Samba

Interoperating with Windows

           Nick Urbanik <nicku(at)nicku.org>
Copyright Conditions: GNU FDL (see http://www.gnu.org/licenses/fdl.html  )

A computing department

Samba

Implements Microsoft’s smb protocol

smb = Symmetric Message Block, gave project its name

achieved through reverse engineering Microsoft’s proprietary protocols (no help from ms, but hindrance)

good reputation for stability and performance outperforming ms servers in both respects

Current production version supports use as a Windows nt compatible server (file sharing, printing, support for network browsing)

Runs on many platforms, including very powerful Solaris machines

Most powerful windows servers run Solaris, not Microsoft software!

Samba 2.2.x

The release provided with current Linux systems Works as an nt 4 compatible pdc Winbind (part of samba) allows Linux and Unix machines to join a Windows Domain Samba can use ldap to authenticate against Both samba 2.2.x and 3 have been put into commercial products, such as Network Attached Storage (nas) hardware Macintosh os X uses samba to provide services to Windows clients, and also to access Windows services.

Limitations of Samba 2.2.x — 1

Does not support Active Directory in the way that a Windows 2000 server does

Samba 2.2 cannot interact with a Microsoft Backup Domain Controller (bdc) but it can be a bdc for another samba server

User information stored on a Samba pdc is not as complete as that stored on a Windows pdc

Samba obeys Linux group file access permissions on the pdc, but it does not tell the client machine about it properly. Group file permissions are hard to set from a client.

Limitations of Samba 2.2.x — 2

Full support for acls (access control lists) depends on applying a patch to the Linux kernel and recompiling the kernel, or waiting till the Linux 2.6.x kernel is released

When samba is working as a wins server, it cannot replicate to other wins servers, whether Microsoft or samba.

Support for Unicode is not very good (greatly improved in samba 3)

Samba Version 3 (alpha release)

Currently used in some commercial systems, but documentation not complete

See

http://us1.samba.org/samba/ftp/alpha/WHATSNEW.txt

Supports Active Directory: a Samba 3 server can join an ads realm as a member server and authenticate users using ldap/kerberos

Supports migrating from a Windows nt 4 domain

Supports trust relationships with Windows nt domain controllers

samba-3.0alpha24-1.i386.rpm is available since
16 May 2003 from http://www.samba.org/

Parts of Samba

Samba consists of two services:

smbd, which does the file sharing, provides print services, and handles authentication of clients, which can be any version of Windows or Linux; nmbd, which does name resolution (the “wins” server), and provides support for browsing the network in the “Network Neighbourhood”

The other parts you will work with include:

The configuration file, /etc/samba/smb.conf

testparm which checks the syntax of

/etc/samba/smb.conf

The smbpasswd program for setting and changing samba passwords

Other Samba Utilities

nmblookup is useful for troubleshooting Netbios name lookup from wins servers or from samba

smbclient is useful for testing samba and Microsoft servers

smbmount mounts smb shares from samba or Windows servers locally.

Usually not necessary to call this directly, you can

   use mount.

smbtar is useful for backing up a Windows machine over the network to a Linux or Unix machine.

Many others, all with man pages. See rpm -ql

samba-client.

Is samba installed? — 1

On an rpm based system, such as Red Hat Linux, do:

$ rpm -qa | grep samba
samba-swat-2.2.7-5.8.0
samba-2.2.7-5.8.0
samba-client-2.2.7-5.8.0
samba-common-2.2.7-5.8.0

This tells us that:

the samba server is installed, together with the swat web configuration system, and that samba version 2.2.7 is installed

Is samba installed? — 2

You can also check on any system that samba is installed, and find the version with:

$ smbd -V
Version 2.2.7-security-rollup-fix
$ nmbd -V
Version 2.2.7-security-rollup-fix

Note that this is an updated version, for Red Hat version 8.0.

Starting, Stopping Samba

Starting, stopping the samba service is the same as with any other service on Linux.

Here we assume that /sbin is on your PATH. If not, you can simply type /sbin/service instead of service.

Is the service running?

$ sudo service smb status
smbd is stopped
nmbd is stopped

Starting, Stopping Samba — 2

To start the two samba daemons:

$ sudo service smb start
Starting SMB services:                                          [  OK  ]
Starting NMB services:                                          [  OK  ]

We can verify that they are running:

$ sudo service smb status
smbd (pid 2523) is running...
nmbd (pid 2527) is running...

We can stop the service in the same way as other services:

$ sudo service smb stop
Shutting down SMB services:                                     [  OK  ]
Shutting down NMB services:                                     [  OK  ]

Starting Samba Automatically

To ensure samba starts when the server boots is the same as for any other service. Is the service configured to start on boot?

$ chkconfig smb --list
smb               0:off   1:off   2:off   3:off   4:off   5:off   6:off

This tells us that it is not configured to start at any runlevel.

$ sudo chkconfig smb on

Now let’s check to see if we turned it on:

$ chkconfig smb --list
smb               0:off   1:off   2:on     3:on     4:on     5:on     6:off

Now it will start automatically in runlevels 2, 3, 4 and 5.

Configuration: /etc/samba/smb.conf

Divided into sections Two kinds of sections:

global section, holds information about the operation of the whole server share sections, holds information about each “share” or service provided by server

Comments start with either a hash ‘#’ or a semi-colon ‘;’ Extensive documentation in man smb.conf

Example /etc/samba/smb.conf — 1

1 [global]
2  netbios name = my-name
3  workgroup = my-named
4  add user script = /usr/sbin/useradd \
5  -n -g machines   \
6  -c 'Samba Machine PDC member' \
7  -d /dev/null -s /bin/false -M %m$
8  security = user
9  encrypt passwords = yes
10  smb passwd file = /etc/samba/smbpasswd
11  username map = /etc/samba/smbusers
12  os level = 65
13  domain logons = yes
14  logon script = scripts\%U.bat
15  wins server = 192.168.68.240

Discussing Example — 1

Configuration is for a Primary Domain Controller (pdc)

slide 15 shows global options that determine overall behaviour of samba

lines 2 and 3 determine the “computer name” and domain name of this pdc lines 4–7 are executed to automatically create a special account for any computer that joins the domain line 8 requires a username and password for someone to access resources from the server line 11 tells samba to use a file that maps Windows names to Linux names, e.g., administrator →

root

Discussion of global section — 2

line 12 increases samba’s chances of winning “browser elections” with Windows machines (see the documentation about browsing)

line 13 says that this is a pdc

line 14 tells samba where to find login scripts

line 15 tells samba to act as a wins client of that machine

To make samba a wins server, provide a line like this:

   wins support = yes

Example /etc/samba/smb.conf — 2

1 [homes]
2  comment = Home Directories
3  browseable = no
4  writable = yes
5 [netlogon]
6  comment = Network Logon Service
7  path = /var/samba/netlogon
8  guest ok = no
9  share modes = no
10 [printers]
11  comment = All Printers
12  path = /var/spool/samba
13  browseable = no
14  guest ok = no
15  printable = yes

Discussing slide 18

slide 18 shows configuration for individual shares and services offered by the server

The homes section (lines 1–4) allow users to automatically access their Linux home directories from the client when they log into the domain.

Will appear as a share with the same name as the Linux username.

The netlogon section (lines 5–9) is necessary to handle domain log[io]ns, which fail if this share does not exist.

It stores log[io]n scripts and system policy files.

The printers section (lines 10–15) allows any user to print from a Windows client to a Linux printer.

profiles share

[profiles]
path = /var/samba/profiles
browsable = no
writeable = yes
create mask = 0600
directory mask = 0700

Suports roaming profiles on NT/2000/XP

The directory in path must exist and be writable:

$ sudo mkdir -p /var/samba/{profiles,netlogon}
$ sudo chmod 775 /var/samba/netlogon
$ sudo chmod 777 /var/samba/profiles

Samba Accounts

Note that each user needs to have two account entries: a posix account entry (i.e., an entry in /etc/passwd, or an ldap posix account) a Samba account entry, which for samba 2.2 is generally in /etc/samba/smbpasswd, but can also be in an ldap directory.

Unless both exist, you will not get access to the samba server from any client.

Machines that join the domain also need an entry in the /etc/passwd file (or in the ldap directory).

This is created automatically with the add user script entry in your smb.conf file.

See lines 4–7 of slide 15

Documentation

Enormous amounts of documentation in

/usr/share/doc/samba-2.2.*/
   Samba-HOWTO-Collection.pdf is very helpful

The manual pages are extensive and quite complete.

man smb.conf is helpful.

You can visit the samba website to see more documentation:

http://us1.samba.org/samba/samba.html

The printed book, Using Samba, 2nd Edition, O’Reilly, 2003, ISBN 0-596-00256-4 is very clear and helpful.