printing system. Often people have problems with their /etc/printcap file or permissions on various print queues.

8.3. What printers do I have?

You can use the 'testprns' program to check to see if the printer name you are using is recognized by Samba. For example, you can use:

testprns printer /etc/printcap

Samba can get its printcap information from a file or from a program. You can try the following to see the format of the extracted information:

testprns -a printer /etc/printcap testprns -a printer '|/bin/cat printcap'

8.4. Setting up printcap and print servers

You may need to set up some printcaps for your Samba system to use. It is strongly recommended that you use the facilities provided by the print spooler to set up queues and printcap information.

Samba requires either a printcap or program to deliver printcap information. This printcap information has the format:

name|alias1|alias2...:option=value:...

For almost all printing systems, the printer 'name' must be composed only of alphanumeric or underscore '_' characters. Some systems also allow hyphens ('-') as well. An alias is an alternative name for the printer, and an alias with a space in it is used as a 'comment' about the printer. The printcap format optionally uses a \ at the end of lines to extend the printcap to multiple lines.

Here are some examples of printcap files:

1. pr just printer name

2. pr|alias printer name and alias

3. pr|My Printer printer name, alias used as comment

4. pr:sh:\ Same as pr:sh:cm= testing :cm= \ testing

5. pr:sh Same as pr:sh:cm= testing :cm= testing

Samba reads the printcap information when first started. If you make changes in the printcap information, then you must do the following:

1. make sure that the print spooler is aware of these changes. The LPRng system uses the 'lpc reread' command to do this.

2. make sure that the spool queues, etc., exist and have the correct permissions. The LPRng system uses the 'checkpc -f' command to do this.

3. You now should send a SIGHUP signal to the smbd server to have it reread the printcap information.

8.5. Job sent, no output

This is the most frustrating part of printing. You may have sent the job, verified that the job was forwarded, set up a wrapper around the command to send the file, but there was no output from the printer.

First, check to make sure that the job REALLY is getting to the right print queue. If you are using a BSD or LPRng print spooler, you can temporarily stop the printing of jobs. Jobs can still be submitted, but they will not be printed. Use:

lpc -Pprinter stop

Now submit a print job and then use 'lpq -Pprinter' to see if the job is in the print queue. If it is not in the print queue then you will have to find out why it is not being accepted for printing.

Next, you may want to check to see what the format of the job really was. With the assistance of the system administrator you can view the submitted jobs files. You may be surprised to find that these are not in what you would expect to call a printable format. You can use the UNIX 'file' utitily to determine what the job format actually is:

cd /var/spool/lpd/printer # spool directory of print jobs ls # find job files file dfA001myhost

You should make sure that your printer supports this format OR that your system administrator has installed a 'print filter' that will convert the file to a format appropriate for your printer.

8.6. Job sent, strange output

Once you have the job printing, you can then start worrying about making it print nicely.

The most common problem is extra pages of output: banner pages OR blank pages at the end.

If you are getting banner pages, check and make sure that the printcap option or printer option is configured for no banners. If you have a printcap, this is the :sh (suppress header or banner page) option. You should have the following in your printer.

printer: ... :sh

If you have this option and are still getting banner pages, there is a strong chance that your printer is generating them for you automatically. You should make sure that banner printing is disabled for the printer. This usually requires using the printer setup software or procedures supplied by the printer manufacturer.

If you get an extra page of output, this could be due to problems with your job format, or if you are generating PostScript jobs, incorrect setting on your printer driver on the MicroSoft client. For example, under Win95 there is a option:

Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|

that allows you to choose if a Ctrl-D is appended to all jobs. This is a very bad thing to do, as most spooling systems will automatically add a ^D to the end of the job if it is detected as PostScript. The multiple ^D may cause an additional page of output.

8.7. Raw PostScript printed

This is a problem that is usually caused by either the print spooling system putting information at the start of the print job that makes the printer think the job is a text file, or your printer simply does not support PostScript. You may need to enable 'Automatic Format Detection' on your printer.

8.8. Advanced Printing

Note that you can do some pretty magic things by using your imagination with the "print command" option and some shell scripts. Doing print accounting is easy by passing the %U option to a print command shell script. You could even make the print command detect the type of output and its size and send it to an appropriate printer.

8.9. Real debugging

If the above debug tips don't help, then maybe you need to bring in the bug guns, system tracing. See Tracing.txt in this directory.

9.1. Introduction

Samba supports the following options to the global smb.conf parameter

[global] security = [share|user(default)|domain|ads]

Please refer to the smb.conf man page for usage information and to the document DOMAIN_MEMBER.html for further background details on domain mode security. The Windows 2000 Kerberos domain security model (security = ads) is described in the ADS-HOWTO.html.

Of the above, "security = server" means that Samba reports to clients that it is running in "user mode" but actually passes off all authentication requests to another "user mode" server. This requires an additional parameter "password server =" that points to the real authentication server. That real authentication server can be another Samba server or can be a Windows NT server, the later natively capable of encrypted password support.

9.2. More complete description of security levels

A SMB server tells the client at startup what "security level" it is running. There are two options "share level" and "user level". Which of these two the client receives affects the way the client then tries to authenticate itself. It does not directly affect (to any great extent) the way the Samba server does security. I know this is strange, but it fits in with the client/server approach of SMB. In SMB everything is initiated and controlled by the client, and the server can only tell the client what is available and whether an action is allowed.

I'll describe user level security first, as its simpler. In user level security the client will send a "session setup" command directly after the protocol negotiation. This contains a username and password. The server can either accept or reject that username/password combination. Note that at this stage the server has no idea what share the client will eventually try to connect to, so it can't base the "accept/reject" on anything other than:

1. the username/password

2. the machine that the client is coming from

If the server accepts the username/password then the client expects to be able to mount any share (using a "tree connection") without specifying a password. It expects that all access rights will be as the username/password specified in the "session setup".

It is also possible for a client to send multiple "session setup" requests. When the server responds it gives the client a "uid" to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this)

Ok, now for share level security. In share level security the client authenticates itself separately for each share. It will send a password along with each "tree connection" (share mount). It does not explicitly send a username with this operation. The client is expecting a password to be associated with each share, independent of the user. This means that samba has to work out what username the client probably wants to use. It is never explicitly sent the username. Some commercial SMB servers such as NT actually associate passwords directly with shares in share level security, but samba always uses the unix authentication scheme where it is a username/password that is authenticated, not a "share/password".

Many clients send a "session setup" even if the server is in share level security. They normally send a valid username but no password. Samba records this username in a list of "possible usernames". When the client then does a "tree connection" it also adds to this list the name of the share they try to connect to (useful for home directories) and any users listed in the "user =" smb.conf line. The password is then checked in turn against these "possible usernames". If a match is found then the client is authenticated as that user.

Finally "server level" security. In server level security the samba server reports to the client that it is in user level security. The client then does a "session setup" as described earlier. The samba server takes the username/password that the client sends and attempts to login to the "password server" by sending exactly the same username/password that it got from the client. If that server is in user level security and accepts the password then samba accepts the clients connection. This allows the samba server to use another SMB server as the "password server".

You should also note that at the very start of all this, where the server tells the client what security level it is in, it also tells the client if it supports encryption. If it does then it supplies the client with a random "cryptkey". The client will then send all passwords in encrypted form. You have to compile samba with encryption enabled to support this feature, and you have to maintain a separate smbpasswd file with SMB style encrypted passwords. It is cryptographically impossible to translate from unix style encryption to SMB style encryption, although there are some fairly simple management schemes by which the two could be kept in sync.

10.1. Joining an NT Domain with Samba 2.2

Assume you have a Samba 2.x server with a NetBIOS name of SERV1 and are joining an NT domain called DOM, which has a PDC with a NetBIOS name of DOMPDC and two backup domain controllers with NetBIOS names DOMBDC1 and DOMBDC2 .

In order to join the domain, first stop all Samba daemons and run the command:

root# smbpasswd -j DOM -r DOMPDC -UAdministrator%password

as we are joining the domain DOM and the PDC for that domain (the only machine that has write access to the domain SAM database) is DOMPDC. The Administrator%password is the login name and password for an account which has the necessary privilege to add machines to the domain. If this is successful you will see the message:

smbpasswd: Joined domain DOM.

in your terminal window. See the smbpasswd(8) man page for more details.

There is existing development code to join a domain without having to create the machine trust account on the PDC beforehand. This code will hopefully be available soon in release branches as well.

This command goes through the machine account password change protocol, then writes the new (random) machine account password for this Samba server into a file in the same directory in which an smbpasswd file would be stored - normally :

/usr/local/samba/private

In Samba 2.0.x, the filename looks like this:

<NT DOMAIN NAME>.<Samba Server Name>.mac

The .mac suffix stands for machine account password file. So in our example above, the file would be called:

DOM.SERV1.mac

In Samba 2.2, this file has been replaced with a TDB (Trivial Database) file named secrets.tdb.

This file is created and owned by root and is not readable by any other user. It is the key to the domain-level security for your system, and should be treated as carefully as a shadow password file.

Now, before restarting the Samba daemons you must edit your smb.conf(5) file to tell Samba it should now use domain security.

Change (or add) your security = line in the [global] section of your smb.conf to read:

security = domain

Next change the workgroup = line in the [global] section to read:

workgroup = DOM

as this is the name of the domain we are joining.

You must also have the parameter encrypt passwords set to yes in order for your users to authenticate to the NT PDC.

Finally, add (or modify) a password server = line in the [global] section to read:

password server = DOMPDC DOMBDC1 DOMBDC2

These are the primary and backup domain controllers Samba will attempt to contact in order to authenticate users. Samba will try to contact each of these servers in order, so you may want to rearrange this list in order to spread out the authentication load among domain controllers.

