From cb6ea099e30da42f08977d212bf7811b653604bf Mon Sep 17 00:00:00 2001 From: Petr Bokoc Date: Fri, 30 Jun 2023 13:43:53 +0200 Subject: [PATCH] Replace outdated Samba docs with a link to RHEL9 docs --- .../pages/_partials/servers/Samba.adoc | 1186 +---------------- 1 file changed, 1 insertion(+), 1185 deletions(-) diff --git a/modules/system-administrators-guide/pages/_partials/servers/Samba.adoc b/modules/system-administrators-guide/pages/_partials/servers/Samba.adoc index 8e0dbd2..a0cc493 100644 --- a/modules/system-administrators-guide/pages/_partials/servers/Samba.adoc +++ b/modules/system-administrators-guide/pages/_partials/servers/Samba.adoc @@ -1,1192 +1,8 @@ [[sect-Samba]] == Samba -indexterm:[Samba,Reference]indexterm:[Samba,Samba] -[application]*Samba* is the standard open source Windows interoperability suite of programs for Linux. It implements the _server message block_ (`SMB`) protocol. Modern versions of this protocol are also known as the _common Internet file system_ (`CIFS`) protocol. It allows the networking of Microsoft *Windows*, Linux, UNIX, and other operating systems together, enabling access to Windows-based file and printer shares. Samba's use of `SMB` allows it to appear as a Windows server to Windows clients. -.Installing the samba package -[NOTE] -==== - -In order to use [application]*Samba*, first ensure the [package]*samba* package is installed on your system by running, as `root`: - -[subs="attributes"] ----- -~]#{nbsp}dnf install samba ----- - -For more information on installing packages with DNF, see xref:package-management/DNF.adoc#sec-Installing[Installing Packages]. - -==== - -[[sect-Samba-Introduction_to_Samba]] -=== Introduction to Samba -indexterm:[Samba,Introduction] -Samba is an important component to seamlessly integrate Linux Servers and Desktops into Active Directory (AD) environments. It can function both as a domain controller (NT4-style) or as a regular domain member (AD or NT4-style). -indexterm:[Samba,Abilities] -.What Samba can do: - -* Serve directory trees and printers to Linux, UNIX, and Windows clients - -* Assist in network browsing (with NetBIOS) - -* Authenticate Windows domain logins - -* Provide _Windows Internet Name Service_ (`WINS`) name server resolution - -* Act as a Windows *NT*-style _Primary Domain Controller_ (PDC) - -* Act as a _Backup Domain Controller_ (BDC) for a Samba-based PDC - -* Act as an Active Directory domain member server - -* Join a Windows NT/2000/2003/2008 PDC/Windows Server 2012 - -.What Samba cannot do: - -* Act as a BDC for a Windows PDC (and vice versa) - -* Act as an Active Directory domain controller - -[[sect-Samba_Daemons_and_Related_Services]] -=== Samba Daemons and Related Services -indexterm:[Samba,daemon,overview] -Samba is comprised of three daemons (`smbd`, `nmbd`, and `winbindd`). Three services (`smb`, `nmb`, and `winbind`) control how the daemons are started, stopped, and other service-related features. These services act as different init scripts. Each daemon is listed in detail below, as well as which specific service has control over it. - -.smbdindexterm:[Samba,daemon,smbd] -The `smbd` server daemon provides file sharing and printing services to Windows clients. In addition, it is responsible for user authentication, resource locking, and data sharing through the `SMB` protocol. The default ports on which the server listens for `SMB` traffic are `TCP` ports 139 and 445. - -The `smbd` daemon is controlled by the `smb` service. - -.nmbdindexterm:[Samba,daemon,nmbd] -The `nmbd` server daemon understands and replies to NetBIOS name service requests such as those produced by SMB/CIFS in Windows-based systems. These systems include Windows 95/98/ME, Windows NT, Windows 2000, Windows XP, and LanManager clients. It also participates in the browsing protocols that make up the Windows `Network Neighborhood` view. The default port that the server listens to for `NMB` traffic is `UDP` port `137`. - -The `nmbd` daemon is controlled by the `nmb` service. - -.winbinddindexterm:[Samba,daemon,winbindd] -The `winbind` service resolves user and group information received from a server running Windows NT, 2000, 2003, Windows Server 2008, or Windows Server 2012. This makes Windows user and group information understandable by UNIX platforms. This is achieved by using Microsoft RPC calls, _Pluggable Authentication Modules_ (PAM), and the _Name Service Switch_ (NSS). This allows Windows NT domain and Active Directory users to appear and operate as UNIX users on a UNIX machine. Though bundled with the Samba distribution, the `winbind` service is controlled separately from the `smb` service. - -The `winbind` daemon is controlled by the `winbind` service and does not require the `smb` service to be started in order to operate. `winbind` is also used when Samba is an Active Directory member, and may also be used on a Samba domain controller (to implement nested groups and interdomain trust). Because `winbind` is a client-side service used to connect to Windows NT-based servers, further discussion of `winbind` is beyond the scope of this chapter. - -.Obtaining a list of utilities that are shipped with Samba -[NOTE] -==== - -See xref:File_and_Print_Servers.adoc#sect-Samba_Distribution_Programs[Samba Distribution Programs] for a list of utilities included in the Samba distribution. - -==== - -[[sect-Samba-Connecting_to_a_Samba_Share]] -=== Connecting to a Samba Share -indexterm:[Samba,share,connecting to with Nautilus] -You can use either [application]*Nautilus* or command line to connect to available Samba shares. - -[[proc-Samba-Connecting_to_a_Samba_Share_GUI]] -.Connecting to a Samba Share Using Nautilus -. To view a list of Samba workgroups and domains on your network, select menu:Places[ > `Network`pass:attributes[{blank}]] from the GNOME panel, and then select the desired network. Alternatively, type `smb:` in the menu:File[ > `Open Location`pass:attributes[{blank}]] bar of [application]*Nautilus*. -+ -An icon appears for each available `SMB` workgroup or domain on the network. -+ -[[fig-samba-nautilus-workgroups]] -.SMB Workgroups in Nautilus -+ -image::samba-nautilus-domain.png[SMB Workgroups in Nautilus] - -. Double-click one of the workgroup or domain icon to view a list of computers within the workgroup or domain. - -. An icon exists for each machine within the workgroup. Double-click on an icon to view the Samba shares on the machine. If a user name and password combination is required, you are prompted for them. -+ -Alternately, you can also specify the Samba server and sharename in the `Location:` bar for [application]*Nautilus* using the following syntax (replace _servername_ and _sharename_ with the appropriate values): -+ -[subs="quotes, macros"] ----- -[command]#smb://pass:attributes[{blank}]_servername_pass:attributes[{blank}]/pass:attributes[{blank}]_sharename_pass:attributes[{blank}]# ----- - -indexterm:[Samba,share,connecting to via the command line]indexterm:[Samba,smbclient]indexterm:[smbclient] - -[[proc-Samba-Connecting_to_a_Samba_Share_CLI]] -.Connecting to a Samba Share Using the Command Line -. To connect to a Samba share from a shell prompt, type the following command: -+ -[subs="quotes, macros"] ----- -[command]#~]$ smbclient //pass:attributes[{blank}]_hostname_pass:attributes[{blank}]/pass:attributes[{blank}]_sharename_ -U _username_pass:attributes[{blank}]# ----- -+ -Replace _hostname_ with the host name or `IP` address of the Samba server you want to connect to, _sharename_ with the name of the shared directory you want to browse, and _username_ with the Samba user name for the system. Enter the correct password or press kbd:[Enter] if no password is required for the user. -+ -If you see the `smb:\>` prompt, you have successfully logged in. Once you are logged in, type `help` for a list of commands. If you want to browse the contents of your home directory, replace _sharename_ with your user name. If the [command]#-U# switch is not used, the user name of the current user is passed to the Samba server. - -. To exit [command]#smbclient#, type `exit` at the `smb:\>` prompt. - -[[sect-Mounting_the_Samba_Share]] -=== Mounting the Share -indexterm:[Samba,share,mounting] -Sometimes it is useful to mount a Samba share to a directory so that the files in the directory can be treated as if they are part of the local file system. - -To mount a Samba share to a directory, create a directory to mount it to (if it does not already exist), and execute the following command as `root`: - -[subs="quotes, macros"] ----- -[command]#mount -t cifs //pass:attributes[{blank}]_servername_pass:attributes[{blank}]/pass:attributes[{blank}]_sharename_ _/mnt/point/_ -o username=pass:attributes[{blank}]_username_,password=pass:attributes[{blank}]_password_pass:attributes[{blank}]# ----- - -This command mounts _sharename_ from _servername_ in the local directory _/mnt/point/_. - -For more information about mounting a samba share, see the *mount.cifs*(8) manual page. - -.Installing cifs-utils package -[NOTE] -==== - -The [application]*mount.cifs* utility is a separate RPM (independent from Samba). In order to use [application]*mount.cifs*, first ensure the [package]*cifs-utils* package is installed on your system by running, as `root`: - -[subs="attributes"] ----- -~]#{nbsp}dnf install cifs-utils ----- - -For more information on installing packages with DNF, see xref:package-management/DNF.adoc#sec-Installing[Installing Packages]. - -Note that the [package]*cifs-utils* package also contains the [application]*cifs.upcall* binary called by the kernel in order to perform kerberized CIFS mounts. For more information on [application]*cifs.upcall*, see the *cifs.upcall*(8) manual page. - -==== - -.CIFS servers that require plain text passwords -[WARNING] -==== - -Some CIFS servers require plain text passwords for authentication. Support for plain text password authentication can be enabled using the following command as `root`: - -[subs="attributes"] ----- -~]#{nbsp}echo 0x37 > /proc/fs/cifs/SecurityFlags ----- - -WARNING: This operation can expose passwords by removing password encryption. - -==== - -[[sect-Samba-Configuring_a_Samba_Server]] -=== Configuring a Samba Server -indexterm:[Samba,configuration]indexterm:[Samba,configuration,default] -The default configuration file (`/etc/samba/smb.conf`) allows users to view their home directories as a Samba share. It also shares all printers configured for the system as Samba shared printers. You can attach a printer to the system and print to it from the Windows machines on your network. - -[[sect-Samba-GUI_Configuration]] -==== Graphical Configuration -indexterm:[Samba,graphical configuration] -To configure Samba using a graphical interface, use one of the available Samba graphical user interfaces. A list of available GUIs can be found at link:++https://www.samba.org/samba/GUI/++[https://www.samba.org/samba/GUI/]. - -[[sect-Samba-Command-Line-Configuration]] -==== Command-Line Configuration -indexterm:[Samba,configuration] -Samba uses `/etc/samba/smb.conf` as its configuration file. If you change this configuration file, the changes do not take effect until you restart the Samba daemon with the following command, as `root`: - -[subs="attributes"] ----- -~]#{nbsp}systemctl restart smb.service ----- - -To specify the Windows workgroup and a brief description of the Samba server, edit the following lines in your `/etc/samba/smb.conf` file: - -[subs="quotes, macros"] ----- - -workgroup = _WORKGROUPNAME_ -server string = _BRIEF COMMENT ABOUT SERVER_ ----- - -Replace _WORKGROUPNAME_ with the name of the Windows workgroup to which this machine should belong. The _BRIEF COMMENT ABOUT SERVER_ is optional and is used as the Windows comment about the Samba system. - -To create a Samba share directory on your Linux system, add the following section to your `/etc/samba/smb.conf` file (after modifying it to reflect your needs and your system): - -[[exam-Samba-Configuring_Samba_Server]] -.An Example Configuration of a Samba Server -==== - -[subs="quotes, macros"] ----- - -[pass:attributes[{blank}]_sharename_pass:attributes[{blank}]] -comment = _Insert a comment here_ -path = _/home/share/_ -valid users = _tfox carole_ -writable = yes -create mask = 0765 ----- - -==== - -The above example allows the users [command]#tfox# and [command]#carole# to read and write to the directory `/home/share/`, on the Samba server, from a Samba client. - -[[sect-Samba-Encrypted_Passwords]] -==== Encrypted Passwords - -Encrypted passwords are enabled by default because it is more secure to use them. To create a user with an encrypted password, use the `smbpasswd` utility: - -[subs="quotes, macros"] ----- -[command]#smbpasswd -a _username_pass:attributes[{blank}]# ----- -indexterm:[Samba,with Windows NT 4.0, 2000, ME, and XP]indexterm:[Windows NT 4.0,connecting to shares using Samba]indexterm:[Windows 98,connecting to shares using Samba]indexterm:[Windows 2000,connecting to shares using Samba]indexterm:[Windows ME,connecting to shares using Samba]indexterm:[Windows XP,connecting to shares using Samba]indexterm:[Samba,encrypted passwords] - -[[sect-Samba-Starting_and_Stopping]] -=== Starting and Stopping Samba -indexterm:[Samba,service,starting]indexterm:[Samba,service,stopping]indexterm:[Samba,service,restarting]indexterm:[Samba,service,conditional restarting]indexterm:[Samba,service,reloading] -To start a Samba server, type the following command in a shell prompt, as `root`: - -[subs="attributes"] ----- -~]#{nbsp}systemctl start smb.service ----- - -.Setting up a domain member server [IMPORTANT] ==== - -To set up a domain member server, you must first join the domain or Active Directory using the [command]#net join# command *before* starting the `smb` service. Also, it is recommended to run `winbind` before `smbd`. - +Documentation for configuring and using Samba has been removed due to being outdated. Use link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/configuring_and_using_network_file_services/index#assembly_using-samba-as-a-server_configuring-and-using-network-file-services[Red Hat Enterprise Linux 9 Samba documentation] instead. ==== - -To stop the server, type the following command in a shell prompt, as `root`: - -[subs="attributes"] ----- -~]#{nbsp}systemctl stop smb.service ----- - -The [option]`restart` option is a quick way of stopping and then starting Samba. This is the most