NOTE|CAUTION|NOTE|NOTE|NOTE|NOTE|NOTE|NOTE

Let's get down to business.

Activating the SWAT Web Interface

Although Samba can be activated and used with Apple's default configuration (stored in /etc/smb.conf ), you'll be missing 99% of the functionality. Samba offers many advanced features that can be accessed only when you manually edit the setup. In its early days, Samba was configured entirely by hand by editing the smb.conf file. It worked, but wasn't really useful to anyone but the most die-hard Unix users. Today, however, configuration is handled entirely through a web-based GUI called SWAT.

SWAT is included with your system but not ready for use—you must configure how launchd will start SWAT. Edit the file /System/Library/LaunchDaemons/swat. plist to include -a as one of the program arguments. This will allow any local user to make changes to the Samba configuration via SWAT. Unfortunately, this is necessary as it is currently not possible to authenticate with the SWAT process. Notice, however, that the SWAT service is Disabled in the plist file. SWAT will not launch at boot and can be used only when an administrator explicitly starts it.

The resulting file should look like this:

<plist version="1.0">

<dict>

        <key>Disabled</key>

        <true/>

        <key>GID</key>

        <integer>0</integer>

        <key>Label</key>

        <string>org.samba.swat</string>

        <key>ProgramArguments</key>

        <array>

                <string>/usr/sbin/swat</string>

                <string>-a -d 10</string>

        </array>

        <key>Sockets</key>

        <dict>

                <key>Listeners</key>

                <dict>

                        <key>SockNodeName</key>

                        <string>localhost</string>

                        <key>SockServiceName</key>

                        <integer>901</integer>

                </dict>

        </dict>

        <key>inetdCompatibility</key>

        <dict>

                <key>Wait</key>

                <false/>

        </dict>

</dict>

</plist>

That's it; SWAT is ready to run. Type sudo /sbin/service swat start to begin using SWAT. When you've finished, you should stop SWAT by typing sudo /sbin/service swat stop .

Configuring Samba Sharing

To configure Samba, start a web browser and point it at port 901 of the Samba server ( http://localhost:901 ). Because authentication is disabled, you will have full access to the SWAT controls. Figure 27.9 shows the SWAT home screen.

The top of the SWAT display includes eight buttons to control the operation of the server:

• Home — Provides links to Samba documentation and supplemental material.

• Globals — Settings that affect the entire server, such as its name and security model.

• Shares — Shared file resources. If you used the sample configuration file that comes with the Apache distribution, a single home directory share already should be configured.

• Printers — Shared printers. To share a printer, it must first be set up so that it can be accessed from Mac OS X. By default, all configured printers are shared.

• Wizard — A quick-start for configuring Samba to be a standalone server, domain controller, or domain member. Because Mac OS X already includes a standalone configuration with setup specific to Mac OS X, starting over isn't recommended.

• Status — Monitor and view the status of the server. If you're logged in as root , you can restart or stop the server process.

• View — View a copy of the text configuration file.

• Password — Set and edit Samba user passwords. Samba authenticates against Mac OS X passwords by default, so it is unlikely you'll need these settings.

Let's step through these configuration screens to see the options used in a typical sharing environment.

Globals

The Global Variables page, shown in Figure 27.10, is the starting point for setting up your Samba server. Many people jump the gun and immediately start setting up file shares. Failure to properly configure the global options might make it impossible to mount or browse shared resources.

Two buttons can save server settings (Commit Changes) and reset changes (Reset Values). Choosing the Basic or Advanced button shows additional options—a number of which are listed in Table 27.4. If you don't see the setting you're looking for, move to the Advanced mode.

Table 27.4. Common Global Options and Their Purpose

The default settings should be sufficient for most small networks, with the exception of the base and security options (such as hosts allow and hosts deny ). The best rule for Samba is that if you aren't sure what something does or whether you even need it, don't touch it.

Shares

The Share Parameters page sets up file shares that can be mounted on networked Windows-based computers. To create a new share, type a share name in the Create Share field and then click the Create Share button. To edit an existing share, choose its name from the pop-up list and then click Choose Share—or click Delete Share to remove it completely.

With the default Tiger Samba configuration file, a single homes share should already be available. homes is unique because it is equivalent to each user sharing his home directory. Figure 27.11 shows this share loaded.

The basic share parameters are listed in Table 27.5. A few advanced options are also included.

Table 27.5. File-Sharing Options and Values

The trickiest part of setting up a share is figuring out user access rights. Regardless of whether Samba is using user-level or share-level access, a Unix user must be mapped to the incoming connection.

The easiest security model is user level (the default), which requires Windows users to log in to their computers using the same username and password set up on the Mac OS X machine. When using user-level access, Windows users are mapped directly to Samba users. The Mac OS X file permissions apply directly to the permissions of the connected user.

Assume, for example, that the Mac OS X user jray has read/write permissions to the folder /Stuff , which is also set to be a Samba share. If jray logs in to a Windows computer using the same username as on Mac OS X, he can access the Stuff share and have read/write access. The SWAT Password page can be used to map Unix users to the passwords that they will use on the remote Windows client if the Windows password doesn't match their default OS X password.

Things are a bit different with share-level access. In such cases, a single password is needed to access the share for all users, and no matter who is logged in, a single account is used by Samba when interacting with the Mac OS X filesystem. To simplify share-level security, create a new Mac OS X user to use for logging in to your shares and then set the guest account for the share equal to the Mac OS X username. You should disable other login access (set the shell to /dev/null ) if you do distribute a password among multiple people for the purpose of file sharing.

Wizard

The Samba Wizard options configure a Samba server to act as a standalone server, domain member, or domain controller. Use the radio buttons to choose your basic server settings, how WINS will be used (as either a client, server, or not at all), and whether home directories should be enabled. Click Commit to save the changes.

Printers

Samba can act as a full print server for a Windows network. By default, all configured printers are shared through a share called printers that operates much like the homes share does for home directories. Refer to Chapter 6, "Printer, Fax, and Font Management," for information about setting up Mac OS X printers.

There are a few options for setting up printer sharing. You can go with the default of sharing every printer available through the printers share. You can also modify the settings of the printers share or any specific shared printer to control its use. A final option is to delete the printers share and configure each device manually. Because Mac OS X normally does most of the work for you automatically, this last option really just makes life more difficult. Shared printers can be configured using the options in Table 27.6.

Table 27.6. Printer Sharing Options

Enter the options needed to create the printer share and then click Commit Changes. Windows clients should be able to browse and print the device (with an appropriate driver) immediately.

Status

The SWAT Server Status page gives a quick overview of the server's current conditions, including active connections, shares, and files. Normally, the administrator can use this screen to restart the server or disable any active connections. Unfortunately, in Tiger, Apple has chosen to use launchd to start smbd and nmbd on demand—meaning that they will not show up as active in the display regardless of whether they truly are.

• Stop/Start/Restart smbd — Stops, starts, or restarts smbd —the Samba SMB file/print server. All active connections are terminated .

• Stop/Start/Restart nmbd — Stops, starts, or restarts nmbd —the Samba NetBIOS name server. Does not affect active connections.

• Stop/Start/Restart winbindd — Stops, starts, or restarts winbindd —A process that binds to a Windows domain to retrieve account information. Does not affect active connections.

The remaining two settings are still useful, regardless of how the daemon processes themselves are handled:

• Auto Refresh — Sets the SWAT status page to autorefresh based on the Refresh Interval field. This is useful for monitoring server activity.

• Kill — The Kill button (an X) appears to the right of every listed connection. Clicking the button immediately terminates the link.

[global]

    auth methods = guest opendirectory

    passdb backend = opendirectorysam guest

    guest account = unknown

    workgroup = POISONTOOTH

    netbios name = POINTY

    server string = Poisontooth SAMBA Server

    encrypt passwords = Yes

    preferred master = Yes

    dns proxy = No

    wins support = Yes

[MyMP3s]

      path = /filestorage/mp3

      read only = No

brezup:root root #

smbstatus

NOTE: Service printers is flagged unavailable.



Samba version 3.0.0beta3

PID   Username   Group     Machine

-------------------------------------------------------------------

 951  jray     jray     client19   (10.0.1.119)

 965  jray     jray     painful    (10.0.1.107)



Service   pid   machine    Connected at

-------------------------------------------------------

IPC$      965  painful    Sat Mar 12 13:11:05 2005

jray      951  client19   Sat Mar 12 13:11:05 2005

jray      965  painful    Sat Mar 12 13:11:05 2005

No locked files