Alternatively, if you want smbd to automatically determine the list of Domain controllers to use for authentication, you may set this line to be :

password server = *

This method, which was introduced in Samba 2.0.6, allows Samba to use exactly the same mechanism that NT does. This method either broadcasts or uses a WINS database in order to find domain controllers to authenticate against.

Finally, restart your Samba daemons and get ready for clients to begin using domain security!

10.2. Samba and Windows 2000 Domains

Many people have asked regarding the state of Samba's ability to participate in a Windows 2000 Domain. Samba 2.2 is able to act as a member server of a Windows 2000 domain operating in mixed or native mode.

There is much confusion between the circumstances that require a "mixed" mode Win2k DC and a when this host can be switched to "native" mode. A "mixed" mode Win2k domain controller is only needed if Windows NT BDCs must exist in the same domain. By default, a Win2k DC in "native" mode will still support NetBIOS and NTLMv1 for authentication of legacy clients such as Windows 9x and NT 4.0. Samba has the same requirements as a Windows NT 4.0 member server.

The steps for adding a Samba 2.2 host to a Win2k domain are the same as those for adding a Samba server to a Windows NT 4.0 domain. The only exception is that the "Server Manager" from NT 4 has been replaced by the "Active Directory Users and Computers" MMC (Microsoft Management Console) plugin.

10.3. Why is this better than security = server?

Currently, domain security in Samba doesn't free you from having to create local Unix users to represent the users attaching to your server. This means that if domain user DOM\fred attaches to your domain security Samba server, there needs to be a local Unix user fred to represent that user in the Unix filesystem. This is very similar to the older Samba security mode security = server, where Samba would pass through the authentication request to a Windows NT server in the same way as a Windows 95 or Windows 98 server would.

Please refer to the Winbind paper for information on a system to automatically assign UNIX uids and gids to Windows NT Domain users and groups. This code is available in development branches only at the moment, but will be moved to release branches soon.

The advantage to domain-level security is that the authentication in domain-level security is passed down the authenticated RPC channel in exactly the same way that an NT server would do it. This means Samba servers now participate in domain trust relationships in exactly the same way NT servers do (i.e., you can add Samba servers into a resource domain and have the authentication passed on from a resource domain PDC to an account domain PDC.

In addition, with security = server every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run out of available connections. With security = domain, however, the Samba daemons connect to the PDC/BDC only for as long as is necessary to authenticate the user, and then drop the connection, thus conserving PDC connection resources.

And finally, acting in the same manner as an NT server authenticating to a PDC means that as part of the authentication reply, the Samba server gets the user identification information such as the user SID, the list of NT groups the user belongs to, etc. All this information will allow Samba to be extended in the future into a mode the developers currently call appliance mode. In this mode, no local Unix users will be necessary, and Samba will generate Unix uids and gids from the information passed back from the PDC when a user is authenticated, making a Samba server truly plug and play in an NT domain environment. Watch for this code soon.

NOTE: Much of the text of this document was first published in the Web magazine LinuxWorld as the article Doing the NIS/NT Samba.

11.1. Abstract

Integration of UNIX and Microsoft Windows NT through a unified logon has been considered a "holy grail" in heterogeneous computing environments for a long time. We present winbind, a component of the Samba suite of programs as a solution to the unified logon problem. Winbind uses a UNIX implementation of Microsoft RPC calls, Pluggable Authentication Modules, and the Name Service Switch to allow Windows NT domain users to appear and operate as UNIX users on a UNIX machine. This paper describes the winbind system, explaining the functionality it provides, how it is configured, and how it works internally.

11.2. Introduction

It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and use different technologies for implementing them. This fact has made it difficult to integrate the two systems in a satisfactory manner.

One common solution in use today has been to create identically named user accounts on both the UNIX and Windows systems and use the Samba suite of programs to provide file and print services between the two. This solution is far from perfect however, as adding and deleting users on both sets of machines becomes a chore and two sets of passwords are required both of which can lead to synchronization problems between the UNIX and Windows systems and confusion for users.

We divide the unified logon problem for UNIX machines into three smaller problems:

• Obtaining Windows NT user and group information

• Authenticating Windows NT users

• Password changing for Windows NT users

Ideally, a prospective solution to the unified logon problem would satisfy all the above components without duplication of information on the UNIX machines and without creating additional tasks for the system administrator when maintaining users and groups on either system. The winbind system provides a simple and elegant solution to all three components of the unified logon problem.

11.3. What Winbind Provides

Winbind unifies UNIX and Windows NT account management by allowing a UNIX box to become a full member of a NT domain. Once this is done the UNIX box will see NT users and groups as if they were native UNIX users and groups, allowing the NT domain to be used in much the same manner that NIS+ is used within UNIX-only environments.

The end result is that whenever any program on the UNIX machine asks the operating system to lookup a user or group name, the query will be resolved by asking the NT domain controller for the specified domain to do the lookup. Because Winbind hooks into the operating system at a low level (via the NSS name resolution modules in the C library) this redirection to the NT domain controller is completely transparent.

Users on the UNIX machine can then use NT user and group names as they would use "native" UNIX names. They can chown files so that they are owned by NT domain users or even login to the UNIX machine and run a UNIX X-Window session as a domain user.

The only obvious indication that Winbind is being used is that user and group names take the form DOMAIN\user and DOMAIN\group. This is necessary as it allows Winbind to determine that redirection to a domain controller is wanted for a particular lookup and which trusted domain is being referenced.

Additionally, Winbind provides an authentication service that hooks into the Pluggable Authentication Modules (PAM) system to provide authentication via a NT domain to any PAM enabled applications. This capability solves the problem of synchronizing passwords between systems since all passwords are stored in a single location (on the domain controller).

11.4. How Winbind Works

The winbind system is designed around a client/server architecture. A long running winbindd daemon listens on a UNIX domain socket waiting for requests to arrive. These requests are generated by the NSS and PAM clients and processed sequentially.

The technologies used to implement winbind are described in detail below.

11.5. Installation and Configuration

Many thanks to John Trostel jtrostel@snapserver.com for providing the HOWTO for this section.

This HOWTO describes how to get winbind services up and running to control access and authenticate users on your Linux box using the winbind services which come with SAMBA 2.2.2.

There is also some Solaris specific information in docs/textdocs/Solaris-Winbind-HOWTO.txt. Future revisions of this document will incorporate that information.

11.6. Limitations

Winbind has a number of limitations in its current released version that we hope to overcome in future releases:

• Winbind is currently only available for the Linux operating system, although ports to other operating systems are certainly possible. For such ports to be feasible, we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication Modules systems. This is becoming more common as NSS and PAM gain support among UNIX vendors.

• The mappings of Windows NT RIDs to UNIX ids is not made algorithmically and depends on the order in which unmapped users or groups are seen by winbind. It may be difficult to recover the mappings of rid to UNIX id mapping if the file containing this information is corrupted or destroyed.

• Currently the winbind PAM module does not take into account possible workstation and logon time restrictions that may be been set for Windows NT users.

11.7. Conclusion

The winbind system, through the use of the Name Service Switch, Pluggable Authentication Modules, and appropriate Microsoft RPC calls have allowed us to provide seamless integration of Microsoft Windows NT domain users on a UNIX system. The result is a great reduction in the administrative cost of running a mixed UNIX and NT network.

12.1. Prerequisite Reading

Before you continue reading in this chapter, please make sure that you are comfortable with configuring basic files services in smb.conf and how to enable and administer password encryption in Samba. Theses two topics are covered in the smb.conf(5) manpage and the Encryption chapter of this HOWTO Collection.

12.2. Background

Versions of Samba prior to release 2.2 had marginal capabilities to act as a Windows NT 4.0 Primary Domain Controller (PDC). With Samba 2.2.0, we are proud to announce official support for Windows NT 4.0-style domain logons from Windows NT 4.0 and Windows 2000 clients. This article outlines the steps necessary for configuring Samba as a PDC. It is necessary to have a working Samba server prior to implementing the PDC functionality. If you have not followed the steps outlined in UNIX_INSTALL.html, please make sure that your server is configured correctly before proceeding. Another good resource in the smb.conf(5) man page. The following functionality should work in 2.2:

• domain logons for Windows NT 4.0/2000 clients.

• placing a Windows 9x client in user level security

• retrieving a list of users and groups from a Samba PDC to Windows 9x/NT/2000 clients

• roving (roaming) user profiles

• Windows NT 4.0-style system policies

The following pieces of functionality are not included in the 2.2 release:

• Windows NT 4 domain trusts

• SAM replication with Windows NT 4.0 Domain Controllers (i.e. a Samba PDC and a Windows NT BDC or vice versa)

• Adding users via the User Manager for Domains

• Acting as a Windows 2000 Domain Controller (i.e. Kerberos and Active Directory)

Please note that Windows 9x clients are not true members of a domain for reasons outlined in this article. Therefore the protocol for support Windows 9x-style domain logons is completely different from NT4 domain logons and has been officially supported for some time.

Implementing a Samba PDC can basically be divided into 2 broad steps.

1. Configuring the Samba PDC

2. Creating machine trust accounts and joining clients to the domain

There are other minor details such as user profiles, system policies, etc... However, these are not necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts. They will be mentioned only briefly here.

12.3. Configuring the Samba Domain Controller

The first step in creating a working Samba PDC is to understand the parameters necessary in smb.conf. I will not attempt to re-explain the parameters here as they are more that adequately covered in the smb.conf man page. For convenience, the parameters have been linked with the actual smb.conf description.

