File: node42.html

package info (click to toggle)
rutebook 1.0-1
links: PTS
area: non-free
in suites: sarge
size: 9,476 kB
ctags: 1,112
sloc: makefile: 47
file content (1021 lines) | stat: -rw-r--r-- 41,496 bytes
parent folder | download | duplicates (2)
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">

<!--Converted with LaTeX2HTML 99.2beta8 (1.46)
original version by:  Nikos Drakos, CBLU, University of Leeds
* revised and updated by:  Marcus Hennecke, Ross Moore, Herb Swan
* with significant contributions from:
  Jens Lippmann, Marek Rouchal, Martin Wilck and others -->
<HTML>
<HEAD>
<TITLE>39. smbd -- Samba NT Server</TITLE>
<META NAME="description" CONTENT="39. smbd -- Samba NT Server">
<META NAME="keywords" CONTENT="rute">
<META NAME="resource-type" CONTENT="document">
<META NAME="distribution" CONTENT="global">

<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="LaTeX2HTML v99.2beta8">
<META HTTP-EQUIV="Content-Style-Type" CONTENT="text/css">

<LINK REL="STYLESHEET" HREF="rute.css">

<LINK REL="next" HREF="node43.html">
<LINK REL="previous" HREF="node41.html">
<LINK REL="up" HREF="rute.html">
<LINK REL="next" HREF="node43.html">
</HEAD>

<BODY BGCOLOR=#FFFFFF >
<TABLE width="100%" border="0" cellspacing="0" cellpadding="0">
<TR><TD align=left bgcolor="#000000">
<FONT COLOR=white>
&nbsp;<A HREF="http://www.icon.co.za/~psheer/rute-purchase.html"><FONT COLOR=white>Purchase</FONT></A>&nbsp;
</FONT>
</TD><TD align=center bgcolor="#000000">
<FONT COLOR=white>
Copyright&nbsp;&#169;&nbsp;2002&nbsp;Paul Sheer. <A HREF="copying.html"><FONT COLOR=white>Click here for copying permissions.</FONT></A>
</FONT>
</TD><TD align=right bgcolor="#000000">
<FONT COLOR=white>
&nbsp;<A HREF="http://www.icon.co.za/~psheer/rute-home.html"><FONT COLOR=white>Home</FONT></A>&nbsp;
</FONT>
</TD></TR>
<TR><TD colspan=2 align=left bgcolor="#ECEBF4">
<IMG SRC="va-btn-small-light-60.png">
</TD><TD align=right bgcolor="#ECEBF4">
<IMG SRC="sflogo2-steel-60.png">
</TD></TR>
</TABLE><BR>

<!--Navigation Panel-->
<A NAME="tex2html2740"
  HREF="node43.html">
<IMG WIDTH="37" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="next" SRC="next.png"></A> 
<A NAME="tex2html2736"
  HREF="rute.html">
<IMG WIDTH="26" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="up" SRC="up.png"></A> 
<A NAME="tex2html2730"
  HREF="node41.html">
<IMG WIDTH="63" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="previous" SRC="prev.png"></A> 
<A NAME="tex2html2738"
  HREF="node1.html">
<IMG WIDTH="65" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="contents" SRC="contents.png"></A>  
<BR>
<B> Next:</B> <A NAME="tex2html2741"
  HREF="node43.html">40. named  </A>
<B> Up:</B> <A NAME="tex2html2737"
  HREF="rute.html">rute</A>
<B> Previous:</B> <A NAME="tex2html2731"
  HREF="node41.html">38. postgres SQL Server</A>
 &nbsp <B>  <A NAME="tex2html2739"
  HREF="node1.html">Contents</A></B> 
<BR>
<BR>
<!--End of Navigation Panel-->
<!--Table of Child-Links-->
<A NAME="CHILD_LINKS"><STRONG>Subsections</STRONG></A>

<UL>
<LI><A NAME="tex2html2742"
  HREF="#SECTION004210000000000000000">39.1 Samba: An Introduction by Christopher R. Hertel</A>
<UL>
<LI><A NAME="tex2html2743"
  HREF="#SECTION004211000000000000000">History -- the (hopefully) Untedious Version</A>
<LI><A NAME="tex2html2744"
  HREF="#SECTION004212000000000000000">Meanwhile, on the Other Side of the Planet...</A>
<LI><A NAME="tex2html2745"
  HREF="#SECTION004213000000000000000">What Samba Does</A>
<LI><A NAME="tex2html2746"
  HREF="#SECTION004214000000000000000">Other Stuff</A>
<LI><A NAME="tex2html2747"
  HREF="#SECTION004215000000000000000">SMB Filesystems for Linux</A>
<LI><A NAME="tex2html2748"
  HREF="#SECTION004216000000000000000">Setup and Management</A>
<LI><A NAME="tex2html2749"
  HREF="#SECTION004217000000000000000">The Present</A>
<LI><A NAME="tex2html2750"
  HREF="#SECTION004218000000000000000">The Future</A>
</UL>
<LI><A NAME="tex2html2751"
  HREF="#SECTION004220000000000000000">39.2 Configuring Samba</A>
<LI><A NAME="tex2html2752"
  HREF="#SECTION004230000000000000000">39.3 Configuring Windows</A>
<LI><A NAME="tex2html2753"
  HREF="#SECTION004240000000000000000">39.4 Configuring a Windows Printer</A>
<LI><A NAME="tex2html2754"
  HREF="#SECTION004250000000000000000">39.5 Configuring <TT>
<FONT COLOR="#0000ff">swat</FONT></TT></A>
<LI><A NAME="tex2html2755"
  HREF="#SECTION004260000000000000000">39.6 Windows NT Caveats</A>
</UL>
<!--End of Table of Child-Links-->
<HR>

<H1><A NAME="SECTION004200000000000000000">
39. <TT>
<FONT COLOR="#0000ff">smbd</FONT></TT> -- Samba NT Server</A>
</H1>

