--- /dev/null
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. The 500-User Office</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.68.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="secure.html" title="Chapter 3. Secure Office Networking"><link rel="next" href="happy.html" title="Chapter 5. Making Happy Users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. The 500-User Office</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Big500users"></a>Chapter 4. The 500-User Office</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="Big500users.html#id2532852">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2532897">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2532996">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2533032">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2533234">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2533257">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2533987">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2534551">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2537859">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2537918">Questions and Answers</a></span></dt></dl></div><p>
+ The Samba-3 networking you explored in <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a> covers the finer points of
+ configuration of peripheral services such as DHCP and DNS, and WINS. You experienced
+ implementation of a simple configuration of the services that are important adjuncts
+ to successful deployment of Samba.
+ </p><p>
+ An analysis of the history of postings to the Samba mailing list easily demonstrates
+ that the two most prevalent Samba problem areas are
+ </p><div class="itemizedlist"><ul type="disc"><li><p>
+ Defective resolution of a NetBIOS name to its IP address
+ </p></li><li><p>
+ Printing problems
+ </p></li></ul></div><p>
+ The exercises
+ so far in this book have focused on implementation of the simplest printing processes
+ involving no print job processing intelligence. In this chapter, you maintain
+ that same approach to printing, but <a href="happy.html" title="Chapter 5. Making Happy Users">???</a> presents an opportunity
+ to make printing more complex for the administrator while making it easier for the user.
+ </p><p>
+ <a class="indexterm" name="id2532788"></a>
+ <a class="indexterm" name="id2532795"></a>
+ <a class="indexterm" name="id2532802"></a>
+ <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a> demonstrates operation of a DHCP server and a DNS server
+ as well as a central WINS server. You validated the operation of these services and
+ saw an effective implementation of a Samba domain controller using the
+ <em class="parameter"><code>tdbsam</code></em> passdb backend.
+ </p><p>
+ The objective of this chapter is to introduce more complex techniques that can be used to
+ improve manageability of Samba as networking needs grow. In this chapter, you implement
+ a distributed DHCP server environment, a distributed DNS server arrangement, a centralized
+ WINS server, and a centralized Samba domain controller.
+ </p><p>
+ A note of caution is important regarding the Samba configuration that is used in this
+ chapter. The use of a single domain controller on a routed, multisegment network is
+ a poor design choice that leads to potential network user complaints.
+ This chapter demonstrates some successful
+ techniques in deployment and configuration management. This should be viewed as a
+ foundation chapter for complex Samba deployments.
+ </p><p>
+ As you master the techniques presented here, you may find much better methods to
+ improve network management and control while reducing human resource overheads.
+ You should take the opportunity to innovate and expand on the methods presented
+ here and explore them to the fullest.
+ </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2532852"></a>Introduction</h2></div></div></div><p>
+ Business continues to go well for Abmas. Mr. Meany is driving your success and the
+ network continues to grow thanks to the hard work Christine has done. You recently
+ hired Stanley Soroka as manager of information systems. Christine recommended Stan
+ to the role. She told you Stan is so good at handling Samba that he can make a cast
+ iron rocking horse that is embedded in concrete kick like a horse at a rodeo. You
+ need skills like his. Christine and Stan get along just fine. Let's see what
+ you can get out of this pair as they plot the next-generation networks.
+ </p><p>
+ Ten months ago Abmas closed an acquisition of a property insurance business. The
+ founder lost interest in the business and decided to sell it to Mr. Meany. Because
+ they were former university classmates, the purchase was concluded with mutual assent.
+ The acquired business is located at the other end of town in much larger facilities.
+ The old Abmas building has become too small. Located on the same campus as the newly
+ acquired business are two empty buildings that are ideal to provide Abmas with
+ opportunity for growth.
+ </p><p>
+ Abmas has now completed the purchase of the two empty buildings, and you are
+ to install a new network and relocate staff in nicely furnished new facilities.
+ The new network is to be used to fully integrate company operations. You have
+ decided to locate the new network operations control center in the larger building
+ in which the insurance group is located to take advantage of an ideal floor space
+ and to allow Stan and Christine to fully stage the new network and test it before
+ it is rolled out. Your strategy is to complete the new network so that it
+ is ready for operation when the old office moves into the new premises.
+ </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2532897"></a>Assignment Tasks</h3></div></div></div><p>
+ The acquired business had 280 network users. The old Abmas building housed
+ 220 network users in unbelievably cramped conditions. The network that
+ initially served 130 users now handles 220 users quite well.
+ </p><p>
+ The two businesses will be fully merged to create a single campus company.
+ The Property Insurance Group (PIG) houses 300 employees, the new Accounting
+ Services Group (ASG) will be in a small building (BLDG1) that houses 50
+ employees, and the Financial Services Group (FSG) will be housed in a large
+ building that has capacity for growth (BLDG2). Building 2 houses 150 network
+ users.
+ </p><p>
+ You have decided to connect the building using fiber optic links between new
+ routers. As a backup, the buildings are interconnected using line-of-sight
+ high-speed infrared facilities. The infrared connection provides a
+ secondary route to be used during periods of high demand for network
+ bandwidth.
+ </p><p>
+ The Internet gateway is upgraded to 15 Mb/sec service. Your ISP
+ provides on your premises a fully managed Cisco PIX firewall. You no longer need
+ to worry about firewall facilities on your network.
+ </p><p>
+ Stanley and Christine have purchased new server hardware. Christine wants to
+ roll out a network that has whistles and bells. Stan wants to start off with
+ a simple to manage, not-too-complex network. He believes that network
+ users need to be gradually introduced to new features and capabilities and not
+ rushed into an environment that may cause disorientation and loss of productivity.
+ </p><p>
+ Your intrepid network team has decided to implement a network configuration
+ that closely mirrors the successful system you installed in the old Abmas building.
+ The new network infrastructure is owned by Abmas, but all desktop systems
+ are being procured through a new out-source services and leasing company. Under
+ the terms of a deal with Mr. M. Proper (CEO), DirectPointe, Inc., provides
+ all desktop systems and includes full level-one help desk support for
+ a flat per-machine monthly fee. The deal allows you to add workstations on demand.
+ This frees Stan and Christine to deal with deeper issues as they emerge and
+ permits Stan to work on creating new future value-added services.
+ </p><p>
+ DirectPointe Inc. receives from you a new standard desktop configuration
+ every four months. They automatically roll that out to each desktop system.
+ You must keep DirectPointe informed of all changes.
+ </p><p><a class="indexterm" name="id2532968"></a>
+ The new network has a single Samba Primary Domain Controller (PDC) located in the
+ Network Operation Center (NOC). Buildings 1 and 2 each have a local server
+ for local application servicing. It is a domain member. The new system
+ uses the <em class="parameter"><code>tdbsam</code></em> passdb backend.
+ </p><p>
+ Printing is based on raw pass-through facilities just as it has been used so far.
+ All printer drivers are installed on the desktop and notebook computers.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2532996"></a>Dissection and Discussion</h2></div></div></div><p>
+ <a class="indexterm" name="id2533004"></a>
+ The example you are building in this chapter is of a network design that works, but this
+ does not make it a design that is recommended. As a general rule, there should be at least
+ one Backup Domain Controller (BDC) per 150 Windows network clients. The principle behind
+ this recommendation is that correct operation of MS Windows clients requires rapid
+ network response to all SMB/CIFS requests. The same rule says that if there are more than
+ 50 clients per domain controller, they are too busy to service requests. Let's put such
+ rules aside and recognize that network load affects the integrity of domain controller
+ responsiveness. This network will have 500 clients serviced by one central domain
+ controller. This is not a good omen for user satisfaction. You, of course, address this
+ very soon (see <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>).
+ </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2533032"></a>Technical Issues</h3></div></div></div><p>
+ Stan has talked you into a horrible compromise, but it is addressed. Just make
+ certain that the performance of this network is well validated before going live.