Here is an example smb.conf for acting as a PDC:

[global] ; Basic server settings netbios name = POGO workgroup = NARNIA ; we should act as the domain and local master browser os level = 64 preferred master = yes domain master = yes local master = yes ; security settings (must user security = user) security = user ; encrypted passwords are a requirement for a PDC encrypt passwords = yes ; support domain logons domain logons = yes ; where to store user profiles? logon path = \\%N\profiles\%u ; where is a user's home directory and where should it ; be mounted at? logon drive = H: logon home = \\homeserver\%u ; specify a generic logon script for all users ; this is a relative **DOS** path to the [netlogon] share logon script = logon.cmd ; necessary share for domain controller [netlogon] path = /usr/local/samba/lib/netlogon read only = yes write list = ntadmin ; share for storing user profiles [profiles] path = /export/smb/ntprofile read only = no create mask = 0600 directory mask = 0700

There are a couple of points to emphasize in the above configuration.

• Encrypted passwords must be enabled. For more details on how to do this, refer to ENCRYPTION.html.

• The server must support domain logons and a [netlogon] share

• The server must be the domain master browser in order for Windows client to locate the server as a DC. Please refer to the various Network Browsing documentation included with this distribution for details.

As Samba 2.2 does not offer a complete implementation of group mapping between Windows NT groups and Unix groups (this is really quite complicated to explain in a short space), you should refer to the domain admin group smb.conf parameter for information of creating "Domain Admins" style accounts.

12.4. Creating Machine Trust Accounts and Joining Clients to the Domain

A machine trust account is a Samba account that is used to authenticate a client machine (rather than a user) to the Samba server. In Windows terminology, this is known as a "Computer Account."

The password of a machine trust account acts as the shared secret for secure communication with the Domain Controller. This is a security feature to prevent an unauthorized machine with the same NetBIOS name from joining the domain and gaining access to domain user/group accounts. Windows NT and 2000 clients use machine trust accounts, but Windows 9x clients do not. Hence, a Windows 9x client is never a true member of a domain because it does not possess a machine trust account, and thus has no shared secret with the domain controller.

A Windows PDC stores each machine trust account in the Windows Registry. A Samba PDC, however, stores each machine trust account in two parts, as follows:

• A Samba account, stored in the same location as user LanMan and NT password hashes (currently smbpasswd). The Samba account possesses and uses only the NT password hash.

• A corresponding Unix account, typically stored in /etc/passwd. (Future releases will alleviate the need to create /etc/passwd entries.)

There are two ways to create machine trust accounts:

• Manual creation. Both the Samba and corresponding Unix account are created by hand.

• "On-the-fly" creation. The Samba machine trust account is automatically created by Samba at the time the client is joined to the domain. (For security, this is the recommended method.) The corresponding Unix account may be created automatically or manually.

12.5. Common Problems and Errors

• I cannot include a '$' in a machine name.

  A 'machine name' in (typically) /etc/passwd of the machine name with a '$' appended. FreeBSD (and other BSD systems?) won't create a user with a '$' in their name.

  The problem is only in the program used to make the entry, once made, it works perfectly. So create a user without the '$' and use vipw to edit the entry, adding the '$'. Or create the whole entry with vipw if you like, make sure you use a unique User ID !

• I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an existing set.." when creating a machine trust account.

  This happens if you try to create a machine trust account from the machine itself and already have a connection (e.g. mapped drive) to a share (or IPC$) on the Samba PDC. The following command will remove all network drive connections:

  C:\WINNT\> net use * /d

  Further, if the machine is a already a 'member of a workgroup' that is the same name as the domain you are joining (bad idea) you will get this message. Change the workgroup name to something else, it does not matter what, reboot, and try again.

• The system can not log you on (C000019B)....

  I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message, "The system can not log you on (C000019B), Please try a gain or consult your system administrator" when attempting to logon.

  This occurs when the domain SID stored in private/WORKGROUP.SID is changed. For example, you remove the file and smbd automatically creates a new one. Or you are swapping back and forth between versions 2.0.7, TNG and the HEAD branch code (not recommended). The only way to correct the problem is to restore the original domain SID or remove the domain client from the domain and rejoin.

• The machine trust account for this computer either does not exist or is not accessible.

  When I try to join the domain I get the message "The machine account for this computer either does not exist or is not accessible". What's wrong?

  This problem is caused by the PDC not having a suitable machine trust account. If you are using the add user script method to create accounts then this would indicate that it has not worked. Ensure the domain admin user system is working.

  Alternatively if you are creating account entries manually then they have not been created correctly. Make sure that you have the entry correct for the machine trust account in smbpasswd file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure that the account name is the machine NetBIOS name with a '$' appended to it ( i.e. computer_name$ ). There must be an entry in both /etc/passwd and the smbpasswd file. Some people have reported that inconsistent subnet masks between the Samba server and the NT client have caused this problem. Make sure that these are consistent for both client and server.

• When I attempt to login to a Samba Domain from a NT4/W2K workstation, I get a message about my account being disabled.

  This problem is caused by a PAM related bug in Samba 2.2.0. This bug is fixed in 2.2.1. Other symptoms could be unaccessible shares on NT/W2K member servers in the domain or the following error in your smbd.log: passdb/pampass.c:pam_account(268) PAM: UNKNOWN ERROR for User: %user%

  At first be ensure to enable the useraccounts with smbpasswd -e %user%, this is normally done, when you create an account.

  In order to work around this problem in 2.2.0, configure the account control flag in /etc/pam.d/samba file as follows:

  account required pam_permit.so

  If you want to remain backward compatibility to samba 2.0.x use pam_permit.so, it's also possible to use pam_pwdb.so. There are some bugs if you try to use pam_unix.so, if you need this, be ensure to use the most recent version of this file.

12.6. System Policies and Profiles

Much of the information necessary to implement System Policies and Roving User Profiles in a Samba domain is the same as that for implementing these same items in a Windows NT 4.0 domain. You should read the white paper Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft.

Here are some additional details:

• What about Windows NT Policy Editor?

  To create or edit ntconfig.pol you must use the NT Server Policy Editor, poledit.exe which is included with NT Server but not NT Workstation. There is a Policy Editor on a NTws but it is not suitable for creating Domain Policies. Further, although the Windows 95 Policy Editor can be installed on an NT Workstation/Server, it will not work with NT policies because the registry key that are set by the policy templates. However, the files from the NT Server will run happily enough on an NTws. You need poledit.exe, common.adm and winnt.adm. It is convenient to put the two *.adm files in c:\winnt\inf which is where the binary will look for them unless told otherwise. Note also that that directory is 'hidden'.

  The Windows NT policy editor is also included with the Service Pack 3 (and later) for Windows NT 4.0. Extract the files using servicepackname /x, i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, poledit.exe and the associated template files (*.adm) should be extracted as well. It is also possible to downloaded the policy template files for Office97 and get a copy of the policy editor. Another possible location is with the Zero Administration Kit available for download from Microsoft.

• Can Win95 do Policies?

  Install the group policy handler for Win9x to pick up group policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. Install group policies on a Win9x client by double-clicking grouppol.inf. Log off and on again a couple of times and see if Win98 picks up group policies. Unfortunately this needs to be done on every Win9x machine that uses group policies....

  If group policies don't work one reports suggests getting the updated (read: working) grouppol.dll for Windows 9x. The group list is grabbed from /etc/group.

• How do I get 'User Manager' and 'Server Manager'

  Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for Domains', the 'Server Manager'?

  Microsoft distributes a version of these tools called nexus for installation on Windows 95 systems. The tools set includes

  • Server Manager

  • User Manager for Domains

  • Event Viewer

  Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE

  The Windows NT 4.0 version of the 'User Manager for Domains' and 'Server Manager' are available from Microsoft via ftp from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE

12.7. What other help can I get?

There are many sources of information available in the form of mailing lists, RFC's and documentation. The docs that come with the samba distribution contain very good explanations of general SMB topics such as browsing.

• What are some diagnostics tools I can use to debug the domain logon process and where can I find them?

  One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d option for both smbd and nmbd to specify what 'debug level' at which to run. See the man pages on smbd, nmbd and smb.conf for more information on debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords).

  Another helpful method of debugging is to compile samba using the gcc -g flag. This will include debug information in the binaries and allow you to attach gdb to the running smbd / nmbd process. In order to attach gdb to an smbd process for an NT workstation, first get the workstation to make the connection. Pressing ctrl-alt-delete and going down to the domain box is sufficient (at least, on the first time you join the domain) to generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open connection, and therefore there will be an smbd process running (assuming that you haven't set a really short smbd idle timeout) So, in between pressing ctrl alt delete, and actually typing in your password, you can gdb attach and continue.

  Some useful samba commands worth investigating:

  • testparam | more

  • smbclient -L //{netbios name of server}

  An SMB enabled version of tcpdump is available from http://www.tcpdup.org/. Ethereal, another good packet sniffer for Unix and Win32 hosts, can be downloaded from http://www.ethereal.com.

  For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's. The version of netmon that ships with SMS allows for dumping packets between any two computers (i.e. placing the network interface in promiscuous mode). The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the local subnet. Be aware that Ethereal can read and write netmon formatted files.

• How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?

  Installing netmon on an NT workstation requires a couple of steps. The following are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT Workstation 4.0. The process should be similar for other version of Windows NT / Netmon. You will need both the Microsoft Windows NT Server 4.0 Install CD and the Workstation 4.0 Install CD.

  Initially you will need to install 'Network Monitor Tools and Agent' on the NT Server. To do this

  • Goto Start - Settings - Control Panel - Network - Services - Add

  • Select the 'Network Monitor Tools and Agent' and click on 'OK'.

  • Click 'OK' on the Network Control Panel.

  • Insert the Windows NT Server 4.0 install CD when prompted.