<P>
<A NAME="chap:smbd"></A><A NAME="chap:smb"></A>The following introduction is quoted from the Samba online documentation.
<BR>
<BR>
<BR>
<BR>
<BR>

<P>
<HR>
<BR>

<P>

<H1><A NAME="SECTION004210000000000000000">
39.1 Samba: An Introduction by Christopher R. Hertel</A>
</H1>

<P>
A lot of emphasis has been placed on peaceful coexistence between U<SMALL>NIX</SMALL>
and Windows.
Unfortunately,
the two systems come from very different cultures and they have
difficulty getting along without mediation. ...and that, of course,
is Samba's job.
<EM>Samba</EM> <I>&lt;<TT><A NAME="tex2html61"
  HREF="http://samba.org/">http://samba.org/</A></TT>&gt;</I> runs on U<SMALL>NIX</SMALL> platforms, but speaks to Windows
clients like a native. It allows a U<SMALL>NIX</SMALL> system to move into a Windows
``Network Neighborhood'' without causing a stir.
Windows users can happily
access file and print services without knowing or caring that those
services are being offered by a U<SMALL>NIX</SMALL> host.

<P>
All of this is managed through a protocol suite which is currently known
as the ``Common Internet File System,'' or <EM>CIFS</EM> <I>&lt;<TT><A NAME="tex2html62"
  HREF="http://www.cifs.com">http://www.cifs.com</A></TT>&gt;</I>. This name was introduced
by Microsoft, and provides some insight into their hopes for the future.
At the heart of CIFS is the latest incarnation of the Server Message
Block (SMB) protocol, which has a long and tedious history. Samba is an
open source CIFS implementation, and is available for free from the
<I><TT><A NAME="tex2html63"
  HREF="http://samba.org/">http://samba.org/</A></TT></I> mirror sites. 

<P>
Samba and Windows are not the only ones to provide CIFS networking. OS/2
supports SMB file
and print sharing, and there are commercial CIFS
products for Macintosh and other platforms (including several others for
U<SMALL>NIX</SMALL>). Samba has been ported to a variety of non-U<SMALL>NIX</SMALL> operating systems,
including VMS, AmigaOS, and NetWare.
CIFS is also supported on dedicated
file server platforms from a variety of vendors. In other words, this
stuff is all over the place. 

<P>

<H2><A NAME="SECTION004211000000000000000">
History -- the (hopefully) Untedious Version</A>
</H2>

<P>
It started a long time ago, in the early days of the PC, when IBM and
Sytec co-developed a simple networking system designed for building
small LANs. The system included something called NetBIOS, or <I><B>Net</B>work
<B>B</B>asic <B>I</B>nput <B>O</B>utput <B>S</B>ystem</I>. NetBIOS was a chunk of software that was
loaded into memory to provide an interface between programs and the
network hardware. It included an addressing scheme that used 16-byte
names to identify workstations and network-enabled applications. Next,
Microsoft added features to DOS that allowed disk I/O to be <I>redirected</I>
to the NetBIOS interface, which made disk space sharable over the LAN.
The file-sharing protocol that they used eventually became known as SMB,
and now CIFS.

<P>
Lots of other software was also written to use the NetBIOS API
(<I><B>A</B>pplication <B>P</B>rogrammer's <B>I</B>nterface</I>), which meant that it would never,
ever, ever go away. Instead, the workings beneath the API were cleverly
gutted and replaced. NetBEUI (<I><B>NetB</B>IOS <B>E</B>nhanced <B>U</B>ser <B>I</B>nterface</I>),
introduced by IBM, provided a mechanism for passing NetBIOS packets over
Token Ring and Ethernet. Others
developed NetBIOS LAN emulation over
higher-level protocols including DECnet,
IPX/SPX and, of course, TCP/IP. 

<P>
NetBIOS and TCP/IP made an interesting team. The latter could be routed
between interconnected networks (internetworks), but NetBIOS was
designed for isolated LANs. The trick was to map the 16-byte NetBIOS
names to IP addresses so that messages could actually find their way
through a routed IP network. A mechanism for doing just that was
described in the Internet RFC1001 and RFC1002 documents. As Windows
evolved, Microsoft added two additional pieces to the SMB package. These
were service announcement, which is called ``browsing,'' and a central
authentication and authorization service known as Windows NT Domain
Control. 

<P>

<H2><A NAME="SECTION004212000000000000000">
Meanwhile, on the Other Side of the Planet...</A>
</H2>

<P>
Andrew Tridgell, who is both tall and Australian, had a bit of a
problem. He needed to mount disk space from a U<SMALL>NIX</SMALL> server on his DOS PC.
Actually, this wasn't the problem at all because he had an NFS (<I><B>N</B>etwork
<B>F</B>ile <B>S</B>ystem</I>) client for DOS and it worked just fine. Unfortunately, he
also had an application that required the NetBIOS interface. Anyone who
has ever tried to run multiple protocols under DOS knows that it can
be...er...quirky. 

<P>
So Andrew chose the obvious solution. He wrote a packet sniffer, reverse
engineered the SMB protocol, and implemented it on the U<SMALL>NIX</SMALL> box. Thus,
he made the U<SMALL>NIX</SMALL> system appear to be a PC file server, which allowed him
to mount shared filesystems from the U<SMALL>NIX</SMALL> server while concurrently
running NetBIOS applications. Andrew published his code in early 1992.
There was a quick, but short succession of bug-fix releases, and then he
put the project aside. Occasionally he would get email about it, but he
otherwise ignored it. Then one day, almost two years later, he decided
to link his wife's Windows PC with his own Linux system. Lacking any
better options, he used his own server code. He was actually surprised
when it worked. 

