Samba Implements Microsoft’s SMB protocol Samba Interoperating with Windows Nick Urbanik Copyright Conditions: GNU FDL (see http://www.gnu.org/licenses/fdl.html) Department of Information and Communications Technology SMB = Symmetric Message Block, gave project its name achieved through reverse engineering Microsoft’s proprietary protocols (no help from MS, but hindrance) good reputation for stability and performance outperforming MS servers in both respects Current production version supports use as a Windows NT compatible server (file sharing, printing, support for network browsing) Runs on many platforms, including very powerful Solaris machines Most powerful windows servers run Solaris, not Microsoft software! OSSI — Samba — ver. 1.2 – p. 1/22 OSSI — Samba — ver. 1.2 – p. 2/22 Samba 2.2.x The release provided with current Linux systems Works as an NT 4 compatible PDC Winbind (part of samba) allows Linux and Unix machines to join a Windows Domain Samba can use LDAP to authenticate against Both samba 2.2.x and 3 have been put into commercial products, such as Network Attached Storage (NAS) hardware Macintosh OS X uses samba to provide services to Windows clients, and also to access Windows services. Limitations of Samba 2.2.x — 1 Does not support Active Directory in the way that a Windows 2000 server does Samba 2.2 cannot interact with a Microsoft Backup Domain Controller (BDC) but it can be a BDC for another samba server User information stored on a Samba PDC is not as complete as that stored on a Windows PDC Samba obeys Linux group file access permissions on the PDC, but it does not tell the client machine about it properly. Group file permissions are hard to set from a client. OSSI — Samba — ver. 1.2 – p. 3/22 OSSI — Samba — ver. 1.2 – p. 4/22 Limitations of Samba 2.2.x — 2 Full support for ACLs (access control lists) depends on applying a patch to the Linux kernel and recompiling the kernel, or waiting till the Linux 2.6.x kernel is released When samba is working as a WINS server, it cannot replicate to other WINS servers, whether Microsoft or samba. Support for Unicode is not very good (greatly improved in samba 3) Samba Version 3 (alpha release) Currently used in some commercial systems, but documentation not complete See http://us1.samba.org/samba/ftp/alpha/WHATSNEW.txt Supports Active Directory: a Samba 3 server can join an ADS realm as a member server and authenticate users using LDAP/kerberos Supports migrating from a Windows NT 4 domain Supports trust relationships with Windows NT domain controllers samba-3.0alpha24-1.i386.rpm is available since 16 May 2003 from http://www.samba.org/ OSSI — Samba — ver. 1.2 – p. 5/22 OSSI — Samba — ver. 1.2 – p. 6/22 Parts of Samba Samba consists of two services: smbd, which does the file sharing, provides print services, and handles authentication of clients, which can be any version of Windows or Linux; nmbd, which does name resolution (the “WINS” server), and provides support for browsing the network in the “Network Neighbourhood” The other parts you will work with include: The configuration file, /etc/samba/smb.conf testparm which checks the syntax of /etc/samba/smb.conf The smbpasswd program for setting and changing samba passwords OSSI — Samba — ver. 1.2 – p. 7/22 Other Samba Utilities nmblookup is useful for troubleshooting NetBIOS name lookup from WINS servers or from samba smbclient is useful for testing samba and Microsoft servers smbmount mounts SMB shares from samba or Windows servers locally. Usually not necessary to call this directly, you can use mount. smbtar is useful for backing up a Windows machine over the network to a Linux or Unix machine. Many others, all with man pages. See rpm -ql samba-client. OSSI — Samba — ver. 1.2 – p. 8/22 Is samba installed? — 1 On an RPM based system, such as Red Hat Linux, do: $ rpm -qa | grep samba samba-swat-2.2.7-5.8.0 samba-2.2.7-5.8.0 samba-client-2.2.7-5.8.0 samba-common-2.2.7-5.8.0 Is samba installed? — 2 You can also check on any system that samba is installed, and find the version with: $ smbd -V Version 2.2.7-security-rollup-fix $ nmbd -V Version 2.2.7-security-rollup-fix This tells us that: the samba server is installed, together with the swat web configuration system, and that samba version 2.2.7 is installed Note that this is an updated version, for Red Hat version 8.0. OSSI — Samba — ver. 1.2 – p. 9/22 OSSI — Samba — ver. 1.2 – p. 10/22 Starting, Stopping Samba Starting, stopping the samba service is the same as with any other service on Linux. Here we assume that /sbin is on your PATH. If not, you can simply type /sbin/service instead of service. Is the service running? $ sudo service smb status smbd is stopped nmbd is stopped Starting, Stopping Samba — 2 To start the two samba daemons: $ sudo service smb start Starting SMB services: Starting NMB services: [ [ OK OK ] ] We can verify that they are running: $ sudo service smb status smbd (pid 2523) is running... nmbd (pid 2527) is