Section 2.3. Implementation

2.3. Implementation

In this example, the assumption is made that this server is being configured from a clean start. The alternate approach could be to demonstrate the migration of the system that is documented in Section to meet the new requirements. The decision to treat this case, as with future examples, as a new installation is based on the premise that you can determine the migration steps from the information provided in Chapter 9, "Migrating NT4 Domain to Samba-3". Additionally, a fresh installation makes the example easier to follow.

Each user will be given a home directory on the UNIX system, which will be available as a private share. Two additional shares will be created, one for the accounting department and the other for the financial services department. Network users will be given access to these shares by way of group membership.

UNIX group membership is the primary mechanism by which Windows Domain users will be granted rights and privileges within the Windows environment.

The user alanm will be made the owner of all files. This will be preserved by setting the sticky bit (set UID/GID) on the top-level directories.



Using UNIX/Linux system tools, name the server sleeth.


Place an entry for the machine sleeth in the /etc/hosts. The printers are network attached, so there should be entries for the network printers also. An example /etc/hosts file is shown here:     sleeth sleeth1     sleeth2    hplj6    hplj4    qms 


Install the Samba-3 binary RPM from the Samba-Team FTP site.


Install the ISC DHCP server using the UNIX/Linux system tools available to you.


Because Samba will be operating over two network interfaces and clients on each side may want to be able to reach clients on the other side, it is imperative that IP forwarding is enabled. Use the system tool of your choice to enable IP forwarding. In the absence of such a tool on the Linux system, add to the /etc/rc.d/rc.local file an entry as follows:

echo 1 > /proc/sys/net/ipv4/ip_forward 

This causes the Linux kernel to forward IP packets so that it acts as a router.


Install the smb.conf file as shown in Example 2.3.3 and Example 2.3.4. Combine these two examples to form a single /etc/samba/smb.conf file.


Add the user root to the Samba password backend:

root#  smbpasswd -a root New SMB password: XXXXXXX Retype new SMB password: XXXXXXX root# 

This is the Windows Domain Administrator password. Never delete this account from the password backend after Windows Domain Groups have been initialized. If you delete this account, your system is crippled. You cannot restore this account, and your Samba server can no longer be administered.


Create the username map file to permit the root account to be called Administrator from the Windows network environment. To do this, create the file /etc/samba/smbusers with the following contents:

#### # User mapping file #### # File Format # ----------- # Unix_ID = Windows_ID # # Examples: # root = Administrator # janes = "Jane Smith" # jimbo = Jim Bones # # Note: If the name contains a space it must be double quoted. #       In the example above the name 'jimbo' will be mapped to Windows #       user names 'Jim' and 'Bones' because the space was not quoted. ####################################################################### root = Administrator #### # End of File #### 


Create and map Windows Domain Groups to UNIX groups. A sample script is provided in Example 2.3.1. Create a file containing this script. We called ours /etc/samba/ Set this file so it can be executed, and then execute the script. Sample output should be as follows:

root#  chmod 755 root#  cd /etc/samba root#  ./ Updated mapping entry for Domain Admins Updated mapping entry for Domain Users Updated mapping entry for Domain Guests No rid or sid specified, choosing algorithmic mapping Successfully added group Accounts Dept to the mapping db No rid or sid specified, choosing algorithmic mapping Successfully added group Domain Guests to the mapping db root#  cd /etc/samba root#  net groupmap list | sort Account Operators (S-1-5-32-548) -> -1 Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep Administrators (S-1-5-32-544) -> -1 Backup Operators (S-1-5-32-551) -> -1 Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs Guests (S-1-5-32-546) -> -1 Power Users (S-1-5-32-547) -> -1 Print Operators (S-1-5-32-550) -> -1 Replicators (S-1-5-32-552) -> -1 System Operators (S-1-5-32-549) -> -1 Users (S-1-5-32-545) -> -1 

Example 2.3.1. Script to Map Windows NT Groups to UNIX Groups
#!/bin/bash # # # # Create UNIX groups groupadd acctsdep groupadd finsrvcs # Map Windows Domain Groups to UNIX groups net groupmap modify ntgroup="Domain Admins"     unixgroup=root net groupmap modify ntgroup="Domain Users"      unixgroup=users net groupmap modify ntgroup="Domain Guests"     unixgroup=nobody # Add Functional Domain Groups net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d 


For each user who needs to be given a Windows Domain account, make an entry in the /etc/passwd file as well as in the Samba password backend. Use the system tool of your choice to create the UNIX system accounts, and use the Samba smbpasswd program to create the Domain user accounts. There are a number of tools for user management under UNIX, such as useradd and adduser, as well as a plethora of custom tools. With the tool of your choice, create a home directory for each user.


Using the preferred tool for your UNIX system, add each user to the UNIX groups created previously, as necessary. File system access control will be based on UNIX group membership.