  At this point the Netmon files should exist in %SYSTEMROOT%\System32\netmon\*.*. Two subdirectories exist as well, parsers\ which contains the necessary DLL's for parsing the netmon packet dump, and captures\.

  In order to install the Netmon tools on an NT Workstation, you will first need to install the 'Network Monitor Agent' from the Workstation install CD.

  • Goto Start - Settings - Control Panel - Network - Services - Add

  • Select the 'Network Monitor Agent' and click on 'OK'.

  • Click 'OK' on the Network Control Panel.

  • Insert the Windows NT Workstation 4.0 install CD when prompted.

  Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as you deem appropriate for your site. You will need administrative rights on the NT box to run netmon.

  To install Netmon on a Windows 9x box install the network monitor agent from the Windows 9x CD (\admin\nettools\netmon). There is a readme file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation.

• The following is a list if helpful URLs and other links:

  • Home of Samba site http://samba.org. We have a mirror near you !

  • The Development document on the Samba mirrors might mention your problem. If so, it might mean that the developers are working on it.

  • See how Scott Merrill simulates a BDC behavior at http://www.skippy.net/linux/smb-howto.html.

  • Although 2.0.7 has almost had its day as a PDC, David Bannon will keep the 2.0.7 PDC pages at http://bioserve.latrobe.edu.au/samba going for a while yet.

  • Misc links to CIFS information http://samba.org/cifs/

  • NT Domains for Unix http://mailhost.cb1.com/~lkcl/ntdom/

  • FTP site for older SMB specs: ftp://ftp.microsoft.com/developr/drg/CIFS/

• How do I get help from the mailing lists?

  There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror and then click on Support and then click on Samba related mailing lists.

  For questions relating to Samba TNG go to http://www.samba-tng.org/ It has been requested that you don't post questions about Samba-TNG to the main stream Samba lists.

  If you post a message to one of the lists please observe the following guide lines :

  • Always remember that the developers are volunteers, they are not paid and they never guarantee to produce a particular feature at a particular time. Any time lines are 'best guess' and nothing more.

  • Always mention what version of samba you are using and what operating system its running under. You should probably list the relevant sections of your smb.conf file, at least the options in [global] that affect PDC support.

  • In addition to the version, if you obtained Samba via CVS mention the date when you last checked it out.

  • Try and make your question clear and brief, lots of long, convoluted questions get deleted before they are completely read ! Don't post html encoded messages (if you can select colour or font size its html).

  • If you run one of those nifty 'I'm on holidays' things when you are away, make sure its configured to not answer mailing lists.

  • Don't cross post. Work out which is the best list to post to and see what happens, i.e. don't post to both samba-ntdom and samba-technical. Many people active on the lists subscribe to more than one list and get annoyed to see the same message two or more times. Often someone will see a message and thinking it would be better dealt with on another, will forward it on for you.

  • You might include partial log files written at a debug level set to as much as 20. Please don't send the entire log but enough to give the context of the error messages.

  • (Possibly) If you have a complete netmon trace ( from the opening of the pipe to the error ) you can send the *.CAP file as well.

  • Please think carefully before attaching a document to an email. Consider pasting the relevant parts into the body of the message. The samba mailing lists go to a huge number of people, do they all need a copy of your smb.conf in their attach directory?

• How do I get off the mailing lists?

  To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to http://lists.samba.org, click on your nearest mirror and then click on Support and then click on Samba related mailing lists. Or perhaps see here

  Please don't post messages to the list asking to be removed, you will just be referred to the above address (unless that process failed in some way...)

12.8. Domain Control for Windows 9x/ME

A domain and a workgroup are exactly the same thing in terms of network browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a network. Also, different access rights can be granted to users if they successfully authenticate against a domain logon server (NT server and other systems based on NT server support this, as does at least Samba TNG now).

The SMB client logging on to a domain has an expectation that every other server in the domain should accept the same authentication information. Network browsing functionality of domains and workgroups is identical and is explained in BROWSING.txt. It should be noted, that browsing is totally orthogonal to logon support.

Issues related to the single-logon network model are discussed in this section. Samba supports domain logons, network logon scripts, and user profiles for MS Windows for workgroups and MS Windows 9X/ME clients which will be the focus of this section.

When an SMB client in a domain wishes to logon it broadcast requests for a logon server. The first one to reply gets the job, and validates its password using whatever mechanism the Samba administrator has installed. It is possible (but very stupid) to create a domain where the user database is not shared between servers, i.e. they are effectively workgroup servers advertising themselves as participating in a domain. This demonstrates how authentication is quite different from but closely involved with domains.

Using these features you can make your clients verify their logon via the Samba server; make clients run a batch file when they logon to the network and download their preferences, desktop and start menu.

Before launching into the configuration instructions, it is worthwhile lookingat how a Windows 9x/ME client performs a logon:

1. The client broadcasts (to the IP broadcast address of the subnet it is in) a NetLogon request. This is sent to the NetBIOS name DOMAIN<1c> at the NetBIOS layer. The client chooses the first response it receives, which contains the NetBIOS name of the logon server to use in the format of \\SERVER.

2. The client then connects to that server, logs on (does an SMBsessetupX) and then connects to the IPC$ share (using an SMBtconX).

3. The client then does a NetWkstaUserLogon request, which retrieves the name of the user's logon script.

4. The client then connects to the NetLogon share and searches for this and if it is found and can be read, is retrieved and executed by the client. After this, the client disconnects from the NetLogon share.

5. The client then sends a NetUserGetInfo request to the server, to retrieve the user's home share, which is used to search for profiles. Since the response to the NetUserGetInfo request does not contain much more the user's home share, profiles for Win9X clients MUST reside in the user home directory.

6. The client then connects to the user's home share and searches for the user's profile. As it turns out, you can specify the user's home share as a sharename and path. For example, \\server\fred\.profile. If the profiles are found, they are implemented.

7. The client then disconnects from the user's home share, and reconnects to the NetLogon share and looks for CONFIG.POL, the policies file. If this is found, it is read and implemented.

12.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba

NOTE : The term "Domain Controller" and those related to it refer to one specific method of authentication that can underly an SMB domain. Domain Controllers prior to Windows NT Server 3.1 were sold by various companies and based on private extensions to the LAN Manager 2.1 protocol. Windows NT introduced Microsoft-specific ways of distributing the user authentication database. See DOMAIN.txt for examples of how Samba can participate in or create SMB domains based on shared authentication database schemes other than the Windows NT SAM.

Windows NT Server can be installed as either a plain file and print server (WORKGROUP workstation or server) or as a server that participates in Domain Control (DOMAIN member, Primary Domain controller or Backup Domain controller). The same is true for OS/2 Warp Server, Digital Pathworks and other similar products, all of which can participate in Domain Control along with Windows NT.

To many people these terms can be confusing, so let's try to clear the air.

Every Windows NT system (workstation or server) has a registry database. The registry contains entries that describe the initialization information for all services (the equivalent of Unix Daemons) that run within the Windows NT environment. The registry also contains entries that tell application software where to find dynamically loadable libraries that they depend upon. In fact, the registry contains entries that describes everything that anything may need to know to interact with the rest of the system.

The registry files can be located on any Windows NT machine by opening a command prompt and typing:

C:\WINNT\> dir %SystemRoot%\System32\config

The environment variable %SystemRoot% value can be obtained by typing:

C:\WINNT>echo %SystemRoot%

The active parts of the registry that you may want to be familiar with are the files called: default, system, software, sam and security.

In a domain environment, Microsoft Windows NT domain controllers participate in replication of the SAM and SECURITY files so that all controllers within the domain have an exactly identical copy of each.

The Microsoft Windows NT system is structured within a security model that says that all applications and services must authenticate themselves before they can obtain permission from the security manager to do what they set out to do.

The Windows NT User database also resides within the registry. This part of the registry contains the user's security identifier, home directory, group memberships, desktop profile, and so on.

Every Windows NT system (workstation as well as server) will have its own registry. Windows NT Servers that participate in Domain Security control have a database that they share in common - thus they do NOT own an independent full registry database of their own, as do Workstations and plain Servers.

The User database is called the SAM (Security Access Manager) database and is used for all user authentication as well as for authentication of inter- process authentication (i.e. to ensure that the service action a user has requested is permitted within the limits of that user's privileges).

The Samba team have produced a utility that can dump the Windows NT SAM into smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and /pub/samba/pwdump on your nearest Samba mirror for the utility. This facility is useful but cannot be easily used to implement SAM replication to Samba systems.

Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers can participate in a Domain security system that is controlled by Windows NT servers that have been correctly configured. Almost every domain will have ONE Primary Domain Controller (PDC). It is desirable that each domain will have at least one Backup Domain Controller (BDC).

The PDC and BDCs then participate in replication of the SAM database so that each Domain Controlling participant will have an up to date SAM component within its registry.

13.1. Prerequisite Reading

Before you continue reading in this chapter, please make sure that you are comfortable with configuring a Samba PDC as described in the Samba-PDC-HOWTO.

13.2. Background

What is a Domain Controller? It is a machine that is able to answer logon requests from workstations in a Windows NT Domain. Whenever a user logs into a Windows NT Workstation, the workstation connects to a Domain Controller and asks him whether the username and password the user typed in is correct. The Domain Controller replies with a lot of information about the user, for example the place where the users profile is stored, the users full name of the user. All this information is stored in the NT user database, the so-called SAM.

There are two kinds of Domain Controller in a NT 4 compatible Domain: A Primary Domain Controller (PDC) and one or more Backup Domain Controllers (BDC). The PDC contains the master copy of the SAM. Whenever the SAM has to change, for example when a user changes his password, this change has to be done on the PDC. A Backup Domain Controller is a machine that maintains a read-only copy of the SAM. This way it is able to reply to logon requests and authenticate users in case the PDC is not available. During this time no changes to the SAM are possible. Whenever changes to the SAM are done on the PDC, all BDC receive the changes from the PDC.

Since version 2.2 Samba officially supports domain logons for all current Windows Clients, including Windows 2000 and XP. This text assumes the domain to be named SAMBA. To be able to act as a PDC, some parameters in the [global]-section of the smb.conf have to be set:

workgroup = SAMBA domain master = yes domain logons = yes

Several other things like a [homes] and a [netlogon] share also may be set along with settings for the profile path, the users home drive and others. This will not be covered in this document.

13.3. What qualifies a Domain Controller on the network?

Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS group name SAMBA#1c with the WINS server and/or by broadcast on the local network. The PDC also registers the unique NetBIOS name SAMBA#1b with the WINS server. The name type #1b is normally reserved for the domain master browser, a role that has nothing to do with anything related to authentication, but the Microsoft Domain implementation requires the domain master browser to be on the same machine as the PDC.

13.4. Can Samba be a Backup Domain Controller?

With version 2.2, no. The native NT SAM replication protocols have not yet been fully implemented. The Samba Team is working on understanding and implementing the protocols, but this work has not been finished for version 2.2.

Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to service logon requests whenever the PDC is down.

13.5. How do I set up a Samba BDC?

Several things have to be done:

• The file private/MACHINE.SID identifies the domain. When a samba server is first started, it is created on the fly and must never be changed again. This file has to be the same on the PDC and the BDC, so the MACHINE.SID has to be copied from the PDC to the BDC.

• The Unix user database has to be synchronized from the PDC to the BDC. This means that both the /etc/passwd and /etc/group have to be replicated from the PDC to the BDC. This can be done manually whenever changes are made, or the PDC is set up as a NIS master server and the BDC as a NIS slave server. To set up the BDC as a mere NIS client would not be enough, as the BDC would not be able to access its user database in case of a PDC failure.

• The Samba password database in the file private/smbpasswd has to be replicated from the PDC to the BDC. This is a bit tricky, see the next section.

• Any netlogon share has to be replicated from the PDC to the BDC. This can be done manually whenever login scripts are changed, or it can be done automatically together with the smbpasswd synchronization.

Finally, the BDC has to be found by the workstations. This can be done by setting

workgroup = samba domain master = no domain logons = yes

in the [global]-section of the smb.conf of the BDC. This makes the BDC only register the name SAMBA#1c with the WINS server. This is no problem as the name SAMBA#1c is a NetBIOS group name that is meant to be registered by more than one machine. The parameter 'domain master = no' forces the BDC not to register SAMBA#1b which as a unique NetBIOS name is reserved for the Primary Domain Controller.

14.1. Purpose

This document describes how to use an LDAP directory for storing Samba user account information traditionally stored in the smbpasswd(5) file. It is assumed that the reader already has a basic understanding of LDAP concepts and has a working directory server already installed. For more information on LDAP architectures and Directories, please refer to the following sites.

• OpenLDAP - http://www.openldap.org/

• iPlanet Directory Server - http://iplanet.netscape.com/directory

Note that O'Reilly Publishing is working on a guide to LDAP for System Administrators which has a planned release date of early summer, 2002.

Two additional Samba resources which may prove to be helpful are

• The Samba-PDC-LDAP-HOWTO maintained by Ignacio Coupeau.

• The NT migration scripts from IDEALX that are geared to manage users and group in such a Samba-LDAP Domain Controller configuration.

14.2. Introduction

Traditionally, when configuring "encrypt passwords = yes" in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account flags have been stored in the smbpasswd(5) file. There are several disadvantages to this approach for sites with very large numbers of users (counted in the thousands).

• The first is that all lookups must be performed sequentially. Given that there are approximately two lookups per domain logon (one for a normal session connection such as when mapping a network drive or printer), this is a performance bottleneck for lareg sites. What is needed is an indexed approach such as is used in databases.

• The second problem is that administrators who desired to replicate a smbpasswd file to more than one Samba server were left to use external tools such as rsync(1) and ssh(1) and wrote custom, in-house scripts.

• And finally, the amount of information which is stored in an smbpasswd entry leaves no room for additional attributes such as a home directory, password expiration time, or even a Relative Identified (RID).

As a result of these defeciencies, a more robust means of storing user attributes used by smbd was developed. The API which defines access to user accounts is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support for a samdb backend (e.g. --with-ldapsam or --with-tdbsam) requires compile time support.

When compiling Samba to include the --with-ldapsam autoconf option, smbd (and associated tools) will store and lookup user accounts in an LDAP directory. In reality, this is very easy to understand. If you are comfortable with using an smbpasswd file, simply replace "smbpasswd" with "LDAP directory" in all the documentation.

There are a few points to stress about what the --with-ldapsam does not provide. The LDAP support referred to in the this documentation does not include:

• A means of retrieving user account information from an Windows 2000 Active Directory server.

• A means of replacing /etc/passwd.

The second item can be accomplished by using LDAP NSS and PAM modules. LGPL versions of these libraries can be obtained from PADL Software (http://www.padl.com/). However, the details of configuring these packages are beyond the scope of this document.

14.3. Supported LDAP Servers

The LDAP samdb code in 2.2.3 has been developed and tested using the OpenLDAP 2.0 server and client libraries. The same code should be able to work with Netscape's Directory Server and client SDK. However, due to lack of testing so far, there are bound to be compile errors and bugs. These should not be hard to fix. If you are so inclined, please be sure to forward all patches to samba-patches@samba.org and jerry@samba.org.

14.4. Schema and Relationship to the RFC 2307 posixAccount

Samba 2.2.3 includes the necessary schema file for OpenLDAP 2.0 in examples/LDAP/samba.schema. (Note that this schema file has been modified since the experimental support initially included in 2.2.2). The sambaAccount objectclass is given here:

objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL DESC 'Samba Account' MUST ( uid $ rid ) MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $ logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $ displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $ description $ userWorkstations $ primaryGroupID $ domain ))

The samba.schema file has been formatted for OpenLDAP 2.0. The OID's are owned by the Samba Team and as such is legal to be openly published. If you translate the schema to be used with Netscape DS, please submit the modified schema file as a patch to jerry@samba.org

Just as the smbpasswd file is mean to store information which supplements a user's /etc/passwd entry, so is the sambaAccount object meant to supplement the UNIX user account information. A sambaAccount is a STRUCTURAL objectclass so it can be stored individually in the directory. However, there are several fields (e.g. uid) which overlap with the posixAccount objectclass outlined in RFC2307. This is by design.

In order to store all user account information (UNIX and Samba) in the directory, it is necessary to use the sambaAccount and posixAccount objectclasses in combination. However, smbd will still obtain the user's UNIX account information via the standard C library calls (e.g. getpwnam(), et. al.). This means that the Samba server must also have the LDAP NSS library installed and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure.

14.5. Configuring Samba with LDAP

14.6. Accounts and Groups management

As users accounts are managed thru the sambaAccount objectclass, you should modify you existing administration tools to deal with sambaAccount attributes.

Machines accounts are managed with the sambaAccount objectclass, just like users accounts. However, it's up to you to stored thoses accounts in a different tree of you LDAP namespace: you should use "ou=Groups,dc=plainjoe,dc=org" to store groups and "ou=People,dc=plainjoe,dc=org" to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration file).

In Samba release 2.2.3, the group management system is based on posix groups. This meand that Samba make usage of the posixGroup objectclass. For now, there is no NT-like group system management (global and local groups).

14.7. Security and sambaAccount

There are two important points to remember when discussing the security of sambaAccount entries in the directory.

• Never retrieve the lmPassword or ntPassword attribute values over an unencrypted LDAP session.

• Never allow non-admin users to view the lmPassword or ntPassword attribute values.

These password hashes are clear text equivalents and can be used to impersonate the user without deriving the original clear text strings. For more information on the details of LM/NT password hashes, refer to the ENCRYPTION chapter of the Samba-HOWTO-Collection.

To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults to require an encrypted session (ldap ssl = on) using the default port of 636 when contacting the directory server. When using an OpenLDAP 2.0 server, it is possible to use the use the StartTLS LDAP extended operation in the place of LDAPS. In either case, you are strongly discouraged to disable this security (ldap ssl = off).

Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS extended operation. However, the OpenLDAP library still provides support for the older method of securing communication between clients and servers.

The second security precaution is to prevent non-administrative users from harvesting password hashes from the directory. This can be done using the following ACL in slapd.conf:

## allow the "ldap admin dn" access, but deny everyone else access to attrs=lmPassword,ntPassword by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write by * none

14.8. LDAP specials attributes for sambaAccounts

The sambaAccount objectclass is composed of the following attributes:

• lmPassword: the LANMAN password 16-byte hash stored as a character representation of a hexidecimal string.

• ntPassword: the NT password hash 16-byte stored as a character representation of a hexidecimal string.

• pwdLastSet: The integer time in seconds since 1970 when the lmPassword and ntPassword attributes were last set.

• acctFlags: string of 11 characters surrounded by square brackets [] representing account flags such as U (user), W(workstation), X(no password expiration), and D(disabled).

• logonTime: Integer value currently unused

• logoffTime: Integer value currently unused

• kickoffTime: Integer value currently unused

• pwdCanChange: Integer value currently unused

• pwdMustChange: Integer value currently unused

• homeDrive: specifies the drive letter to which to map the UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" where X is the letter of the drive to map. Refer to the "logon drive" parameter in the smb.conf(5) man page for more information.

• scriptPath: The scriptPath property specifies the path of the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path is relative to the netlogon share. Refer to the "logon script" parameter in the smb.conf(5) man page for more information.