+ </p><p>
+ Design decisions made in this design include the following:
+ </p><div class="itemizedlist"><ul type="disc"><li><p>
+ <a class="indexterm" name="id2533053"></a>
+ <a class="indexterm" name="id2533060"></a>
+ <a class="indexterm" name="id2533067"></a>
+ A single PDC is being implemented. This limitation is based on the choice not to
+ use LDAP. Many network administrators fear using LDAP because of the perceived
+ complexity of implementation and management of an LDAP-based backend for all user
+ identity management as well as to store network access credentials.
+ </p></li><li><p>
+ <a class="indexterm" name="id2533083"></a>
+ <a class="indexterm" name="id2533090"></a>
+ Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the
+ only choice that makes sense with 500 users is to use the tdbsam passwd backend.
+ This type of backend is not receptive to replication to BDCs. If the tdbsam
+ <code class="filename">passdb.tdb</code> file is replicated to BDCs using
+ <span><strong class="command">rsync</strong></span>, there are two potential problems: (1) data that is in
+ memory but not yet written to disk will not be replicated, and (2) domain member
+ machines periodically change the secret machine password. When this happens, there
+ is no mechanism to return the changed password to the PDC.
+ </p></li><li><p>
+ All domain user, group, and machine accounts are managed on the PDC. This makes
+ for a simple mode of operation but has to be balanced with network performance and
+ integrity of operations considerations.
+ </p></li><li><p>
+ <a class="indexterm" name="id2533131"></a>
+ A single central WINS server is being used. The PDC is also the WINS server.
+ Any attempt to operate a routed network without a WINS server while using NetBIOS
+ over TCP/IP protocols does not work unless on each client the name resolution
+ entries for the PDC are added to the <code class="filename">LMHOSTS</code>. This file is
+ normally located on the Windows XP Professional client in the
+ <code class="filename">C:\WINDOWS\SYSTEM32\ETC\DRIVERS</code> directory.
+ </p></li><li><p>
+ At this time the Samba WINS database cannot be replicated. That is
+ why a single WINS server is being implemented. This should work without a problem.
+ </p></li><li><p>
+ <a class="indexterm" name="id2533168"></a>
+ BDCs make use of <span><strong class="command">winbindd</strong></span> to provide
+ access to domain security credentials for file system access and object storage.
+ </p></li><li><p>
+ <a class="indexterm" name="id2533187"></a>
+ <a class="indexterm" name="id2533196"></a>
+ Configuration of Windows XP Professional clients is achieved using DHCP. Each
+ subnet has its own DHCP server. Backup DHCP serving is provided by one
+ alternate DHCP server. This necessitates enabling of the DHCP Relay agent on
+ all routers. The DHCP Relay agent must be programmed to pass DHCP Requests from the
+ network directed at the backup DHCP server.
+ </p></li><li><p>
+ All network users are granted the ability to print to any printer that is
+ network-attached. All printers are available from each server. Print jobs that
+ are spooled to a printer that is not on the local network segment are automatically
+ routed to the print spooler that is in control of that printer. The specific details
+ of how this might be done are demonstrated for one example only.
+ </p></li><li><p>
+ The network address and subnetmask chosen provide 1022 usable IP addresses in
+ each subnet. If in the future more addresses are required, it would make sense
+ to add further subnets rather than change addressing.
+ </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2533234"></a>Political Issues</h3></div></div></div><p>
+ This case gets close to the real world. You and I know the right way to implement
+ domain control. Politically, we have to navigate a minefield. In this case, the need is to
+ get the PDC rolled out in compliance with expectations and also to be ready to save the day
+ by having the real solution ready before it is needed. That real solution is presented in
+ <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>.
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2533257"></a>Implementation</h2></div></div></div><p>
+ The following configuration process begins following installation of Red Hat Fedora Core2 on the
+ three servers shown in the network topology diagram in <a href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">???</a>. You have
+ selected hardware that is appropriate to the task.
+ </p><div class="figure"><a name="chap05net"></a><p class="title"><b>Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.</b></p><div class="mediaobject"><img src="images/chap5-net.png" width="270" alt="Network Topology 500 User Network Using tdbsam passdb backend."></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-dnshcp-setup"></a>Installation of DHCP, DNS, and Samba Control Files</h3></div></div></div><p>
+ Carefully install the configuration files into the correct locations as shown in
+ <a href="Big500users.html#ch5-filelocations" title="Table 4.1. Domain: MEGANET, File Locations for Servers">???</a>. You should validate that the full file path is
+ correct as shown.
+ </p><p>
+ The abbreviation shown in this table as <code class="constant">{VLN}</code> refers to
+ the directory location beginning with <code class="filename">/var/lib/named</code>.
+ </p><div class="table"><a name="ch5-filelocations"></a><p class="title"><b>Table 4.1. Domain: <code class="constant">MEGANET</code>, File Locations for Servers</b></p><table summary="Domain: MEGANET, File Locations for Servers" border="1"><colgroup><col align="left"><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th colspan="2" align="center">File Information</th><th colspan="3" align="center">Server Name</th></tr><tr><th align="center">Source</th><th align="center">Target Location</th><th align="center">MASSIVE</th><th align="center">BLDG1</th><th align="center">BLDG2</th></tr></thead><tbody><tr><td align="left"><a href="Big500users.html#ch5-massivesmb" title="Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf">???</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#ch5-dc-common" title="Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf">???</a></td><td align="left"><code class="filename">/etc/samba/dc-common.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#ch5-commonsmb" title="Example 4.3. Common Samba Configuration File: /etc/samba/common.conf">???</a></td><td align="left"><code class="filename">/etc/samba/common.conf</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="Big500users.html#ch5-bldg1-smb" title="Example 4.4. Server: BLDG1 (Member), File: smb.conf">???</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#ch5-bldg2-smb" title="Example 4.5. Server: BLDG2 (Member), File: smb.conf">???</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a href="Big500users.html#ch5-dommem-smb" title="Example 4.6. Common Domain Member Include File: dom-mem.conf">???</a></td><td align="left"><code class="filename">/etc/samba/dommem.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="Big500users.html#massive-dhcp" title="Example 4.7. Server: MASSIVE, File: dhcpd.conf">???</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#bldg1dhcp" title="Example 4.8. Server: BLDG1, File: dhcpd.conf">???</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#bldg2dhcp" title="Example 4.9. Server: BLDG2, File: dhcpd.conf">???</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a href="Big500users.html#massive-nameda" title="Example 4.10. Server: MASSIVE, File: named.conf, Part: A">???</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#massive-namedb" title="Example 4.11. Server: MASSIVE, File: named.conf, Part: B">???</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#massive-namedc" title="Example 4.12. Server: MASSIVE, File: named.conf, Part: C">???</a></td><td align="left"><code class="filename">/etc/named.conf (part C)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#abmasbizdns" title="Example 4.13. Forward Zone File: abmas.biz.hosts">???</a></td><td align="left"><code class="filename">{VLN}/master/abmas.biz.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#abmasusdns" title="Example 4.14. Forward Zone File: abmas.biz.hosts">???</a></td><td align="left"><code class="filename">{VLN}/master/abmas.us.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#bldg12nameda" title="Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A">???</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="Big500users.html#bldg12namedb" title="Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B">???</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">???</a></td><td align="left"><code class="filename">{VLN}/localhost.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">???</a></td><td align="left"><code class="filename">{VLN}/127.0.0.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">???</a></td><td align="left"><code class="filename">{VLN}/root.hint</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr></tbody></table></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2533987"></a>Server Preparation: All Servers</h3></div></div></div><p>
+ The following steps apply to all servers. Follow each step carefully.
+ </p><div class="procedure"><a name="id2533998"></a><p class="title"><b>Procedure 4.1. Server Preparation Steps</b></p><ol type="1"><li><p>
+ Using the UNIX/Linux system tools, set the name of the server as shown in the network
+ topology diagram in <a href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">???</a>. For SUSE Linux products, the tool
+ that permits this is called <span><strong class="command">yast2</strong></span>; for Red Hat Linux products,
+ you can use the <span><strong class="command">netcfg</strong></span> tool.
+ Verify that your hostname is correctly set by running:
+</p><pre class="screen">
+<code class="prompt">root# </code> uname -n
+</pre><p>
+ An alternate method to verify the hostname is:
+</p><pre class="screen">
+<code class="prompt">root# </code> hostname -f
+</pre><p>
+ </p></li><li><p>
+ <a class="indexterm" name="id2534062"></a>
+ <a class="indexterm" name="id2534069"></a>
+ Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses
+ of all network interfaces that are on the host server. This is necessary so that during
+ startup the system is able to resolve all its own names to the IP address prior to
+ startup of the DNS server. You should check the startup order of your system. If the
+ CUPS print server is started before the DNS server (<span><strong class="command">named</strong></span>), you
+ should also include an entry for the printers in the <code class="filename">/etc/hosts</code> file.
+ </p></li><li><p>
+ <a class="indexterm" name="id2534107"></a>
+ All DNS name resolution should be handled locally. To ensure that the server is configured
+ correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> so it has the following
+ content:
+</p><pre class="screen">
+search abmas.us abmas.biz
+nameserver 127.0.0.1
+</pre><p>
+ This instructs the name resolver function (when configured correctly) to ask the DNS server
+ that is running locally to resolve names to addresses.
+ </p></li><li><p>
+ <a class="indexterm" name="id2534139"></a>
+ <a class="indexterm" name="id2534146"></a>
+ Add the <code class="constant">root</code> user to the password backend:
+</p><pre class="screen">
+<code class="prompt">root# </code> smbpasswd -a root
+New SMB password: XXXXXXXX
+Retype new SMB password: XXXXXXXX
+<code class="prompt">root# </code>
+</pre><p>
+ The <code class="constant">root</code> account is the UNIX equivalent of the Windows domain administrator.
+ This account is essential in the regular maintenance of your Samba server. It must never be
+ deleted. If for any reason the account is deleted, you may not be able to recreate this account
+ without considerable trouble.
+ </p></li><li><p>
+ <a class="indexterm" name="id2534191"></a>
+ <a class="indexterm" name="id2534198"></a>
+ Create the username map file to permit the <code class="constant">root</code> account to be called
+ <code class="constant">Administrator</code> from the Windows network environment. To do this, create
+ the file <code class="filename">/etc/samba/smbusers</code> with the following contents:
+</p><pre class="screen">
+####
+# User mapping file
+####
+# File Format
+# -----------
+# Unix_ID = Windows_ID
+#
+# Examples:
+# root = Administrator
+# janes = "Jane Smith"
+# jimbo = Jim Bones
+#
+# Note: If the name contains a space it must be double quoted.
+# In the example above the name 'jimbo' will be mapped to Windows
+# user names 'Jim' and 'Bones' because the space was not quoted.
+#######################################################################
+root = Administrator
+####
+# End of File
+####
+</pre><p>
+ </p></li><li><p>
+ Configure all network-attached printers to have a fixed IP address.
+ </p></li><li><p>
+ Create an entry in the DNS database on the server <code class="constant">MASSIVE</code>
+ in both the forward lookup database for the zone <code class="constant">abmas.biz.hosts</code>
+ and in the reverse lookup database for the network segment that the printer is
+ located in. Example configuration files for similar zones were presented in <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a>,
+ <a href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">???</a> and <a href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">???</a>.
+ </p></li><li><p>
+ Follow the instructions in the printer manufacturer's manuals to permit printing
+ to port 9100. Use any other port the manufacturer specifies for direct mode,
+ raw printing. This allows the CUPS spooler to print using raw mode protocols.
+ <a class="indexterm" name="id2534289"></a>
+ <a class="indexterm" name="id2534296"></a>
+ </p></li><li><p>
+ <a class="indexterm" name="id2534310"></a>
+ Only on the server to which the printer is attached configure the CUPS Print
+ Queues as follows:
+</p><pre class="screen">
+<code class="prompt">root# </code> lpadmin -p <em class="parameter"><code>printque</code></em> -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E
+</pre><p>
+ <a class="indexterm" name="id2534345"></a>
+ This step creates the necessary print queue to use no assigned print filter. This
+ is ideal for raw printing, that is, printing without use of filters.
+ The name <em class="parameter"><code>printque</code></em> is the name you have assigned for
+ the particular printer.
+ </p></li><li><p>
+ Print queues may not be enabled at creation. Make certain that the queues
+ you have just created are enabled by executing the following:
+</p><pre class="screen">
+<code class="prompt">root# </code> /usr/bin/enable <em class="parameter"><code>printque</code></em>
+</pre><p>
+ </p></li><li><p>
+ Even though your print queue may be enabled, it is still possible that it
+ does not accept print jobs. A print queue services incoming printing
+ requests only when configured to do so. Ensure that your print queue is
+ set to accept incoming jobs by executing the following command:
+</p><pre class="screen">
+<code class="prompt">root# </code> /usr/bin/accept <em class="parameter"><code>printque</code></em>
+</pre><p>
+ </p></li><li><p>
+ <a class="indexterm" name="id2534424"></a>
+ <a class="indexterm" name="id2534431"></a>
+ <a class="indexterm" name="id2534438"></a>
+ This step, as well as the next one, may be omitted where CUPS version 1.1.18
+ or later is in use. Although it does no harm to follow it anyway, and may
+ help to avoid time spent later trying to figure out why print jobs may be
+ disappearing without a trace. Look at these two steps as <span class="emphasis"><em>insurance</em></span>
+ against lost time. Edit file <code class="filename">/etc/cups/mime.convs</code> to
+ uncomment the line:
+</p><pre class="screen">
+application/octet-stream application/vnd.cups-raw 0 -
+</pre><p>
+ </p></li><li><p>
+ <a class="indexterm" name="id2534474"></a>
+ Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line:
+</p><pre class="screen">
+application/octet-stream
+</pre><p>
+ </p></li><li><p>
+ Refer to the CUPS printing manual for instructions regarding how to configure
+ CUPS so that print queues that reside on CUPS servers on remote networks
+ route print jobs to the print server that owns that queue. The default setting
+ on your CUPS server may automatically discover remotely installed printers and
+ may permit this functionality without requiring specific configuration.
+ </p></li><li><p>
+ As part of the roll-out program, you need to configure the application's
+ server shares. This can be done once on the central server and may then be
+ replicated using a tool such as <span><strong class="command">rsync</strong></span>. Refer to the man
+ page for <span><strong class="command">rsync</strong></span> for details regarding use. The notes in
+ <a href="secure.html#ch4appscfg" title="Application Share Configuration">???</a> may help in your decisions to use an application
+ server facility.
+ </p></li></ol></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+ Logon scripts that are run from a domain controller (PDC or BDC) are capable of using semi-intelligent
+ processes to automap Windows client drives to an application server that is nearest to the client. This
+ is considerably more difficult when a single PDC is used on a routed network. It can be done, but not
+ as elegantly as you see in the next chapter.
+ </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2534551"></a>Server-Specific Preparation</h3></div></div></div><p>
+ There are some steps that apply to particular server functionality only. Each step is critical
+ to correct server operation. The following step-by-step installation guidance will assist you
+ in working through the process of configuring the PDC and then both BDC's.
+ </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2534565"></a>Configuration for Server: <code class="constant">MASSIVE</code></h4></div></div></div><p>
+ The steps presented here attempt to implement Samba installation in a generic manner. While
+ some steps are clearly specific to Linux, it should not be too difficult to apply them to
+ your platform of choice.
+ </p><div class="procedure"><a name="id2534580"></a><p class="title"><b>Procedure 4.2. Primary Domain Controller Preparation</b></p><ol type="1"><li><p>
+ <a class="indexterm" name="id2534592"></a>
+ <a class="indexterm" name="id2534599"></a>
+ The host server acts as a router between the two internal network segments as well
+ as for all Internet access. This necessitates that IP forwarding be enabled. This can be
+ achieved by adding to the <code class="filename">/etc/rc.d/boot.local</code> an entry as follows:
+</p><pre class="screen">
+echo 1 > /proc/sys/net/ipv4/ip_forward
+</pre><p>
+ To ensure that your kernel is capable of IP forwarding during configuration, you may wish to execute
+ that command manually also. This setting permits the Linux system to act as a router.
+ </p></li><li><p>
+ This server is dual hosted (i.e., has two network interfaces) one goes to the Internet
+ and the other to a local network that has a router that is the gateway to the remote networks.
+ You must therefore configure the server with route table entries so that it can find machines
+ on the remote networks. You can do this using the appropriate system tools for your Linux
+ server or using static entries that you place in one of the system startup files. It is best
+ to always use the tools that the operating system vendor provided. In the case of SUSE Linux, the
+ best tool to do this is YaST (refer to SUSE Administration Manual); in the case of Red Hat,
+ this is best done using the graphical system configuration tools (see the Red Hat documentation).
+ An example of how this may be done manually is as follows:
+</p><pre class="screen">
+<code class="prompt">root# </code> route add net 172.16.4.0 netmask 255.255.252.0 gw 172.16.0.128
+<code class="prompt">root# </code> route add net 172.16.8.0 netmask 255.255.252.0 gw 172.16.0.128
+</pre><p>
+ If you just execute these commands manually, the route table entries you have created are
+ not persistent across system reboots. You may add these commands directly to the local
+ startup files as follows: (SUSE) <code class="filename">/etc/rc.d/boot.local</code>, (Red Hat)
+ <code class="filename">/etc/rc.d/init.d/rc.local</code>.
+ </p></li><li><p>
+ <a class="indexterm" name="id2534692"></a>
+ The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file.
+ This file controls the operation of the various resolver libraries that are part of the Linux
+ Glibc libraries. Edit this file so that it contains the following entries:
+</p><pre class="screen">
+hosts: files dns wins
+</pre><p>
+ </p></li><li><p>
+ <a class="indexterm" name="id2534722"></a>
+ Create and map Windows domain groups to UNIX groups. A sample script is provided in
+ <a href="Big500users.html#ch5-initgrps" title="Example 4.17. Initialize Groups Script, File: /etc/samba/initGrps.sh">???</a>. Create a file containing this script. You called yours
+ <code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed
+ and then execute the script. An example of the execution of this script as well as its
+ validation are shown in Section 4.3.2, Step 5.
+ </p></li><li><p>
+ <a class="indexterm" name="id2534754"></a>
+ <a class="indexterm" name="id2534761"></a>
+ <a class="indexterm" name="id2534770"></a>
+ For each user who needs to be given a Windows domain account, make an entry in the
+ <code class="filename">/etc/passwd</code> file as well as in the Samba password backend.
+ Use the system tool of your choice to create the UNIX system account, and use the Samba
+ <span><strong class="command">smbpasswd</strong></span> to create a domain user account.
+ </p><p>
+ <a class="indexterm" name="id2534797"></a>
+ <a class="indexterm" name="id2534804"></a>
+ <a class="indexterm" name="id2534810"></a>
+ There are a number of tools for user management under UNIX, such as
+ <span><strong class="command">useradd</strong></span>, <span><strong class="command">adduser</strong></span>, as well as a plethora of custom
+ tools. With the tool of your choice, create a home directory for each user.
+ </p></li><li><p>
+ Using the preferred tool for your UNIX system, add each user to the UNIX groups created
+ previously as necessary. File system access control is based on UNIX group membership.
+ </p></li><li><p>
+ Create the directory mount point for the disk subsystem that is to be mounted to provide
+ data storage for company files, in this case, the mount point indicated in the <code class="filename">smb.conf</code>
+ file is <code class="filename">/data</code>. Format the file system as required and mount the formatted
+ file system partition using appropriate system tools.
+ </p></li><li><p>
+ <a class="indexterm" name="id2534874"></a>
+ Create the top-level file storage directories for data and applications as follows:
+</p><pre class="screen">
+<code class="prompt">root# </code> mkdir -p /data/{accounts,finsvcs,pidata}
+<code class="prompt">root# </code> mkdir -p /apps
+<code class="prompt">root# </code> chown -R root:root /data
+<code class="prompt">root# </code> chown -R root:root /apps
+<code class="prompt">root# </code> chown -R bjordan:accounts /data/accounts
+<code class="prompt">root# </code> chown -R bjordan:finsvcs /data/finsvcs
+<code class="prompt">root# </code> chown -R bjordan:finsvcs /data/pidata
+<code class="prompt">root# </code> chmod -R ug+rwxs,o-rwx /data
+<code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /apps
+</pre><p>
+ Each department is responsible for creating its own directory structure within the departmental
+ share. The directory root of the <span><strong class="command">accounts</strong></span> share is <code class="filename">/data/accounts</code>.
+ The directory root of the <span><strong class="command">finsvcs</strong></span> share is <code class="filename">/data/finsvcs</code>.
+ The <code class="filename">/apps</code> directory is the root of the <code class="constant">apps</code> share
+ that provides the application server infrastructure.
+ </p></li><li><p>
+ The <code class="filename">smb.conf</code> file specifies an infrastructure to support roaming profiles and network
+ logon services. You can now create the file system infrastructure to provide the
+ locations on disk that these services require. Adequate planning is essential
+ because desktop profiles can grow to be quite large. For planning purposes, a minimum of
+ 200 MB of storage should be allowed per user for profile storage. The following
+ commands create the directory infrastructure needed:
+</p><pre class="screen">
+<code class="prompt">root# </code> mkdir -p /var/spool/samba
+<code class="prompt">root# </code> mkdir -p /var/lib/samba/{netlogon/scripts,profiles}
+<code class="prompt">root# </code> chown -R root:root /var/spool/samba
+<code class="prompt">root# </code> chown -R root:root /var/lib/samba
+<code class="prompt">root# </code> chmod a+rwxt /var/spool/samba
+</pre><p>
+ For each user account that is created on the system, the following commands should be
+ executed:
+</p><pre class="screen">
+<code class="prompt">root# </code> mkdir /var/lib/samba/profiles/'username'
+<code class="prompt">root# </code> chown 'username':users /var/lib/samba/profiles/'username'
+<code class="prompt">root# </code> chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username'
+</pre><p>
+ </p></li><li><p>
+ <a class="indexterm" name="id2535080"></a>
+ <a class="indexterm" name="id2535087"></a>
+ Create a logon script. It is important that each line is correctly terminated with
+ a carriage return and line-feed combination (i.e., DOS encoding). The following procedure
+ works if the right tools (<code class="constant">unxi2dos</code> and <code class="constant">dos2unix</code>) are installed.
+ First, create a file called <code class="filename">/var/lib/samba/netlogon/scripts/logon.bat.unix</code>
+ with the following contents:
+</p><pre class="screen">
+net time \\massive /set /yes
+net use h: /home
+</pre><p>
+ Convert the UNIX file to a DOS file:
+</p><pre class="screen">
+<code class="prompt">root# </code> dos2unix < /var/lib/samba/netlogon/scripts/logon.bat.unix \
+ > /var/lib/samba/netlogon/scripts/logon.bat
+</pre><p>
+ </p></li><li><p>
+ There is one preparatory step without which you cannot have a working Samba network
+ environment. You must add an account for each network user. You can do this by executing
+ the following steps for each user:
+</p><pre class="screen">
+<code class="prompt">root# </code> useradd -m <em class="parameter"><code>username</code></em>
+<code class="prompt">root# </code> passwd <em class="parameter"><code>username</code></em>
+Changing password for <em class="parameter"><code>username</code></em>.
+New password: XXXXXXXX
+Re-enter new password: XXXXXXXX
+Password changed
+<code class="prompt">root# </code> smbpasswd -a <em class="parameter"><code>username</code></em>
+New SMB password: XXXXXXXX
+Retype new SMB password: XXXXXXXX
+Added user <em class="parameter"><code>username</code></em>.
+</pre><p>
+ You do, of course, use a valid user login ID in place of <em class="parameter"><code>username</code></em>.
+ </p></li><li><p>
+ Follow the processes shown in <a href="Big500users.html#ch5-procstart" title="Process Startup Configuration">???</a> to start all services.
+ </p></li><li><p>
+ Your server is ready for validation testing. Do not proceed with the steps in
+ <a href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">???</a> until after the operation of the server has been
+ validated following the same methods as outlined in <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a>, <a href="secure.html#ch4valid" title="Validation">???</a>.
+ </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="ch5-domsvrspec"></a>Configuration Specific to Domain Member Servers: <code class="constant">BLDG1, BLDG2</code></h4></div></div></div><p>
+ The following steps will guide you through the nuances of implementing BDCs for the broadcast
+ isolated network segments. Remember that if the target installation platform is not Linux, it may
+ be necessary to adapt some commands to the equivalent on the target platform.
+ </p><div class="procedure"><a name="id2535273"></a><p class="title"><b>Procedure 4.3. Backup Domain Controller Configuration Steps</b></p><ol type="1"><li><p>
+ <a class="indexterm" name="id2535285"></a>
+ The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file.
+ This file controls the operation of the various resolver libraries that are part of the Linux
+ Glibc libraries. Edit this file so that it contains the following entries:
+</p><pre class="screen">
+passwd: files winbind
+group: files winbind
+hosts: files dns wins
+</pre><p>
+ </p></li><li><p>
+ Follow the steps outlined in <a href="Big500users.html#ch5-procstart" title="Process Startup Configuration">???</a> to start all services. Do not
+ start Samba at this time. Samba is controlled by the process called <span><strong class="command">smb</strong></span>.
+ </p></li><li><p>
+ <a class="indexterm" name="id2535337"></a>
+ You must now attempt to join the domain member servers to the domain. The following
+ instructions should be executed to effect this:
+</p><pre class="screen">
+<code class="prompt">root# </code> net rpc join
+</pre><p>
+ </p></li><li><p>
+ <a class="indexterm" name="id2535369"></a>
+ You now start the Samba services by executing:
+</p><pre class="screen">
+<code class="prompt">root# </code> service smb start
+</pre><p>
+ </p></li><li><p>
+ Your server is ready for validation testing. Do not proceed with the steps in
+ <a href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">???</a> until after the operation of the server has been
+ validated following the same methods as outlined in <a href="secure.html#ch4valid" title="Validation">???</a>.
+ </p></li></ol></div></div></div><div class="example"><a name="ch5-massivesmb"></a><p class="title"><b>Example 4.1. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></b></p><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2535455"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2535467"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2535480"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2535493"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2535506"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2535519"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2535532"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2535545"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2535558"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2535572"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2535585"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2535598"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2535612"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2535625"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2535638"></a><em class="parameter"><code>include = /etc/samba/dc-common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2535660"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2535673"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2535686"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2535707"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2535720"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2535733"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2535754"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2535767"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2535780"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div><div class="example"><a name="ch5-dc-common"></a><p class="title"><b>Example 4.2. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></b></p><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2535829"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2535842"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2535856"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2535869"></a><em class="parameter"><code>logon path = \%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2535882"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2535894"></a><em class="parameter"><code>logon home = \%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2535907"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2535920"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2535933"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2535954"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2535967"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2535980"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2535993"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2536014"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2536027"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2536040"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2536053"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2536074"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2536087"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2536100"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2536113"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div><div class="example"><a name="ch5-commonsmb"></a><p class="title"><b>Example 4.3. Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2536158"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2536171"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2536184"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2536196"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2536209"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2536222"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2536235"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2536248"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2536260"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2536273"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2536287"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2536300"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2536313"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2536326"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2536339"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2536352"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2536364"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr><tr><td><a class="indexterm" name="id2536378"></a><em class="parameter"><code>include = </code></em></td></tr><tr><td># Share and Service Definitions are common to all servers</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2536403"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2536416"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2536429"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2536442"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2536454"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2536467"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2536480"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2536502"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2536515"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2536527"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id2536540"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div><div class="example"><a name="ch5-bldg1-smb"></a><p class="title"><b>Example 4.4. Server: BLDG1 (Member), File: smb.conf</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2536584"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2536597"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2536610"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div><div class="example"><a name="ch5-bldg2-smb"></a><p class="title"><b>Example 4.5. Server: BLDG2 (Member), File: smb.conf</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2536654"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2536666"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id2536679"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div><div class="example"><a name="ch5-dommem-smb"></a><p class="title"><b>Example 4.6. Common Domain Member Include File: dom-mem.conf</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2536724"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2536737"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2536750"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2536763"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2536776"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2536789"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2536802"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr></table></div><div class="example"><a name="massive-dhcp"></a><p class="title"><b>Example 4.7. Server: MASSIVE, File: dhcpd.conf</b></p><pre class="screen">
+# Abmas Accounting Inc.
+
+default-lease-time 86400;
+max-lease-time 172800;
+default-lease-time 86400;
+ddns-updates on;
+ddns-update-style interim;
+
+option ntp-servers 172.16.0.1;
+option domain-name "abmas.biz";
+option domain-name-servers 172.16.0.1, 172.16.4.1;
+option netbios-name-servers 172.16.0.1;
+option netbios-node-type 8;
+
+subnet 172.16.1.0 netmask 255.255.252.0 {
+ range dynamic-bootp 172.16.1.0 172.16.2.255;
+ option subnet-mask 255.255.252.0;
+ option routers 172.16.0.1, 172.16.0.128;
+ allow unknown-clients;
+ }
+subnet 172.16.4.0 netmask 255.255.252.0 {
+ range dynamic-bootp 172.16.7.0 172.16.7.254;
+ option subnet-mask 255.255.252.0;
+ option routers 172.16.4.128;
+ allow unknown-clients;
+ }
+subnet 172.16.8.0 netmask 255.255.252.0 {
+ range dynamic-bootp 172.16.11.0 172.16.11.254;
+ option subnet-mask 255.255.252.0;
+ option routers 172.16.4.128;
+ allow unknown-clients;
+ }
+subnet 127.0.0.0 netmask 255.0.0.0 {
+ }
+subnet 123.45.67.64 netmask 255.255.255.252 {
+ }
+</pre></div><div class="example"><a name="bldg1dhcp"></a><p class="title"><b>Example 4.8. Server: BLDG1, File: dhcpd.conf</b></p><pre class="screen">
+# Abmas Accounting Inc.
+
+default-lease-time 86400;
+max-lease-time 172800;
+default-lease-time 86400;
+ddns-updates on;
+ddns-update-style ad-hoc;
+
+option ntp-servers 172.16.0.1;
+option domain-name "abmas.biz";
+option domain-name-servers 172.16.0.1, 172.16.4.1;
+option netbios-name-servers 172.16.0.1;
+option netbios-node-type 8;
+
+subnet 172.16.1.0 netmask 255.255.252.0 {
+ range dynamic-bootp 172.16.3.0 172.16.3.255;
+ option subnet-mask 255.255.252.0;
+ option routers 172.16.0.1, 172.16.0.128;
+ allow unknown-clients;
+ }
+subnet 172.16.4.0 netmask 255.255.252.0 {
+ range dynamic-bootp 172.16.5.0 172.16.6.255;
+ option subnet-mask 255.255.252.0;
+ option routers 172.16.4.128;
+ allow unknown-clients;
+ }
+subnet 127.0.0.0 netmask 255.0.0.0 {
+ }
+</pre></div><div class="example"><a name="bldg2dhcp"></a><p class="title"><b>Example 4.9. Server: BLDG2, File: dhcpd.conf</b></p><pre class="screen">
+# Abmas Accounting Inc.
+
+default-lease-time 86400;
+max-lease-time 172800;
+default-lease-time 86400;
+ddns-updates on;
+ddns-update-style interim;
+
+option ntp-servers 172.16.0.1;
+option domain-name "abmas.biz";
+option domain-name-servers 172.16.0.1, 172.16.4.1;
+option netbios-name-servers 172.16.0.1;
+option netbios-node-type 8;
+
+subnet 172.16.8.0 netmask 255.255.252.0 {
+ range dynamic-bootp 172.16.9.0 172.16.10.255;
+ option subnet-mask 255.255.252.0;
+ option routers 172.16.8.128;
+ allow unknown-clients;
+ }
+subnet 127.0.0.0 netmask 255.0.0.0 {
+ }
+</pre></div><div class="example"><a name="massive-nameda"></a><p class="title"><b>Example 4.10. Server: MASSIVE, File: named.conf, Part: A</b></p><pre class="screen">
+###
+# Abmas Biz DNS Control File
+###
+# Date: November 15, 2003
+###
+options {
+ directory "/var/lib/named";
+ forwarders {
+ 123.45.12.23;
+ 123.45.54.32;
+ };
+ forward first;
+ listen-on {
+ mynet;
+ };
+ auth-nxdomain yes;
+ multiple-cnames yes;
+ notify no;
+};
+
+zone "." in {
+ type hint;
+ file "root.hint";
+};
+
+zone "localhost" in {
+ type master;
+ file "localhost.zone";
+};
+
+zone "0.0.127.in-addr.arpa" in {
+ type master;
+ file "127.0.0.zone";
+};
+
+acl mynet {
+ 172.16.0.0/24;
+ 172.16.4.0/24;
+ 172.16.8.0/24;
+ 127.0.0.1;
+};
+
+acl seconddns {
+ 123.45.54.32;
+};
+</pre></div><div class="example"><a name="massive-namedb"></a><p class="title"><b>Example 4.11. Server: MASSIVE, File: named.conf, Part: B</b></p><pre class="screen">
+zone "abmas.biz" {
+ type master;
+ file "/var/lib/named/master/abmas.biz.hosts";
+ allow-query {
+ mynet;
+ };
+ allow-transfer {
+ mynet;
+ };
+ allow-update {
+ mynet;
+ };
+};
+
+zone "abmas.us" {
+ type master;
+ file "/var/lib/named/master/abmas.us.hosts";
+ allow-query {
+ all;
+ };
+ allow-transfer {
+ seconddns;
+ };
+};
+</pre></div><div class="example"><a name="massive-namedc"></a><p class="title"><b>Example 4.12. Server: MASSIVE, File: named.conf, Part: C</b></p><pre class="screen">
+zone "0.16.172.in-addr.arpa" {
+ type master;
+ file "/var/lib/named/master/172.16.0.0.rev";
+ allow-query {
+ mynet;
+ };
+ allow-transfer {
+ mynet;
+ };
+ allow-update {
+ mynet;
+ };
+};
+
+zone "4.16.172.in-addr.arpa" {
+ type master;
+ file "/var/lib/named/master/172.16.4.0.rev";
+ allow-query {
+ mynet;
+ };
+ allow-transfer {
+ mynet;
+ };
+ allow-update {
+ mynet;
+ };
+};
+
+zone "8.16.172.in-addr.arpa" {
+ type master;
+ file "/var/lib/named/master/172.16.8.0.rev";
+ allow-query {
+ mynet;
+ };
+ allow-transfer {
+ mynet;
+ };
+ allow-update {
+ mynet;
+ };
+};
+</pre></div><div class="example"><a name="abmasbizdns"></a><p class="title"><b>Example 4.13. Forward Zone File: abmas.biz.hosts</b></p><pre class="screen">
+$ORIGIN .
+$TTL 38400 ; 10 hours 40 minutes
+abmas.biz IN SOA massive.abmas.biz. root.abmas.biz. (
+ 2003021833 ; serial
+ 10800 ; refresh (3 hours)
+ 3600 ; retry (1 hour)
+ 604800 ; expire (1 week)
+ 38400 ; minimum (10 hours 40 minutes)
+ )
+ NS massive.abmas.biz.
+ NS bldg1.abmas.biz.
+ NS bldg2.abmas.biz.
+ MX 10 massive.abmas.biz.
+$ORIGIN abmas.biz.
+massive A 172.16.0.1
+router0 A 172.16.0.128
+bldg1 A 172.16.4.1
+router4 A 172.16.4.128
+bldg2 A 172.16.8.1
+router8 A 172.16.8.128
+</pre></div><div class="example"><a name="abmasusdns"></a><p class="title"><b>Example 4.14. Forward Zone File: abmas.biz.hosts</b></p><pre class="screen">
+$ORIGIN .
+$TTL 38400 ; 10 hours 40 minutes
+abmas.us IN SOA server.abmas.us. root.abmas.us. (
+ 2003021833 ; serial
+ 10800 ; refresh (3 hours)
+ 3600 ; retry (1 hour)
+ 604800 ; expire (1 week)
+ 38400 ; minimum (10 hours 40 minutes)
+ )
+ NS dns.abmas.us.
+ NS dns2.abmas.us.
+ MX 10 mail.abmas.us.
+$ORIGIN abmas.us.
+server A 123.45.67.66
+dns2 A 123.45.54.32
+gw A 123.45.67.65
+www CNAME server
+mail CNAME server
+dns CNAME server
+</pre></div><div class="example"><a name="bldg12nameda"></a><p class="title"><b>Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A</b></p><pre class="screen">
+###
+# Abmas Biz DNS Control File
+###
+# Date: November 15, 2003
+###
+options {
+ directory "/var/lib/named";
+ forwarders {
+ 172.16.0.1;
+ };
+ forward first;
+ listen-on {
+ mynet;
+ };
+ auth-nxdomain yes;
+ multiple-cnames yes;
+ notify no;
+};
+
+zone "." in {
+ type hint;
+ file "root.hint";
+};
+
+zone "localhost" in {
+ type master;
+ file "localhost.zone";
+};
+
+zone "0.0.127.in-addr.arpa" in {
+ type master;
+ file "127.0.0.zone";
+};
+
+acl mynet {
+ 172.16.0.0/24;
+ 172.16.4.0/24;
+ 172.16.8.0/24;
+ 127.0.0.1;
+};
+
+acl seconddns {
+ 123.45.54.32;
+};
+</pre></div><div class="example"><a name="bldg12namedb"></a><p class="title"><b>Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B</b></p><pre class="screen">
+zone "abmas.biz" {
+ type slave;
+ file "/var/lib/named/slave/abmas.biz.hosts";
+ allow-query {
+ mynet;
+ };
+ allow-transfer {
+ mynet;
+ };
+};
+
+zone "0.16.172.in-addr.arpa" {
+ type slave;
+ file "/var/lib/slave/master/172.16.0.0.rev";
+ allow-query {
+ mynet;
+ };
+ allow-transfer {
+ mynet;
+ };
+};
+
+zone "4.16.172.in-addr.arpa" {
+ type slave;
+ file "/var/lib/named/slave/172.16.4.0.rev";
+ allow-query {
+ mynet;
+ };
+ allow-transfer {
+ mynet;
+ };
+};
+
+zone "8.16.172.in-addr.arpa" {
+ type slave;
+ file "/var/lib/named/slave/172.16.8.0.rev";
+ allow-query {
+ mynet;
+ };
+ allow-transfer {
+ mynet;
+ };
+};
+</pre></div><div class="example"><a name="ch5-initgrps"></a><p class="title"><b>Example 4.17. Initialize Groups Script, File: /etc/samba/initGrps.sh</b></p><pre class="screen">
+#!/bin/bash
+
+# Create UNIX groups
+groupadd acctsdep
+groupadd finsrvcs
+groupadd piops
+
+# Map Windows Domain Groups to UNIX groups
+net groupmap modify ntgroup="Domain Admins" unixgroup=root
+net groupmap modify ntgroup="Domain Users" unixgroup=users
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
+
+# Add Functional Domain Groups
+net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
+net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
+net groupmap add ntgroup="Insurance Group" unixgroup=piops type=d
+</pre></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-procstart"></a>Process Startup Configuration</h3></div></div></div><p>
+ <a class="indexterm" name="id2537173"></a>
+ <a class="indexterm" name="id2537180"></a>
+ There are two essential steps to process startup configuration. A process
+ must be configured so that it is automatically restarted each time the server
+ is rebooted. This step involves use of the <span><strong class="command">chkconfig</strong></span> tool that
+ created appropriate symbolic links from the master daemon control file that is
+ located in the <code class="filename">/etc/rc.d</code> directory to the <code class="filename">/etc/rc'x'.d</code>
+ directories. Links are created so that when the system run-level is changed, the
+ necessary start or kill script is run.
+ </p><p>
+ <a class="indexterm" name="id2537216"></a>
+ In the event that a service is provided not as a daemon but via the internetworking
+ super daemon (<span><strong class="command">inetd</strong></span> or <span><strong class="command">xinetd</strong></span>), then the <span><strong class="command">chkconfig</strong></span>
+ tool makes the necessary entries in the <code class="filename">/etc/xinetd.d</code> directory
+ and sends a hang-up (HUP) signal to the super daemon, thus forcing it to
+ re-read its control files.
+ </p><p>
+ Last, each service must be started to permit system validation to proceed. The following steps
+ are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you
+ are installing Samba.
+ </p><div class="procedure"><a name="id2537260"></a><p class="title"><b>Procedure 4.4. Process Startup Configuration Steps</b></p><ol type="1"><li><p>
+ Use the standard system tool to configure each service to restart
+ automatically at every system reboot. For example,
+ <a class="indexterm" name="id2537274"></a>
+</p><pre class="screen">
+<code class="prompt">root# </code> chkconfig dhpc on
+<code class="prompt">root# </code> chkconfig named on
+<code class="prompt">root# </code> chkconfig cups on
+<code class="prompt">root# </code> chkconfig smb on
+<code class="prompt">root# </code> chkconfig swat on
+</pre><p>
+ </p></li><li><p>
+ <a class="indexterm" name="id2537324"></a>
+ <a class="indexterm" name="id2537331"></a>
+ <a class="indexterm" name="id2537338"></a>
+ Now start each service to permit the system to be validated.
+ Execute each of the following in the sequence shown:
+
+</p><pre class="screen">
+<code class="prompt">root# </code> service dhcp restart
+<code class="prompt">root# </code> service named restart
+<code class="prompt">root# </code> service cups restart
+<code class="prompt">root# </code> service smb restart
+<code class="prompt">root# </code> service swat restart
+</pre><p>
+ </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch5wincfg"></a>Windows Client Configuration</h3></div></div></div><p>
+ The procedure for desktop client configuration for the network in this chapter is similar to
+ that used for the previous one. There are a few subtle changes that should be noted.
+ </p><div class="procedure"><a name="id2537404"></a><p class="title"><b>Procedure 4.5. Windows Client Configuration Steps</b></p><ol type="1"><li><p>
+ Install MS Windows XP Professional. During installation, configure the client to use DHCP for
+ TCP/IP protocol configuration.
+ <a class="indexterm" name="id2537417"></a>
+ <a class="indexterm" name="id2537424"></a>
+ DHCP configures all Windows clients to use the WINS Server address that has been defined
+ for the local subnet.
+ </p></li><li><p>
+ Join the Windows domain <code class="constant">MEGANET</code>. Use the domain administrator
+ username <code class="constant">root</code> and the SMB password you assigned to this account.
+ A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
+ a Windows domain is given in <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>.
+ Reboot the machine as prompted and then log on using the domain administrator account
+ (<code class="constant">root</code>).
+ </p></li><li><p>
+ Verify that the server called <code class="constant">MEGANET</code> is visible in <span class="guimenu">My Network Places</span>,
+ that it is possible to connect to it and see the shares <span class="guimenuitem">accounts</span>,
+ <span class="guimenuitem">apps</span>, and <span class="guimenuitem">finsvcs</span>,
+ and that it is possible to open each share to reveal its contents.
+ </p></li><li><p>
+ Create a drive mapping to the <code class="constant">apps</code> share on a server. At this time, it does
+ not particularly matter which application server is used. It is necessary to manually
+ set a persistent drive mapping to the local applications server on each workstation at the time of
+ installation. This step is avoided by the improvements to the design of the network configuration
+ in the next chapter.
+ </p></li><li><p>
+ Perform an administrative installation of each application to be used. Select the options
+ that you wish to use. Of course, you choose to run applications over the network, correct?
+ </p></li><li><p>
+ Now install all applications to be installed locally. Typical tools include Adobe Acrobat,
+ NTP-based time synchronization software, drivers for specific local devices such as fingerprint
+ scanners, and the like. Probably the most significant application to be locally installed
+ is antivirus software.
+ </p></li><li><p>
+ Now install all four printers onto the staging system. The printers you install
+ include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers, and you
+ also configure use of the identical printers that are located in the financial services department.
+ Install printers on each machine using the following steps:
+
+ </p><div class="procedure"><a name="id2537555"></a><p class="title"><b>Procedure 4.6. Steps to Install Printer Drivers on Windows Clients</b></p><ol type="1"><li><p>
+ Click <span class="guimenu">Start</span>-><span class="guimenuitem">Settings</span>-><span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>.
+ Ensure that <span class="guimenuitem">Local printer</span> is selected.
+ </p></li><li><p>
+ Click <span class="guibutton">Next</span>. In the
+ <span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>.
+ In the <span class="guimenuitem">Printers:</span> panel, select the printer called
+ <code class="constant">HP LaserJet 6</code>. Click <span class="guibutton">Next</span>.
+ </p></li><li><p>
+ In the <span class="guimenuitem">Available ports:</span> panel, select
+ <code class="constant">FILE:</code>. Accept the default printer name by clicking
+ <span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a
+ test page?</span>”, click <span class="guimenuitem">No</span>. Click
+ <span class="guibutton">Finish</span>.
+ </p></li><li><p>
+ You may be prompted for the name of a file to print to. If so, close the
+ dialog panel. Right-click <span class="guiicon">HP LaserJet 6</span>-><span class="guimenuitem">Properties</span>.
+ </p></li><li><p>
+ In the <span class="guimenuitem">Network</span> panel, enter the name of
+ the print queue on the Samba server as follows: <code class="constant">\\BLDG1\hplj6a</code>.
+ Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation.
+ </p></li><li><p>
+ Repeat the printer installation steps above for both HP LaserJet 6 printers
+ as well as for both QMS Magicolor laser printers. Remember to install all
+ printers but to set the destination port for each to the server on the
+ local network. For example, a workstation in the accounting group should
+ have all printers directed at the server <code class="constant">BLDG1</code>.
+ You may elect to point all desktop workstation configurations at the
+ server called <code class="constant">MASSIVE</code> and then in your deployment
+ procedures, it would be wise to document the need to redirect the printer
+ configuration (as well as the applications server drive mapping) to the
+ server on the network segment on which the workstation is to be located.
+ </p></li></ol></div><p>
+ </p></li><li><p>
+ When you are satisfied that the staging systems are complete, use the appropriate procedure to
+ remove the client from the domain. Reboot the system, and then log on as the local administrator
+ and clean out all temporary files stored on the system. Before shutting down, use the disk
+ defragmentation tool so that the file system is in optimal condition before replication.
+ </p></li><li><p>
+ Boot the workstation using the Norton (Symantec) Ghosting disk (or CD-ROM) and image the
+ machine to a network share on the server.
+ </p></li><li><p>
+ You may now replicate the image using the appropriate Norton Ghost procedure to the target
+ machines. Make sure to use the procedure that ensures each machine has a unique
+ Windows security identifier (SID). When the installation of the disk image is complete, boot the PC.
+ </p></li><li><p>
+ Log onto the machine as the local Administrator (the only option), and join the machine to
+ the domain following the procedure set out in <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>. You must now set the
+ persistent drive mapping to the applications server that the user is to use. The system is now
+ ready for the user to log on, provided you have created a network logon account for that
+ user, of course.
+ </p></li><li><p>
+ Instruct all users to log onto the workstation using their assigned username and password.
+ </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2537859"></a>Key Points Learned</h3></div></div></div><p>
+ The network you have just deployed has been a valuable exercise in forced constraint.
+ You have deployed a network that works well, although you may soon start to see
+ performance problems, at which time the modifications demonstrated in <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>
+ bring the network to life. The following key learning points were experienced:
+ </p><div class="itemizedlist"><ul type="disc"><li><p>
+ The power of using <code class="filename">smb.conf</code> include files
+ </p></li><li><p>
+ Use of a single PDC over a routed network
+ </p></li><li><p>
+ Joining a Samba-3 domain member server to a Samba-3 domain
+ </p></li><li><p>
+ Configuration of winbind to use domain users and groups for Samba access
+ to resources on the domain member servers
+ </p></li><li><p>
+ The introduction of roaming profiles
+ </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2537918"></a>Questions and Answers</h2></div></div></div><p>
+ </p><div class="qandaset"><dl><dt> <a href="Big500users.html#id2537933">
+ The example smb.conf files in this chapter make use of the include facility.
+ How may I get to see what the actual working smb.conf settings are?
+ </a></dt><dt> <a href="Big500users.html#id2537982">
+ Why does the include file common.conf have an empty include statement?
+ </a></dt><dt> <a href="Big500users.html#id2538045">
+ I accept that the simplest configuration necessary to do the job is the best. The use of tdbsam
+ passdb backend is much simpler than having to manage an LDAP-based ldapsam passdb backend.
+ I tried using rsync to replicate the passdb.tdb, and it seems to work fine!
+ So what is the problem?
+ </a></dt><dt> <a href="Big500users.html#id2538100">
+ You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash?
+ </a></dt><dt> <a href="Big500users.html#id2538130">
+ How does the Windows client find the PDC?
+ </a></dt><dt> <a href="Big500users.html#id2538153">
+ Why did you enable IP forwarding (routing) only on the server called MASSIVE?
+ </a></dt><dt> <a href="Big500users.html#id2538183">
+ You did nothing special to implement roaming profiles. Why?
+ </a></dt><dt> <a href="Big500users.html#id2538203">
+ On the domain member computers, you configured winbind in the /etc/nsswitch.conf file.
+ You did not configure any PAM settings. Is this an omission?
+ </a></dt><dt> <a href="Big500users.html#id2538235">
+ You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this?
+ </a></dt><dt> <a href="Big500users.html#id2538276">
+ The domain controller has an auto-shutdown script. Isn't that dangerous?
+ </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2537933"></a><a name="id2537935"></a><b></b></td><td align="left" valign="top"><p>
+ The example <code class="filename">smb.conf</code> files in this chapter make use of the <em class="parameter"><code>include</code></em> facility.
+ How may I get to see what the actual working <code class="filename">smb.conf</code> settings are?
+ </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
+ You may readily see the net compound effect of the included files by running:
+</p><pre class="screen">
+<code class="prompt">root# </code> testparm -s | less
+</pre><p>
+ </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2537982"></a><a name="id2537985"></a><b></b></td><td align="left" valign="top"><p>
+ Why does the include file <code class="filename">common.conf</code> have an empty include statement?
+ </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
+ The use of the empty include statement nullifies further includes. For example, let's say you
+ desire to have just an smb.conf file that is built from the array of include files of which the
+ master control file is called <code class="filename">master.conf</code>. The following command
+ produces a compound <code class="filename">smb.conf</code> file.
+</p><pre class="screen">
+<code class="prompt">root# </code> testparm -s /etc/samba/master.conf > /etc/samba/smb.conf
+</pre><p>
+ If the include parameter was not in the common.conf file, the final <code class="filename">smb.conf</code> file leaves
+ the include in place, even though the file it points to has already been included. This is a bug
+ that will be fixed at a future date.
+ </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538045"></a><a name="id2538047"></a><b></b></td><td align="left" valign="top"><p>
+ I accept that the simplest configuration necessary to do the job is the best. The use of <em class="parameter"><code>tdbsam</code></em>
+ passdb backend is much simpler than having to manage an LDAP-based <em class="parameter"><code>ldapsam</code></em> passdb backend.
+ I tried using <span><strong class="command">rsync</strong></span> to replicate the <code class="filename">passdb.tdb</code>, and it seems to work fine!
+ So what is the problem?
+ </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
+ Replication of the <em class="parameter"><code>tdbsam</code></em> database file can result in loss of currency in its
+ contents between the PDC and BDCs. The most notable symptom is that workstations may not be able
+ to log onto the network following a reboot and may have to rejoin the domain to recover network
+ access capability.
+ </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538100"></a><a name="id2538102"></a><b></b></td><td align="left" valign="top"><p>
+ You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash?
+ </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
+ No. It is possible to have as many DHCP servers on a network segment as makes sense. A DHCP server
+ offers an IP address lease, but it is the client that determines which offer is accepted, no matter how many
+ offers are made. Under normal operation, the client accepts the first offer it receives.
+ </p><p>
+ The only exception to this rule is when the client makes a directed request from a specific DHCP server
+ for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash.
+ </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538130"></a><a name="id2538132"></a><b></b></td><td align="left" valign="top"><p>
+ How does the Windows client find the PDC?
+ </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
+ The Windows client obtains the WINS server address from the DHCP lease information. It also
+ obtains from the DHCP lease information the parameter that causes it to use directed UDP (UDP Unicast)
+ to register itself with the WINS server and to obtain enumeration of vital network information to
+ enable it to operate successfully.
+ </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538153"></a><a name="id2538155"></a><b></b></td><td align="left" valign="top"><p>
+ Why did you enable IP forwarding (routing) only on the server called <code class="constant">MASSIVE</code>?
+ </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
+ The server called <code class="constant">MASSIVE</code> is acting as a router to the Internet. No other server
+ (BLDG1 or BLDG2) has any need for IP forwarding because they are attached only to their own network.
+ Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network
+ segments to the router that is its gateway to them.
+ </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538183"></a><a name="id2538185"></a><b></b></td><td align="left" valign="top"><p>
+ You did nothing special to implement roaming profiles. Why?
+ </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
+ Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional
+ clients is to use roaming profiles.
+ </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538203"></a><a name="id2538205"></a><b></b></td><td align="left" valign="top"><p>
+ On the domain member computers, you configured winbind in the <code class="filename">/etc/nsswitch.conf</code> file.
+ You did not configure any PAM settings. Is this an omission?
+ </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
+ PAM is needed only for authentication. When Samba is using Microsoft encrypted passwords, it makes only
+ marginal use of PAM. PAM configuration handles only authentication. If you want to log onto the domain
+ member servers using Windows networking usernames and passwords, it is necessary to configure PAM
+ to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name
+ service switch (NSS).
+ </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538235"></a><a name="id2538237"></a><b></b></td><td align="left" valign="top"><p>
+ You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this?
+ </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
+ Oh, I did not think you would notice that. It is there so that it can be used. This is more fully discussed
+ in <span class="emphasis"><em>TOSHARG2</em></span>, which has a full chapter dedicated to the subject. While we are on the
+ subject, it should be noted that you should definitely not use SWAT on any system that makes use
+ of <code class="filename">smb.conf</code> <em class="parameter"><code>include</code></em> files because SWAT optimizes them out into an aggregated
+ file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to
+ handle this functionality gracefully.
+ </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2538276"></a><a name="id2538279"></a><b></b></td><td align="left" valign="top"><p>
+ The domain controller has an auto-shutdown script. Isn't that dangerous?
+ </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
+ Well done, you spotted that! I guess it is dangerous. It is good to know that you can do this, though.
+ </p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 3. Secure Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 5. Making Happy Users</td></tr></table></div></body></html>
projects / samba / blobdiff