THIRD EDITION Using Samba Gerald Carter, Jay Ts, and Robert Eckstein Beijing • Cambridge • Farnham • Köln • Paris • Sebastopol • Taipei • Tokyo Using Samba, Third Edition by Gerald Carter, Jay Ts, and Robert Eckstein Copyright © 2007, 2003, 2000 O’Reilly Media, Inc. All rights reserved. Printed in the United States of America. Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472. O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (safari.oreilly.com). For more information, contact our corporate/institutional sales department: (800) 998-9938 [email protected]. Editor: Andy Oram Indexer: Julie Hawks Executive Editor: Mary T. O’Brien Cover Designer: Karen Montgomery Production Editor: Lydia Onofrei Interior Designer: David Futato Copyeditor: Nancy Kotary Illustrators: RobertRomanoandJessamynRead Proofreader: Nancy Reinhardt Printing History: January 2000: First Edition. February 2003: Second Edition. January 2007: Third Edition. Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are registered trademarks of O’ReillyMedia,Inc.UsingSamba,theimageofanAfricangroundhornbill,andrelatedtradedressare trademarks of O’Reilly Media, Inc. Manyofthedesignationsusedbymanufacturersandsellerstodistinguishtheirproductsareclaimedas trademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps. While every precaution has been taken in the preparation of this book, the publisher and authors assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein. This book uses RepKover™, a durable and flexible lay-flat binding. ISBN-10: 0-596-00769-8 ISBN-13: 978-0-596-00769-0 [M] Table of Contents Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii 1. An Introduction to Samba . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 What Is Samba? 2 What Can Samba Do for Me? 3 The Common Internet File System 8 Connecting to a CIFS File Share 18 Browsing 20 Authentication: Peer-to-Peer Versus Domains 23 What’s in Samba 3.0? 25 Future Research in Samba 4.0 27 What Can Samba Do? 28 An Overview of the Samba Distribution 29 How Can I Get Samba? 31 2. Installing Samba on a Unix System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Binary Packages 32 Compiling from Source 34 Compiling and Installing Samba 42 Enabling the Samba Web Administration Tool (SWAT) 46 A Basic Samba Configuration File 48 Firewall Configuration 53 Starting the Samba Daemons 54 3. Configuring Windows Clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Windows Networking Concepts 62 Windows Setup 68 iii 4. The Samba Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Basic Syntax and Rules 80 Special Sections 88 Configuration File Options 90 Basic Server Configuration 93 Disk Share Configuration 96 Networking Options with Samba 99 Virtual Servers 103 Logging Configuration Options 106 5. Accounts, Authentication, and Authorization . . . . . . . . . . . . . . . . . . . . . . . . 112 Security Modes 112 User Management 121 Group Mapping 137 User Privilege Management 140 Controlling Authorization for File Shares 143 6. Advanced Disk Shares . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Special Share Names 148 Filesystem Differences 151 Access Control Lists 171 Microsoft Distributed File Systems 178 Virtual File Systems 181 Executing Server Scripts 182 7. Printing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Print Shares 185 A Usable Print Share 190 Samba and CUPS 192 The [printers] Service 193 Enabling SMB Printer Sharing in OS X 196 Creating a PDF Printer 196 Managing Windows Print Drivers 197 Printers and Security 205 Disabling Point and Print 207 Printing, Queue Lists, and tdb Files 208 Printing to Windows Printers 209 Printing Parameters 213 iv | Table of Contents 8. Name Resolution and Network Browsing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 Name Resolution 217 Network Browsing 222 9. Domain Controllers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 Samba Domains: NT 4.0 or Active Directory? 234 Configuring a Samba PDC 235 Configuring a Samba BDC 252 passdb Recommendations 253 Migrating an NT 4.0 Domain to Samba 254 Domain Trusts 258 Remote Server Management 261 10. Domain Member Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 Joining a Domain 271 Domain and ADS Security Modes 273 Matching Domain Users to Local Accounts 284 Winbind 286 Additional Winbind Features 298 11. Unix Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304 The Linux CIFS Filesystem 305 FreeBSD’s smbfs 311 Mac OS X 315 smbclient 317 Remote Administration with net 326 12. Troubleshooting Samba . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 The Tool Box 335 Samba Logs 336 Unix Utilities 339 The Fault Tree 342 Troubleshooting Browsing 354 Troubleshooting Name Services 359 Troubleshooting Network Addresses 364 Troubleshooting NetBIOS Names 367 Extra Resources 368 Table of Contents | v A. Summary of Samba Daemons and Commands. . . . . . . . . . . . . . . . . . . . . . . . 371 B. Downloading Samba with Subversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409 C. Configure Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419 vi | Table of Contents Preface 1 YouarereadingabookaboutSamba,asoftwaresuitethatconnectsWindows,Unix, and other operating systems using Windows’ native networking protocols. Samba allows Unix servers to offer Windows networking services by matching the filesys- tem and networking models of Unix to those of Windows. Samba acts as a bridge between the two systems, connecting the corresponding parts of their architectures and providing a translation wherever necessary. Bridging the gap between systems as dissimilar as Windows and Unix is a complex task—onethatSambahandlessurprisinglywell.TobeagoodSambaadministrator, yourabilitiesmustparallelSamba’s.Forstarters,youneedtoknowbasicUnixsystem and network administration and have a good understanding of Windows filesystems andnetworkingfundamentals.Inaddition,youneedtolearnhowSambafillsinthe “gray area” between Unix and Windows; for instance, how a Unix user relates to a corresponding Windows account. Once you know how everything fits together, you’ll find it easy to configure a Samba server to provide your network with reliable and high-performance resources. Our job is to make all of that easier for you. We do this by starting out with a quick but comprehensive tour of Windows networking in Chapter1, followed by task-orientedChapters2and3,whichtellyouhowtosetupaminimalSambaserver and configure Windows clients to work with it. Most likely, you will be surprised how quickly you can complete the required tasks. We believe that a hands-on approach is the most effective, and you can use the cli- ents and servers you build in Chapters 2 and 3 to test examples that we describe throughoutthebook.Youcanjumparoundfromchaptertochapterifyoulike,but ifyoucontinuesequentiallyfromChapter4onward,bythetimeyoufinishthebook youwillhaveawell-configuredproductionSambaserverreadyforuse.Allyouhave todoisaddtheappropriatesupportforyourintendedpurposeasweexplainhowto use each feature. vii Audience for This Book This book is primarily intended for Unix administrators who need to support Win- dows clients on their network, as well as anyone who needs to access the resources of a Windows network environment from a Unix client. Although we assume that you are familiar with basic Unix system administration, we do not assume that you areanetworkingexpert.Wedoourbestalongthewaytohelpoutwithunusualdef- initions and terms. Furthermore, we don’t assume that you are an expert in Microsoft Windows. We carefully explain all the essential concepts related to Windows networking, and we gothroughtheWindowssideoftheinstallationtaskinconsiderabledetail,focusing on the current Microsoft operating system offerings. For the Unix side, we give examples that work with common Unix operating systems, such as Linux, Solaris, FreeBSD, and Mac OS X. We concentrate on Samba 3.0. However, because Samba releases include a high degree of backward compatibility with older releases, we believe you will find this book largely applicable to other versions as well. How This Book Is Organized Here is a quick description of each chapter: Chapter1,An Introduction to Samba ProvidesanoverviewofSambaanditscapabilities,andthendescribesthemost important concepts of NetBIOS and SMB/CIFS networking. Finally, we give you a quick overview of the daemons and utilities that are included in the Samba distribution. Chapter2,Installing Samba on a Unix System Covers both building Samba from source and using vendor-provided packages. We discuss the pitfalls surrounding upgrading Samba from one release to the next, as well as some basic configuration settings. Chapter3,Configuring Windows Clients Explains how to configure Microsoft Windows 2000 and later clients to partici- pate in an SMB/CIFS network. Chapter4,The Samba Configuration File GetsyouuptospeedonthestructureoftheSambaconfigurationfileandshows you how to take control of basic file-sharing services. Chapter5,Accounts, Authentication, and Authorization Gives you all the details about creating and managing users and groups in both local files and LDAP directory services. We’ll also explain how to manage user privilege assignments as well security options for protecting shares. viii | Preface