reliable way to make configuration changes take effect after editing the configuration file for Samba. Note that the restart option starts the daemon even if it was not running originally. - -To restart the server, type the following command in a shell prompt, as `root`: - -[subs="attributes"] ----- -~]#{nbsp}systemctl restart smb.service ----- - -The [option]`condrestart` (_conditional restart_) option only starts `smb` on the condition that it is currently running. This option is useful for scripts, because it does not start the daemon if it is not running. - -.Applying the changes to the configuration -[NOTE] -==== - -When the `/etc/samba/smb.conf` file is changed, Samba automatically reloads it after a few minutes. Issuing a manual [command]#restart# or [command]#reload# is just as effective. - -==== - -To conditionally restart the server, type the following command, as `root`: - -[subs="attributes"] ----- -~]#{nbsp}systemctl try-restart smb.service ----- - -A manual reload of the `/etc/samba/smb.conf` file can be useful in case of a failed automatic reload by the `smb` service. To ensure that the Samba server configuration file is reloaded without restarting the service, type the following command, as `root`: - -[subs="attributes"] ----- -~]#{nbsp}systemctl reload smb.service ----- - -By default, the `smb` service does *not* start automatically at boot time. To configure Samba to start at boot time, type the following at a shell prompt as `root`: - -[subs="attributes"] ----- -~]#{nbsp}systemctl enable smb.service ----- - -See xref:infrastructure-services/Services_and_Daemons.adoc#ch-Services_and_Daemons[Services and Daemons] for more information regarding this tool. - -[[sect-Samba-Server_Types_and_the_smb.conf_File]] -=== Samba Server Types and the `smb.conf` File -indexterm:[Samba,smb.conf]indexterm:[Samba,Server Types] -Samba configuration is straightforward. All modifications to Samba are done in the `/etc/samba/smb.conf` configuration file. Although the default `smb.conf` file is well documented, it does not address complex topics such as LDAP, Active Directory, and the numerous domain controller implementations. - -The following sections describe the different ways a Samba server can be configured. Keep in mind your needs and the changes required to the `/etc/samba/smb.conf` file for a successful configuration. - -[[sect-Samba-Standalone_Server]] -==== Stand-alone Server -indexterm:[Samba,server types,Stand Alone] -A stand-alone server can be a workgroup server or a member of a workgroup environment. A stand-alone server is not a domain controller and does not participate in a domain in any way. The following examples include several user-level security configurations. For more information on security modes, see xref:File_and_Print_Servers.adoc#sect-Samba-Security_Modes[Samba Security Modes]. - -.Anonymous Read-Onlyindexterm:[Samba,smb.conf,Anonymous Read Only example] -The following `/etc/samba/smb.conf` file shows a sample configuration needed to implement anonymous read-only file sharing. Two directives are used to configure anonymous access – `map to guest = Bad user` and `guest account = nobody`. - -[[exam-Samba-Standalone_Anonymous_Read-Only_Server]] -.An Example Configuration of a Anonymous Read-Only Samba Server -==== - ----- -[global] -workgroup = DOCS -netbios name = DOCS_SRV -security = user -guest account = nobody # default value -map to guest = Bad user - -[data] -comment = Documentation Samba Server -path = /export -read only = yes -guest ok = yes ----- - -==== - -.Anonymous Read/Writeindexterm:[Samba,smb.conf,Anonymous Read/Write example] -The following `/etc/samba/smb.conf` file shows a sample configuration needed to implement anonymous read/write file sharing. To enable anonymous read/write file sharing, set the `read only` directive to `no`. The `force user` and `force group` directives are also added to enforce the ownership of any newly placed files specified in the share. - -.Do not use anonymous read/write servers -[NOTE] -==== - -Although having an anonymous read/write server is possible, it is not recommended. Any files placed in the share space, regardless of user, are assigned the user/group combination as specified by a generic user (`force user`) and group (`force group`) in the `/etc/samba/smb.conf` file. - -==== - -[[exam-Samba-Standalone_Anonymous_Read-Write-Server]] -.An Example Configuration of a Anonymous Read/Write Samba Server -==== - ----- - -[global] -workgroup = DOCS -security = user -guest account = nobody # default value -map to guest = Bad user - -[data] -comment = Data -path = /export -guest ok = yes -writeable = yes -force user = user -force group = group ----- - -==== - -.Anonymous Print Serverindexterm:[Samba,smb.conf,Anonymous Print Server example] -The following `/etc/samba/smb.conf` file shows a sample configuration needed to implement an anonymous print server. Setting `browseable` to `no` as shown does not list the printer in Windows `Network Neighborhood`. Although hidden from browsing, configuring the printer explicitly is possible. By connecting to `DOCS_SRV` using NetBIOS, the client can have access to the printer if the client is also part of the `DOCS` workgroup. It is also assumed that the client has the correct local printer driver installed, as the `use client driver` directive is set to `yes`. In this case, the Samba server has no responsibility for sharing printer drivers to the client. - -[[exam-Samba-Standalone_Anonymous_Print-Server]] -.An Example Configuration of a Anonymous Print Samba Server -==== - ----- - -[global] -workgroup = DOCS -netbios name = DOCS_SRV -security = user -map to guest = Bad user -printing = cups - -[printers] -comment = All Printers -path = /var/spool/samba -guest ok = yes -printable = yes -use client driver = yes -browseable = yes ----- - -==== - -.Secure Read/Write File and Print Serverindexterm:[Samba,smb.conf,Secure File and Print Server example] -The following `/etc/samba/smb.conf` file shows a sample configuration needed to implement a secure read/write file and print server. Setting the `security` directive to `user` forces Samba to authenticate client connections. Notice the `[homes]` share does not have a `force user` or `force group` directive as the `[public]` share does. The `[homes]` share uses the authenticated user details for any files created as opposed to the `force user` and `force group` in `[public]`. - -[[exam-Samba-Standalone_Secure_Read_Write_File_and_Print_Server]] -.An Example Configuration of a Secure Read/Write File and Print Samba Server -==== - ----- - -[global] -workgroup = DOCS -netbios name = DOCS_SRV -security = user -printcap name = cups -disable spools = yes -show add printer wizard = no -printing = cups - -[homes] -comment = Home Directories -valid users = %S -read only = no -browseable = no - -[public] -comment = Data -path = /export -force user = docsbot -force group = users -guest ok = yes - -[printers] -comment = All Printers -path = /var/spool/samba -printer admin = john, ed, @admins -create mask = 0600 -guest ok = yes -printable = yes -use client driver = yes -browseable = yes ----- - -==== - -[[sect-Samba-Domain_Member_Server]] -==== Domain Member