<P>
Through his email contacts, Andrew discovered that NetBIOS and SMB were
actually (though nominally) documented. With this new information at his
fingertips he set to work again, but soon ran into another problem. He
was contacted by a company claiming trademark on the name that he had
chosen for his server software. Rather than cause a fuss, Andrew did a
quick scan against a spell-checker dictionary, looking for words
containing the letters ``smb''. ``Samba'' was in the list. Curiously, that
same word is not in the dictionary file that he uses today. (Perhaps
they know it's been taken.) 

<P>
The Samba project has grown mightily since then. Andrew now has a whole
team of programmers, scattered around the world, to help with Samba
development. When a new release is announced, thousands of copies are
downloaded within days. Commercial systems vendors, including Silicon
Graphics, bundle Samba with their products. There are even Samba
T-shirts available. Perhaps one of the best measures of the success of
Samba is that it was listed in the ``Halloween Documents'', a pair of
internal Microsoft memos that were leaked to the Open Source community.
These memos list Open Source products which Microsoft considers to be
competitive threats. The absolutely best measure of success, though, is
that Andrew can still share the printer with his wife. 

<P>

<H2><A NAME="SECTION004213000000000000000">
What Samba Does</A>
</H2>

<P>
Samba consists of two key programs, plus a bunch of other stuff that
we'll get to later. The two key programs are
<TT>
<FONT COLOR="#0000ff">smbd</FONT></TT> and <TT>
<FONT COLOR="#0000ff">nmbd</FONT></TT>. Their job is
to implement the four basic modern-day CIFS services, which are: 

<P>

<UL>
<LI>File and print services
</LI>
<LI>Authentication and Authorization
</LI>
<LI>Name resolution
</LI>
<LI>Service announcement (browsing)
</LI>
</UL>
<P>
File and print services are, of course, the cornerstone of the CIFS
suite. These are provided by <TT>
<FONT COLOR="#0000ff">smbd</FONT></TT>, the SMB daemon. <TT>
<FONT COLOR="#0000ff">Smbd</FONT></TT> also handles
``share mode'' and ``user mode'' authentication and authorization. That is,
you can protect shared file and print services by requiring passwords.
In share mode, the simplest and least recommended scheme, a password can
be assigned to a shared directory or printer (simply called a ``share'').
This single password is then given to everyone who is allowed to use the
share. With user mode authentication, each user has their own username
and password and the System Administrator can grant or deny access on an
individual basis. 

<P>
The Windows NT Domain system provides a further level of authentication
refinement for CIFS. The basic idea is that a user should only have to
log in once to have access to all of the authorized services on the
network. The NT Domain system handles this with an authentication
server, called a Domain Controller. An NT Domain (which should <I>not</I> be
confused with a <I><B>D</B>omain <B>N</B>ame <B>S</B>ystem</I>
(DNS) Domain) is basically a group of
machines which share the same Domain Controller. 

<P>
The NT Domain system deserves special mention because, until the release
of Samba version 2, only Microsoft owned code to implement the NT Domain
authentication protocols. With version 2, Samba introduced the first
non-Microsoft-derived NT Domain authentication code. The eventual goal,
of course, it to completely mimic a Windows NT Domain Controller. 

<P>
The other two CIFS pieces, name resolution and browsing, are handled by
<TT>
<FONT COLOR="#0000ff">nmbd</FONT></TT>. These two services basically involve the management and
distribution of lists of NetBIOS names. 

<P>
Name resolution takes two forms: broadcast
and point-to-point. A machine
may use either or both of these methods, depending upon its
configuration. Broadcast resolution is the closest to the original
NetBIOS mechanism. Basically, a client looking for a service named
<TT>
<FONT COLOR="#0000ff">Trillian</FONT></TT> will call out <TT>
<FONT COLOR="#0000ff">``Yo! Trillian! Where are you?''</FONT></TT>, and wait for the
machine with that name to answer with an IP address. This can generate a
bit of broadcast traffic (a lot of shouting in the streets), but it is
restricted to the local LAN so it doesn't cause too much trouble. 

<P>
The other type of name resolution involves the use of an NBNS (<I><B>N</B>et<B>B</B>IOS
<B>N</B>ame <B>S</B>ervice</I>) server. (Microsoft called their NBNS implementation WINS,
for Windows Internet Name Service, and that acronym is more commonly
used today.) The NBNS works something like the wall of an old-fashioned
telephone booth. (Remember those?) Machines can leave their name and
number (IP address) for others to see. 

<P>
<PRE>
Hi, I'm node Voomba.  Call me for a good time!  192.168.100.101
</PRE>

<P>
It works like this: The clients send their NetBIOS names and IP addresses
to the NBNS server, which keeps the information in a simple database.
When a client wants to talk to another client, it sends the other
client's name to the NBNS server. If the name is on the list, the NBNS
hands back an IP address. You've got the name, look up the number. 

<P>
Clients on different subnets can all share the same NBNS server so,
unlike broadcast, the point-to-point mechanism is not limited to the
local LAN. In many ways the NBNS is similar to the DNS, but the NBNS
name list is almost completely dynamic and there are few controls to
ensure that only authorized clients can register names. Conflicts can,
and do, occur fairly easily. 

<P>
Finally, there's browsing. This is a whole 'nother kettle of worms, but
Samba's <TT>
<FONT COLOR="#0000ff">nmbd</FONT></TT> handles it anyway. This is not the web browsing we know and
love, but a browsable list of services (file and print shares) offered
by the computers on a network. 

<P>
On a LAN, the participating computers hold an election to decide which
of them will become the Local Master Browser (LMB). The ``winner'' then
identifies itself by claiming a special NetBIOS name (in addition to any
other names it may have). The LMB's job is to keep a list of available
services, and it is this list that appears when you click on the Windows
``Network Neighborhood'' icon. 