• profilePath: specifies a path to the user's profile. This value can be a null string, a local absolute path, or a UNC path. Refer to the "logon path" parameter in the smb.conf(5) man page for more information.

• smbHome: The homeDirectory property specifies the path of the home directory for the user. The string can be null. If homeDrive is set and specifies a drive letter, homeDirectory should be a UNC path. The path must be a network UNC path of the form \\server\share\directory. This value can be a null string. Refer to the "logon home" parameter in the smb.conf(5) man page for more information.

• userWorkstation: character string value currently unused.

• rid: the integer representation of the user's relative identifier (RID).

• primaryGroupID: the relative identifier (RID) of the primary group of the user.

The majority of these parameters are only used when Samba is acting as a PDC of a domain (refer to the Samba-PDC-HOWTO for details on how to configure Samba as a Primary Domain Controller). The following four attributes are only stored with the sambaAccount entry if the values are non-default values:

• smbHome

• scriptPath

• logonPath

• homeDrive

These attributes are only stored with the sambaAccount entry if the values are non-default values. For example, assume TASHTEGO has now been configured as a PDC and that logon home = \\%L\%u was defined in its smb.conf file. When a user named "becky" logons to the domain, the logon home string is expanded to \\TASHTEGO\becky. If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", this value is used. However, if this attribute does not exist, then the value of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry is the value is something other than the default (e.g. \\MOBY\becky).

14.9. Example LDIF Entries for a sambaAccount

The following is a working LDIF with the inclusion of the posixAccount objectclass:

dn: uid=guest2, ou=people,dc=plainjoe,dc=org ntPassword: 878D8014606CDA29677A44EFA1353FC7 pwdMustChange: 2147483647 primaryGroupID: 1201 lmPassword: 552902031BEDE9EFAAD3B435B51404EE pwdLastSet: 1010179124 logonTime: 0 objectClass: sambaAccount uid: guest2 kickoffTime: 2147483647 acctFlags: [UX ] logoffTime: 2147483647 rid: 19006 pwdCanChange: 0

The following is an LDIF entry for using both the sambaAccount and posixAccount objectclasses:

dn: uid=gcarter, ou=people,dc=plainjoe,dc=org logonTime: 0 displayName: Gerald Carter lmPassword: 552902031BEDE9EFAAD3B435B51404EE primaryGroupID: 1201 objectClass: posixAccount objectClass: sambaAccount acctFlags: [UX ] userPassword: {crypt}BpM2ej8Rkzogo uid: gcarter uidNumber: 9000 cn: Gerald Carter loginShell: /bin/bash logoffTime: 2147483647 gidNumber: 100 kickoffTime: 2147483647 pwdLastSet: 1010179230 rid: 19000 homeDirectory: /home/tashtego/gcarter pwdCanChange: 0 pwdMustChange: 2147483647 ntPassword: 878D8014606CDA29677A44EFA1353FC7

14.10. Comments

Please mail all comments regarding this HOWTO to jerry@samba.org. This documents was last updated to reflect the Samba 2.2.3 release.

15.1. Overview of browsing

SMB networking provides a mechanism by which clients can access a list of machines in a network, a so-called "browse list". This list contains machines that are ready to offer file and/or print services to other machines within the network. Thus it does not include machines which aren't currently able to do server tasks. The browse list is heavily used by all SMB clients. Configuration of SMB browsing has been problematic for some Samba users, hence this document.

Browsing will NOT work if name resolution from NetBIOS names to IP addresses does not function correctly. Use of a WINS server is highly recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. WINS allows remote segment clients to obtain NetBIOS name_type information that can NOT be provided by any other means of name resolution.

15.2. Browsing support in samba

Samba now fully supports browsing. The browsing is supported by nmbd and is also controlled by options in the smb.conf file (see smb.conf(5)).

Samba can act as a local browse master for a workgroup and the ability for samba to support domain logons and scripts is now available. See DOMAIN.txt for more information on domain logons.

Samba can also act as a domain master browser for a workgroup. This means that it will collate lists from local browse masters into a wide area network server list. In order for browse clients to resolve the names they may find in this list, it is recommended that both samba and your clients use a WINS server.

Note that you should NOT set Samba to be the domain master for a workgroup that has the same name as an NT Domain: on each wide area network, you must only ever have one domain master browser per workgroup, regardless of whether it is NT, Samba or any other type of domain master that is providing this service.

[Note that nmbd can be configured as a WINS server, but it is not necessary to specifically use samba as your WINS server. NTAS can be configured as your WINS server. In a mixed NT server and samba environment on a Wide Area Network, it is recommended that you use the NT server's WINS server capabilities. In a samba-only environment, it is recommended that you use one and only one nmbd as your WINS server].

To get browsing to work you need to run nmbd as usual, but will need to use the "workgroup" option in smb.conf to control what workgroup Samba becomes a part of.

Samba also has a useful option for a Samba server to offer itself for browsing on another subnet. It is recommended that this option is only used for 'unusual' purposes: announcements over the internet, for example. See "remote announce" in the smb.conf man page.

15.3. Problem resolution

If something doesn't work then hopefully the log.nmb file will help you track down the problem. Try a debug level of 2 or 3 for finding problems. Also note that the current browse list usually gets stored in text form in a file called browse.dat.

Note that if it doesn't work for you, then you should still be able to type the server name as \\SERVER in filemanager then hit enter and filemanager should display the list of available shares.

Some people find browsing fails because they don't have the global "guest account" set to a valid account. Remember that the IPC$ connection that lists the shares is done as guest, and thus you must have a valid guest account.

Also, a lot of people are getting bitten by the problem of too many parameters on the command line of nmbd in inetd.conf. This trick is to not use spaces between the option and the parameter (eg: -d2 instead of -d 2), and to not use the -B and -N options. New versions of nmbd are now far more likely to correctly find your broadcast and network address, so in most cases these aren't needed.

The other big problem people have is that their broadcast address, netmask or IP address is wrong (specified with the "interfaces" option in smb.conf)

15.4. Browsing across subnets

With the release of Samba 1.9.17(alpha1 and above) Samba has been updated to enable it to support the replication of browse lists across subnet boundaries. New code and options have been added to achieve this. This section describes how to set this feature up in different settings.

To see browse lists that span TCP/IP subnets (ie. networks separated by routers that don't pass broadcast traffic) you must set up at least one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing NetBIOS name to IP address translation to be done by doing a direct query of the WINS server. This is done via a directed UDP packet on port 137 to the WINS server machine. The reason for a WINS server is that by default, all NetBIOS name to IP address translation is done by broadcasts from the querying machine. This means that machines on one subnet will not be able to resolve the names of machines on another subnet without using a WINS server.

Remember, for browsing across subnets to work correctly, all machines, be they Windows 95, Windows NT, or Samba servers must have the IP address of a WINS server given to them by a DHCP server, or by manual configuration (for Win95 and WinNT, this is in the TCP/IP Properties, under Network settings) for Samba this is in the smb.conf file.

15.5. Setting up a WINS server

Either a Samba machine or a Windows NT Server machine may be set up as a WINS server. To set a Samba machine to be a WINS server you must add the following option to the smb.conf file on the selected machine : in the [globals] section add the line

wins support = yes

Versions of Samba previous to 1.9.17 had this parameter default to yes. If you have any older versions of Samba on your network it is strongly suggested you upgrade to 1.9.17 or above, or at the very least set the parameter to 'no' on all these machines.

Machines with "wins support = yes" will keep a list of all NetBIOS names registered with them, acting as a DNS for NetBIOS names.

You should set up only ONE wins server. Do NOT set the "wins support = yes" option on more than one Samba server.

To set up a Windows NT Server as a WINS server you need to set up the WINS service - see your NT documentation for details. Note that Windows NT WINS Servers can replicate to each other, allowing more than one to be set up in a complex subnet environment. As Microsoft refuse to document these replication protocols Samba cannot currently participate in these replications. It is possible in the future that a Samba->Samba WINS replication protocol may be defined, in which case more than one Samba machine could be set up as a WINS server but currently only one Samba server should have the "wins support = yes" parameter set.

After the WINS server has been configured you must ensure that all machines participating on the network are configured with the address of this WINS server. If your WINS server is a Samba machine, fill in the Samba machine IP address in the "Primary WINS Server" field of the "Control Panel->Network->Protocols->TCP->WINS Server" dialogs in Windows 95 or Windows NT. To tell a Samba server the IP address of the WINS server add the following line to the [global] section of all smb.conf files :

wins server = >name or IP address<

where >name or IP address< is either the DNS name of the WINS server machine or its IP address.

Note that this line MUST NOT BE SET in the smb.conf file of the Samba server acting as the WINS server itself. If you set both the "wins support = yes" option and the "wins server = >name<" option then nmbd will fail to start.

There are two possible scenarios for setting up cross subnet browsing. The first details setting up cross subnet browsing on a network containing Windows 95, Samba and Windows NT machines that are not configured as part of a Windows NT Domain. The second details setting up cross subnet browsing on networks that contain NT Domains.

15.6. Setting up Browsing in a WORKGROUP

To set up cross subnet browsing on a network containing machines in up to be in a WORKGROUP, not an NT Domain you need to set up one Samba server to be the Domain Master Browser (note that this is *NOT* the same as a Primary Domain Controller, although in an NT Domain the same machine plays both roles). The role of a Domain master browser is to collate the browse lists from local master browsers on all the subnets that have a machine participating in the workgroup. Without one machine configured as a domain master browser each subnet would be an isolated workgroup, unable to see any machines on any other subnet. It is the presense of a domain master browser that makes cross subnet browsing possible for a workgroup.