running... We can stop the service in the same way as other services: $ sudo service smb stop Shutting down SMB services: Shutting down NMB services: [ [ OK OK ] ] OSSI — Samba — ver. 1.2 – p. 11/22 OSSI — Samba — ver. 1.2 – p. 12/22 Starting Samba Automatically To ensure samba starts when the server boots is the same as for any other service. Is the service configured to start on boot? $ chkconfig smb --list smb 0:off 1:off 2:off 3:off 4:off 5:off 6:off Configuration: /etc/samba/smb.conf Divided into sections Two kinds of sections: global section, holds information about the operation of the whole server share sections, holds information about each “share” or service provided by server Comments start with either a hash ‘#’ or a semi-colon ‘;’ Extensive documentation in man smb.conf This tells us that it is not configured to start at any runlevel. $ sudo chkconfig smb on Now let’s check to see if we turned it on: $ chkconfig smb --list smb 0:off 1:off 2:on 3:on 4:on 5:on 6:off Now it will start automatically in runlevels 2, 3, 4 and 5. OSSI — Samba — ver. 1.2 – p. 13/22 OSSI — Samba — ver. 1.2 – p. 14/22 Example /etc/samba/smb.conf — 1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Discussing Example — 1 Configuration is for a Primary Domain Controller (PDC) slide 15 shows global options that determine overall behaviour of samba lines 2 and 3 determine the “computer name” and domain name of this PDC lines 4–7 are executed to automatically create a special account for any computer that joins the domain line 8 requires a username and password for someone to access resources from the server line 11 tells samba to use a file that maps Windows names to Linux names, e.g., administrator → root OSSI — Samba — ver. 1.2 – p. 16/22 [global] netbios name = my-name workgroup = my-named add user script = /usr/sbin/useradd \ -n -g machines \ -c ’Samba Machine PDC member’ \ -d /dev/null -s /bin/false -M %m$ security = user encrypt passwords = yes smb passwd file = /etc/samba/smbpasswd username map = /etc/samba/smbusers os level = 65 domain logons = yes logon script = scripts\%U.bat wins server = 192.168.68.240 OSSI — Samba — ver. 1.2 – p. 15/22 Discussion of global section — 2 line 12 increases samba’s chances of winning “browser elections” with Windows machines (see the documentation about browsing) line 13 says that this is a PDC line 14 tells samba where to find login scripts line 15 tells samba to act as a WINS client of that machine To make samba a WINS server, provide a line like this: wins support = yes Example /etc/samba/smb.conf — 2 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 [homes] comment = Home Directories browseable = no writable = yes [netlogon] comment = Network Logon Service path = /var/samba/netlogon guest ok = no share modes = no [printers] comment = All Printers path = /var/spool/samba browseable = no guest ok = no printable = yes OSSI — Samba — ver. 1.2 – p. 18/22 OSSI — Samba — ver. 1.2 – p. 17/22 Discussing slide 18 slide 18 shows configuration for individual shares and services offered by the server The homes section (lines 1–4) allow users to automatically access their Linux home directories from the client when they log into the domain. Will appear as a share with the same name as the Linux username. The netlogon section (lines 5–9) is necessary to handle domain log[io]ns, which fail if this share does not exist. It stores log[io]n scripts and system policy files. The printers section (lines 10–15) allows any user to print from a Windows client to a Linux printer. profiles share [profiles] path = /var/samba/profiles browsable = no writeable = yes create mask = 0600 directory mask = 0700 Suports roaming profiles on NT/2000/XP The directory in path must exist and be writable: $ sudo mkdir -p /var/samba/{profiles,netlogon} $ sudo chmod 775 /var/samba/netlogon $ sudo chmod 777 /var/samba/profiles OSSI — Samba — ver. 1.2 – p. 19/22 OSSI — Samba — ver. 1.2 – p. 20/22 Samba Accounts Note that each user needs to have two account entries: a POSIX account entry (i.e., an entry in /etc/passwd, or an LDAP POSIX account) a Samba account entry, which for samba 2.2 is generally in /etc/samba/smbpasswd, but can also be in an LDAP directory. Unless both exist, you will not get access to the samba server from any client. Machines that join the domain also need an entry in the /etc/passwd file (or in the LDAP directory). This is created automatically with the add user script entry in your smb.conf file. See lines 4–7 of slide 15 OSSI — Samba — ver. 1.2 – p. 21/22 Documentation Enormous amounts of documentation in /usr/share/doc/samba-2.2.*/ Samba-HOWTO-Collection.pdf is very helpful The manual pages are extensive and quite complete. man smb.conf is helpful. You can visit the samba website to see more documentation: http://us1.samba.org/samba/samba.html The printed book, Using Samba, 2nd Edition, O’Reilly, 2003, ISBN 0-596-00256-4 is very clear and helpful. OSSI — Samba — ver. 1.2 – p. 22/22