<P>
In addition to LMBs, there are <I>Domain</I> Master Browsers (DMBs). DMBs
coordinate browse lists across NT Domains, even on routed networks.
Using the NBNS, an LMB will locate its DMB to exchange and combine
browse lists. Thus, the browse list is propagated to all hosts in the NT
Domain. Unfortunately, the synchronization times are spread apart a bit.
It can take more than an hour for a change on a remote subnet to appear
in the Network Neighborhood. 

<P>

<H2><A NAME="SECTION004214000000000000000">
Other Stuff</A>
</H2>

<P>
Samba comes with a variety of utilities. The most commonly used are: 

<P>
<DL>
<DT><STRONG><TT>
<FONT COLOR="#0000ff">smbclient</FONT></TT></STRONG></DT>
<DD>A simple SMB client, with an interface similar to that of the FTP
    utility. It can be used from a U<SMALL>NIX</SMALL> system to connect to a remote
    SMB share, transfer files, and send files to remote print shares
    (printers). 

<P>
</DD>
<DT><STRONG><TT>
<FONT COLOR="#0000ff">nmblookup</FONT></TT></STRONG></DT>
<DD>A NetBIOS name service client. <TT>
<FONT COLOR="#0000ff">Nmblookup</FONT></TT> can be used to find NetBIOS
    names on a network, look up their IP addresses, and query a remote
    machine for the list of names the machine believes it owns. 

<P>
</DD>
<DT><STRONG><TT>
<FONT COLOR="#0000ff">swat</FONT></TT></STRONG></DT>
<DD>The <I><B>S</B>amba <B>W</B>eb <B>A</B>dministration <B>T</B>ool</I>.
    Swat allows you to configure Samba remotely, using a web browser.
</DD>
</DL>

<P>
There are more, of course, but describing them would require explaining
even more bits and pieces of CIFS, SMB, and Samba. That's where things
really get tedious, so we'll leave it alone for now. 

<P>

<H2><A NAME="SECTION004215000000000000000">
SMB Filesystems for Linux</A>
</H2>

<P>
One of the cool things that you can do with a Windows box is use an SMB
file share as if it were a hard disk on your own machine. The <TT>
<FONT COLOR="#0000ff">N:</FONT></TT> drive
can look, smell, feel, and act like your own disk space, but it's really
disk space on some other computer somewhere else on the network. 

<P>
Linux systems can do this too, using the <TT>
<FONT COLOR="#0000ff">smbfs</FONT></TT> filesystem. Built from
Samba code, <TT>
<FONT COLOR="#0000ff">smbfs</FONT></TT> (which stands for <I><B>SMB</B> <B>F</B>ile<B>s</B>ystem</I>) allows Linux to map
a remote SMB share into its directory structure. So, for example, the
<TT>
<FONT COLOR="#0000ff">/mnt/zarquon</FONT></TT> directory might actually be an SMB share, yet you can read,
write, edit, delete, and copy the files in that directory just as you
would local files. 

<P>
The <TT>
<FONT COLOR="#0000ff">smbfs</FONT></TT> is nifty, but it only works with Linux. In fact, it's not even
part of the Samba suite. It is distributed with Samba as a courtesy and
convenience. A more general solution is the new <TT>
<FONT COLOR="#0000ff">smbsh</FONT></TT> (<I><B>SMB</B> <B>sh</B>ell</I>, which
is still under development at the time of this writing). This is a cool
gadget. It is run like a U<SMALL>NIX</SMALL> shell, but it does some funky fiddling
with calls to U<SMALL>NIX</SMALL> libraries. By intercepting these calls, <TT>
<FONT COLOR="#0000ff">smbsh</FONT></TT> can
make it look as though SMB shares are mounted. All of the read, write,
etc. operations are available to the <TT>
<FONT COLOR="#0000ff">smbsh</FONT></TT> user. Another feature of
<TT>
<FONT COLOR="#0000ff">smbsh</FONT></TT> is that it works on a per user, per shell basis, while mounting a
filesystem is a system-wide operation. This allows for much
finer-grained access controls. 

<P>

<H2><A NAME="SECTION004216000000000000000">
Setup and Management</A>
</H2>

<P>
Samba is configured using the <TT>
<FONT COLOR="#0000ff">smb.conf</FONT></TT> file. This is a simple text file
designed to look a lot like those *.ini files used in Windows. The goal,
of course, is to give network administrators familiar with Windows
something comfortable to play with. Over time, though, the number of
things that can be configured in Samba has grown, and the percentage of
Network Admins willing to edit a Windows *.ini file has shrunk. For some
people, that makes managing the <TT>
<FONT COLOR="#0000ff">smb.conf</FONT></TT> file a bit daunting. 

<P>
Still, learning the ins and outs of <TT>
<FONT COLOR="#0000ff">smb.conf</FONT></TT> is a worthwhile penance.
Each of the <TT>
<FONT COLOR="#0000ff">smb.conf</FONT></TT> variables has a purpose, and a lot of fine-tuning
can be accomplished. The file structure contents are fully documented,
so as to give administrators a running head start, and <TT>
<FONT COLOR="#0000ff">smb.conf</FONT></TT> can be
manipulated using <TT>
<FONT COLOR="#0000ff">swat</FONT></TT>, which at least makes it nicer to look at. 

<P>

<H2><A NAME="SECTION004217000000000000000">
The Present</A>
</H2>

<P>
Samba 2.0 was released in January 1999. One of the most significant and
cool features of the 2.0 release was improved speed. Ziff-Davis
Publishing used their Netbench software to benchmark Samba 2.0 on Linux
against Windows NT4. They ran all of their tests on the same PC
hardware, and their results showed Samba's throughput under load to be
at least twice that of NT. Samba is shipped with all major Linux
distributions, and Ziff-Davis tested three of those. 