Server -indexterm:[Samba,server types,Domain Member] -A domain member, while similar to a stand-alone server, is logged into a domain controller (either Windows or Samba) and is subject to the domain's security rules. An example of a domain member server would be a departmental server running Samba that has a machine account on the Primary Domain Controller (PDC). All of the department's clients still authenticate with the PDC, and desktop profiles and all network policy files are included. The difference is that the departmental server has the ability to control printer and network shares. - -.Active Directory Domain Member Serverindexterm:[Samba,smb.conf,Active Directory Member Server example] -To implement an Active Directory domain member server, follow procedure below: - -[[proc-Samba-Adding_an_AD_Member]] -.Adding a Member Server to an Active Directory Domain -. Create the `/etc/samba/smb.conf` configuration file on a member server to be added to the Active Directory domain. Add the following lines to the configuration file: -+ ----- - -[global] -realm = EXAMPLE.COM -security = ADS -encrypt passwords = yes -# Optional. Use only if Samba cannot determine the Kerberos server automatically. -password server = kerberos.example.com ----- -+ -With the above configuration, Samba authenticates users for services being run locally but is also a client of the Active Directory. Ensure that your kerberos `realm` parameter is shown in all caps (for example `realm = EXAMPLE.COM`). Since Windows 2000/2003/2008 requires Kerberos for Active Directory authentication, the `realm` directive is required. If Active Directory and Kerberos are running on different servers, the `password server` directive is required to help the distinction. - -. Configure Kerberos on the member server. Create the `/etc/krb5.conf` configuration file with the following content: -+ ----- - -[logging] - default = FILE:/var/log/krb5libs.log - -[libdefaults] - default_realm = AD.EXAMPLE.COM - dns_lookup_realm = true - dns_lookup_kdc = true - ticket_lifetime = 24h - renew_lifetime = 7d - rdns = false - forwardable = false - -[realms] -# Define only if DNS lookups are not working -# AD.EXAMPLE.COM = { -# kdc = server.ad.example.com -# admin_server = server.ad.example.com -# master_kdc = server.ad.example.com -# } - -[domain_realm] -# Define only if DNS lookups are not working -# .ad.example.com = AD.EXAMPLE.COM -# ad.example.com = AD.EXAMPLE.COM ----- -+ -Uncomment the `[realms]` and `[domain_realm]` sections if DNS lookups are not working. -+ -For more information on Kerberos, and the [command]#/etc/krb5.conf# file, see the [citetitle]_Using Kerberos_ section of the [citetitle]_link:++https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/Using_Kerberos.html++[Red{nbsp}Hat{nbsp}Enterprise{nbsp}Linux{nbsp}7 System Level Authentication Guide]_. - -. To join an Active Directory server, type the following command as `root` on the member server: -+ ----- -~]# net ads join -U administrator%password ----- -+ -The [command]#net# command authenticates as `Administrator` using the NT LAN Manager (NTLM) protocol and creates the machine account. Then [command]#net# uses the machine account credentials to authenticate with Kerberos. -+ -.The security option -[NOTE] -==== - -Since `security = ads` and not `security = user` is used, a local password back end such as `smbpasswd` is not needed. Older clients that do not support `security = ads` are authenticated as if `security = domain` had been set. This change does not affect functionality and allows local users not previously in the domain. - -==== - -.Windows NT4-based Domain Member Serverindexterm:[Samba,smb.conf,NT4-style Domain Member example] -The following `/etc/samba/smb.conf` file shows a sample configuration needed to implement a Windows NT4-based domain member server. Becoming a member server of an NT4-based domain is similar to connecting to an Active Directory. The main difference is NT4-based domains do not use Kerberos in their authentication method, making the `/etc/samba/smb.conf` file simpler. In this instance, the Samba member server functions as a pass through to the NT4-based domain server. - -[[exam-Samba-Domain_Member_Server-Windows_NT4-based_Domain_Memeber_Server]] -.An Example Configuration of Samba Windows NT4-based Domain Member Server -==== - ----- - -[global] -workgroup = DOCS -netbios name = DOCS_SRV -security = domain - -[homes] -comment = Home Directories -valid users = %S -read only = no -browseable = no - -[public] -comment = Data -path = /export -force user = docsbot -force group = users -guest ok = yes ----- - -==== - -Having Samba as a domain member server can be useful in many situations. There are times where the Samba server can have other uses besides file and printer sharing. It may be beneficial to make Samba a domain member server in instances where Linux-only applications are required for use in the domain environment. Administrators appreciate keeping track of all machines in the domain, even if not Windows-based. In the event the Windows-based server hardware is deprecated, it is quite easy to modify the `/etc/samba/smb.conf` file to convert the server to a Samba-based PDC. If Windows NT-based servers are upgraded to Windows 2000/2003/2008 the `/etc/samba/smb.conf` file is easily modifiable to incorporate the infrastructure change to Active Directory if needed. - -.Make sure you join the domain before starting Samba -[IMPORTANT] -==== - -After configuring the `/etc/samba/smb.conf` file, join the domain *before* starting Samba by typing the following command as `root`: - ----- -~]# net rpc join -U administrator%password ----- - -==== - -Note that the [option]`-S` option, which specifies the domain server host name, does not need to be stated in the [command]#net rpc join# command. Samba uses the host name specified by the `workgroup` directive in the `/etc/samba/smb.conf` file instead of it being stated explicitly. - -[[sect-Samba-Domain_Controller]] -==== Domain Controller -indexterm:[Samba,server types,Domain Controller] -A domain controller in Windows NT is functionally similar to a Network Information Service (NIS) server in a Linux environment. Domain controllers and NIS servers both host user and group information databases as well as related services. Domain controllers are mainly used for security, including the authentication of users accessing domain resources. The service that maintains the user and group database integrity is called the _Security Account Manager_ (SAM). The SAM database is stored differently between Windows and Linux Samba-based systems, therefore SAM replication cannot be achieved and platforms cannot be mixed in a PDC/BDC environment. - -In a Samba environment, there can be only one PDC and zero or more BDCs. - -.A mixed Samba/Windows domain controller environment -[IMPORTANT] -==== - -Samba cannot exist in a mixed Samba/Windows domain controller environment (Samba cannot be a BDC of a Windows PDC or vice versa). Alternatively, Samba PDCs and BDCs *can* coexist. - -==== - -.Primary Domain Controller (PDC) Using `tdbsam`pass:attributes[{blank}]indexterm:[Samba,smb.conf,PDC using tdbsam] -The simplest and most common