In an WORKGROUP environment the domain master browser must be a Samba server, and there must only be one domain master browser per workgroup name. To set up a Samba server as a domain master browser, set the following option in the [global] section of the smb.conf file :

domain master = yes

The domain master browser should also preferrably be the local master browser for its own subnet. In order to achieve this set the following options in the [global] section of the smb.conf file :

domain master = yes local master = yes preferred master = yes os level = 65

The domain master browser may be the same machine as the WINS server, if you require.

Next, you should ensure that each of the subnets contains a machine that can act as a local master browser for the workgroup. Any NT machine should be able to do this, as will Windows 95 machines (although these tend to get rebooted more often, so it's not such a good idea to use these). To make a Samba server a local master browser set the following options in the [global] section of the smb.conf file :

domain master = no local master = yes preferred master = yes os level = 65

Do not do this for more than one Samba server on each subnet, or they will war with each other over which is to be the local master browser.

The "local master" parameter allows Samba to act as a local master browser. The "preferred master" causes nmbd to force a browser election on startup and the "os level" parameter sets Samba high enough so that it should win any browser elections.

If you have an NT machine on the subnet that you wish to be the local master browser then you can disable Samba from becoming a local master browser by setting the following options in the [global] section of the smb.conf file :

domain master = no local master = no preferred master = no os level = 0

15.7. Setting up Browsing in a DOMAIN

If you are adding Samba servers to a Windows NT Domain then you must not set up a Samba server as a domain master browser. By default, a Windows NT Primary Domain Controller for a Domain name is also the Domain master browser for that name, and many things will break if a Samba server registers the Domain master browser NetBIOS name (DOMAIN>1B<) with WINS instead of the PDC.

For subnets other than the one containing the Windows NT PDC you may set up Samba servers as local master browsers as described. To make a Samba server a local master browser set the following options in the [global] section of the smb.conf file :

domain master = no local master = yes preferred master = yes os level = 65

If you wish to have a Samba server fight the election with machines on the same subnet you may set the "os level" parameter to lower levels. By doing this you can tune the order of machines that will become local master browsers if they are running. For more details on this see the section "FORCING SAMBA TO BE THE MASTER" below.

If you have Windows NT machines that are members of the domain on all subnets, and you are sure they will always be running then you can disable Samba from taking part in browser elections and ever becoming a local master browser by setting following options in the [global] section of the smb.conf file :

domain master = no local master = no preferred master = no os level = 0

15.8. Forcing samba to be the master

Who becomes the "master browser" is determined by an election process using broadcasts. Each election packet contains a number of parameters which determine what precedence (bias) a host should have in the election. By default Samba uses a very low precedence and thus loses elections to just about anyone else.

If you want Samba to win elections then just set the "os level" global option in smb.conf to a higher number. It defaults to 0. Using 34 would make it win all elections over every other system (except other samba systems!)

A "os level" of 2 would make it beat WfWg and Win95, but not NTAS. A NTAS domain controller uses level 32.

The maximum os level is 255

If you want samba to force an election on startup, then set the "preferred master" global option in smb.conf to "yes". Samba will then have a slight advantage over other potential master browsers that are not preferred master browsers. Use this parameter with care, as if you have two hosts (whether they are windows 95 or NT or samba) on the same local subnet both set with "preferred master" to "yes", then periodically and continually they will force an election in order to become the local master browser.

If you want samba to be a "domain master browser", then it is recommended that you also set "preferred master" to "yes", because samba will not become a domain master browser for the whole of your LAN or WAN if it is not also a local master browser on its own broadcast isolated subnet.

It is possible to configure two samba servers to attempt to become the domain master browser for a domain. The first server that comes up will be the domain master browser. All other samba servers will attempt to become the domain master browser every 5 minutes. They will find that another samba server is already the domain master browser and will fail. This provides automatic redundancy, should the current domain master browser fail.

15.9. Making samba the domain master

The domain master is responsible for collating the browse lists of multiple subnets so that browsing can occur between subnets. You can make samba act as the domain master by setting "domain master = yes" in smb.conf. By default it will not be a domain master.

Note that you should NOT set Samba to be the domain master for a workgroup that has the same name as an NT Domain.

When samba is the domain master and the master browser it will listen for master announcements (made roughly every twelve minutes) from local master browsers on other subnets and then contact them to synchronise browse lists.

If you want samba to be the domain master then I suggest you also set the "os level" high enough to make sure it wins elections, and set "preferred master" to "yes", to get samba to force an election on startup.

Note that all your servers (including samba) and clients should be using a WINS server to resolve NetBIOS names. If your clients are only using broadcasting to resolve NetBIOS names, then two things will occur:

1. your local master browsers will be unable to find a domain master browser, as it will only be looking on the local subnet.

2. if a client happens to get hold of a domain-wide browse list, and a user attempts to access a host in that list, it will be unable to resolve the NetBIOS name of that host.

If, however, both samba and your clients are using a WINS server, then:

1. your local master browsers will contact the WINS server and, as long as samba has registered that it is a domain master browser with the WINS server, your local master browser will receive samba's ip address as its domain master browser.

2. when a client receives a domain-wide browse list, and a user attempts to access a host in that list, it will contact the WINS server to resolve the NetBIOS name of that host. as long as that host has registered its NetBIOS name with the same WINS server, the user will be able to see that host.

15.10. Note about broadcast addresses

If your network uses a "0" based broadcast address (for example if it ends in a 0) then you will strike problems. Windows for Workgroups does not seem to support a 0's broadcast and you will probably find that browsing and name lookups won't work.

15.11. Multiple interfaces

Samba now supports machines with multiple network interfaces. If you have multiple interfaces then you will need to use the "interfaces" option in smb.conf to configure them. See smb.conf(5) for details.

16.1. Comparisons

The Samba server uses TCP to talk to the client. Thus if you are trying to see if it performs well you should really compare it to programs that use the same protocol. The most readily available programs for file transfer that use TCP are ftp or another TCP based SMB server.

If you want to test against something like a NT or WfWg server then you will have to disable all but TCP on either the client or server. Otherwise you may well be using a totally different protocol (such as Netbeui) and comparisons may not be valid.

Generally you should find that Samba performs similarly to ftp at raw transfer speed. It should perform quite a bit faster than NFS, although this very much depends on your system.

Several people have done comparisons between Samba and Novell, NFS or WinNT. In some cases Samba performed the best, in others the worst. I suspect the biggest factor is not Samba vs some other system but the hardware and drivers used on the various systems. Given similar hardware Samba should certainly be competitive in speed with other systems.

16.2. Oplocks

16.3. Socket options

There are a number of socket options that can greatly affect the performance of a TCP based server like Samba.

The socket options that Samba uses are settable both on the command line with the -O option, or in the smb.conf file.

The "socket options" section of the smb.conf manual page describes how to set these and gives recommendations.

Getting the socket options right can make a big difference to your performance, but getting them wrong can degrade it by just as much. The correct settings are very dependent on your local network.

The socket option TCP_NODELAY is the one that seems to make the biggest single difference for most networks. Many people report that adding "socket options = TCP_NODELAY" doubles the read performance of a Samba drive. The best explanation I have seen for this is that the Microsoft TCP/IP stack is slow in sending tcp ACKs.

16.4. Read size

The option "read size" affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger than this value then the server begins writing the data before it has received the whole packet from the network, or in the case of SMBreadbraw, it begins writing to the network before all the data has been read from disk.

This overlapping works best when the speeds of disk and network access are similar, having very little effect when the speed of one is much greater than the other.

The default value is 16384, but very little experimentation has been done yet to determine the optimal value, and it is likely that the best value will vary greatly between systems anyway. A value over 65536 is pointless and will cause you to allocate memory unnecessarily.

16.5. Max xmit

At startup the client and server negotiate a "maximum transmit" size, which limits the size of nearly all SMB commands. You can set the maximum size that Samba will negotiate using the "max xmit = " option in smb.conf. Note that this is the maximum size of SMB request that Samba will accept, but not the maximum size that the *client* will accept. The client maximum receive size is sent to Samba by the client and Samba honours this limit.

It defaults to 65536 bytes (the maximum), but it is possible that some clients may perform better with a smaller transmit unit. Trying values of less than 2048 is likely to cause severe problems.

In most cases the default is the best option.

16.6. Locking

By default Samba does not implement strict locking on each read/write call (although it did in previous versions). If you enable strict locking (using "strict locking = yes") then you may find that you suffer a severe performance hit on some systems.

The performance hit will probably be greater on NFS mounted filesystems, but could be quite high even on local disks.

16.7. Share modes

Some people find that opening files is very slow. This is often because of the "share modes" code needed to fully implement the dos share modes stuff. You can disable this code using "share modes = no". This will gain you a lot in opening and closing files but will mean that (in some cases) the system won't force a second user of a file to open the file read-only if the first has it open read-write. For many applications that do their own locking this doesn't matter, but for some it may. Most Windows applications depend heavily on "share modes" working correctly and it is recommended that the Samba share mode support be left at the default of "on".

The share mode code in Samba has been re-written in the 1.9.17 release following tests with the Ziff-Davis NetBench PC Benchmarking tool. It is now believed that Samba 1.9.17 implements share modes similarly to Windows NT.

NOTE: In the most recent versions of Samba there is an option to use shared memory via mmap() to implement the share modes. This makes things much faster. See the Makefile for how to enable this.

16.8. Log level

If you set the log level (also known as "debug level") higher than 2 then you may suffer a large drop in performance. This is because the server flushes the log file after each operation, which can be very expensive.

16.9. Wide lines

The "wide links" option is now enabled by default, but if you disable it (for better security) then you may suffer a performance hit in resolving filenames. The performance loss is lessened if you have "getwd cache = yes", which is now the default.

16.10. Read raw

The "read raw" operation is designed to be an optimised, low-latency file read operation. A server may choose to not support it, however. and Samba makes support for "read raw" optional, with it being enabled by default.

In some cases clients don't handle "read raw" very well and actually get lower performance using it than they get using the conventional read operations.

So you might like to try "read raw = no" and see what happens on your network. It might lower, raise or not affect your performance. Only testing can really tell.

16.11. Write raw

The "write raw" operation is designed to be an optimised, low-latency file write operation. A server may choose to not support it, however. and Samba makes support for "write raw" optional, with it being enabled by default.

Some machines may find "write raw" slower than normal write, in which case you may wish to change this option.

16.12. Read prediction

Samba can do read prediction on some of the SMB commands. Read prediction means that Samba reads some extra data on the last file it read while waiting for the next SMB command to arrive. It can then respond more quickly when the next read request arrives.

This is disabled by default. You can enable it by using "read prediction = yes".

Note that read prediction is only used on files that were opened read only.

Read prediction should particularly help for those silly clients (such as "Write" under NT) which do lots of very small reads on a file.

Samba will not read ahead more data than the amount specified in the "read size" option. It always reads ahead on 1k block boundaries.

16.13. Memory mapping

Samba supports reading files via memory mapping them. One some machines this can give a large boost to performance, on others it makes not difference at all, and on some it may reduce performance.

To enable you you have to recompile Samba with the -DUSE_MMAP option on the FLAGS line of the Makefile.

Note that memory mapping is only used on files opened read only, and is not used by the "read raw" operation. Thus you may find memory mapping is more effective if you disable "read raw" using "read raw = no".

16.14. Slow Clients

One person has reported that setting the protocol to COREPLUS rather than LANMAN2 gave a dramatic speed improvement (from 10k/s to 150k/s).

I suspect that his PC's (386sx16 based) were asking for more data than they could chew. I suspect a similar speed could be had by setting "read raw = no" and "max xmit = 2048", instead of changing the protocol. Lowering the "read size" might also help.

16.15. Slow Logins

Slow logins are almost always due to the password checking time. Using the lowest practical "password level" will improve things a lot. You could also enable the "UFC crypt" option in the Makefile.

16.16. Client tuning

Often a speed problem can be traced to the client. The client (for example Windows for Workgroups) can often be tuned for better TCP performance.

See your client docs for details. In particular, I have heard rumours that the WfWg options TCPWINDOWSIZE and TCPSEGMENTSIZE can have a large impact on performance.

Also note that some people have found that setting DefaultRcvWindow in the [MSTCP] section of the SYSTEM.INI file under WfWg to 3072 gives a big improvement. I don't know why.

My own experience wth DefaultRcvWindow is that I get much better performance with a large value (16384 or larger). Other people have reported that anything over 3072 slows things down enourmously. One person even reported a speed drop of a factor of 30 when he went from 3072 to 8192. I don't know why.

It probably depends a lot on your hardware, and the type of unix box you have at the other end of the link.

Paul Cochrane has done some testing on client side tuning and come to the following conclusions:

Install the W2setup.exe file from www.microsoft.com. This is an update for the winsock stack and utilities which improve performance.

Configure the win95 TCPIP registry settings to give better perfomance. I use a program called MTUSPEED.exe which I got off the net. There are various other utilities of this type freely available. The setting which give the best performance for me are:

1. MaxMTU Remove

2. RWIN Remove

3. MTUAutoDiscover Disable

4. MTUBlackHoleDetect Disable

5. Time To Live Enabled

6. Time To Live - HOPS 32

7. NDI Cache Size 0

I tried virtually all of the items mentioned in the document and the only one which made a difference to me was the socket options. It turned out I was better off without any!!!!!

In terms of overall speed of transfer, between various win95 clients and a DX2-66 20MB server with a crappy NE2000 compatible and old IDE drive (Kernel 2.0.30). The transfer rate was reasonable for 10 baseT.

FIXME The figures are: Put Get P166 client 3Com card: 420-440kB/s 500-520kB/s P100 client 3Com card: 390-410kB/s 490-510kB/s DX4-75 client NE2000: 370-380kB/s 330-350kB/s

I based these test on transfer two files a 4.5MB text file and a 15MB textfile. The results arn't bad considering the hardware Samba is running on. It's a crap machine!!!!

The updates mentioned in 1 and 2 brought up the transfer rates from just over 100kB/s in some clients.

A new client is a P333 connected via a 100MB/s card and hub. The transfer rates from this were good: 450-500kB/s on put and 600+kB/s on get.

Looking at standard FTP throughput, Samba is a bit slower (100kB/s upwards). I suppose there is more going on in the samba protocol, but if it could get up to the rate of FTP the perfomance would be quite staggering.

16.17. My Results

Some people want to see real numbers in a document like this, so here they are. I have a 486sx33 client running WfWg 3.11 with the 3.11b tcp/ip stack. It has a slow IDE drive and 20Mb of ram. It has a SMC Elite-16 ISA bus ethernet card. The only WfWg tuning I've done is to set DefaultRcvWindow in the [MSTCP] section of system.ini to 16384. My server is a 486dx3-66 running Linux. It also has 20Mb of ram and a SMC Elite-16 card. You can see my server config in the examples/tridge/ subdirectory of the distribution.

I get 490k/s on reading a 8Mb file with copy. I get 441k/s writing the same file to the samba server.

Of course, there's a lot more to benchmarks than 2 raw throughput figures, but it gives you a ballpark figure.

I've also tested Win95 and WinNT, and found WinNT gave me the best speed as a samba client. The fastest client of all (for me) is smbclient running on another linux box. Maybe I'll add those results here someday ...

17.1. FAQs

18.1. Introduction

Samba is developed in an open environment. Developers use CVS (Concurrent Versioning System) to "checkin" (also known as "commit") new source code. Samba's various CVS branches can be accessed via anonymous CVS using the instructions detailed in this chapter.

This document is a modified version of the instructions found at http://samba.org/samba/cvs.html

18.2. CVS Access to samba.org

The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, including samba, rsync and jitterbug. There are two main ways of accessing the CVS server on this host.

19.1. Introduction

The email address for bug reports is samba@samba.org

Please take the time to read this file before you submit a bug report. Also, please see if it has changed between releases, as we may be changing the bug reporting mechanism at some time.

Please also do as much as you can yourself to help track down the bug. Samba is maintained by a dedicated group of people who volunteer their time, skills and efforts. We receive far more mail about it than we can possibly answer, so you have a much higher chance of an answer and a fix if you send us a "developer friendly" bug report that lets us fix it fast.

Do not assume that if you post the bug to the comp.protocols.smb newsgroup or the mailing list that we will read it. If you suspect that your problem is not a bug but a configuration problem then it is better to send it to the Samba mailing list, as there are (at last count) 5000 other users on that list that may be able to help you.

You may also like to look though the recent mailing list archives, which are conveniently accessible on the Samba web pages at http://samba.org/samba/

19.2. General info

Before submitting a bug report check your config for silly errors. Look in your log files for obvious messages that tell you that you've misconfigured something and run testparm to test your config file for correct syntax.

Have you run through the diagnosis? This is very important.

If you include part of a log file with your bug report then be sure to annotate it with exactly what you were doing on the client at the time, and exactly what the results were.

19.3. Debug levels

If the bug has anything to do with Samba behaving incorrectly as a server (like refusing to open a file) then the log files will probably be very useful. Depending on the problem a log level of between 3 and 10 showing the problem may be appropriate. A higher level givesmore detail, but may use too much disk space.

To set the debug level use log level = in your smb.conf. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. To do this use:

log level = 10 log file = /usr/local/samba/lib/log.%m include = /usr/local/samba/lib/smb.conf.%m

then create a file /usr/local/samba/lib/smb.conf.machine where "machine" is the name of the client you wish to debug. In that file put any smb.conf commands you want, for example log level= may be useful. This also allows you to experiment with different security systems, protocol levels etc on just one machine.

The smb.conf entry log level = is synonymous with the entry debuglevel = that has been used in older versions of Samba and is being retained for backwards compatibility of smb.conf files.

As the log level = value is increased you will record a significantly increasing level of debugging information. For most debugging operations you may not need a setting higher than 3. Nearly all bugs can be tracked at a setting of 10, but be prepared for a VERY large volume of log data.

19.4. Internal errors

If you get a "INTERNAL ERROR" message in your log files it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless you have faulty hardware or system software)

If the message came from smbd then it will probably be accompanied by a message which details the last SMB message received by smbd. This info is often very useful in tracking down the problem so please include it in your bug report.

You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed.

You may also find that a core file appeared in a "corefiles" subdirectory of the directory where you keep your samba log files. This file is the most useful tool for tracking down the bug. To use it you do this:

gdb smbd core

adding appropriate paths to smbd and core so gdb can find them. If you don't have gdb then try "dbx". Then within the debugger use the command "where" to give a stack trace of where the problem occurred. Include this in your mail.

If you known any assembly language then do a "disass" of the routine where the problem occurred (if its in a library routine then disassemble the routine that called it) and try to work out exactly where the problem is by looking at the surrounding code. Even if you don't know assembly then incuding this info in the bug report can be useful.

19.5. Attaching to a running process

Unfortunately some unixes (in particular some recent linux kernels) refuse to dump a core file if the task has changed uid (which smbd does often). To debug with this sort of system you could try to attach to the running process using "gdb smbd PID" where you get PID from smbstatus. Then use "c" to continue and try to cause the core dump using the client. The debugger should catch the fault and tell you where it occurred.

19.6. Patches

The best sort of bug report is one that includes a fix! If you send us patches please use diff -u format if your version of diff supports it, otherwise use diff -c4. Make sure your do the diff against a clean version of the source and let me know exactly what version you used.