<P>
Another milestone was reached when Silicon Graphics (SGI) became the
first commercial U<SMALL>NIX</SMALL> vendor to support Samba. In their December 1998
press release, they claimed that their Origin series servers running
Samba 2.0 were the most powerful line of file servers for Windows
clients available. SGI now offers commercial support for Samba as do
several other providers, many of which are listed on the Samba web site
(see <I><TT><A NAME="tex2html64"
  HREF="http://samba.org/">http://samba.org/</A></TT></I>). Traditional Internet support is, of course,
still available via the <TT>
<FONT COLOR="#0000ff">comp.protocols.smb</FONT></TT> newsgroup and the
<TT>
<FONT COLOR="#0000ff">samba@samba.org</FONT></TT> mailing list.

<P>
The Samba Team continues to work on new goodies. Current interests
include NT ACLs (<I><B>A</B>ccess <B>C</B>ontrol <B>L</B>ists</I>),
support for LDAP (the Lightweight Directory Access Protocol), NT Domain Control, and
Microsoft's DFS (<I><B>D</B>istributed <B>F</B>ile <B>S</B>ystem</I>). 

<P>

<H2><A NAME="SECTION004218000000000000000">
The Future</A>
</H2>

<P>
Windows 2000 looms on the horizon like a lazy animal peeking its head
over the edge of its burrow while trying to decide whether or not to
come out. No one is exactly sure about the kind of animal it will be
when it does appear, but folks are fairly certain that it will have
teeth. 

<P>
Because of their dominance on the desktop, Microsoft gets to decide how
CIFS will grow. Windows 2000, like previous major operating system
releases, will give us a whole new critter to study. Based on the beta
copies and the things that Microsoft has said, here are some things to
watch for: 

<P>
<DL>
<DT><STRONG>CIFS Without NetBIOS</STRONG></DT>
<DD>Microsoft will attempt to decouple CIFS and NetBIOS. NetBIOS won't
    go away, mind you, but it won't be <I>required</I> for CIFS networking
    either. Instead, the SMB protocol will be carried natively over
    TCP/IP. Name lookups will occur via the DNS. 
</DD>
<DT><STRONG>Dynamic DNS</STRONG></DT>
<DD>Microsoft will implement Dynamic DNS, a still-evolving system
    designed by the IETF (<I><B>I</B>nternet
    <B>E</B>ngineering <B>T</B>ask <B>F</B>orce</I>). Dynamic DNS
    allows names to be added to a DNS server on-the-fly. 
</DD>
<DT><STRONG>Kerberos V</STRONG></DT>
<DD>Microsoft has plans to use Kerberos V. The Microsoft K5 tickets are
    supposed to contain a
    <EM><I><B>P</B>rivilege <B>A</B>ttribute <B>C</B>ertificate</I> (PAC)</EM> <I>&lt;<TT><A NAME="tex2html65"
  HREF="http://www.usenix.org/publications/login/1997-11/embraces.html">http://www.usenix.org/publications/login/1997-11/embraces.html</A></TT>&gt;</I>,
    which will include user and group ID information from the Active
    Directory. Servers will be looking for this PAC when they grant
    access to the services that they provide. Thus, Kerberos may be used
    for both authentication and authorization.
</DD>
<DT><STRONG>Active Directory</STRONG></DT>
<DD>The Active Directory appears to be at the heart of Windows 2000
    networking. It is likely that legacy NetBIOS services will register
    their names in the Active Directory. 
</DD>
<DT><STRONG>Hierarchical NT Domains</STRONG></DT>
<DD>Instead of isolated Domain Controllers, the NT Domain system will
    become hierarchical. The naming system will change to one that is
    remarkably similar to that of the DNS.
</DD>
</DL>

<P>
One certainty is that W2K (as it is often called) is, and will be, under
close scrutiny. Windows has already attracted the attention of some of
the Internet Wonderland's more curious inhabitants, including security
analysts, standards groups, crackers dens, and general all-purpose
geeks. The business world, which has finally gotten a taste of the
freedom of Open Source Software, may be reluctant to return to the world
of proprietary, single-vendor solutions. Having the code in your hands
is both reassuring and empowering. 

<P>
Whatever the next Windows animal looks like, it will be Samba's job to
help it get along with its peers in the diverse world of the Internet.
The Samba Team, a microcosm of the Internet community, are among those
watching W2K to see how it develops. Watching does not go hand-in-hand
with waiting, though, and Samba is an on-going and open effort. Visit
the Samba web site, join the mailing lists, and see what's going on. 

<P>
Participate in the future.
<BR>
<BR>


<P>
<HR>

<P>

<H1><A NAME="SECTION004220000000000000000">
39.2 Configuring Samba</A>
</H1>

<P>
That said, configuring <TT>
<FONT COLOR="#0000ff">smbd</FONT></TT> is really easy. A typical LAN
will require a U<SMALL>NIX</SMALL> machine that can share <TT>
<FONT COLOR="#0000ff">/home/*</FONT></TT>
directories to Windows clients, where each user can log in as the name of
their home directory. It must also act as a print share that redirects
print jobs through <TT>
<FONT COLOR="#0000ff">lpr</FONT></TT>; and then in PostScript, the way we like it.
Consider a Windows machine <TT>
<FONT COLOR="#0000ff">divinian.cranzgot.co.za</FONT></TT> on a local LAN
<TT>
<FONT COLOR="#0000ff">192.168.3.0/24</FONT></TT>. The user of that machine would have a U<SMALL>NIX</SMALL> login
<TT>
<FONT COLOR="#0000ff">psheer</FONT></TT> on the server <TT>
<FONT COLOR="#0000ff">cericon.cranzgot.co.za</FONT></TT>.

<P>
The usual place for Samba's configuration file is
<TT>
<FONT COLOR="#0000ff">/etc/samba/smb.conf</FONT></TT> on most distributions. A minimalist
configuration
file to perform the above functions might be:

<P><TABLE nowrap="1" width="100%" border="0" cellspacing="0" cellpadding="0">
<TR>
<TD valign="top" class="source" width="2%"><FONT color=red>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<font size="-1"><code>5</code></font><code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<font size="-1"><code>10</code></font><code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<font size="-1"><code>15</code></font><code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<font size="-1"><code>20</code></font><code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
</FONT></TD><TD valign="top" class="source" bgcolor="#FFE0C0"><FONT color=blue>
<code>[global]</code><br>
<code>&nbsp;&nbsp;&nbsp;workgroup&nbsp;=&nbsp;MYGROUP</code><br>
<code>&nbsp;&nbsp;&nbsp;server&nbsp;string&nbsp;=&nbsp;Samba&nbsp;Server</code><br>
<code>&nbsp;&nbsp;&nbsp;hosts&nbsp;allow&nbsp;=&nbsp;192.168.&nbsp;127.</code><br>
<code>&nbsp;&nbsp;&nbsp;printcap&nbsp;name&nbsp;=&nbsp;/etc/printcap</code><br>
<code>&nbsp;&nbsp;&nbsp;load&nbsp;printers&nbsp;=&nbsp;yes</code><br>
<code>&nbsp;&nbsp;&nbsp;printing&nbsp;=&nbsp;bsd</code><br>
<code>&nbsp;&nbsp;&nbsp;log&nbsp;file&nbsp;=&nbsp;/var/log/samba/%m.log</code><br>
<code>&nbsp;&nbsp;&nbsp;max&nbsp;log&nbsp;size&nbsp;=&nbsp;0</code><br>
<code>&nbsp;&nbsp;&nbsp;security&nbsp;=&nbsp;user</code><br>
<code>&nbsp;&nbsp;&nbsp;socket&nbsp;options&nbsp;=&nbsp;TCP_NODELAY&nbsp;SO_RCVBUF=8192&nbsp;SO_SNDBUF=8192</code><br>
<code>&nbsp;&nbsp;&nbsp;encrypt&nbsp;passwords&nbsp;=&nbsp;yes</code><br>
<code>&nbsp;&nbsp;&nbsp;smb&nbsp;passwd&nbsp;file&nbsp;=&nbsp;/etc/samba/smbpasswd</code><br>
<code>[homes]</code><br>
<code>&nbsp;&nbsp;&nbsp;comment&nbsp;=&nbsp;Home&nbsp;Directories</code><br>
<code>&nbsp;&nbsp;&nbsp;browseable&nbsp;=&nbsp;no</code><br>
<code>&nbsp;&nbsp;&nbsp;writable&nbsp;=&nbsp;yes</code><br>
<code>[printers]</code><br>
<code>&nbsp;&nbsp;&nbsp;comment&nbsp;=&nbsp;All&nbsp;Printers</code><br>
<code>&nbsp;&nbsp;&nbsp;path&nbsp;=&nbsp;/var/spool/samba</code><br>
<code>&nbsp;&nbsp;&nbsp;browseable&nbsp;=&nbsp;no</code><br>
<code>&nbsp;&nbsp;&nbsp;guest&nbsp;ok&nbsp;=&nbsp;no</code><br>
<code>&nbsp;&nbsp;&nbsp;printable&nbsp;=&nbsp;yes</code><br>
</FONT></TD></TR></TABLE><P>

<P>
The SMB protocol stores passwords differently from U<SMALL>NIX</SMALL>. It
therefore needs its own password file, usually
<TT>
<FONT COLOR="#0000ff">/etc/samba/smbpasswd</FONT></TT>. There is also a mapping between U<SMALL>NIX</SMALL>
logins and Samba logins in <TT>
<FONT COLOR="#0000ff">/etc/samba/smbusers</FONT></TT>, but for simplicity we will
use the same U<SMALL>NIX</SMALL> name as the Samba login name. We can add a
new U<SMALL>NIX</SMALL> user and Samba user and set both their passwords with

<P><TABLE nowrap="1" width="100%" border="0" cellspacing="0" cellpadding="0">
<TR>
<TD valign="top" class="source" width="2%"><FONT color=red>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
</FONT></TD><TD valign="top" class="source" bgcolor="#FFE0C0"><FONT color=blue>
<code>smbadduser&nbsp;psheer:psheer</code><br>
<code>useradd&nbsp;psheer</code><br>
<code>smbpasswd&nbsp;psheer</code><br>
<code>passwd&nbsp;psheer</code><br>
</FONT></TD></TR></TABLE><P>

<P>
Note that with SMB there are all sorts of issues with case
interpretation--an incorrectly typed password could still work
with Samba but obviously won't with U<SMALL>NIX</SMALL>.

<P>
To start Samba, run the familiar

<P><TABLE nowrap="1" width="100%" border="0" cellspacing="0" cellpadding="0">
<TR>
<TD valign="top" class="source" width="2%"><FONT color=red>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
</FONT></TD><TD valign="top" class="source" bgcolor="#FFE0C0"><FONT color=blue>
<code>/etc/init.d/smbd&nbsp;start</code><br>
<code>(&nbsp;/etc/rc.d/init.d/smbd&nbsp;start&nbsp;)</code><br>
<code>(&nbsp;/etc/init.d/samba&nbsp;start&nbsp;)</code><br>
</FONT></TD></TR></TABLE><P>

<P>
For good measure, there should also be a proper DNS configuration
with forward and reverse lookups for all client machines.