implementation of a Samba PDC uses the new default `tdbsam` password database back end. Replacing the aging `smbpasswd` back end, `tdbsam` has numerous improvements that are explained in more detail in xref:File_and_Print_Servers.adoc#sect-Samba-Account_Information-Databases[Samba Account Information Databases]. The `passdb backend` directive controls which back end is to be used for the PDC. - -The following `/etc/samba/smb.conf` file shows a sample configuration needed to implement a `tdbsam` password database back end. - -[[exam-Samba_Domain_Controller-PDC_Using_tdbsam]] -.An Example Configuration of Primary Domain Controller (PDC) Using `tdbsam` -==== - ----- - -[global] -workgroup = DOCS -netbios name = DOCS_SRV -passdb backend = tdbsam -security = user -add user script = /usr/sbin/useradd -m "%u" -delete user script = /usr/sbin/userdel -r "%u" -add group script = /usr/sbin/groupadd "%g" -delete group script = /usr/sbin/groupdel "%g" -add user to group script = /usr/sbin/usermod -G "%g" "%u" -add machine script = /usr/sbin/useradd -s /bin/false -d /dev/null -g machines "%u" -# The following specifies the default logon script -# Per user logon scripts can be specified in the user -# account using pdbedit logon script = logon.bat -# This sets the default profile path. -# Set per user paths with pdbedit -logon drive = H: -domain logons = yes -os level = 35 -preferred master = yes -domain master = yes - -[homes] - comment = Home Directories - valid users = %S - read only = no - -[netlogon] - comment = Network Logon Service - path = /var/lib/samba/netlogon/scripts - browseable = no - read only = no -# For profiles to work, create a user directory under the -# path shown. -# mkdir -p /var/lib/samba/profiles/john - -[Profiles] - comment = Roaming Profile Share - path = /var/lib/samba/profiles - read only = no - browseable = no - guest ok = yes - profile acls = yes -# Other resource shares ... ... ----- - -==== - -To provide a functional PDC system which uses `tdbsam` follow these steps: - -[[proc-Samba_Domain_Controller-PDC_Using_tdbsam]] - -. Adjust the `smb.conf` configuration file as shown in xref:File_and_Print_Servers.adoc#exam-Samba_Domain_Controller-PDC_Using_tdbsam[An Example Configuration of Primary Domain Controller (PDC) Using `tdbsam`]. - -. Add the `root` user to the Samba password database. You will be prompted to provide a new Samba password for the `root` user: -+ ----- -~]# smbpasswd -a root -New SMB password: ----- - -. Start the `smb` service: -+ ----- -~]# service smb start ----- - -. Make sure all profile, user, and netlogon directories are created. - -. Add groups that users can be members of: -+ ----- -~]# groupadd -f users -~]# groupadd -f nobody -~]# groupadd -f ntadmins ----- - -. Associate the UNIX groups with their respective Windows groups. -+ ----- -~]# net groupmap add ntgroup="Domain Users" unixgroup=users -~]# net groupmap add ntgroup="Domain Guests" unixgroup=nobody -~]# net groupmap add ntgroup="Domain Admins" unixgroup=ntadmins ----- - -. Grant access rights to a user or a group. For example, to grant the right to add client machines to the domain on a Samba domain controller, to the members to the Domain Admins group, execute the following command: -+ ----- -~]# net rpc rights grant 'DOCS\Domain Admins' SetMachineAccountPrivilege -S PDC -U root ----- - -Keep in mind that Windows systems prefer to have a primary group which is mapped to a domain group such as Domain Users. - -Windows groups and users use the same namespace thus not allowing the existence of a group and a user with the same name like in UNIX. - -.Limitations of the tdbsam authentication back end -[NOTE] -==== - -If you need more than one domain controller or have more than 250 users, do *not* use the `tdbsam` authentication back end. LDAP is recommended in these cases. - -==== - -.Primary Domain Controller (PDC) with Active Directoryindexterm:[Samba,smb.conf,PDC using Active Directory] -Although it is possible for Samba to be a member of an Active Directory, it is not possible for Samba to operate as an Active Directory domain controller. - -[[sect-Samba-Security_Modes]] -=== Samba Security Modes -indexterm:[Samba,Security Modes] -There are only two types of security modes for Samba, _share-level_ and _user-level_, which are collectively known as *pass:attributes[{blank}]_security levels_pass:attributes[{blank}]*. Share-level security is deprecated and has been removed from Samba. Configurations containing this mode need to be migrated to use user-level security. User-level security can be implemented in one of three different ways. The different ways of implementing a security level are called _security modes_. - -[[sect-Samba_Security_Modes-User_Level]] -==== User-Level Security -indexterm:[Samba,Security Modes,User Level Security] -User-level security is the default and recommended setting for Samba. Even if the `security = user` directive is not listed in the `/etc/samba/smb.conf` file, it is used by Samba. If the server accepts the client's user name and password, the client can then mount multiple shares without specifying a password for each instance. Samba can also accept session-based user name and password requests. The client maintains multiple authentication contexts by using a unique UID for each logon. - -In the `/etc/samba/smb.conf` file, the `security = user` directive that sets user-level security is: - -[subs="quotes"] ----- - -[GLOBAL] -... -security = user -... ----- - -.Samba Guest Sharesindexterm:[Samba,Security Modes] -As mentioned above, share-level security mode is deprecated. To configure a Samba guest share without using the `security = share` parameter, follow the procedure below: - -[[proc-Samba_Security_Modes-Samba_Guest_Shares]] -.Configuring Samba Guest Shares -. Create a username map file, in this example `/etc/samba/smbusers`, and add the following line to it: -+ -[subs="quotes"] ----- -nobody = guest ----- - -. Add the following directives to the main section in the `/etc/samba/smb.conf` file. Also, do not use the `valid users` directive: -+ -[subs="quotes, macros"] ----- - -[GLOBAL] -... -security = user -map to guest = Bad User -username map = _/etc/samba/smbusers_ -... ----- -+ -The `username map` directive provides a path to the username map file specified in the previous step. - -. Add the following directive to the share section in the `/ect/samba/smb.conf` file. Do not use the `valid users` directive. -+ -[subs="quotes"] ----- -[SHARE] -... -guest ok = yes -... ----- - -The following sections describe other implementations of user-level security. - -.Domain Security Mode (User-Level Security)indexterm:[Samba,Security Modes,Domain Security Mode] -In domain security mode, the Samba server has a machine account (domain security trust account) and causes all authentication requests to be passed through to the domain controllers. The Samba server is made into a domain member server by using the following directives in the `/etc/samba/smb.conf` file: - -[subs="quotes"] ----- - -[GLOBAL] -... -security = domain -workgroup = MARKETING -... ----- - -.Active Directory Security Mode (User-Level Security)indexterm:[Samba,Security Modes,Active Directory Security Mode] -If you have an Active Directory environment, it is possible to join the domain as a native Active Directory member. Even if a security policy restricts the use of NT-compatible authentication protocols, the Samba server can join an ADS using Kerberos. Samba in Active Directory member mode can accept Kerberos tickets. - -In the `/etc/samba/smb.conf` file, the following directives make Samba an Active Directory member server: - -[subs="quotes"] ----- - -[GLOBAL] -... -security = ADS -realm = EXAMPLE.COM -password server = kerberos.example.com -... ----- - -[[sect-Samba_Security_Modes-Share_Level]] -==== Share-Level Security -indexterm:[Samba,Security Modes,Share-Level Security] -With share-level security, the server accepts only a password without an explicit user name from the client. The server expects a password for each share, independent of the user name. There have been recent reports that Microsoft Windows clients have compatibility issues with share-level security servers. This mode is deprecated and has been removed from Samba. Configurations containing `security = share` should be updated to use user-level security. Follow the steps in xref:File_and_Print_Servers.adoc#proc-Samba_Security_Modes-Samba_Guest_Shares[Configuring Samba Guest Shares] to avoid using the `security = share` directive. - -[[sect-Samba-Account_Information-Databases]] -=== Samba Account Information Databases -indexterm:[Samba,Account Information Databases] -The following is a list different back ends you can use with Samba. Other back ends not listed here may also be available. -indexterm:[Samba,Backward Compatible Database Back Ends]indexterm:[Samba,Account Information Databases,Plain Text]indexterm:[Samba,Account Information Databases,smbpasswd]indexterm:[Samba,Account Information Databases,ldapsam_compat]indexterm:[Samba,New Database Back Ends]indexterm:[Samba,Account Information Databases,tdbsam]indexterm:[Samba,Account Information Databases,ldapsam]indexterm:[Samba,Account Information Databases,mysqlsam]indexterm:[Samba,Account Information Databases,xmlsam] - -Plain Text:: Plain text back ends are nothing more than the `/etc/passwd` type back ends. With a plain text back end, all user names and passwords are sent unencrypted between the client and the Samba server. This method is very insecure and is not recommended for use by any means. It is possible that different Windows clients connecting to the Samba server with plain text passwords cannot support such an authentication method. - -`smbpasswd`:: The `smbpasswd` back end utilizes a plain ASCII text layout that includes the MS Windows LanMan and NT account, and encrypted password information. The `smbpasswd` back end lacks the storage of the Windows NT/2000/2003 SAM extended controls. The `smbpasswd` back end is not recommended because it does not scale well or hold any Windows information, such as RIDs for NT-based groups. The `tdbsam` back end solves these issues for use in a smaller database (250 users), but is still not an enterprise-class solution. - -`ldapsam_compat`:: The `ldapsam_compat` back end allows continued OpenLDAP support for use with upgraded versions of Samba. - -`tdbsam`:: The default `tdbsam` password back end provides a database back end for local servers, servers that do not need built-in database replication, and servers that do not require the scalability or complexity of LDAP. The `tdbsam` back end includes all of the `smbpasswd` database information as well as the previously-excluded SAM information. The inclusion of the extended SAM data allows Samba to implement the same account and system access controls as seen with Windows NT/2000/2003/2008-based systems. -+ -The `tdbsam` back end is recommended for 250 users at most. Larger organizations should require Active Directory or LDAP integration due to scalability and possible network infrastructure concerns. - -`ldapsam`:: The `ldapsam` back end provides an optimal distributed account installation method for Samba. LDAP is optimal because of its ability to replicate its database to any number of servers such as the [application]*Red{nbsp}Hat Directory Server* or an [application]*OpenLDAP Server*. LDAP databases are light-weight and scalable, and as such are preferred by large enterprises. Installation and configuration of directory servers is beyond the scope of this chapter. For more information on the [application]*Red{nbsp}Hat Directory Server*, see the [citetitle]_link:++https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/html/deployment_guide/index++[Red Hat Directory Server 10 Deployment Guide]_. For more information on LDAP, see xref:servers/Directory_Servers.adoc#s1-OpenLDAP[OpenLDAP]. -+ -If you are upgrading from a previous version of Samba to 3.0, note that the OpenLDAP schema file (`/usr/share/doc/samba-_version_pass:attributes[{blank}]/LDAP/samba.schema`) and the Red{nbsp}Hat Directory Server schema file (`/usr/share/doc/samba-_version_pass:attributes[{blank}]/LDAP/samba-schema-FDS.ldif`) have changed. These files contain the _attribute syntax definitions_ and _objectclass definitions_ that the `ldapsam` back end needs in order to function properly. -+ -As such, if you are using the `ldapsam` back end for your Samba server, you will need to configure `slapd` to include one of these schema file. See xref:servers/Directory_Servers.adoc#s3-ldap-configuration-schema [Extending Schema] for directions on how to do this. -+ -.Make sure the openldap-servers package is installed -[NOTE] -==== - -You need to have the [package]*openldap-servers* package installed if you want to use the `ldapsam` back end. To ensure that the package is installed, execute the following command as `roots`: - ----- -~]# dnf install openldap-servers ----- - -==== - -[[sect-Samba-Network_Browsing]] -=== Samba Network Browsing -indexterm:[Samba,Network Browsing]indexterm:[Samba,Browsing] -_Network browsing_ enables Windows and Samba servers to appear in the Windows `Network Neighborhood`. Inside the `Network Neighborhood`, icons are represented as servers and if opened, the server's shares and printers that are available are displayed. - -Network browsing capabilities require NetBIOS over `TCP`pass:attributes[{blank}]/pass:attributes[{blank}]`IP`. NetBIOS-based networking uses broadcast (`UDP`) messaging to accomplish browse list management. Without NetBIOS and WINS as the primary method for `TCP`pass:attributes[{blank}]/pass:attributes[{blank}]`IP` host name resolution, other methods such as static files (`/etc/hosts`) or `DNS`, must be used. - -A domain master browser collates the browse lists from local master browsers on all subnets so that browsing can occur between workgroups and subnets. Also, the domain master browser should preferably be the local master browser for its own subnet. - -[[sect-Samba-Domain-Browsing]] -==== Domain Browsing -indexterm:[Samba,Network Browsing,Domain Browsing] -By default, a Windows server PDC for a domain is also the domain master browser for that domain. A Samba server must *not* be set up as a domain master server in this type of situation. - -For subnets that do not include the Windows server PDC, a Samba server can be implemented as a local master browser. Configuring the `/etc/samba/smb.conf` file for a local master browser (or no browsing at all) in a domain controller environment is the same as workgroup configuration (see xref:File_and_Print_Servers.adoc#sect-Samba-Configuring_a_Samba_Server[Configuring a Samba Server]). - -[[sect-Samba-WINS]] -==== WINS (Windows Internet Name Server) -indexterm:[Samba,WINS]indexterm:[Samba,Network Browsing,WINS] -Either a Samba server or a Windows NT server can function as a WINS server. When a WINS server is used with NetBIOS enabled, UDP unicasts can be routed which allows name resolution across networks. Without a WINS server, the UDP broadcast is limited to the local subnet and therefore cannot be routed to other subnets, workgroups, or domains. If WINS replication is necessary, do not use Samba as your primary WINS server, as Samba does not currently support WINS replication. - -In a mixed NT/2000/2003/2008 server and Samba environment, it is recommended that you use the Microsoft WINS capabilities. In a Samba-only environment, it is recommended that you use *only one* Samba server for WINS. - -The following is an example of the `/etc/samba/smb.conf` file in which the Samba server is serving as a WINS server: - -[[exam-Samba-WINS]] -.An Example Configuration of WINS Server -==== - -[subs="quotes"] ----- - -[global] -wins support = yes ----- - -==== - -.Using WINS -[NOTE] -==== - -All servers (including Samba) should connect to a WINS server to resolve NetBIOS names. Without WINS, browsing only occurs on the local subnet. Furthermore, even if a domain-wide list is somehow obtained, hosts cannot be resolved for the client without WINS. - -==== - -[[sect-Samba_with_CUPS_Printing_Support]] -=== Samba with CUPS Printing Support -indexterm:[Samba,CUPS Printing Support] -Samba allows client machines to share printers connected to the Samba server. In addition, Samba also allows client machines to send documents built in Linux to Windows printer shares. Although there are other printing systems that function with {MAJOROS}, CUPS (Common UNIX Print System) is the recommended printing system due to its close integration with Samba. - -[[sect-Samba-CUPS-smb.conf]] -==== Simple `smb.conf` Settings -indexterm:[Samba,CUPS Printing Support,CUPS smb.conf] -The following example shows a very basic `/etc/samba/smb.conf` configuration for CUPS support: - -[[exam-Samba-CUPS-smb.conf]] -.An Example Configuration of Samba with CUPS Support -==== - -[subs="quotes"] ----- - -[global] -load printers = yes -printing = cups -printcap name = cups -[printers] -comment = All Printers -path = /var/spool/samba -browseable = no -guest ok = yes -writable = no -printable = yes -printer admin = @ntadmins -[print$] -comment = Printer Drivers Share -path = /var/lib/samba/drivers -write list = ed, john -printer admin = ed, john ----- - -==== - -Other printing configurations are also possible. To add additional security and privacy for printing confidential documents, users can have their own print spooler not located in a public path. If a job fails, other users would not have access to the file. - -The `print$` directive contains printer drivers for clients to access if not available locally. The `print$` directive is optional and may not be required depending on the organization. - -Setting `browseable` to `yes` enables the printer to be viewed in the Windows Network Neighborhood, provided the Samba server is set up correctly in the domain or workgroup. - -[[sect-Samba_Distribution_Programs]] -=== Samba Distribution Programs -indexterm:[Samba,Programs] -.`net`pass:attributes[{blank}]indexterm:[Samba,Programs,net]indexterm:[net program] ----- -net ----- - -The `net` utility is similar to the `net` utility used for Windows and MS-DOS. The first argument is used to specify the protocol to use when executing a command. The [option]`pass:attributes[{blank}]_protocol_pass:attributes[{blank}]` option can be [option]`ads`, [option]`rap`, or [option]`rpc` for specifying the type of server connection. Active Directory uses [option]`ads`, Win9x/NT3 uses [option]`rap`, and Windows NT4/2000/2003/2008 uses [option]`rpc`. If the protocol is omitted, `net` automatically tries to determine it. - -The following example displays a list of the available shares for a host named `wakko`: - -[subs="quotes, macros"] ----- - -~]$ pass:attributes[{blank}][command]#net -l share -S wakko# -Password: -Enumerating shared resources (exports) on remote server: -Share name Type Description ----------- ---- ----------- -data Disk Wakko data share -tmp Disk Wakko tmp share -IPC$ IPC IPC Service (Samba Server) -ADMIN$ IPC IPC Service (Samba Server) ----- - -The following example displays a list of Samba users for a host named `wakko`: - -[subs="quotes, macros"] ----- - -~]$ pass:attributes[{blank}][command]#net -l user -S wakko# -root password: -User name Comment ------------------------------ -andriusb Documentation -joe Marketing -lisa Sales ----- - -.`nmblookup`pass:attributes[{blank}]indexterm:[Samba,Programs,nmblookup]indexterm:[nmblookup program] ----- -nmblookup ----- - -The `nmblookup` program resolves NetBIOS names into `IP` addresses. The program broadcasts its query on the local subnet until the target machine replies. - -The following example displays the `IP` address of the NetBIOS name `trek`: - -[subs="quotes, macros"] ----- - -~]$ pass:attributes[{blank}][command]#nmblookup trek# -querying trek on 10.1.59.255 -10.1.56.45 trek<00> ----- - -.`pdbedit`pass:attributes[{blank}]indexterm:[Samba,Programs,pdbedit]indexterm:[pdbedit program] -[subs="quotes, macros"] ----- -[command]#pdbedit _<options>_pass:attributes[{blank}]# ----- - -The `pdbedit` program manages accounts located in the SAM database. All back ends are supported including `smbpasswd`, LDAP, and the tdb database library. - -The following are examples of adding, deleting, and listing users: - -[subs="quotes, macros"] ----- - -~]$ pass:attributes[{blank}][command]#pdbedit -a kristin# -new password: -retype new password: -Unix username: kristin -NT username: -Account Flags: [U ] -User SID: S-1-5-21-1210235352-3804200048-1474496110-2012 -Primary Group SID: S-1-5-21-1210235352-3804200048-1474496110-2077 -Full Name: Home Directory: \\wakko\kristin -HomeDir Drive: -Logon Script: -Profile Path: \\wakko\kristin\profile -Domain: WAKKO -Account desc: -Workstations: Munged -dial: -Logon time: 0 -Logoff time: Mon, 18 Jan 2038 22:14:07 GMT -Kickoff time: Mon, 18 Jan 2038 22:14:07 GMT -Password last set: Thu, 29 Jan 2004 08:29:28 -GMT Password can change: Thu, 29 Jan 2004 08:29:28 GMT -Password must change: Mon, 18 Jan 2038 22:14:07 GMT -~]$ pass:attributes[{blank}][command]#pdbedit -v -L kristin# -Unix username: kristin -NT username: -Account Flags: [U ] -User SID: S-1-5-21-1210235352-3804200048-1474496110-2012 -Primary Group SID: S-1-5-21-1210235352-3804200048-1474496110-2077 -Full Name: -Home Directory: \\wakko\kristin -HomeDir Drive: -Logon Script: -Profile Path: \\wakko\kristin\profile -Domain: WAKKO -Account desc: -Workstations: Munged -dial: -Logon time: 0 -Logoff time: Mon, 18 Jan 2038 22:14:07 GMT -Kickoff time: Mon, 18 Jan 2038 22:14:07 GMT -Password last set: Thu, 29 Jan 2004 08:29:28 GMT -Password can change: Thu, 29 Jan 2004 08:29:28 GMT -Password must change: Mon, 18 Jan 2038 22:14:07 GMT -~]$ pass:attributes[{blank}][command]#pdbedit -L# -andriusb:505: -joe:503: -lisa:504: -kristin:506: -~]$ pass:attributes[{blank}][command]#pdbedit -x joe# -~]$ pass:attributes[{blank}][command]#pdbedit -L# -andriusb:505: lisa:504: kristin:506: ----- - -.`rpcclient`pass:attributes[{blank}]indexterm:[Samba,Programs,rpcclient]indexterm:[rpcclient program] -[subs="quotes, macros"] ----- -[command]#rpcclient _<server> <options>_pass:attributes[{blank}]# ----- - -The `rpcclient` program issues administrative commands using Microsoft RPCs, which provide access to the Windows administration graphical user interfaces (GUIs) for systems management. This is most often used by advanced users that understand the full complexity of Microsoft RPCs. - -.`smbcacls`pass:attributes[{blank}]indexterm:[Samba,Programs,smbcacls]indexterm:[smbcacls program] -[subs="quotes, macros"] ----- -[command]#smbcacls _<//server/share> <filename> <options>_pass:attributes[{blank}]# ----- - -The `smbcacls` program modifies Windows ACLs on files and directories shared by a Samba server or a Windows server. - -.`smbclient`pass:attributes[{blank}]indexterm:[Samba,Programs,smbclient]indexterm:[smbclient program] -[subs="quotes, macros"] ----- -[command]#smbclient _<//server/share> <password> <options>_pass:attributes[{blank}]# ----- - -The `smbclient` program is a versatile UNIX client which provides functionality similar to the `ftp` utility. - -.`smbcontrol`pass:attributes[{blank}]indexterm:[Samba,Programs,smbcontrol]indexterm:[smbcontrol program] -[subs="quotes, macros"] ----- -[command]#smbcontrol -i _<options>_pass:attributes[{blank}]# ----- - -[subs="quotes, macros"] ----- -[command]#smbcontrol _<options> <destination> <messagetype> <parameters>_pass:attributes[{blank}]# ----- - -The `smbcontrol` program sends control messages to running `smbd`, `nmbd`, or `winbindd` daemons. Executing [command]#smbcontrol -i# runs commands interactively until a blank line or a `'q'` is entered. - -.`smbpasswd`pass:attributes[{blank}]indexterm:[Samba,Programs,smbpasswd]indexterm:[smbpasswd program] -[subs="quotes, macros"] ----- -[command]#smbpasswd _<options> <username> <password>_pass:attributes[{blank}]# ----- - -The `smbpasswd` program manages encrypted passwords. This program can be run by a superuser to change any user's password and also by an ordinary user to change their own Samba password. - -.`smbspool`pass:attributes[{blank}]indexterm:[Samba,Programs,smbspool]indexterm:[smbspool program] -[subs="quotes, macros"] ----- -[command]#smbspool _<job> <user> <title> <copies> <options> <filename>_pass:attributes[{blank}]# ----- - -The `smbspool` program is a CUPS-compatible printing interface to Samba. Although designed for use with CUPS printers, [command]#smbspool# can work with non-CUPS printers as well. - -.`smbstatus`pass:attributes[{blank}]indexterm:[Samba,Programs,smbstatus]indexterm:[smbstatus program] -[subs="quotes, macros"] ----- -[command]#smbstatus _<options>_pass:attributes[{blank}]# ----- - -The `smbstatus` program displays the status of current connections to a Samba server. - -.`smbtar`pass:attributes[{blank}]indexterm:[Samba,Programs,smbtar]indexterm:[smbtar program] -[subs="quotes, macros"] ----- -[command]#smbtar _<options>_pass:attributes[{blank}]# ----- - -The `smbtar` program performs backup and restores of Windows-based share files and directories to a local tape archive. Though similar to the `tar` utility, the two are not compatible. - -.`testparm`pass:attributes[{blank}]indexterm:[Samba,Programs,testparm]indexterm:[testparm program] ----- -testparm ----- - -The `testparm` program checks the syntax of the `/etc/samba/smb.conf` file. If your `smb.conf` file is in the default location (`/etc/samba/smb.conf`) you do not need to specify the location. Specifying the host name and `IP` address to the `testparm` program verifies that the `hosts.allow` and `host.deny` files are configured correctly. The `testparm` program also displays a summary of your `smb.conf` file and the server's role (stand-alone, domain, etc.) after testing. This is convenient when debugging as it excludes comments and concisely presents information for experienced administrators to read. For example: - -[subs="macros"] ----- - -~]$ testparm -Load smb config files from /etc/samba/smb.conf -Processing section "[homes]" -Processing section "[printers]" -Processing section "[tmp]" -Processing section "[html]" -Loaded services file OK. -Server role: ROLE_STANDALONE -Press enter to see a dump of your service definitions -pass:quotes[`<enter>`] -# Global parameters -[global] - workgroup = MYGROUP - server string = Samba Server - security = SHARE - log file = /var/log/samba/%m.log - max log size = 50 - socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 - dns proxy = no -[homes] - comment = Home Directories - read only = no - browseable = no -[printers] - comment = All Printers - path = /var/spool/samba - printable = yes - browseable = no -[tmp] - comment = Wakko tmp - path = /tmp - guest only = yes -[html] - comment = Wakko www - path = /var/www/html - force user = andriusb - force group = users - read only = no - guest only = yes ----- - -.`wbinfo`pass:attributes[{blank}]indexterm:[Samba,Programs,wbinfo]indexterm:[wbinfo program] -[subs="quotes, macros"] ----- -[command]#wbinfo _<options>_pass:attributes[{blank}]# ----- - -The `wbinfo` program displays information from the `winbindd` daemon. The `winbindd` daemon must be running for `wbinfo` to work. - -[[sect-Samba-Resources]] -=== Additional Resources -indexterm:[Samba,Additional Resources] -The following sections give you the means to explore Samba in greater detail. - -.Installed Documentationindexterm:[Samba,Additional Resources,installed documentation] - -* `/usr/share/doc/samba-/` — All additional files included with the Samba distribution. This includes all helper scripts, sample configuration files, and documentation. - -* See the following man pages for detailed information specific [application]*Samba* features: -+ -** *smb.conf*(5) -+ -** *samba*(7) -+ -** *smbd*(8) -+ -** *nmbd*(8) -+ -** *winbindd*(8) - -.Useful Websitesindexterm:[Samba,Additional Resources,useful websites] - -* link:++https://www.samba.org/++[https://www.samba.org/] — Homepage for the Samba distribution and all official documentation created by the Samba development team. Many resources are available in HTML and PDF formats, while others are only available for purchase. Although many of these links are not {MAJOROS} specific, some concepts may apply. - -* link:++https://wiki.samba.org/index.php/User_Documentation++[https://wiki.samba.org/index.php/User_Documentation] — Samba 4.x official documentation. - -* link:++https://www.samba.org/samba/archives.html++[https://www.samba.org/samba/archives.html ] — Active email lists for the Samba community. Enabling digest mode is recommended due to high levels of list activity. - -* Samba newsgroups — Samba threaded newsgroups, such as link:++https://www.gmane.org/++[www.gmane.org], that use the `NNTP` protocol are also available. This an alternative to receiving mailing list emails.