Create the directory mount point for the disk subsystem that is mounted to provide data storage for company files. In this case the mount point is indicated in the smb.conf file is /data. Format the file system as required, mount the formatted file system partition using mount, and make the appropriate changes in /etc/fstab.


Create the top-level file storage directories are follows:

root#  mkdir -p /data/{accounts,finsvcs} root#  chown -R root:root /data root#  chown -R alanm:accounts /data/accounts root#  chown -R alanm:finsvcs /data/finsvcs root#  chmod -R ug+rwx,o+rx-w /data 

Each department is responsible for creating its own directory structure within its share. The directory root of the accounts share is /data/accounts. The directory root of the finsvcs share is /data/finsvcs.


Configure the printers with the IP addresses as shown in Figure 2.1. Follow the instructions in the manufacturers' manuals to permit printing to port 9100. This allows the CUPS spooler to print using raw mode protocols.

Figure 2.1. Abmas Accounting 52-User Network Topology


Configure the CUPS Print Queues as follows:

root#  lpadmin -p hplj4 -v socket:// -E root#  lpadmin -p hplj6 -v socket:// -E root#  lpadmin -p qms -v socket:// -E 

This creates the necessary print queues with no assigned print filter.


Edit the file /etc/cups/mime.convs to uncomment the line:

application/octet-stream     application/vnd.cups-raw     0     - 


Edit the file /etc/cups/mime.types to uncomment the line:



Using your favorite system editor, create an /etc/dhcpd.conf with the contents as shown in Example 2.3.2.


Use the standard system tool to start Samba and CUPS and configure them to start automatically at every system reboot. For example,

root#  chkconfig dhcp on root#  chkconfig smb on root#  chkconfig cups on root#  /etc/rc.d/init.d/dhcp restart root#  /etc/rc.d/init.d/smb restart root#  /etc/rc.d/init.d/cups restart 


Configure the name service switch (NSS) to handle WINS-based name resolution. Since this system does not use a DNS server, it is safe to remove this option from the NSS configuration. Edit the /etc/nsswitch.conf file so that the hosts: entry looks like this:

hosts:     files wins 

2.3.1. Validation

Does everything function as it ought? That is the key question at this point. Here are some simple steps to validate your Samba server configuration.



If your smb.conf file has bogus options or parameters, this may cause Samba to refuse to start. The first step should always be to validate the contents of this file by running:

root#  testparm -s Load smb config files from smb.conf Processing section "[homes]" Processing section "[printers]" Processing section "[netlogon]" Processing section "[accounts]" Processing section "[service]" Loaded services file OK. # Global parameters [global]         workgroup = BILLMORE         passwd chat = *New*Password* \       %n\n *Re-enter*new*password* %n\n *Password*changed*         username map = /etc/samba/smbusers         syslog = 0         name resolve order = wins bcast hosts         printcap name = CUPS         show add printer wizard = No         add user script = /usr/sbin/useradd -m '%u'         delete user script = /usr/sbin/userdel -r '%u'         add group script = /usr/sbin/groupadd '%g'         delete group script = /usr/sbin/groupdel '%g'         add user to group script = /usr/sbin/usermod -G '%g' '%u'         add machine script = /usr/sbin/useradd             -s /bin/false -d /var/lib/nobody '%u'         logon script = scripts\logon.bat         logon path =         logon drive = X:         domain logons = Yes         preferred master = Yes         wins support = Yes ... ### Remainder cut to save space ### 

The inclusion of an invalid parameter (say one called dogbert) would generate an error as follows:

Unknown parameter encountered: "dogbert" Ignoring unknown parameter "dogbert" 

Clear away all errors before proceeding, and start or restart samba as necessary.


Check that the Samba server is running:

root#  ps ax | grep mbd 14244 ?        S      0:00 /usr/sbin/nmbd -D 14245 ?        S      0:00 /usr/sbin/nmbd -D 14290 ?        S      0:00 /usr/sbin/smbd -D $rootprompt; ps ax | grep winbind 14293 ?        S     0:00 /usr/sbin/winbindd -B 14295 ?        S     0:00 /usr/sbin/winbindd -B 

The winbindd daemon is running in split mode (normal), so there are also two instances of it. For more information regarding winbindd, see TOSHARG2, Chapter 23, Section 23.3. The single instance of smbd is normal.


Check that an anonymous connection can be made to the Samba server:

root#  smbclient -L localhost -U%         Sharename      Type       Comment         ---------      ----       -------         netlogon       Disk       Network Logon Service         accounts       Disk       Accounting Files         finsvcs        Disk       Financial Service Files         IPC$           IPC        IPC Service (Samba3)         ADMIN$         IPC        IPC Service (Samba3)         hplj4          Printer    Hewlett-Packard LaserJet 4         hplj6          Printer    Hewlett-Packard LaserJet 6         qms            Printer    QMS Magicolor Laser Printer XXXX         Server               Comment         ---------            -------         SLEETH               Samba 3.0.20         Workgroup            Master         ---------            -------         BILLMORE             SLEETH 

This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent of browsing the server from a Windows client to obtain a list of shares on the server. The -U% argument means to send a NULL username and a NULL password.