<P>
At this point you can test your Samba server from the U<SMALL>NIX</SMALL>
side. L<SMALL>INUX</SMALL> has native support for SMB shares with the <TT>
<FONT COLOR="#0000ff">smbfs</FONT></TT>
file system. Try <TT>
<FONT COLOR="#0000ff">mount</FONT></TT>ing a share served by the local machine:

<P><TABLE nowrap="1" width="100%" border="0" cellspacing="0" cellpadding="0">
<TR>
<TD valign="top" class="source" width="2%"><FONT color=red>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
</FONT></TD><TD valign="top" class="source" bgcolor="#FFE0C0"><FONT color=blue>
<code>mkdir&nbsp;-p&nbsp;/mnt/smb</code><br>
<code>mount&nbsp;-t&nbsp;smbfs&nbsp;-o&nbsp;username=psheer,password=12345&nbsp;//cericon/psheer&nbsp;/mnt/smb</code><br>
</FONT></TD></TR></TABLE><P>

<P>
You can now run <TT>
<FONT COLOR="#0000ff">tail&nbsp;-f&nbsp;/var/log/samba/cericon.log</FONT></TT>. It should
contain messages like:

<P><TABLE nowrap="1" width="100%" border="0" cellspacing="0" cellpadding="0">
<TR>
<TD valign="top" class="source" width="2%"><FONT color=red size="-1">
<code>&nbsp;</code><br>
</FONT></TD><TD valign="top" class="source" bgcolor="#FFE0C0"><FONT color=blue size="-1">
<code>cericon&nbsp;(192.168.3.2)&nbsp;connect&nbsp;to&nbsp;service&nbsp;psheer&nbsp;as&nbsp;user&nbsp;psheer&nbsp;(uid=500,&nbsp;gid=500)&nbsp;(pid&nbsp;942)</code><br>
</FONT></TD></TR></TABLE><P>
where a ``service'' means either a directory share or a print share.

<P>
The useful utility <TT>
<FONT COLOR="#0000ff">smbclient</FONT></TT> is a generic tool for
running SMB requests, but is mostly useful for printing. Make sure
your printer daemon is running (and working) and then try

<P><TABLE nowrap="1" width="100%" border="0" cellspacing="0" cellpadding="0">
<TR>
<TD valign="top" class="source" width="2%"><FONT color=red size="-1">
<code>&nbsp;</code><br>
</FONT></TD><TD valign="top" class="source" bgcolor="#FFE0C0"><FONT color=blue size="-1">
<code>echo&nbsp;hello&nbsp;|&nbsp;smbclient&nbsp;//cericon/lp&nbsp;12345&nbsp;-U&nbsp;psheer&nbsp;-c&nbsp;'print&nbsp;-'</code><br>
</FONT></TD></TR></TABLE><P>
which will create a small entry in the <TT>
<FONT COLOR="#0000ff">lp</FONT></TT> print
queue. Your log file will be appended with:

<P><TABLE nowrap="1" width="100%" border="0" cellspacing="0" cellpadding="0">
<TR>
<TD valign="top" class="source" width="2%"><FONT color=red size="-1">
<code>&nbsp;</code><br>
</FONT></TD><TD valign="top" class="source" bgcolor="#FFE0C0"><FONT color=blue size="-1">
<code>cericon&nbsp;(192.168.3.2)&nbsp;connect&nbsp;to&nbsp;service&nbsp;lp&nbsp;as&nbsp;user&nbsp;psheer&nbsp;(uid=500,&nbsp;gid=500)&nbsp;(pid&nbsp;1014)</code><br>
</FONT></TD></TR></TABLE><P>

<P>

<H1><A NAME="SECTION004230000000000000000">
39.3 Configuring Windows</A>
</H1>

<P>
Configuration from Windows begins with a working TCP/IP
configuration:
<DIV ALIGN="CENTER">
 <!-- MATH
 $\epsfbox{desk3.ps}$
 -->
<IMG
   ALIGN="BOTTOM" BORDER="0"
 SRC="desk3.png"
 ALT="\epsfbox{desk3.ps}">

</DIV>
Next, you need to <B>Log&nbsp;Off</B> from the <B>Start</B> menu and
log back in as your Samba user.
<DIV ALIGN="CENTER">
 <!-- MATH
 $\epsfbox{desk1.ps}$
 -->
<IMG
   ALIGN="BOTTOM" BORDER="0"
 SRC="desk1.png"
 ALT="\epsfbox{desk1.ps}">

</DIV>

<P>
Finally, go to <B>Run...</B> in the <B>Start</B> menu
and enter <TT>
<FONT COLOR="#0000ff">&#92;&#92;cericon&#92;psheer</FONT></TT>.
You will be prompted for a password, which you should enter as
for the <TT>
<FONT COLOR="#0000ff">smbpasswd</FONT></TT> program above.
<DIV ALIGN="CENTER">
 <!-- MATH
 $\epsfbox{desk2.ps}$
 -->
<IMG
   ALIGN="BOTTOM" BORDER="0"
 SRC="desk1.png"
 ALT="\epsfbox{desk2.ps}">

</DIV>
This should bring up your home directory like
you have probably never seen it before.

<P>

<H1><A NAME="SECTION004240000000000000000">
39.4 Configuring a Windows Printer</A>
</H1>

<P>
Under <B>Settings</B> in your <B>Start</B> menu, you can
add new printers. Your U<SMALL>NIX</SMALL> <TT>
<FONT COLOR="#0000ff">lp</FONT></TT> print queue is visible as the
<TT>
<FONT COLOR="#0000ff">&#92;&#92;cericon&#92;lp</FONT></TT> network
printer and should be entered as such in the configuration wizard. For
a printer driver, you should choose ``Apple Color Laserwriter,'' since
this driver just produces regular PostScript output. In the printer driver
options you should also select to optimize for ``portability.''

<P>

<H1><A NAME="SECTION004250000000000000000">
39.5 Configuring <TT>
<FONT COLOR="#0000ff">swat</FONT></TT></A>
</H1>

<P>

<TT>
<FONT COLOR="#0000ff">swat</FONT></TT> is a service, run from <TT>
<FONT COLOR="#0000ff">inetd</FONT></TT>, that listens for HTTP
connections on port <TT>
<FONT COLOR="#0000ff">901</FONT></TT>. It allows complete remote management of
Samba from a web browser. To configure, add the service
<TT>
<FONT COLOR="#0000ff">swat&nbsp;&nbsp;901/tcp</FONT></TT> to your <TT>
<FONT COLOR="#0000ff">/etc/services</FONT></TT> file, and the
following to your <TT>
<FONT COLOR="#0000ff">/etc/inetd.conf</FONT></TT> file.

<P><TABLE nowrap="1" width="100%" border="0" cellspacing="0" cellpadding="0">
<TR>
<TD valign="top" class="source" width="2%"><FONT color=red>
<code>&nbsp;</code><br>
</FONT></TD><TD valign="top" class="source" bgcolor="#FFE0C0"><FONT color=blue>
<code>swat&nbsp;stream&nbsp;tcp&nbsp;nowait&nbsp;root&nbsp;/usr/sbin/tcpd&nbsp;/usr/sbin/swat</code><br>
</FONT></TD></TR></TABLE><P>
being <I>very careful who you allow connections from</I>.
If you are running <TT>
<FONT COLOR="#0000ff">xinetd</FONT></TT>, create a file
<TT>
<FONT COLOR="#0000ff">/etc/xinetd.d/swat</FONT></TT>:

<P><TABLE nowrap="1" width="100%" border="0" cellspacing="0" cellpadding="0">
<TR>
<TD valign="top" class="source" width="2%"><FONT color=red>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<font size="-1"><code>5</code></font><code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<font size="-1"><code>10</code></font><code>&nbsp;</code><br>
<code>&nbsp;</code><br>
<code>&nbsp;</code><br>
</FONT></TD><TD valign="top" class="source" bgcolor="#FFE0C0"><FONT color=blue>
<code>service&nbsp;swat</code><br>
<code>{</code><br>
<code>&nbsp;&nbsp;&nbsp;&nbsp;port&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;901</code><br>
<code>&nbsp;&nbsp;&nbsp;&nbsp;socket_type&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;stream</code><br>
<code>&nbsp;&nbsp;&nbsp;&nbsp;wait&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;no</code><br>
<code>&nbsp;&nbsp;&nbsp;&nbsp;only_from&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;localhost&nbsp;192.168.0.0/16</code><br>
<code>&nbsp;&nbsp;&nbsp;&nbsp;user&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;root</code><br>
<code>&nbsp;&nbsp;&nbsp;&nbsp;server&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;/usr/sbin/swat</code><br>
<code>&nbsp;&nbsp;&nbsp;&nbsp;server_args&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;-s&nbsp;/etc/samba/smb.conf</code><br>
<code>&nbsp;&nbsp;&nbsp;&nbsp;log_on_failure&nbsp;&nbsp;+=&nbsp;USERID</code><br>
<code>&nbsp;&nbsp;&nbsp;&nbsp;disable&nbsp;=&nbsp;no</code><br>
<code>}</code><br>
</FONT></TD></TR></TABLE><P>

<P>
After restarting <TT>
<FONT COLOR="#0000ff">inetd</FONT></TT> (or <TT>
<FONT COLOR="#0000ff">xinetd</FONT></TT>), you can point your web
browser to <I><TT><A NAME="tex2html66"
  HREF="http://cericon:901/">http://cericon:901/</A></TT></I>. Netscape will request a user and
password. You should login as <TT>
<FONT COLOR="#0000ff">root</FONT></TT> (<TT>
<FONT COLOR="#0000ff">swat</FONT></TT> does not use <TT>
<FONT COLOR="#0000ff">smbpasswd</FONT></TT>
to authenticate this login). The web page interface is extremely easy to use--
<DIV ALIGN="CENTER">
 <!-- MATH
 $\epsfbox{swat.ps}$
 -->
<IMG
   ALIGN="BOTTOM" BORDER="0"
 SRC="desk2.png"
 ALT="\epsfbox{swat.ps}">

</DIV>
--and, being written by the Samba developers
themselves, can be trusted to produce working configurations. The web
page also gives a convenient interface to all the
documentation. Do note
that it will completely overwrite your existing configuration file.

<P>

<H1><A NAME="SECTION004260000000000000000">
39.6 Windows NT Caveats</A>
</H1>

<P>
Windows SMB servers compete to be the name server of their domain by
version number and uptime. By this we again mean the Windows name
service and not the DNS service. How exactly this works I will not cover
here, <FONT COLOR="#ffa500">[Probably because I have no idea what I am talking about.]</FONT>but do be aware that configuring a Samba server on a network of many NT
machines and getting it to work can be a nightmare. A solution once
attempted was to shut down all machines on the LAN, then pick one as the
domain server, then bring it up first after waiting an hour for all
possible timeouts to have elapsed. After verifying that it was working
properly, the rest of the machines were booted.

<P>
Then of course, don't forget your <TT>
<FONT COLOR="#0000ff">nmblookup</FONT></TT> command. 

<P>

<P>
<HR>
<!--Navigation Panel-->
<A NAME="tex2html2740"
  HREF="node43.html">
<IMG WIDTH="37" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="next" SRC="next.png"></A> 
<A NAME="tex2html2736"
  HREF="rute.html">
<IMG WIDTH="26" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="up" SRC="up.png"></A> 
<A NAME="tex2html2730"
  HREF="node41.html">
<IMG WIDTH="63" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="previous" SRC="prev.png"></A> 
<A NAME="tex2html2738"
  HREF="node1.html">
<IMG WIDTH="65" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="contents" SRC="contents.png"></A>  
<BR>
<B> Next:</B> <A NAME="tex2html2741"
  HREF="node43.html">40. named  </A>
<B> Up:</B> <A NAME="tex2html2737"
  HREF="rute.html">rute</A>
<B> Previous:</B> <A NAME="tex2html2731"
  HREF="node41.html">38. postgres SQL Server</A>
 &nbsp <B>  <A NAME="tex2html2739"
  HREF="node1.html">Contents</A></B> 
<!--End of Navigation Panel-->

</BODY>
</HTML>