Verify that the printers have the IP addresses assigned in the DHCP server configuration file. The easiest way to do this is to ping the printer name. Immediately after the ping response has been received, execute arp -a to find the MAC address of the printer that has responded. Now you can compare the IP address and the MAC address of the printer with the configuration information in the /etc/dhcpd.conf file. They should, of course, match. For example,

root#  ping hplj4 PING hplj4 ( 56(84) bytes of data. 64 bytes from hplj4 ( icmp_seq=1 ttl=64 time=0.113 ms root#  arp -a hplj4 ( at 08:00:46:7A:35:E4 [ether] on eth0 

The MAC address 08:00:46:7A:35:E4 matches that specified for the IP address from which the printer has responded and the entry for it in the /etc/dhcpd.conf file.


Make an authenticated connection to the server using the smbclient tool:

root#  smbclient //sleeth/accounts -U alanm Password: XXXXXXX smb: \> dir   .                         D         0  Sun  Nov   9  01:28:34  2003   ..                        D         0  Sat  Aug  16  17:24:26  2003   .mc                      DH         0  Sat  Nov   8  21:57:38  2003   .qt                      DH         0  Fri  Sep   5  00:48:25  2003   SMB                       D         0  Sun  Oct  19  23:04:30  2003   Documents                 D         0  Sat  Nov   1  00:31:51  2003   xpsp1a_en_x86.exe           131170400  Sun  Nov   2  01:25:44  2003            65387 blocks of size 65536. 28590 blocks available smb: \> q 



Configure clients to the network settings shown in Figure 2.1. All clients use DHCP for TCP/IP protocol stack configuration. DHCP configures all Windows clients to use the WINS Server address


Join the Windows Domain called BILLMORE. Use the Domain Administrator username root and the SMB password you assigned to this account. A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to a Windows Domain is given in Chapter 15, "A Collection of Useful Tidbits", Section 15.1. Reboot the machine as prompted and then log on using a Domain User account.


Verify on each client that the machine called SLEETH is visible in My Network Places, that it is possible to connect to it and see the shares accounts and finsvcs, and that it is possible to open that share to reveal its contents.


Instruct all users to log onto the workstation using their assigned username and password.


Install a printer on each using the following steps:

  1. Click Start Add Printer+Next. Do not click Network printer. Ensure that Local printer is selected.

  2. Click Next. In the Manufacturer: panel, select HP. In the Printers: panel, select the printer called HP LaserJet 4. Click Next.

  3. In the Available ports: panel, select FILE:. Accept the default printer name by clicking Next. When asked, "Would you like to print a test page?", click No. Click Finish.

  4. You may be prompted for the name of a file to print to. If so, close the dialog panel. Right-click HP LaserJet 4 In the Network panel, enter the name of the print queue on the Samba server as follows: \\SERVER\hplj4. Click OK+OK to complete the installation.

  5. Repeat the printer installation steps above for the HP LaserJet 6 printer as well as for the QMS Magicolor XXXX laser printer.

2.3.2. Notebook Computers: A Special Case

As a network administrator, you already know how to create local machine accounts for Windows 200x/XP Professional systems. This is the preferred solution to provide continuity of work for notebook users so that absence from the office network environment does not become a barrier to productivity.

By creating a local machine account that has the same username and password as you create for that user in the Windows Domain environment, the user can log onto the machine locally and still transparently access network resources as if logged onto the domain itself. There are some trade-offs that mean that as the network is more tightly secured, it becomes necessary to modify Windows client configuration somewhat.

2.3.3. Key Points Learned

In this network design and implementation exercise, you created a Windows NT4-style Domain Controller using Samba-3.0.20. Following these guidelines, you experienced and implemented several important aspects of Windows networking. In the next chapter, you build on the experience. These are the highlights from this chapter:

  • You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary network configuration settings from this server.

  • You created a Windows Domain Controller. You were able to use the network logon service and successfully joined Windows 200x/XP Professional clients to the Domain.

  • You created raw print queues in the CUPS printing system. You maintained a simple printing system so that all users can share centrally managed printers. You installed native printer drivers on the Windows clients.

  • You experienced the benefits of centrally managed user accounts on the server.

  • You offered Mobile notebook users a solution that allows them to continue to work while away from the office and not connected to the corporate network.

    Samba-3 by Example. Practical Exercises to Successful Deployment
    Samba-3 by Example: Practical Exercises to Successful Deployment (2nd Edition)
    ISBN: 013188221X
    EAN: 2147483647
    Year: 2005
    Pages: 142

    Similar book on Amazon © 2008-2017.
    If you may any questions please contact us: