[system-administrators-guide/22] Using grubby with the GRUB 2 Menu
by stephenw
commit 745160e484d9d3076cbe61621197cff9e25c89e2
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Fri Jun 19 17:57:42 2015 +0200
Using grubby with the GRUB 2 Menu
en-US/Working_with_the_GRUB_2_Boot_Loader.xml | 87 ++++++++++++++++++++++++-
1 files changed, 85 insertions(+), 2 deletions(-)
---
diff --git a/en-US/Working_with_the_GRUB_2_Boot_Loader.xml b/en-US/Working_with_the_GRUB_2_Boot_Loader.xml
index 54f772d..f4c11bf 100644
--- a/en-US/Working_with_the_GRUB_2_Boot_Loader.xml
+++ b/en-US/Working_with_the_GRUB_2_Boot_Loader.xml
@@ -97,8 +97,91 @@ menuentry 'Fedora, with Linux 3.17.4-301.fc21.x86_64' --class fedora --class gnu
</note>
</section>
- <section id="sec-Customizing_GRUB_2_Menu">
- <title>Customizing GRUB 2 Menu</title>
+ <section id="sec-Using_grubby_with_the_GRUB_2_Menu">
+ <title>Using grubby with the GRUB 2 Menu</title>
+<para>
+ The <command>grubby</command> tool can be used to read information from, and make persistent changes to, the <filename>grub.cfg</filename> file. It enables, for example, changing GRUB menu entries to specify what arguments to pass to a kernel on system start and changing the default kernel.<remark> IS THIS BIT TRUE?</remark> In Red Hat Enterprise Linux 7, <command>grubby</command> defaults to working with the GRUB 2 configuration file, <filename>grub.cfg</filename>.<remark> Do we need to warn users to use the "--grub2" option in scripts?</remark>
+</para>
+<example id="ex-Listing_the_Default_Kernel">
+<title>Listing the Default Kernel</title>
+<para>
+ To find out the file name of the default kernel, enter a command as follows:
+</para>
+<screen>~]# <command>grubby --default-kernel</command>
+/boot/vmlinuz-3.10.0-229.4.2.el7.x86_64</screen>
+<para>
+ To find out the index number of the default kernel, enter a command as follows:
+</para>
+<screen>~]# <command>grubby --default-index</command>
+0</screen>
+
+</example>
+<example id="ex-Viewing_the_GRUB_Menu_Entry_for_a_Kernel">
+<title>Viewing the GRUB Menu Entry for a Kernel</title>
+<para>
+ To view the GRUB menu entry for a kernel, enter a command as follows:
+</para>
+<screen>~]# <command>grubby --info /boot/vmlinuz-3.10.0-229.4.2.el7.x86_64</command>
+index=0
+kernel=/boot/vmlinuz-3.10.0-229.4.2.el7.x86_64
+args="ro rd.lvm.lv=rhel/root crashkernel=auto rd.lvm.lv=rhel/swap vconsole.font=latarcyrheb-sun16 vconsole.keymap=us rhgb quiet LANG=en_US.UTF-8"
+root=/dev/mapper/rhel-root
+initrd=/boot/initramfs-3.10.0-229.4.2.el7.x86_64.img
+title=Red Hat Enterprise Linux Server (3.10.0-229.4.2.el7.x86_64) 7.0 (Maipo)</screen>
+</example>
+<para>
+ The <option>--update-kernel</option> option can be used to update a menu entry when used in combination with <option>--args</option> to add new arguments and <option>--remove-arguments</option> to remove existing arguments. These options accept a quoted space-separated list. The command to simultaneously add and remove arguments a from GRUB menu entry has the follow format:
+ <synopsis>grubby --remove-args="<replaceable>argX argY</replaceable>" --args="<replaceable>argA argB</replaceable>" --update-kernel /boot/<replaceable>kernel</replaceable></synopsis>
+
+</para>
+<example id="ex-Adding_and_Removing_Arguments_from_a_GRUB_Menu_Entry">
+<title>Adding and Removing Arguments from a GRUB Menu Entry</title>
+<para>
+ To add and remove arguments from a kernel's GRUB menu entry, use a command as follows:
+<screen>~]# <command>grubby --remove-args="rhgb quiet" --args=console=ttyS0,115200 --update-kernel /boot/vmlinuz-3.10.0-229.4.2.el7.x86_64</command></screen>
+This command removes the Red Hat graphical boot argument, enables boot message to be seen, and adds a serial console. As the console arguments will be added at the end of the line, the new console will take precedence over any other consoles configured.
+</para>
+<para>
+ To review the changes, use the <option>--info</option> command option as follows:
+</para>
+<screen>~]# <command>grubby --info /boot/vmlinuz-3.10.0-229.4.2.el7.x86_64</command>
+index=0
+kernel=/boot/vmlinuz-3.10.0-229.4.2.el7.x86_64
+args="ro rd.lvm.lv=rhel/root crashkernel=auto rd.lvm.lv=rhel/swap vconsole.font=latarcyrheb-sun16 vconsole.keymap=us LANG=en_US.UTF-8 <emphasis role="bold">ttyS0,115200</emphasis>"
+root=/dev/mapper/rhel-root
+initrd=/boot/initramfs-3.10.0-229.4.2.el7.x86_64.img
+title=Red Hat Enterprise Linux Server (3.10.0-229.4.2.el7.x86_64) 7.0 (Maipo)</screen>
+</example>
+
+<example id="ex-Updating_All_Kernel_Menus_with_the_Same_Arguments">
+<title>Updating All Kernel Menus with the Same Arguments</title>
+<para>
+To add the same kernel boot arguments to all the kernel menu entries, enter a command as follows:
+<screen>~]# <command>grubby --update-kernel=ALL --args=<replaceable>console=ttyS0,115200</replaceable></command></screen>
+The <option>--update-kernel</option> parameter also accepts DEFAULT or a comma separated list of kernel index numbers.
+</para>
+</example>
+
+<example id="ex-Changing_a_Kernel_Argument">
+ <title>Changing a Kernel Argument</title>
+ <para>
+ To change a value in an existing kernel argument, specify the argument again, changing the value as required. For example, to change the virtual console font size, use a command as follows:
+ <screen>~]# <command>grubby --args=vconsole.font=latarcyrheb-sun32 --update-kernel /boot/vmlinuz-3.10.0-229.4.2.el7.x86_64</command>
+index=0
+kernel=/boot/vmlinuz-3.10.0-229.4.2.el7.x86_64
+args="ro rd.lvm.lv=rhel/root crashkernel=auto rd.lvm.lv=rhel/swap vconsole.font=<emphasis role="bold">latarcyrheb-sun32</emphasis> vconsole.keymap=us LANG=en_US.UTF-8"
+root=/dev/mapper/rhel-root
+initrd=/boot/initramfs-3.10.0-229.4.2.el7.x86_64.img
+title=Red Hat Enterprise Linux Server (3.10.0-229.4.2.el7.x86_64) 7.0 (Maipo)</screen>
+ </para>
+</example>
+<para>
+ See the <filename>grubby(8)</filename> manual page for more command options.
+</para>
+</section>
+
+<section id="sec-Customizing_the_GRUB_2_Menu">
+<title>Customizing the GRUB 2 Menu</title>
<para>
GRUB 2 scripts search the user's computer and build a boot menu based on what operating systems the scripts find. To reflect the latest system boot options, the boot menu is rebuilt automatically when the kernel is updated or a new kernel is added.
</para>
8 years, 6 months
[system-administrators-guide/22] Update intro to explain about grubby
by stephenw
commit 5eca86a555d4ec895adc6f1928408ef8f29239a5
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Fri Jun 19 17:04:15 2015 +0200
Update intro to explain about grubby
grubby does not update /etc/default/grub file which needs
to be modified to keep the settings permanent
en-US/Working_with_the_GRUB_2_Boot_Loader.xml | 14 +++++++++++++-
1 files changed, 13 insertions(+), 1 deletions(-)
---
diff --git a/en-US/Working_with_the_GRUB_2_Boot_Loader.xml b/en-US/Working_with_the_GRUB_2_Boot_Loader.xml
index 31194f1..54f772d 100644
--- a/en-US/Working_with_the_GRUB_2_Boot_Loader.xml
+++ b/en-US/Working_with_the_GRUB_2_Boot_Loader.xml
@@ -27,7 +27,17 @@
<section id="sec-Configuring_the_GRUB_2_Boot_Loader">
<title>Configuring the GRUB 2 Boot Loader</title>
<para>
- GRUB 2 reads its configuration from the <filename>/boot/grub2/grub.cfg</filename> file on traditional BIOS-based machines and from the <filename>/boot/efi/EFI/redhat/grub.cfg</filename> file on UEFI machines. This file contains menu information, however, it is not supposed to be edited as it is generated by the <application>/usr/sbin/grub2-mkconfig</application> utility based on Linux kernels located in the <filename class="directory">/boot/</filename> directory, template files located in <filename class="directory">/etc/grub.d/</filename>, and custom settings in the <filename>/etc/default/grub</filename> file. Any manual edits could therefore cause the changes to be lost during updates. The GRUB 2 configuration file, <filename>grub.cfg</filename>, is automatically updated each time a new kernel is installed. Note that any changes to <filename>/etc/default/grub</filename> require rebuilding the <filename>grub.cfg</filename> file. To update the GRUB 2 configuration file m
anually, use the <command>grub2-mkconfig <option>-o</option></command> command as follows:
+ GRUB 2 reads its configuration from the <filename>/boot/grub2/grub.cfg</filename> file on traditional BIOS-based machines and from the <filename>/boot/efi/EFI/redhat/grub.cfg</filename> file on UEFI machines. This file contains menu information.
+ </para>
+ <para>
+ The <filename>grub.cfg</filename> is not supposed to be edited as it is generated by the <application>/usr/sbin/grub2-mkconfig</application> utility based on Linux kernels located in the <filename class="directory">/boot/</filename> directory, template files located in <filename class="directory">/etc/grub.d/</filename>, and custom settings in the <filename>/etc/default/grub</filename> file. Any manual edits could therefore be lost during updates. The GRUB 2 configuration file, <filename>grub.cfg</filename>, is automatically updated each time a new kernel is installed. Note that any manual changes to <filename>/etc/default/grub</filename> require rebuilding the <filename>grub.cfg</filename> file.</para>
+ <para>
+The <filename>/etc/default/grub</filename> file is used by <command>grub2-mkconfig</command>, which should only be used by <systemitem>anaconda</systemitem> when creating <filename>grub.cfg</filename> initially during the installation process, and can be used in the event of a system failure, for example if the boot loader configurations need to be recreated from scratch. In general it is not recommended to use <filename>grub2-mkconfig</filename> manually except as a last resort. Normal operations on <filename>grub.cfg</filename>, such as the removal and addition of new kernels, should be done with the <command>grubby</command> tool and, for scripts, using <command>new-kernel-pkg</command> tool. If you use <command>grubby</command> to modify the default kernel the changes continues to be inherited when new kernels are installed.
+ </para>
+
+ <bridgehead renderas="sect3">Rebuilding the GRUB 2 Configuration File</bridgehead>
+ <para>
+ To rebuild the GRUB 2 configuration file manually using the <command>grub2-mkconfig</command> command, proceed as follows:
</para>
<itemizedlist>
@@ -44,6 +54,8 @@
</para>
</listitem>
</itemizedlist>
+
+<bridgehead renderas="sect3">Menu Entries in grub.cfg</bridgehead>
<para>
Among various code snippets and directives, the <filename>grub.cfg</filename> configuration file contains one or more <literal>menuentry</literal> blocks, each representing a single GRUB 2 boot menu entry. These blocks always start with the <literal>menuentry</literal> keyword followed by a title, list of options, and an opening curly bracket, and end with a closing curly bracket. Anything between the opening and closing bracket should be indented. For example, the following is a sample <literal>menuentry</literal> block for &MAJOROSVER; with Linux kernel 3.17.4-301.fc21.x86_64:
</para>
8 years, 6 months
[system-administrators-guide/22] Repo specific overrides global in dnf.conf
by stephenw
commit fb5fdac6e0bbb458e3fe6feec6b4e20026d06885
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Fri Aug 14 10:45:51 2015 +0200
Repo specific overrides global in dnf.conf
en-US/DNF.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
---
diff --git a/en-US/DNF.xml b/en-US/DNF.xml
index 04a1e7d..630ad45 100644
--- a/en-US/DNF.xml
+++ b/en-US/DNF.xml
@@ -1030,7 +1030,7 @@ ID | Login user | Date a | Action | Altere
<tertiary>configuring DNF and DNF repositories</tertiary>
</indexterm>
<para>
- The configuration file for DNF and related utilities is located at <filename>/etc/dnf/dnf.conf</filename>. This file contains one mandatory <literal>[main]</literal> section, which allows you to set DNF options that have global effect, and may also contain one or more <literal>[<replaceable>repository</replaceable>]</literal> sections, which allow you to set repository-specific options. However, it is recommended to define individual repositories in new or existing <filename class="extension">.repo</filename> files in the <filename class="directory">/etc/yum.repos.d/</filename>directory. The values you define in the <literal>[main]</literal> section of the <filename>/etc/dnf/dnf.conf</filename> file may override values set in individual <literal>[<replaceable>repository</replaceable>]</literal> sections.
+ The configuration file for DNF and related utilities is located at <filename>/etc/dnf/dnf.conf</filename>. This file contains one mandatory <literal>[main]</literal> section, which allows you to set DNF options that have global effect, and may also contain one or more <literal>[<replaceable>repository</replaceable>]</literal> sections, which allow you to set repository-specific options. However, it is recommended to define individual repositories in new or existing <filename class="extension">.repo</filename> files in the <filename class="directory">/etc/yum.repos.d/</filename> directory. The values you define in individual <literal>[<replaceable>repository</replaceable>]</literal> sections of the <filename>/etc/dnf/dnf.conf</filename> file override values set in the <literal>[main]</literal> section.
</para>
<para>
This section shows you how to:
8 years, 6 months
[system-administrators-guide/22] Samba - incorporated changes from RHEL.
by stephenw
commit 656bc8c467680ff38951de71d3447fe0917e1d7e
Author: Barbora Ančincová <bancinco(a)redhat.com>
Date: Wed Jul 15 12:17:03 2015 +0200
Samba - incorporated changes from RHEL.
en-US/Samba.xml | 2919 ++++++++++++++++++++++++++++---------------------------
1 files changed, 1477 insertions(+), 1442 deletions(-)
---
diff --git a/en-US/Samba.xml b/en-US/Samba.xml
index 8fc2a02..29b04e1 100644
--- a/en-US/Samba.xml
+++ b/en-US/Samba.xml
@@ -1,620 +1,792 @@
<?xml version='1.0'?>
<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
]>
-<section id="s1-Samba">
- <title>Samba</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Reference</secondary>
- </indexterm>
- <indexterm>
- <primary>Samba</primary>
- <see>Samba</see>
- </indexterm>
- <para>
- <application>Samba</application> is an open source implementation of the <firstterm>server message block</firstterm> (<systemitem class="protocol">SMB</systemitem>) protocol. Modern versions of this protocol are also known as the <firstterm>common Internet file system</firstterm> (<systemitem class="protocol">CIFS</systemitem>) protocol. It allows the networking of Microsoft <trademark class="registered">Windows</trademark>, Linux, UNIX, and other operating systems together, enabling access to Windows-based file and printer shares. Samba's use of <systemitem class="protocol">SMB</systemitem> allows it to appear as a Windows server to Windows clients.</para>
- <note>
- <title>Installing the samba package</title>
- <para>In order to use <application>Samba</application>, first ensure the <package>samba</package> package is installed on your system by running, as <systemitem class="username">root</systemitem>:</para>
- <screen>~]# <command>dnf install samba</command></screen>
- <para>For more information on installing packages with DNF, see <xref linkend="sec-Installing"/>.</para>
- </note>
-
- <section
- id="samba-rgs-overview">
- <title>Introduction to Samba</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Introduction</secondary>
- </indexterm>
- <para>Fedora includes Samba version <literal>4.1</literal>:</para>
- <section
- id="s3-samba-abilities">
- <title>Samba Features</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Abilities</secondary>
- </indexterm>
- <para>Samba is a powerful and versatile server application.</para>
- <para>What Samba can do:</para>
- <itemizedlist>
- <listitem>
- <para>Serve directory trees and printers to Linux, UNIX, and Windows clients</para>
- </listitem>
- <listitem>
- <para>Assist in network browsing (with or without NetBIOS)</para>
- </listitem>
- <listitem>
- <para>Authenticate Windows domain logins</para>
- </listitem>
- <listitem>
- <para>Provide <firstterm>Windows Internet Name Service</firstterm> (<systemitem class="service">WINS</systemitem>) name server resolution</para>
- </listitem>
- <listitem>
- <para>Act as a Windows <trademark
- class="registered">NT</trademark>-style <firstterm>Primary Domain Controller</firstterm> (PDC)</para>
- </listitem>
- <listitem>
- <para>Act as a <firstterm>Backup Domain Controller</firstterm> (BDC) for a Samba-based PDC</para>
- </listitem>
- <listitem>
- <para>Act as an Active Directory domain member server</para>
- </listitem>
- <listitem>
- <para>Join a Windows NT/2000/2003/2008 PDC/Windows Server 2012</para>
- </listitem>
- </itemizedlist>
- <para>What Samba cannot do:</para>
- <itemizedlist>
- <listitem>
- <para>Act as a BDC for a Windows PDC (and vice versa)</para>
- </listitem>
- <listitem>
- <para>Act as an Active Directory domain controller</para>
- </listitem>
- </itemizedlist>
- </section>
- </section>
- <section
- id="s2-samba-daemons">
- <title>Samba Daemons and Related Services</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>daemon</secondary>
- </indexterm>
- <para>The following is a brief introduction to the individual Samba daemons and services.</para>
- <section
- id="s3-samba-services">
- <title>Samba Daemons</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>daemon</secondary>
- <tertiary>overview</tertiary>
- </indexterm>
- <para>Samba is comprised of three daemons (<command>smbd</command>, <command>nmbd</command>, and <command>winbindd</command>). Three services (<command>smb</command>, <command>nmb</command>, and <command>winbind</command>) control how the daemons are started, stopped, and other service-related features. These services act as different init scripts. Each daemon is listed in detail below, as well as which specific service has control over it.</para>
- <bridgehead id="s4-samba-daemon-smbd">
- <command>smbd</command>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>daemon</secondary>
- <tertiary>smbd</tertiary>
- </indexterm>
- <para>The <command>smbd</command> server daemon provides file sharing and printing services to Windows clients. In addition, it is responsible for user authentication, resource locking, and data sharing through the <systemitem class="protocol">SMB</systemitem> protocol. The default ports on which the server listens for <systemitem class="protocol">SMB</systemitem> traffic are <systemitem class="protocol">TCP</systemitem> ports <constant>139</constant> and <constant>445</constant>.</para>
- <para>The <command>smbd</command> daemon is controlled by the <command>smb</command> service.</para>
- <bridgehead id="s4-samba-daemon-nmbd">
- <command>nmbd</command>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>daemon</secondary>
- <tertiary>nmbd</tertiary>
- </indexterm>
- <para>The <command>nmbd</command> server daemon understands and replies to NetBIOS name service requests such as those produced by SMB/CIFS in Windows-based systems. These systems include Windows 95/98/ME, Windows NT, Windows 2000, Windows XP, and LanManager clients. It also participates in the browsing protocols that make up the Windows <guilabel>Network Neighborhood</guilabel> view. The default port that the server listens to for <systemitem class="protocol">NMB</systemitem> traffic is <systemitem class="protocol">UDP</systemitem> port <systemitem class="constant">137</systemitem>.</para>
- <para>The <command>nmbd</command> daemon is controlled by the <command>nmb</command> service.</para>
- <bridgehead id="s4-samba-daemon-winbindd">
- <command>winbindd</command>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>daemon</secondary>
- <tertiary>winbindd</tertiary>
- </indexterm>
- <para>The <command>winbind</command> service resolves user and group information received from a server running Windows NT, 2000, 2003, Windows Server 2008, or Windows Server 2012. This makes Windows user and group information understandable by UNIX platforms. This is achieved by using Microsoft RPC calls, <firstterm>Pluggable Authentication Modules</firstterm> (PAM), and the <firstterm>Name Service Switch</firstterm> (NSS). This allows Windows NT domain users to appear and operate as UNIX users on a UNIX machine. Though bundled with the Samba distribution, the <command>winbind</command> service is controlled separately from the <command>smb</command> service.</para>
- <para>The <command>winbindd</command> daemon is controlled by the <command>winbind</command> service and does not require the <command>smb</command> service to be started in order to operate. <command>winbindd</command> is also used when Samba is an Active Directory member, and may also be used on a Samba domain controller (to implement nested groups and interdomain trust). Because <command>winbind</command> is a client-side service used to connect to Windows NT-based servers, further discussion of <command>winbind</command> is beyond the scope of this chapter.</para>
- <note>
- <title>Obtaining a list of utilities that are shipped with Samba</title>
- <para>See <xref linkend="s2-samba-programs"/> for a list of utilities included in the Samba distribution.</para>
- </note>
- </section>
- </section>
- <section
- id="s2-samba-connect-share">
- <title>Connecting to a Samba Share</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>share</secondary>
- <tertiary>connecting to with Nautilus</tertiary>
- </indexterm>
- <para>You can use <application>Nautilus</application> to view available Samba shares on your network. To view a list of Samba workgroups and domains on your network, select <menuchoice><guimenu>Applications</guimenu><guisubmenu>Accessories</guisubmenu><guimenuitem>Files</guimenuitem></menuchoice> from the <guimenu>Activities</guimenu> menu, and click <guimenuitem>Browse Network</guimenuitem> at the sidebar.</para>
- <figure id="fig-samba-nautilus-workgroups">
- <title>Browsing a network in Nautilus</title>
- <mediaobject>
- <imageobject>
- <imagedata fileref="images/samba-nautilus-domain.png" format="PNG" scalefit="0" />
- </imageobject>
- <textobject>
- <para>Browsing a network in Nautilus</para>
- </textobject>
- </mediaobject>
- </figure>
- <para>An icon appears for each available <systemitem class="protocol">SMB</systemitem> workgroup or domain on the network. Double-click one of the workgroup/domain icons to view a list of computers within the workgroup/domain.</para>
- <para>Each machine within the workgroup is represented by its own icon. Double-click on an icon to view the Samba shares on the machine. If a username and password combination is required, you are prompted for them.</para>
- <para>Alternately, you can also specify the Samba server and sharename in the <guilabel>Location:</guilabel> bar for <application>Nautilus</application> using the following syntax (replace <replaceable>servername</replaceable> and <replaceable>sharename</replaceable> with the appropriate values):</para>
- <screen><command>smb://<replaceable>servername</replaceable>/<replaceable>sharename</replaceable></command></screen>
- <section
- id="s3-samba-connect-share-cmdline">
- <title>Command Line</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>share</secondary>
- <tertiary>connecting to via the command line</tertiary>
- </indexterm>
- <indexterm>
- <primary>Samba</primary>
- <secondary>
- <command>findsmb</command>
- </secondary>
- </indexterm>
- <indexterm>
- <primary><command>findsmb</command></primary>
- </indexterm>
- <para>To query the network for Samba servers, use the <command>findsmb</command> command. For each server found, it displays its <systemitem class="protocol">IP</systemitem> address, NetBIOS name, workgroup name, operating system, and <systemitem class="protocol">SMB</systemitem> server version.</para>
- <indexterm>
- <primary>Samba</primary>
- <secondary><command>smbclient</command></secondary>
- </indexterm>
- <indexterm>
- <primary><command>smbclient</command></primary>
- </indexterm>
- <para>To connect to a Samba share from a shell prompt, type the following command:</para>
- <screen>~]$ <command>smbclient //<replaceable>hostname</replaceable>/<replaceable>sharename</replaceable> -U <replaceable>username</replaceable></command></screen>
- <para>Replace <replaceable>hostname</replaceable> with the hostname or <systemitem class="protocol">IP</systemitem> address of the Samba server you want to connect to, <replaceable>sharename</replaceable> with the name of the shared directory you want to browse, and <replaceable>username</replaceable> with the Samba username for the system. Enter the correct password or press <keycap>Enter</keycap> if no password is required for the user.</para>
- <para>If you see the <prompt>smb:\></prompt> prompt, you have successfully logged in. Once you are logged in, type <userinput>help</userinput> for a list of commands. If you want to browse the contents of your home directory, replace <replaceable>sharename</replaceable> with your username. If the <command>-U</command> switch is not used, the username of the current user is passed to the Samba server.</para>
- <para>To exit <command>smbclient</command>, type <userinput>exit</userinput> at the <prompt>smb:\></prompt> prompt.</para>
- </section>
- <section
- id="s2-samba-mounting">
- <title>Mounting the Share</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>share</secondary>
- <tertiary>mounting</tertiary>
- </indexterm>
- <para>Sometimes it is useful to mount a Samba share to a directory so that the files in the directory can be treated as if they are part of the local file system.</para>
- <para>To mount a Samba share to a directory, create a directory to mount it to (if it does not already exist), and execute the following command as <systemitem class="username">root</systemitem>:</para>
- <screen>
-<command>~]# mount -t cifs //<replaceable>servername</replaceable>/<replaceable>sharename</replaceable>
- <replaceable>/mnt/point/</replaceable> -o username=<replaceable>username</replaceable>,password=<replaceable>password</replaceable></command></screen>
-
- <para>This command mounts <replaceable>sharename</replaceable> from <replaceable>servername</replaceable> in the local directory <replaceable>/mnt/point/</replaceable>.
- </para>
- <note>
- <title>Installing cifs-utils package</title>
- <para>The <application>mount.cifs</application> utility is a separate RPM (independent from Samba). In order to use <application>mount.cifs</application>, first ensure the <package>cifs-utils</package> package is installed on your system by running, as <systemitem class="username">root</systemitem>:</para>
- <screen>~]# <command>dnf install cifs-utils</command></screen>
- <para>For more information on installing packages with DNF, see <xref linkend="sec-Installing"/>.</para>
- <para>
- Note that the <package>cifs-utils</package> package also contains the <application>cifs.upcall</application> binary called by the kernel in order to perform kerberized CIFS mounts. For more information on <application>cifs.upcall</application>, see <command>man cifs.upcall</command>.
- </para>
- </note>
- <para>
- For more information about mounting a samba share, see <command>man mount.cifs</command>.
- </para>
- <warning>
- <title>CIFS servers that require plain text passwords</title>
- <para>
- Some CIFS servers require plain text passwords for authentication. Support for plain text password authentication can be enabled using the following command as <systemitem class="username">root</systemitem>:
- </para>
- <screen>~]# <command>echo 0x37 > /proc/fs/cifs/SecurityFlags</command></screen>
- <para>
- WARNING: This operation can expose passwords by removing password encryption.
- </para>
- </warning>
- </section>
- </section>
- <section
- id="s2-samba-configuring">
- <title>Configuring a Samba Server</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>configuration</secondary>
- </indexterm>
- <indexterm>
- <primary>Samba</primary>
- <secondary>configuration</secondary>
- <tertiary>default</tertiary>
- </indexterm>
- <para>The default configuration file (<filename>/etc/samba/smb.conf</filename>) allows users to view their home directories as a Samba share. It also shares all printers configured for the system as Samba shared printers. You can attach a printer to the system and print to it from the Windows machines on your network.</para>
- <section
- id="s3-samba-configuring-gui">
- <title>Graphical Configuration</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>graphical configuration</secondary>
- </indexterm>
- <para>
- To configure Samba using a graphical interface, use one of the available Samba graphical user interfaces. A list of available GUIs can be found at <ulink url="http://www.samba.org/samba/GUI/">http://www.samba.org/samba/GUI/</ulink>.
- </para>
- </section>
- <section
- id="s3-samba-configuring-cmdline">
- <title>Command Line Configuration</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>configuration</secondary>
- </indexterm>
- <para>Samba uses <filename>/etc/samba/smb.conf</filename> as its configuration file. If you change this configuration file, the changes do not take effect until you restart the Samba daemon with the following command, as <systemitem class="username">root</systemitem>:
- <screen>~]# <command>systemctl restart smb.service</command></screen>
- </para>
- <para>To specify the Windows workgroup and a brief description of the Samba server, edit the following lines in your <filename>/etc/samba/smb.conf</filename> file:</para>
- <programlisting>workgroup = <replaceable>WORKGROUPNAME</replaceable>
-server string = <replaceable>BRIEF COMMENT ABOUT SERVER</replaceable></programlisting>
- <para>Replace <replaceable>WORKGROUPNAME</replaceable> with the name of the Windows workgroup to which this machine should belong. The <replaceable>BRIEF COMMENT ABOUT SERVER</replaceable> is optional and is used as the Windows comment about the Samba system.</para>
- <para>To create a Samba share directory on your Linux system, add the following section to your <filename>/etc/samba/smb.conf</filename> file (after modifying it to reflect your needs and your system):</para>
- <programlisting>[<replaceable>sharename</replaceable>]
+<section id="sect-Samba">
+ <title>Samba</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Reference</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <see>Samba</see>
+ </indexterm>
+ <para>
+ <application>Samba</application> is the standard open source Windows interoperability suite of programs for Linux. It implements the <firstterm>server message block</firstterm> (<systemitem class="protocol">SMB</systemitem>) protocol. Modern versions of this protocol are also known as the <firstterm>common Internet file system</firstterm> (<systemitem class="protocol">CIFS</systemitem>) protocol. It allows the networking of Microsoft <trademark class="registered">Windows</trademark>, Linux, UNIX, and other operating systems together, enabling access to Windows-based file and printer shares. Samba's use of <systemitem class="protocol">SMB</systemitem> allows it to appear as a Windows server to Windows clients.
+ </para>
+ <note>
+ <title>Installing the samba package</title>
+ <para>
+ In order to use <application>Samba</application>, first ensure the <package>samba</package> package is installed on your system by running, as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>dnf install samba</command></screen>
+ <para>
+ For more information on installing packages with DNF, see <xref linkend="sec-Installing"/>.
+ </para>
+ </note>
+ <section id="sect-Samba-Introduction_to_Samba">
+ <title>Introduction to Samba</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Introduction</secondary>
+ </indexterm>
+ <para>
+ Samba is an important component to seamlessly integrate Linux Servers and Desktops into Active Directory (AD) environments. It can function both as a domain controller (NT4-style) or as a regular domain member (AD or NT4-style).
+ </para>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Abilities</secondary>
+ </indexterm>
+ <bridgehead renderas="sect3">What Samba can do:</bridgehead>
+ <itemizedlist>
+ <listitem>
+ <para>
+ Serve directory trees and printers to Linux, UNIX, and Windows clients
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Assist in network browsing (with NetBIOS)
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Authenticate Windows domain logins
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Provide <firstterm>Windows Internet Name Service</firstterm> (<systemitem class="service">WINS</systemitem>) name server resolution
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Act as a Windows <trademark class="registered">NT</trademark>-style <firstterm>Primary Domain Controller</firstterm> (PDC)
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Act as a <firstterm>Backup Domain Controller</firstterm> (BDC) for a Samba-based PDC
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Act as an Active Directory domain member server
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Join a Windows NT/2000/2003/2008 PDC/Windows Server 2012
+ </para>
+ </listitem>
+ </itemizedlist>
+ <bridgehead renderas="sect3">What Samba cannot do:</bridgehead>
+ <itemizedlist>
+ <listitem>
+ <para>
+ Act as a BDC for a Windows PDC (and vice versa)
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Act as an Active Directory domain controller
+ </para>
+ </listitem>
+ </itemizedlist>
+ </section>
+ <section id="sect-Samba_Daemons_and_Related_Services">
+ <title>Samba Daemons and Related Services</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>daemon</secondary>
+ <tertiary>overview</tertiary>
+ </indexterm>
+ <para>
+ Samba is comprised of three daemons (<systemitem class="daemon">smbd</systemitem>, <systemitem class="daemon">nmbd</systemitem>, and <systemitem class="daemon">winbindd</systemitem>). Three services (<systemitem class="service">smb</systemitem>, <systemitem class="service">nmb</systemitem>, and <systemitem class="service">winbind</systemitem>) control how the daemons are started, stopped, and other service-related features. These services act as different init scripts. Each daemon is listed in detail below, as well as which specific service has control over it.
+ </para>
+ <bridgehead id="brid-Samba-Daemons-smbd" renderas="sect3">smbd</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>daemon</secondary>
+ <tertiary>smbd</tertiary>
+ </indexterm>
+ <para>
+ The <systemitem class="daemon">smbd</systemitem> server daemon provides file sharing and printing services to Windows clients. In addition, it is responsible for user authentication, resource locking, and data sharing through the <systemitem class="protocol">SMB</systemitem> protocol. The default ports on which the server listens for <systemitem class="protocol">SMB</systemitem> traffic are <systemitem class="protocol">TCP</systemitem> ports <constant>139</constant> and <constant>445</constant>.
+ </para>
+ <para>
+ The <systemitem class="daemon">smbd</systemitem> daemon is controlled by the <systemitem>smb</systemitem> service.
+ </para>
+ <bridgehead id="brid-Samba-Daemons-nmbd" renderas="sect3">nmbd</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>daemon</secondary>
+ <tertiary>nmbd</tertiary>
+ </indexterm>
+ <para>
+ The <systemitem class="daemon">nmbd</systemitem> server daemon understands and replies to NetBIOS name service requests such as those produced by SMB/CIFS in Windows-based systems. These systems include Windows 95/98/ME, Windows NT, Windows 2000, Windows XP, and LanManager clients. It also participates in the browsing protocols that make up the Windows <guilabel>Network Neighborhood</guilabel> view. The default port that the server listens to for <systemitem class="protocol">NMB</systemitem> traffic is <systemitem class="protocol">UDP</systemitem> port <systemitem class="constant">137</systemitem>.
+ </para>
+ <para>
+ The <systemitem class="daemon">nmbd</systemitem> daemon is controlled by the <systemitem>nmb</systemitem> service.
+ </para>
+ <bridgehead id="brid-Samba-Daemons-winbindd" renderas="sect3">winbindd</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>daemon</secondary>
+ <tertiary>winbindd</tertiary>
+ </indexterm>
+ <para>
+ The <systemitem class="daemon">winbind</systemitem> service resolves user and group information received from a server running Windows NT, 2000, 2003, Windows Server 2008, or Windows Server 2012. This makes Windows user and group information understandable by UNIX platforms. This is achieved by using Microsoft RPC calls, <firstterm>Pluggable Authentication Modules</firstterm> (PAM), and the <firstterm>Name Service Switch</firstterm> (NSS). This allows Windows NT domain and Active Directory users to appear and operate as UNIX users on a UNIX machine. Though bundled with the Samba distribution, the <systemitem>winbind</systemitem> service is controlled separately from the <systemitem>smb</systemitem> service.
+ </para>
+ <para>
+ The <systemitem class="daemon">winbind</systemitem> daemon is controlled by the <systemitem>winbind</systemitem> service and does not require the <systemitem>smb</systemitem> service to be started in order to operate. <systemitem class="daemon">winbind</systemitem> is also used when Samba is an Active Directory member, and may also be used on a Samba domain controller (to implement nested groups and interdomain trust). Because <systemitem>winbind</systemitem> is a client-side service used to connect to Windows NT-based servers, further discussion of <systemitem>winbind</systemitem> is beyond the scope of this chapter.
+ </para>
+ <note>
+ <title>Obtaining a list of utilities that are shipped with Samba</title>
+ <para>
+ See <xref linkend="sect-Samba_Distribution_Programs"/> for a list of utilities included in the Samba distribution.
+ </para>
+ </note>
+ </section>
+ <section id="sect-Samba-Connecting_to_a_Samba_Share">
+ <title>Connecting to a Samba Share</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>share</secondary>
+ <tertiary>connecting to with Nautilus</tertiary>
+ </indexterm>
+ <para>
+ You can use either <application>Nautilus</application> or command line to connect to available Samba shares.
+ </para>
+ <procedure id="proc-Samba-Connecting_to_a_Samba_Share_GUI">
+ <title>Connecting to a Samba Share Using Nautilus</title>
+ <step>
+ <para>
+ To view a list of Samba workgroups and domains on your network, select <menuchoice><guimenu>Places</guimenu> <guimenuitem>Network</guimenuitem></menuchoice> from the GNOME panel, and then select the desired network. Alternatively, type <userinput>smb:</userinput> in the <menuchoice><guimenu>File</guimenu> <guimenuitem>Open Location</guimenuitem></menuchoice> bar of <application>Nautilus</application>.
+ </para>
+ <para>
+ <!-- As shown in <xref linkend="fig-samba-nautilus-workgroups"/>,--> An icon appears for each available <systemitem class="protocol">SMB</systemitem> workgroup or domain on the network.
+ </para>
+ <figure float="0" id="fig-samba-nautilus-workgroups">
+ <title>SMB Workgroups in Nautilus</title>
+ <mediaobject>
+ <imageobject>
+ <imagedata fileref="images/samba-nautilus-domain.png" format="PNG" scalefit="1"/>
+ </imageobject>
+ <textobject>
+ <para>SMB Workgroups in Nautilus</para>
+ </textobject>
+ </mediaobject>
+ </figure>
+ </step>
+ <step>
+ <para>
+ Double-click one of the workgroup or domain icon to view a list of computers within the workgroup or domain.
+ </para>
+ <!-- <figure float="0" id="fig-samba-nautilus-machines">
+ <title>SMB Machines in Nautilus</title>
+ <mediaobject>
+ <imageobject>
+ <imagedata fileref="images/mthelena_host.png" format="PNG" scalefit="1"/>
+ </imageobject>
+ <textobject>
+ <para>SMB Machines in Nautilus</para>
+ </textobject>
+ </mediaobject>
+ </figure> -->
+ </step>
+ <step>
+ <para>
+ <!-- As displayed in <xref linkend="fig-samba-nautilus-machines"/>, --> An icon exists for each machine within the workgroup. Double-click on an icon to view the Samba shares on the machine. If a user name and password combination is required, you are prompted for them.
+ </para>
+ <para>
+ Alternately, you can also specify the Samba server and sharename in the <guilabel>Location:</guilabel> bar for <application>Nautilus</application> using the following syntax (replace <replaceable>servername</replaceable> and <replaceable>sharename</replaceable> with the appropriate values):
+ </para>
+ <synopsis><command>smb://<replaceable>servername</replaceable>/<replaceable>sharename</replaceable></command></synopsis>
+ </step>
+ </procedure>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>share</secondary>
+ <tertiary>connecting to via the command line</tertiary>
+ </indexterm>
+ <!-- Hiding this section due to: https://bugzilla.redhat.com/show_bug.cgi?id=1052228#c8
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary><command>findsmb</command></secondary>
+ </indexterm>
+ <indexterm>
+ <primary><command>findsmb</command></primary>
+ </indexterm> -->
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary><command>smbclient</command></secondary>
+ </indexterm>
+ <indexterm>
+ <primary><command>smbclient</command></primary>
+ </indexterm>
+ <procedure id="proc-Samba-Connecting_to_a_Samba_Share_CLI">
+ <title>Connecting to a Samba Share Using the Command Line</title>
+ <!-- Hiding this section due to: https://bugzilla.redhat.com/show_bug.cgi?id=1052228#c8
+ <step>
+ <para>
+ To query the network for Samba servers, use the <command>findsmb</command> command. For each server found, it displays its <systemitem class="protocol">IP</systemitem> address, NetBIOS name, workgroup name, operating system, and <systemitem class="protocol">SMB</systemitem> server version:
+ </para>
+ <synopsis>~]$ <command>findsmb</command></synopsis>
+ </step> -->
+ <step>
+ <para>
+ To connect to a Samba share from a shell prompt, type the following command:
+ </para>
+ <synopsis><command>~]$ smbclient //<replaceable>hostname</replaceable>/<replaceable>sharename</replaceable> -U <replaceable>username</replaceable></command></synopsis>
+ <para>
+ Replace <replaceable>hostname</replaceable> with the host name or <systemitem class="protocol">IP</systemitem> address of the Samba server you want to connect to, <replaceable>sharename</replaceable> with the name of the shared directory you want to browse, and <replaceable>username</replaceable> with the Samba user name for the system. Enter the correct password or press <keycap>Enter</keycap> if no password is required for the user.
+ </para>
+ <para>
+ If you see the <prompt>smb:\></prompt> prompt, you have successfully logged in. Once you are logged in, type <userinput>help</userinput> for a list of commands. If you want to browse the contents of your home directory, replace <replaceable>sharename</replaceable> with your user name. If the <command>-U</command> switch is not used, the user name of the current user is passed to the Samba server.
+ </para>
+ </step>
+ <step>
+ <para>
+ To exit <command>smbclient</command>, type <userinput>exit</userinput> at the <prompt>smb:\></prompt> prompt.
+ </para>
+ </step>
+ </procedure>
+ </section>
+ <section id="sect-Mounting_the_Samba_Share">
+ <title>Mounting the Share</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>share</secondary>
+ <tertiary>mounting</tertiary>
+ </indexterm>
+ <para>
+ Sometimes it is useful to mount a Samba share to a directory so that the files in the directory can be treated as if they are part of the local file system.
+ </para>
+ <para>
+ To mount a Samba share to a directory, create a directory to mount it to (if it does not already exist), and execute the following command as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen><command>mount -t cifs //<replaceable>servername</replaceable>/<replaceable>sharename</replaceable> <replaceable>/mnt/point/</replaceable> -o username=<replaceable>username</replaceable>,password=<replaceable>password</replaceable></command></screen>
+ <para>
+ This command mounts <replaceable>sharename</replaceable> from <replaceable>servername</replaceable> in the local directory <replaceable>/mnt/point/</replaceable>.
+ </para>
+ <para>
+ For more information about mounting a samba share, see the <citerefentry><refentrytitle>mount.cifs</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page.
+ </para>
+ <note>
+ <title>Installing cifs-utils package</title>
+ <para>
+ The <application>mount.cifs</application> utility is a separate RPM (independent from Samba). In order to use <application>mount.cifs</application>, first ensure the <package>cifs-utils</package> package is installed on your system by running, as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>dnf install cifs-utils</command></screen>
+ <para>
+ For more information on installing packages with DNF, see <xref linkend="sec-Installing"/>.
+ </para>
+ <para>
+ Note that the <package>cifs-utils</package> package also contains the <application>cifs.upcall</application> binary called by the kernel in order to perform kerberized CIFS mounts. For more information on <application>cifs.upcall</application>, see the <citerefentry><refentrytitle>cifs.upcall</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page.
+ </para>
+ </note>
+ <warning>
+ <title>CIFS servers that require plain text passwords</title>
+ <para>
+ Some CIFS servers require plain text passwords for authentication. Support for plain text password authentication can be enabled using the following command as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>echo 0x37 > /proc/fs/cifs/SecurityFlags</command></screen>
+ <para>
+ WARNING: This operation can expose passwords by removing password encryption.
+ </para>
+ </warning>
+ </section>
+ <section id="sect-Samba-Configuring_a_Samba_Server">
+ <title>Configuring a Samba Server</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>configuration</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>configuration</secondary>
+ <tertiary>default</tertiary>
+ </indexterm>
+ <para>
+ The default configuration file (<filename>/etc/samba/smb.conf</filename>) allows users to view their home directories as a Samba share. It also shares all printers configured for the system as Samba shared printers. You can attach a printer to the system and print to it from the Windows machines on your network.
+ </para>
+ <section id="sect-Samba-GUI_Configuration">
+ <title>Graphical Configuration</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>graphical configuration</secondary>
+ </indexterm>
+ <para>
+ To configure Samba using a graphical interface, use one of the available Samba graphical user interfaces. A list of available GUIs can be found at <ulink url="http://www.samba.org/samba/GUI/">http://www.samba.org/samba/GUI/</ulink>.
+ </para>
+ </section>
+ <section id="sect-Samba-Command-Line-Configuration">
+ <title>Command-Line Configuration</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>configuration</secondary>
+ </indexterm>
+ <para>
+ Samba uses <filename>/etc/samba/smb.conf</filename> as its configuration file. If you change this configuration file, the changes do not take effect until you restart the Samba daemon with the following command, as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>systemctl restart smb.service</command></screen>
+ <para>
+ To specify the Windows workgroup and a brief description of the Samba server, edit the following lines in your <filename>/etc/samba/smb.conf</filename> file:
+ </para>
+<screen>
+workgroup = <replaceable>WORKGROUPNAME</replaceable>
+server string = <replaceable>BRIEF COMMENT ABOUT SERVER</replaceable></screen>
+ <para>
+ Replace <replaceable>WORKGROUPNAME</replaceable> with the name of the Windows workgroup to which this machine should belong. The <replaceable>BRIEF COMMENT ABOUT SERVER</replaceable> is optional and is used as the Windows comment about the Samba system.
+ </para>
+ <para>
+ To create a Samba share directory on your Linux system, add the following section to your <filename>/etc/samba/smb.conf</filename> file (after modifying it to reflect your needs and your system):
+ </para>
+ <example id="exam-Samba-Configuring_Samba_Server">
+ <title>An Example Configuration of a Samba Server</title>
+<screen>
+[<replaceable>sharename</replaceable>]
comment = <replaceable>Insert a comment here</replaceable>
path = <replaceable>/home/share/</replaceable>
valid users = <replaceable>tfox carole</replaceable>
-public = no
writable = yes
-printable = no
-create mask = 0765</programlisting>
- <para>The above example allows the users <command>tfox</command> and <command>carole</command> to read and write to the directory <filename>/home/share</filename>, on the Samba server, from a Samba client.</para>
- </section>
- <section
- id="s3-samba-encrypted-passwords">
- <title>Encrypted Passwords</title>
- <para>Encrypted passwords are enabled by default because it is more secure to use them. To create a user with an encrypted password, use the command <command>smbpasswd -a <replaceable>username</replaceable></command>.</para>
- <indexterm>
- <primary>Samba</primary>
- <secondary>with Windows NT 4.0, 2000, ME, and XP</secondary>
- </indexterm>
- <indexterm>
- <primary>Windows NT 4.0</primary>
- <secondary>connecting to shares using Samba</secondary>
- </indexterm>
- <indexterm>
- <primary>Windows 98</primary>
- <secondary>connecting to shares using Samba</secondary>
- </indexterm>
- <indexterm>
- <primary>Windows 2000</primary>
- <secondary>connecting to shares using Samba</secondary>
- </indexterm>
- <indexterm>
- <primary>Windows ME</primary>
- <secondary>connecting to shares using Samba</secondary>
- </indexterm>
- <indexterm>
- <primary>Windows XP</primary>
- <secondary>connecting to shares using Samba</secondary>
- </indexterm>
-
- <indexterm>
- <primary>Samba</primary>
- <secondary>encrypted passwords</secondary>
- </indexterm>
- </section>
- </section>
- <section
- id="s2-samba-startstop">
- <title>Starting and Stopping Samba</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>service</secondary>
- <tertiary>starting</tertiary>
- </indexterm>
- <indexterm>
- <primary>Samba</primary>
- <secondary>service</secondary>
- <tertiary>stopping</tertiary>
- </indexterm>
- <indexterm>
- <primary>Samba</primary>
- <secondary>service</secondary>
- <tertiary>restarting</tertiary>
- </indexterm>
- <indexterm>
- <primary>Samba</primary>
- <secondary>service</secondary>
- <tertiary>conditional restarting</tertiary>
- </indexterm>
- <indexterm>
- <primary>Samba</primary>
- <secondary>service</secondary>
- <tertiary>reloading</tertiary>
- </indexterm>
- <para>To start a Samba server, type the following command in a shell prompt, as <systemitem class="username">root</systemitem>:</para>
-<screen>~]# <command>systemctl start smb.service</command></screen>
- <important>
- <title>Setting up a domain member server</title>
- <para>To set up a domain member server, you must first join the domain or Active Directory using the <command>net join</command> command <emphasis>before</emphasis> starting the <command>smb</command> service. Also, it is recommended to run <systemitem class="daemon">winbind</systemitem> before <systemitem class="daemon">smbd</systemitem>.</para>
- </important>
- <para>To stop the server, type the following command in a shell prompt, as <systemitem class="username">root</systemitem>:</para>
- <screen>~]# <command>systemctl stop smb.service</command></screen>
- <para>The <option>restart</option> option is a quick way of stopping and then starting Samba. This is the most reliable way to make configuration changes take effect after editing the configuration file for Samba. Note that the restart option starts the daemon even if it was not running originally.</para>
- <para>To restart the server, type the following command in a shell prompt, as <systemitem class="username">root</systemitem>:</para>
- <screen>~]# <command>systemctl restart smb.service</command></screen>
- <para>The <option>condrestart</option> (<firstterm>conditional restart</firstterm>) option only starts <command>smb</command> on the condition that it is currently running. This option is useful for scripts, because it does not start the daemon if it is not running.</para>
- <note>
- <title>Applying the changes to the configuration</title>
- <para>When the <filename>/etc/samba/smb.conf</filename> file is changed, Samba automatically reloads it after a few minutes. Issuing a manual <command>restart</command> or <command>reload</command> is just as effective.</para>
- </note>
- <para>To conditionally restart the server, type the following command, as <systemitem class="username">root</systemitem>:</para>
- <screen>~]# <command>systemctl condrestart smb.service</command></screen>
- <para>A manual reload of the <filename>/etc/samba/smb.conf</filename> file can be useful in case of a failed automatic reload by the <command>smb</command> service. To ensure that the Samba server configuration file is reloaded without restarting the service, type the following command, as <systemitem class="username">root</systemitem>:</para>
- <screen>~]# <command>systemctl reload smb.service</command></screen>
- <para>By default, the <command>smb</command> service does <emphasis>not</emphasis> start automatically at boot time. To configure Samba to start at boot time, type the following at a shell prompt as <systemitem class="username">root</systemitem>:</para>
- <screen>~]# <command>systemctl enable smb.service</command></screen>
-<para>See <xref linkend="ch-Services_and_Daemons" /> for more information regarding this tool.</para>
- </section>
- <section
- id="s2-samba-servers">
- <title>Samba Server Types and the <filename>smb.conf</filename> File</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>smb.conf</secondary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Server Types</secondary>
- </indexterm>
- <para>Samba configuration is straightforward. All modifications to Samba are done in the <filename>/etc/samba/smb.conf</filename> configuration file. Although the default <filename>smb.conf</filename> file is well documented, it does not address complex topics such as LDAP, Active Directory, and the numerous domain controller implementations.</para>
- <para>The following sections describe the different ways a Samba server can be configured. Keep in mind your needs and the changes required to the <filename>/etc/samba/smb.conf</filename> file for a successful configuration.</para>
- <section
- id="s3-samba-standalone">
- <title>Stand-alone Server</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>server types</secondary>
- <tertiary>Stand Alone</tertiary>
- </indexterm>
- <para>A stand-alone server can be a workgroup server or a member of a workgroup environment. A stand-alone server is not a domain controller and does not participate in a domain in any way. The following examples include several anonymous share-level security configurations and one user-level security configuration. For more information on share-level and user-level security modes, refer to <xref
- linkend="s2-samba-security-modes"/>.</para>
- <section
- id="s4-samba-standalone-anonreadonly">
- <title>Anonymous Read-Only</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>smb.conf</secondary>
- <tertiary>Anonymous Read Only example</tertiary>
- </indexterm>
- <para>The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement anonymous read-only file sharing. The <command>security = share</command> parameter makes a share anonymous. Note, security levels for a single Samba server cannot be mixed. The <command>security</command> directive is a global Samba parameter located in the <command>[global]</command> configuration section of the <filename>/etc/samba/smb.conf</filename> file.</para>
- <programlisting>[global]
+create mask = 0765</screen>
+ </example>
+ <para>
+ The above example allows the users <command>tfox</command> and <command>carole</command> to read and write to the directory <filename class="directory">/home/share/</filename>, on the Samba server, from a Samba client.
+ </para>
+ </section>
+ <section id="sect-Samba-Encrypted_Passwords">
+ <title>Encrypted Passwords</title>
+ <para>
+ Encrypted passwords are enabled by default because it is more secure to use them. To create a user with an encrypted password, use the <systemitem>smbpasswd</systemitem> utility:
+ </para>
+ <synopsis><command>smbpasswd -a <replaceable>username</replaceable></command></synopsis>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>with Windows NT 4.0, 2000, ME, and XP</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Windows NT 4.0</primary>
+ <secondary>connecting to shares using Samba</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Windows 98</primary>
+ <secondary>connecting to shares using Samba</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Windows 2000</primary>
+ <secondary>connecting to shares using Samba</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Windows ME</primary>
+ <secondary>connecting to shares using Samba</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Windows XP</primary>
+ <secondary>connecting to shares using Samba</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>encrypted passwords</secondary>
+ </indexterm>
+ </section>
+ </section>
+ <section id="sect-Samba-Starting_and_Stopping">
+ <title>Starting and Stopping Samba</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>service</secondary>
+ <tertiary>starting</tertiary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>service</secondary>
+ <tertiary>stopping</tertiary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>service</secondary>
+ <tertiary>restarting</tertiary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>service</secondary>
+ <tertiary>conditional restarting</tertiary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>service</secondary>
+ <tertiary>reloading</tertiary>
+ </indexterm>
+ <para>
+ To start a Samba server, type the following command in a shell prompt, as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>systemctl start smb.service</command></screen>
+ <important>
+ <title>Setting up a domain member server</title>
+ <para>
+ To set up a domain member server, you must first join the domain or Active Directory using the <command>net join</command> command <emphasis>before</emphasis> starting the <systemitem class="service">smb</systemitem> service. Also, it is recommended to run <systemitem class="daemon">winbind</systemitem> before <systemitem class="daemon">smbd</systemitem>.
+ </para>
+ </important>
+ <para>
+ To stop the server, type the following command in a shell prompt, as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>systemctl stop smb.service</command></screen>
+ <para>
+ The <option>restart</option> option is a quick way of stopping and then starting Samba. This is the most reliable way to make configuration changes take effect after editing the configuration file for Samba. Note that the restart option starts the daemon even if it was not running originally.
+ </para>
+ <para>
+ To restart the server, type the following command in a shell prompt, as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>systemctl restart smb.service</command></screen>
+ <para>
+ The <option>condrestart</option> (<firstterm>conditional restart</firstterm>) option only starts <systemitem class="service">smb</systemitem> on the condition that it is currently running. This option is useful for scripts, because it does not start the daemon if it is not running.
+ </para>
+ <note>
+ <title>Applying the changes to the configuration</title>
+ <para>
+ When the <filename>/etc/samba/smb.conf</filename> file is changed, Samba automatically reloads it after a few minutes. Issuing a manual <command>restart</command> or <command>reload</command> is just as effective.
+ </para>
+ </note>
+ <para>
+ To conditionally restart the server, type the following command, as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>systemctl try-restart smb.service</command></screen>
+ <para>
+ A manual reload of the <filename>/etc/samba/smb.conf</filename> file can be useful in case of a failed automatic reload by the <systemitem class="service">smb</systemitem> service. To ensure that the Samba server configuration file is reloaded without restarting the service, type the following command, as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>systemctl reload smb.service</command></screen>
+ <para>
+ By default, the <systemitem class="service">smb</systemitem> service does <emphasis>not</emphasis> start automatically at boot time. To configure Samba to start at boot time, type the following at a shell prompt as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>systemctl enable smb.service</command></screen>
+ <para>
+ See <xref linkend="ch-Services_and_Daemons" /> for more information regarding this tool.
+ </para>
+ </section>
+ <section id="sect-Samba-Server_Types_and_the_smb.conf_File">
+ <title>Samba Server Types and the <filename>smb.conf</filename> File</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>smb.conf</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Server Types</secondary>
+ </indexterm>
+ <para>
+ Samba configuration is straightforward. All modifications to Samba are done in the <filename>/etc/samba/smb.conf</filename> configuration file. Although the default <filename>smb.conf</filename> file is well documented, it does not address complex topics such as LDAP, Active Directory, and the numerous domain controller implementations.
+ </para>
+ <para>
+ The following sections describe the different ways a Samba server can be configured. Keep in mind your needs and the changes required to the <filename>/etc/samba/smb.conf</filename> file for a successful configuration.
+ </para>
+ <section id="sect-Samba-Standalone_Server">
+ <title>Stand-alone Server</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>server types</secondary>
+ <tertiary>Stand Alone</tertiary>
+ </indexterm>
+ <para>
+ A stand-alone server can be a workgroup server or a member of a workgroup environment. A stand-alone server is not a domain controller and does not participate in a domain in any way. The following examples include several user-level security configurations. For more information on security modes, see <xref linkend="sect-Samba-Security_Modes"/>.
+ </para>
+ <bridgehead id="brid-Samba-Standalone_Anonymous_Read-Only_Server" renderas="sect3">Anonymous Read-Only</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>smb.conf</secondary>
+ <tertiary>Anonymous Read Only example</tertiary>
+ </indexterm>
+ <para>
+ The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement anonymous read-only file sharing. Two directives are used to configure anonymous access – <parameter>map to guest = Bad user</parameter> and <parameter>guest account = nobody</parameter>.
+ </para>
+ <example id="exam-Samba-Standalone_Anonymous_Read-Only_Server">
+ <title>An Example Configuration of a Anonymous Read-Only Samba Server</title>
+<screen>[global]
workgroup = DOCS
netbios name = DOCS_SRV
-security = share
+security = user
+guest account = nobody # default value
+map to guest = Bad user
+
[data]
comment = Documentation Samba Server
path = /export
-read only = Yes
-guest only = Yes</programlisting>
- </section>
- <section
- id="s4-samba-standalone-anonreadwrite">
- <title>Anonymous Read/Write</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>smb.conf</secondary>
- <tertiary>Anonymous Read/Write example</tertiary>
- </indexterm>
- <para>The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement anonymous read/write file sharing. To enable anonymous read/write file sharing, set the <command>read only</command> directive to <command>no</command>. The <command>force user</command> and <command>force group</command> directives are also added to enforce the ownership of any newly placed files specified in the share.</para>
- <note>
- <title>Do not use anonymous read/write servers</title>
- <para>Although having an anonymous read/write server is possible, it is not recommended. Any files placed in the share space, regardless of user, are assigned the user/group combination as specified by a generic user (<command>force user</command>) and group (<command>force group</command>) in the <filename>/etc/samba/smb.conf</filename> file.</para>
- </note>
- <programlisting>[global]
+read only = yes
+guest ok = yes</screen>
+ </example>
+ <bridgehead id="brid-Samba-Standalone_Anonymous_Read-Write-Server" renderas="sect3">Anonymous Read/Write</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>smb.conf</secondary>
+ <tertiary>Anonymous Read/Write example</tertiary>
+ </indexterm>
+ <para>
+ The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement anonymous read/write file sharing. To enable anonymous read/write file sharing, set the <parameter>read only</parameter> directive to <literal>no</literal>. The <parameter>force user</parameter> and <parameter>force group</parameter> directives are also added to enforce the ownership of any newly placed files specified in the share.
+ </para>
+ <note>
+ <title>Do not use anonymous read/write servers</title>
+ <para>
+ Although having an anonymous read/write server is possible, it is not recommended. Any files placed in the share space, regardless of user, are assigned the user/group combination as specified by a generic user (<parameter>force user</parameter>) and group (<parameter>force group</parameter>) in the <filename>/etc/samba/smb.conf</filename> file.
+ </para>
+ </note>
+ <example id="exam-Samba-Standalone_Anonymous_Read-Write-Server">
+ <title>An Example Configuration of a Anonymous Read/Write Samba Server</title>
+ <screen>
+[global]
workgroup = DOCS
-netbios name = DOCS_SRV
-security = share
+security = user
+guest account = nobody # default value
+map to guest = Bad user
+
[data]
comment = Data
path = /export
-force user = docsbot
-force group = users
-read only = No
-guest ok = Yes</programlisting>
- </section>
- <section
- id="s4-samba-standalone-anonprint">
- <title>Anonymous Print Server</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>smb.conf</secondary>
- <tertiary>Anonymous Print Server example</tertiary>
- </indexterm>
- <para>The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement an anonymous print server. Setting <command>browseable</command> to <command>no</command> as shown does not list the printer in Windows <guilabel>Network Neighborhood</guilabel>. Although hidden from browsing, configuring the printer explicitly is possible. By connecting to <command>DOCS_SRV</command> using NetBIOS, the client can have access to the printer if the client is also part of the <command>DOCS</command> workgroup. It is also assumed that the client has the correct local printer driver installed, as the <command>use client driver</command> directive is set to <command>Yes</command>. In this case, the Samba server has no responsibility for sharing printer drivers to the client.</para>
- <programlisting>[global]
+guest ok = yes
+writeable = yes
+force user = user
+force group = group</screen>
+ </example>
+ <bridgehead id="brid-Samba-Standalone_Anonymous_Print-Server" renderas="sect3">Anonymous Print Server</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>smb.conf</secondary>
+ <tertiary>Anonymous Print Server example</tertiary>
+ </indexterm>
+ <para>
+ The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement an anonymous print server. Setting <parameter>browseable</parameter> to <literal>no</literal> as shown does not list the printer in Windows <guilabel>Network Neighborhood</guilabel>. Although hidden from browsing, configuring the printer explicitly is possible. By connecting to <literal>DOCS_SRV</literal> using NetBIOS, the client can have access to the printer if the client is also part of the <literal>DOCS</literal> workgroup. It is also assumed that the client has the correct local printer driver installed, as the <parameter>use client driver</parameter> directive is set to <literal>yes</literal>. In this case, the Samba server has no responsibility for sharing printer drivers to the client.
+ </para>
+ <example id="exam-Samba-Standalone_Anonymous_Print-Server">
+ <title>An Example Configuration of a Anonymous Print Samba Server</title>
+ <screen>
+[global]
workgroup = DOCS
netbios name = DOCS_SRV
-security = share
-printcap name = cups
-disable spools= Yes
-show add printer wizard = No
+security = user
+map to guest = Bad user
printing = cups
+
[printers]
comment = All Printers
path = /var/spool/samba
-guest ok = Yes
-printable = Yes
-use client driver = Yes
-browseable = Yes</programlisting>
- </section>
- <section
- id="s4-samba-standalone-readwriteall">
- <title>Secure Read/Write File and Print Server</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>smb.conf</secondary>
- <tertiary>Secure File and Print Server example</tertiary>
- </indexterm>
- <para>The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement a secure read/write print server. Setting the <command>security</command> directive to <command>user</command> forces Samba to authenticate client connections. Notice the <command>[homes]</command> share does not have a <command>force user</command> or <command>force group</command> directive as the <command>[public]</command> share does. The <command>[homes]</command> share uses the authenticated user details for any files created as opposed to the <command>force user</command> and <command>force group</command> in <command>[public]</command>.</para>
- <programlisting>[global]
+guest ok = yes
+printable = yes
+use client driver = yes
+browseable = yes</screen>
+ </example>
+ <bridgehead id="brid-Samba-Standalone_Secure_Read_Write_File_and_Print_Server" renderas="sect3">Secure Read/Write File and Print Server</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>smb.conf</secondary>
+ <tertiary>Secure File and Print Server example</tertiary>
+ </indexterm>
+ <para>
+ The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement a secure read/write file and print server. Setting the <parameter>security</parameter> directive to <literal>user</literal> forces Samba to authenticate client connections. Notice the <literal>[homes]</literal> share does not have a <parameter>force user</parameter> or <parameter>force group</parameter> directive as the <literal>[public]</literal> share does. The <literal>[homes]</literal> share uses the authenticated user details for any files created as opposed to the <parameter>force user</parameter> and <parameter>force group</parameter> in <literal>[public]</literal>.
+ </para>
+ <example id="exam-Samba-Standalone_Secure_Read_Write_File_and_Print_Server">
+ <title>An Example Configuration of a Secure Read/Write File and Print Samba Server</title>
+ <screen>
+[global]
workgroup = DOCS
netbios name = DOCS_SRV
security = user
printcap name = cups
-disable spools = Yes
-show add printer wizard = No
+disable spools = yes
+show add printer wizard = no
printing = cups
+
[homes]
comment = Home Directories
valid users = %S
-read only = No
-browseable = No
+read only = no
+browseable = no
+
[public]
comment = Data
path = /export
force user = docsbot
force group = users
-guest ok = Yes
+guest ok = yes
+
[printers]
comment = All Printers
path = /var/spool/samba
printer admin = john, ed, @admins
create mask = 0600
-guest ok = Yes
-printable = Yes
-use client driver = Yes
-browseable = Yes</programlisting>
- </section>
- </section>
- <section
- id="s3-samba-domain-member">
- <title>Domain Member Server</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>server types</secondary>
- <tertiary>Domain Member</tertiary>
- </indexterm>
- <para>A domain member, while similar to a stand-alone server, is logged into a domain controller (either Windows or Samba) and is subject to the domain's security rules. An example of a domain member server would be a departmental server running Samba that has a machine account on the Primary Domain Controller (PDC). All of the department's clients still authenticate with the PDC, and desktop profiles and all network policy files are included. The difference is that the departmental server has the ability to control printer and network shares.</para>
- <section
- id="s4-samba-domain-member-ads">
- <title>Active Directory Domain Member Server</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>smb.conf</secondary>
- <tertiary>Active Directory Member Server example</tertiary>
- </indexterm>
- <para>The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement an Active Directory domain member server. In this example, Samba authenticates users for services being run locally but is also a client of the Active Directory. Ensure that your kerberos <command>realm</command> parameter is shown in all caps (for example <command>realm = EXAMPLE.COM</command>). Since Windows 2000/2003/2008 requires Kerberos for Active Directory authentication, the <command>realm</command> directive is required. If Active Directory and Kerberos are running on different servers, the <command>password server</command> directive may be required to help the distinction.</para>
- <programlisting>[global]
+guest ok = yes
+printable = yes
+use client driver = yes
+browseable = yes</screen>
+ </example>
+ </section>
+ <section id="sect-Samba-Domain_Member_Server">
+ <title>Domain Member Server</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>server types</secondary>
+ <tertiary>Domain Member</tertiary>
+ </indexterm>
+ <para>
+ A domain member, while similar to a stand-alone server, is logged into a domain controller (either Windows or Samba) and is subject to the domain's security rules. An example of a domain member server would be a departmental server running Samba that has a machine account on the Primary Domain Controller (PDC). All of the department's clients still authenticate with the PDC, and desktop profiles and all network policy files are included. The difference is that the departmental server has the ability to control printer and network shares.
+ </para>
+ <bridgehead id="brid-Samba_Domain_Member_Server-Active_Directory_Domain_Member_Sever" renderas="sect3">Active Directory Domain Member Server</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>smb.conf</secondary>
+ <tertiary>Active Directory Member Server example</tertiary>
+ </indexterm>
+ <para>
+ To implement an Active Directory domain member server, follow procedure below:
+ </para>
+ <procedure id="proc-Samba-Adding_an_AD_Member">
+ <title>Adding a Member Server to an Active Directory Domain</title>
+ <step>
+ <para>
+ Create the <filename>/etc/samba/smb.conf</filename> configuration file on a member server to be added to the Active Directory domain. Add the following lines to the configuration file:
+ </para>
+ <screen>
+[global]
realm = EXAMPLE.COM
security = ADS
encrypt passwords = yes
# Optional. Use only if Samba cannot determine the Kerberos server automatically.
-password server = kerberos.example.com</programlisting>
- <para>In order to join a member server to an Active Directory domain, the following steps must be completed:</para>
- <itemizedlist>
- <listitem>
- <para>Configuration of the <filename>/etc/samba/smb.conf</filename> file on the member server</para>
- </listitem>
- <listitem>
- <para>Configuration of Kerberos, including the <filename>/etc/krb5.conf</filename> file, on the member server</para>
- </listitem>
- <listitem>
- <para>Creation of the machine account on the Active Directory domain server</para>
- </listitem>
- <listitem>
- <para>Association of the member server to the Active Directory domain</para>
- </listitem>
- </itemizedlist>
- <para>To create the machine account and join the Windows 2000/2003/2008 Active Directory, Kerberos must first be initialized for the member server wishing to join the Active Directory domain. To create an administrative Kerberos ticket, type the following command as <systemitem class="username">root</systemitem> on the member server:</para>
- <screen><command>kinit administrator(a)EXAMPLE.COM</command></screen>
- <para>
- The <command>kinit</command> command is a Kerberos initialization script that references the Active Directory administrator account and Kerberos realm. Since Active Directory requires Kerberos tickets, <command>kinit</command> obtains and caches a Kerberos ticket-granting ticket for client/server authentication.</para> <!-- TBD6: link to the Smart Cards Guide -->
- <para>To join an Active Directory server (windows1.example.com), type the following command as <systemitem class="username">root</systemitem> on the member server:</para>
- <screen><command>net ads join -S windows1.example.com -U administrator%password</command></screen>
- <para>Since the machine <command>windows1</command> was automatically found in the corresponding Kerberos realm (the <command>kinit</command> command succeeded), the <command>net</command> command connects to the Active Directory server using its required administrator account and password. This creates the appropriate machine account on the Active Directory and grants permissions to the Samba domain member server to join the domain.</para>
- <note>
- <title>The security option</title>
- <para>Since <command>security = ads</command> and not <command>security = user</command> is used, a local password back end such as <filename>smbpasswd</filename> is not needed. Older clients that do not support <command>security = ads</command> are authenticated as if <command>security = domain</command> had been set. This change does not affect functionality and allows local users not previously in the domain.</para>
- </note>
- </section>
- <section
- id="s4-samba-domain-member-nt4">
- <title>Windows NT4-based Domain Member Server</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>smb.conf</secondary>
- <tertiary>NT4-style Domain Member example</tertiary>
- </indexterm>
- <para>The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement a Windows NT4-based domain member server. Becoming a member server of an NT4-based domain is similar to connecting to an Active Directory. The main difference is NT4-based domains do not use Kerberos in their authentication method, making the <filename>/etc/samba/smb.conf</filename> file simpler. In this instance, the Samba member server functions as a pass through to the NT4-based domain server.</para>
- <programlisting>[global]
+password server = kerberos.example.com</screen>
+ <para>
+ With the above configuration, Samba authenticates users for services being run locally but is also a client of the Active Directory. Ensure that your kerberos <parameter>realm</parameter> parameter is shown in all caps (for example <literal>realm = EXAMPLE.COM</literal>). Since Windows 2000/2003/2008 requires Kerberos for Active Directory authentication, the <parameter>realm</parameter> directive is required. If Active Directory and Kerberos are running on different servers, the <parameter>password server</parameter> directive is required to help the distinction.
+ </para>
+ </step>
+ <step>
+ <para>
+ Configure Kerberos on the member server. Create the <filename>/etc/krb5.conf</filename> configuration file with the following content:
+ </para>
+ <screen>
+[logging]
+ default = FILE:/var/log/krb5libs.log
+
+[libdefaults]
+ default_realm = AD.EXAMPLE.COM
+ dns_lookup_realm = true
+ dns_lookup_kdc = true
+ ticket_lifetime = 24h
+ renew_lifetime = 7d
+ rdns = false
+ forwardable = false
+
+[realms]
+# Define only if DNS lookups are not working
+# AD.EXAMPLE.COM = {
+# kdc = server.ad.example.com
+# admin_server = server.ad.example.com
+# master_kdc = server.ad.example.com
+# }
+
+[domain_realm]
+# Define only if DNS lookups are not working
+# .ad.example.com = AD.EXAMPLE.COM
+# ad.example.com = AD.EXAMPLE.COM</screen>
+ <para>
+ Uncomment the <literal>[realms]</literal> and <literal>[domain_realm]</literal> sections if DNS lookups are not working.
+ </para>
+ <para>
+ For more information on Kerberos, and the <command>/etc/krb5.conf</command> file, see the <citetitle pubwork="section">Using Kerberos</citetitle> section of the <ulink url="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/...">&MAJOROSVER; <citetitle>Managing Single Sign-On and Smart Cards</citetitle></ulink>.
+ </para>
+ </step>
+ <step>
+ <para>
+ To join an Active Directory server, type the following command as <systemitem class="username">root</systemitem> on the member server:
+ </para>
+ <screen>~]# <command>net ads join -U administrator%<replaceable>password</replaceable></command></screen>
+ <para>
+ The <command>net</command> command authenticates as <systemitem class="username">Administrator</systemitem> using the NT LAN Manager (NTLM) protocol and creates the machine account. Then <command>net</command> uses the machine account credentials to authenticate with Kerberos.
+ </para>
+ <note>
+ <title>The security option</title>
+ <para>
+ Since <parameter>security = ads</parameter> and not <parameter>security = user</parameter> is used, a local password back end such as <systemitem>smbpasswd</systemitem> is not needed. Older clients that do not support <parameter>security = ads</parameter> are authenticated as if <parameter>security = domain</parameter> had been set. This change does not affect functionality and allows local users not previously in the domain.
+ </para>
+ </note>
+ </step>
+ </procedure>
+ <bridgehead id="brid-Samba-Domain_Member_Server-Windows_NT4-based_Domain_Memeber_Server" renderas="sect3">Windows NT4-based Domain Member Server</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>smb.conf</secondary>
+ <tertiary>NT4-style Domain Member example</tertiary>
+ </indexterm>
+ <para>
+ The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement a Windows NT4-based domain member server. Becoming a member server of an NT4-based domain is similar to connecting to an Active Directory. The main difference is NT4-based domains do not use Kerberos in their authentication method, making the <filename>/etc/samba/smb.conf</filename> file simpler. In this instance, the Samba member server functions as a pass through to the NT4-based domain server.
+ </para>
+ <example id="exam-Samba-Domain_Member_Server-Windows_NT4-based_Domain_Memeber_Server">
+ <title>An Example Configuration of Samba Windows NT4-based Domain Member Server</title>
+ <screen>
+[global]
workgroup = DOCS
netbios name = DOCS_SRV
security = domain
+
[homes]
comment = Home Directories
valid users = %S
-read only = No
-browseable = No
+read only = no
+browseable = no
+
[public]
comment = Data
path = /export
force user = docsbot
force group = users
-guest ok = Yes</programlisting>
- <para>Having Samba as a domain member server can be useful in many situations. There are times where the Samba server can have other uses besides file and printer sharing. It may be beneficial to make Samba a domain member server in instances where Linux-only applications are required for use in the domain environment. Administrators appreciate keeping track of all machines in the domain, even if not Windows-based. In the event the Windows-based server hardware is deprecated, it is quite easy to modify the <filename>/etc/samba/smb.conf</filename> file to convert the server to a Samba-based PDC. If Windows NT-based servers are upgraded to Windows 2000/2003/2008, the <filename>/etc/samba/smb.conf</filename> file is easily modifiable to incorporate the infrastructure change to Active Directory if needed.</para>
- <important>
- <title>Make sure you join the domain before starting Samba</title>
- <para>After configuring the <filename>/etc/samba/smb.conf</filename> file, join the domain <emphasis>before</emphasis> starting Samba by typing the following command as <systemitem class="username">root</systemitem>:</para>
- <screen><command>net rpc join -U administrator%password</command></screen>
- </important>
- <para>Note that the <option>-S</option> option, which specifies the domain server hostname, does not need to be stated in the <command>net rpc join</command> command. Samba uses the hostname specified by the <command>workgroup</command> directive in the <filename>/etc/samba/smb.conf</filename> file instead of it being stated explicitly.</para>
- </section>
- </section>
- <section
- id="s3-samba-domain-controller">
- <title>Domain Controller</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>server types</secondary>
- <tertiary>Domain Controller</tertiary>
- </indexterm>
- <para>A domain controller in Windows NT is functionally similar to a Network Information Service (NIS) server in a Linux environment. Domain controllers and NIS servers both host user/group information databases as well as related services. Domain controllers are mainly used for security, including the authentication of users accessing domain resources. The service that maintains the user/group database integrity is called the <firstterm>Security Account Manager</firstterm> (SAM). The SAM database is stored differently between Windows and Linux Samba-based systems, therefore SAM replication cannot be achieved and platforms cannot be mixed in a PDC/BDC environment.</para>
- <para>In a Samba environment, there can be only one PDC and zero or more BDCs.</para>
- <important>
- <title>A mixed Samba/Windows domain controller environment</title>
- <para>Samba cannot exist in a mixed Samba/Windows domain controller environment (Samba cannot be a BDC of a Windows PDC or vice versa). Alternatively, Samba PDCs and BDCs <emphasis>can</emphasis> coexist.</para>
- </important>
- <section
- id="s4-samba-pdc-tdbsam">
- <title>Primary Domain Controller (PDC) using <command>tdbsam</command>
- </title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>smb.conf</secondary>
- <tertiary>PDC using <command>tdbsam</command>
- </tertiary>
- </indexterm>
- <para>The simplest and most common implementation of a Samba PDC uses the new default <command>tdbsam</command> password database back end. Replacing the aging <command>smbpasswd</command> back end, <command>tdbsam</command> has numerous improvements that are explained in more detail in <xref
- linkend="s2-samba-account-info-dbs"/>. The <command>passdb backend</command> directive controls which back end is to be used for the PDC.</para>
- <para>The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement a <command>tdbsam</command> password database back end.
- </para>
- <programlisting>[global]
+guest ok = yes</screen>
+ </example>
+ <para>
+ Having Samba as a domain member server can be useful in many situations. There are times where the Samba server can have other uses besides file and printer sharing. It may be beneficial to make Samba a domain member server in instances where Linux-only applications are required for use in the domain environment. Administrators appreciate keeping track of all machines in the domain, even if not Windows-based. In the event the Windows-based server hardware is deprecated, it is quite easy to modify the <filename>/etc/samba/smb.conf</filename> file to convert the server to a Samba-based PDC. If Windows NT-based servers are upgraded to Windows 2000/2003/2008 the <filename>/etc/samba/smb.conf</filename> file is easily modifiable to incorporate the infrastructure change to Active Directory if needed.
+ </para>
+ <important>
+ <title>Make sure you join the domain before starting Samba</title>
+ <para>
+ After configuring the <filename>/etc/samba/smb.conf</filename> file, join the domain <emphasis>before</emphasis> starting Samba by typing the following command as <systemitem class="username">root</systemitem>:
+ </para>
+<screen>~]# <command>net rpc join -U administrator%password</command></screen>
+ </important>
+ <para>
+ Note that the <option>-S</option> option, which specifies the domain server host name, does not need to be stated in the <command>net rpc join</command> command. Samba uses the host name specified by the <parameter>workgroup</parameter> directive in the <filename>/etc/samba/smb.conf</filename> file instead of it being stated explicitly.
+ </para>
+ </section>
+ <section id="sect-Samba-Domain_Controller">
+ <title>Domain Controller</title>
+
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>server types</secondary>
+ <tertiary>Domain Controller</tertiary>
+ </indexterm>
+ <para>
+ A domain controller in Windows NT is functionally similar to a Network Information Service (NIS) server in a Linux environment. Domain controllers and NIS servers both host user and group information databases as well as related services. Domain controllers are mainly used for security, including the authentication of users accessing domain resources. The service that maintains the user and group database integrity is called the <firstterm>Security Account Manager</firstterm> (SAM). The SAM database is stored differently between Windows and Linux Samba-based systems, therefore SAM replication cannot be achieved and platforms cannot be mixed in a PDC/BDC environment.
+ </para>
+ <para>
+ In a Samba environment, there can be only one PDC and zero or more BDCs.
+ </para>
+ <important>
+ <title>A mixed Samba/Windows domain controller environment</title>
+ <para>
+ Samba cannot exist in a mixed Samba/Windows domain controller environment (Samba cannot be a BDC of a Windows PDC or vice versa). Alternatively, Samba PDCs and BDCs <emphasis>can</emphasis> coexist.
+ </para>
+ </important>
+ <bridgehead id="brid-Samba_Domain_Controller-PDC_Using_tdbsam" renderas="sect3">Primary Domain Controller (PDC) Using <systemitem>tdbsam</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>smb.conf</secondary>
+ <tertiary>PDC using <systemitem>tdbsam</systemitem></tertiary>
+ </indexterm>
+ <para>
+ The simplest and most common implementation of a Samba PDC uses the new default <systemitem>tdbsam</systemitem> password database back end. Replacing the aging <systemitem>smbpasswd</systemitem> back end, <systemitem>tdbsam</systemitem> has numerous improvements that are explained in more detail in <xref linkend="sect-Samba-Account_Information-Databases"/>. The <parameter>passdb backend</parameter> directive controls which back end is to be used for the PDC.
+ </para>
+ <para>
+ The following <filename>/etc/samba/smb.conf</filename> file shows a sample configuration needed to implement a <systemitem>tdbsam</systemitem> password database back end.
+ </para>
+ <example id="exam-Samba_Domain_Controller-PDC_Using_tdbsam">
+ <title>An Example Configuration of Primary Domain Controller (PDC) Using <systemitem>tdbsam</systemitem></title>
+ <screen>
+[global]
workgroup = DOCS
netbios name = DOCS_SRV
passdb backend = tdbsam
@@ -631,560 +803,481 @@ add machine script = /usr/sbin/useradd -s /bin/false -d /dev/null -g machines "
# This sets the default profile path.
# Set per user paths with pdbedit
logon drive = H:
-domain logons = Yes
+domain logons = yes
os level = 35
-preferred master = Yes
-domain master = Yes
+preferred master = yes
+domain master = yes
+
[homes]
comment = Home Directories
valid users = %S
- read only = No
+ read only = no
+
[netlogon]
comment = Network Logon Service
path = /var/lib/samba/netlogon/scripts
- browseable = No
- read only = No
+ browseable = no
+ read only = no
# For profiles to work, create a user directory under the
# path shown.
-<command>mkdir -p /var/lib/samba/profiles/john</command>
+# mkdir -p /var/lib/samba/profiles/john
+
[Profiles]
comment = Roaming Profile Share
path = /var/lib/samba/profiles
- read only = No
- browseable = No
- guest ok = Yes
- profile acls = Yes
-# Other resource shares ... ...</programlisting>
- <para>To provide a functional PDC system which uses the <command>tdbsam</command> follow these steps:</para>
- <orderedlist>
- <listitem>
- <para>
- Use a configuration of the <filename>smb.conf</filename> file as shown in the example above.
- </para>
- </listitem>
- <listitem>
- <para>
- Add the <systemitem class="username">root</systemitem> user to the Samba password database:</para>
-<screen><command>smbpasswd -a root</command></screen>
- </listitem>
- <listitem>
- <para>
- Start the <command>smb</command> service.
- </para>
- </listitem>
- <listitem>
- <para>
- Make sure all profile, user, and netlogon directories are created.
- </para>
- </listitem>
- <listitem>
- <para>
- Add groups that users can be members of:
- </para>
-<screen><command>groupadd -f users</command>
-<command>groupadd -f nobody</command>
-<command>groupadd -f ntadmins</command></screen>
- </listitem>
- <listitem>
- <para>
- Associate the UNIX groups with their respective Windows groups:
-<screen><command>net groupmap add ntgroup="Domain Users" unixgroup=users</command>
-<command>net groupmap add ntgroup="Domain Guests" unixgroup=nobody</command>
-<command>net groupmap add ntgroup="Domain Admins" unixgroup=ntadmins</command></screen>
- </para>
- </listitem>
- <listitem>
- <para>
- Grant access rights to a user or a group. For example, to grant the right to add client machines to the domain on a Samba domain controller, to the members to the Domain Admins group, execute the following command:
-<screen><command>net rpc rights grant 'DOCS\Domain Admins' SetMachineAccountPrivilege -S PDC -U root</command></screen>
- </para>
- </listitem>
- </orderedlist>
- <para>
- Keep in mind that Windows systems prefer to have a primary group which is mapped to a domain group such as Domain Users.
- </para>
- <para>
- Windows groups and users use the same namespace thus not allowing the existence of a group and a user with the same name like in UNIX.
- </para>
- <note>
- <title>Limitations of the tdbsam authentication back end</title>
- <para>
- If you need more than one domain controller or have more than 250 users, do <emphasis>not</emphasis> use a <command>tdbsam</command> authentication back end. LDAP is recommended in these cases.
- </para>
- </note>
- </section>
- <!-- RHEL5: tech edit: cut these!
- <section id="samba-rgs-pdc-ldap">
- <title>Primary Domain Controller (PDC) using LDAP</title>
- <indexterm significance="normal">
- <primary>Samba</primary>
- <secondary>smb.conf</secondary>
- <tertiary>PDC using LDAP</tertiary>
- </indexterm>
- <para>The most powerful and versatile implementation of a Samba PDC is its ability to have an LDAP password backend. LDAP is highly scalable. LDAP database servers can be used for redundancy and fail-over by replicating to a Samba BDC. Groups of LDAP PDCs
- and BDCs with load balancing are ideal for an enterprise environment. On the other hand, LDAP configurations are inherently complex to setup and maintain. If SSL is to be incorporated with LDAP, the complexity instantly multiplies. Even so, with
- careful and precise planning, LDAP is an ideal solution for enterprise environments.</para>
- <para>Note the <command>passdb backend</command> directive as well as specific LDAP suffix specifications. Although the Samba configuration for LDAP is straightforward, the installation of OpenLDAP is not trivial. LDAP should be installed
- and configured before any Samba configuration. Also, notice that Samba and LDAP do not need to be on the same server to function. It is highly recommended to separate the two in an enterprise environment.</para>
-<screen>[global]
-workgroup = DOCS
-netbios name = DOCS_SRV
-passdb backend = ldapsam:ldap://ldap.example.com
-username map = /etc/samba/smbusers
-security = user
-add user script = /usr/sbin/useradd -m %u
-delete user script = /usr/sbin/userdel -r %u
-add group script = /usr/sbin/groupadd %g
-delete group script = /usr/sbin/groupdel %g
-add user to group script = /usr/sbin/usermod -G %g %u
-add machine script = \ /usr/sbin/useradd -s /bin/false -d /dev/null \ -g machines %u
-# The following specifies the default logon script
-# Per user logon scripts can be specified in the
-# user account using pdbedit logon script = scripts\logon.bat
-# This sets the default profile path.
-# Set per user paths with pdbedit logon path = \\%L\Profiles\%U
-logon drive = H:
-logon home = \\%L\%U
-domain logons = Yes
-os level = 35
-preferred master = Yes
-domain master = Yes
-ldap suffix = dc=example,dc=com
-ldap machine suffix = ou=People
-ldap user suffix = ou=People
-ldap group suffix = ou=Group
-ldap idmap suffix = ou=People
-ldap admin dn = cn=Manager
-ldap ssl = no
-ldap passwd sync = yes
-idmap uid = 15000-20000
-idmap gid = 15000-20000 ...
+ read only = no
+ browseable = no
+ guest ok = yes
+ profile acls = yes
# Other resource shares ... ...</screen>
+ </example>
+ <para>
+ To provide a functional PDC system which uses <systemitem>tdbsam</systemitem> follow these steps:
+ </para>
+ <procedure id="proc-Samba_Domain_Controller-PDC_Using_tdbsam">
+ <step>
+ <para>
+ Adjust the <filename>smb.conf</filename> configuration file as shown in <xref linkend="exam-Samba_Domain_Controller-PDC_Using_tdbsam" />.
+ </para>
+ </step>
+ <step>
+ <para>
+ Add the <systemitem class="username">root</systemitem> user to the Samba password database. You will be prompted to provide a new Samba password for the <systemitem class="username">root</systemitem> user:
+ </para>
+ <screen>~]# <command>smbpasswd -a root</command>
+New SMB password:</screen>
+ </step>
+ <step>
+ <para>
+ Start the <systemitem>smb</systemitem> service:
+ </para>
+ <screen>~]# <command>service smb start</command></screen>
+ </step>
+ <step>
+ <para>
+ Make sure all profile, user, and netlogon directories are created.
+ </para>
+ </step>
+ <step>
+ <para>
+ Add groups that users can be members of:
+ </para>
+ <screen>~]# <command>groupadd -f users</command>
+~]# <command>groupadd -f nobody</command>
+~]# <command>groupadd -f ntadmins</command></screen>
+ </step>
+ <step>
+ <para>
+ Associate the UNIX groups with their respective Windows groups.
+ </para>
+ <screen>~]# <command>net groupmap add ntgroup="Domain Users" unixgroup=users</command>
+~]# <command>net groupmap add ntgroup="Domain Guests" unixgroup=nobody</command>
+~]# <command>net groupmap add ntgroup="Domain Admins" unixgroup=ntadmins</command></screen>
+ </step>
+ <step>
+ <para>
+ Grant access rights to a user or a group. For example, to grant the right to add client machines to the domain on a Samba domain controller, to the members to the Domain Admins group, execute the following command:
+ </para>
+ <screen>~]# <command>net rpc rights grant 'DOCS\Domain Admins' SetMachineAccountPrivilege -S PDC -U root</command></screen>
+ </step>
+ </procedure>
+ <para>
+ Keep in mind that Windows systems prefer to have a primary group which is mapped to a domain group such as Domain Users.
+ </para>
+ <para>
+ Windows groups and users use the same namespace thus not allowing the existence of a group and a user with the same name like in UNIX.
+ </para>
<note>
- <title>Note</title>
- <para>Implementing LDAP in this <filename>smb.conf</filename> file assumes that a working LDAP server has been successfully installed on <command>ldap.example.com</command>.</para>
+ <title>Limitations of the tdbsam authentication back end</title>
+ <para>
+ If you need more than one domain controller or have more than 250 users, do <emphasis>not</emphasis> use the <systemitem>tdbsam</systemitem> authentication back end. LDAP is recommended in these cases.
+ </para>
</note>
- </section>
- <section id="samba-rgs-bdc-ldap">
- <title>Backup Domain Controller (BDC) using LDAP</title>
- <indexterm significance="normal">
+ <bridgehead id="brid-Samba_Domain_Controller-Primary_Domain_Controller_with_Active_Directory" renderas="sect3">Primary Domain Controller (PDC) with Active Directory</bridgehead>
+ <indexterm>
<primary>Samba</primary>
<secondary>smb.conf</secondary>
- <tertiary>BDC using LDAP</tertiary>
+ <tertiary>PDC using Active Directory</tertiary>
</indexterm>
- <para>A BDC is an integral part of any enterprise Samba/LDAP solution. The <filename>/etc/samba/smb.conf</filename> files between the PDC and BDC are virtually identical except for the <command>domain master</command> directive. Make sure
- the PDC has a value of <command>Yes</command> and the BDC has a value of <command>No</command>. If you have multiple BDCs for a PDC, the <command>os level</command> directive is useful in setting the BDC
- election priority. The higher the value, the higher the server priority for connecting clients.</para>
- <note>
- <title>Note</title>
- <para>A BDC can either use the LDAP database of the PDC or have its own LDAP database. This example uses the LDAP database of the PDC as seen in the <command>passdb backend</command> directive.</para>
- </note>
-<screen>[global]
-workgroup = DOCS
-netbios name = DOCS_SRV2
-passdb backend = ldapsam:ldap://ldap.example.com
-username map = /etc/samba/smbusers
+ <para>
+ Although it is possible for Samba to be a member of an Active Directory, it is not possible for Samba to operate as an Active Directory domain controller.
+ </para>
+ </section>
+ </section>
+ <section id="sect-Samba-Security_Modes">
+ <title>Samba Security Modes</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Security Modes</secondary>
+ </indexterm>
+ <para>
+ There are only two types of security modes for Samba, <firstterm>share-level</firstterm> and <firstterm>user-level</firstterm>, which are collectively known as <emphasis><firstterm>security levels</firstterm></emphasis>. Share-level security is deprecated and has been removed from Samba. Configurations containing this mode need to be migrated to use user-level security. User-level security can be implemented in one of three different ways. The different ways of implementing a security level are called <firstterm>security modes</firstterm>.
+ </para>
+ <section id="sect-Samba_Security_Modes-User_Level">
+ <title>User-Level Security</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Security Modes</secondary>
+ <tertiary>User Level Security</tertiary>
+ </indexterm>
+ <para>
+ User-level security is the default and recommended setting for Samba. Even if the <parameter>security = user</parameter> directive is not listed in the <filename>/etc/samba/smb.conf</filename> file, it is used by Samba. If the server accepts the client's user name and password, the client can then mount multiple shares without specifying a password for each instance. Samba can also accept session-based user name and password requests. The client maintains multiple authentication contexts by using a unique UID for each logon.
+ </para>
+ <para>In the <filename>/etc/samba/smb.conf</filename> file, the <parameter>security = user</parameter> directive that sets user-level security is:
+ </para>
+ <screen>
+[GLOBAL]
+...
security = user
-add user script = /usr/sbin/useradd -m %u
-delete user script = /usr/sbin/userdel -r %u
-add group script = /usr/sbin/groupadd %g
-delete group script = /usr/sbin/groupdel %g
-add user to group script = /usr/sbin/usermod -G %g %u
-add machine script = \ /usr/sbin/useradd -s /bin/false -d /dev/null \ -g machines %u
-# The following specifies the default logon script
-# Per user logon scripts can be specified in the
-# user account using pdbedit logon script = scripts\logon.bat
-# This sets the default profile path.
-# Set per user paths with pdbedit logon path = \\%L\Profiles\%U logon drive = H:
-logon home = \\%L\%U
-domain logons = Yes
-os level = 35
-preferred master = Yes
-domain master = No \
-ldap suffix = dc=example,dc=com
-ldap machine suffix = ou=People
-ldap user suffix = ou=People
-ldap group suffix = ou=Group
-ldap idmap suffix = ou=People
-ldap admin dn = cn=Manager
-ldap ssl = no ldap
-passwd sync = yes
-idmap uid = 15000-20000
-idmap gid = 15000-20000 ...
-# Other resource shares ... ...</screen>
- </section>
- -->
- <section
- id="samba-rgs-pdc-ads">
- <title>Primary Domain Controller (PDC) with Active Directory</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>smb.conf</secondary>
- <tertiary>PDC using Active Directory</tertiary>
- </indexterm>
- <para>Although it is possible for Samba to be a member of an Active Directory, it is not possible for Samba to operate as an Active Directory domain controller.</para>
- </section>
- </section>
- </section>
- <section
- id="s2-samba-security-modes">
- <title>Samba Security Modes</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Security Modes</secondary>
- </indexterm>
- <para>There are only two types of security modes for Samba, <emphasis>share-level</emphasis> and <emphasis>user-level</emphasis>, which are collectively known as <emphasis><firstterm>security levels</firstterm>
- </emphasis>. Share-level security can only be implemented in one way, while user-level security can be implemented in one of four different ways. The different ways of implementing a security level are called <emphasis><firstterm>security modes</firstterm></emphasis>.</para>
- <section
- id="s3-samba-user-level">
- <title>User-Level Security</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Security Modes</secondary>
- <tertiary>User Level Security</tertiary>
- </indexterm>
- <para>User-level security is the default setting for Samba. Even if the <command>security = user</command> directive is not listed in the <filename>/etc/samba/smb.conf</filename> file, it is used by Samba. If the server accepts the client's username/password, the client can then mount multiple shares without specifying a password for each instance. Samba can also accept session-based username/password requests. The client maintains multiple authentication contexts by using a unique UID for each logon.</para>
- <para>In the <filename>/etc/samba/smb.conf</filename> file, the <command>security = user</command> directive that sets user-level security is:</para>
- <programlisting>[GLOBAL]
+...</screen>
+ <bridgehead id="brid-Samba_Security_Modes-Samba_Guest_Shares" renderas="sect3">Samba Guest Shares</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Security Modes</secondary>
+ </indexterm>
+ <para>
+ As mentioned above, share-level security mode is deprecated. To configure a Samba guest share without using the <parameter>security = share</parameter> parameter, follow the procedure below:
+ </para>
+ <procedure id="proc-Samba_Security_Modes-Samba_Guest_Shares">
+ <title>Configuring Samba Guest Shares</title>
+ <step>
+ <para>
+ Create a username map file, in this example <filename>/etc/samba/smbusers</filename>, and add the following line to it:
+ </para>
+ <screen>nobody = guest</screen>
+ </step>
+ <step>
+ <para>
+ Add the following directives to the main section in the <filename>/etc/samba/smb.conf</filename> file. Also, do not use the <parameter>valid users</parameter> directive:
+ </para>
+<screen>
+[GLOBAL]
...
security = user
-...</programlisting>
- <para>The following sections describe other implementations of user-level security.</para>
- <section
- id="s3-samba-domain-security-mode">
- <title>Domain Security Mode (User-Level Security)</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Security Modes</secondary>
- <tertiary>Domain Security Mode</tertiary>
- </indexterm>
- <para>In domain security mode, the Samba server has a machine account (domain security trust account) and causes all authentication requests to be passed through to the domain controllers. The Samba server is made into a domain member server by using the following directives in the <filename>/etc/samba/smb.conf</filename> file:</para>
- <programlisting>[GLOBAL]
+map to guest = Bad User
+username map = <replaceable>/etc/samba/smbusers</replaceable>
+...</screen>
+ <para>
+ The <parameter>username map</parameter> directive provides a path to the username map file specified in the previous step.
+ </para>
+ </step>
+ <step>
+ <para>
+ Add the following directive to the share section in the <filename>/ect/samba/smb.conf</filename> file. Do not use the <parameter>valid users</parameter> directive.
+ </para>
+<screen>[SHARE]
+...
+guest ok = yes
+...</screen>
+ </step>
+ </procedure>
+ <para>
+ The following sections describe other implementations of user-level security.
+ </para>
+ <bridgehead id="brid-Samba_Security_Modes-User_Level-Domain_Security_Mode" renderas="sect3">Domain Security Mode (User-Level Security)</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Security Modes</secondary>
+ <tertiary>Domain Security Mode</tertiary>
+ </indexterm>
+ <para>
+ In domain security mode, the Samba server has a machine account (domain security trust account) and causes all authentication requests to be passed through to the domain controllers. The Samba server is made into a domain member server by using the following directives in the <filename>/etc/samba/smb.conf</filename> file:
+ </para>
+ <screen>
+[GLOBAL]
...
security = domain
workgroup = MARKETING
-...</programlisting>
- </section>
- <section
- id="s3-samba-ads-security-mode">
- <title>Active Directory Security Mode (User-Level Security)</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Security Modes</secondary>
- <tertiary>Active Directory Security Mode</tertiary>
- </indexterm>
- <para>If you have an Active Directory environment, it is possible to join the domain as a native Active Directory member. Even if a security policy restricts the use of NT-compatible authentication protocols, the Samba server can join an ADS using Kerberos. Samba in Active Directory member mode can accept Kerberos tickets.</para>
- <para>In the <filename>/etc/samba/smb.conf</filename> file, the following directives make Samba an Active Directory member server:</para>
- <programlisting>[GLOBAL]
+...</screen>
+ <bridgehead id="brid-Samba_Security_Modes-Active_Directory_Security_Mode" renderas="sect3">Active Directory Security Mode (User-Level Security)</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Security Modes</secondary>
+ <tertiary>Active Directory Security Mode</tertiary>
+ </indexterm>
+ <para>
+ If you have an Active Directory environment, it is possible to join the domain as a native Active Directory member. Even if a security policy restricts the use of NT-compatible authentication protocols, the Samba server can join an ADS using Kerberos. Samba in Active Directory member mode can accept Kerberos tickets.
+ </para>
+ <para>
+ In the <filename>/etc/samba/smb.conf</filename> file, the following directives make Samba an Active Directory member server:
+ </para>
+ <screen>
+[GLOBAL]
...
security = ADS
realm = EXAMPLE.COM
password server = kerberos.example.com
-...</programlisting>
- </section>
- <section
- id="s3-samba-server-security-mode">
- <title>Server Security Mode (User-Level Security)</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Security Modes</secondary>
- <tertiary>Server Security Mode</tertiary>
- </indexterm>
- <para>Server security mode was previously used when Samba was not capable of acting as a domain member server.</para>
- <note>
- <title>Avoid using the server security mode</title>
- <para>It is highly recommended to <emphasis>not</emphasis> use this mode since there are numerous security drawbacks.</para>
- </note>
- <para>In the <filename>/etc/samba/smb.conf</filename>, the following directives enable Samba to operate in server security mode:</para>
- <programlisting>[GLOBAL]
-...
-encrypt passwords = Yes
-security = server
-password server = "NetBIOS_of_Domain_Controller"
-...</programlisting>
- </section>
- </section>
- <section
- id="s3-samba-share-level">
- <title>Share-Level Security</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Security Modes</secondary>
- <tertiary>Share-Level Security</tertiary>
- </indexterm>
- <para>With share-level security, the server accepts only a password without an explicit username from the client. The server expects a password for each share, independent of the username. There have been recent reports that Microsoft Windows clients have compatibility issues with share-level security servers. Samba developers strongly discourage use of share-level security.</para>
- <para>In the <filename>/etc/samba/smb.conf</filename> file, the <command>security = share</command> directive that sets share-level security is:</para>
- <programlisting>[GLOBAL]
-...
-security = share
-...</programlisting>
- </section>
- </section>
- <section
- id="s2-samba-account-info-dbs">
- <title>Samba Account Information Databases</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Account Information Databases</secondary>
- </indexterm>
- <para>The latest release of Samba offers many new features including new password database back ends not previously available. Samba version 3.0.0 fully supports all databases used in previous versions of Samba. However, although supported, many back ends may not be suitable for production use.</para>
- <para>The following is a list different back ends you can use with Samba. Other back ends not listed here may also be available.</para>
- <!-- RHEL5: tech review: merge 2 sections!
- <section id="s3-samba-backwardcompat-backends">
- <title>Backward Compatible Backends</title> -->
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Backward Compatible Database Back Ends</secondary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Account Information Databases</secondary>
- <tertiary>Plain Text</tertiary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Account Information Databases</secondary>
- <tertiary>
- <command>smbpasswd</command>
- </tertiary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Account Information Databases</secondary>
- <tertiary>
- <command>ldapsam_compat</command>
- </tertiary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>New Database Back Ends</secondary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Account Information Databases</secondary>
- <tertiary>
- <command>tdbsam</command>
- </tertiary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Account Information Databases</secondary>
- <tertiary>
- <command>ldapsam</command>
- </tertiary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Account Information Databases</secondary>
- <tertiary>
- <command>mysqlsam</command>
- </tertiary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Account Information Databases</secondary>
- <tertiary>
- <command>xmlsam</command>
- </tertiary>
- </indexterm>
- <variablelist>
- <varlistentry>
- <term>Plain Text</term>
- <listitem>
- <para>Plain text back ends are nothing more than the <command>/etc/passwd</command> type back ends. With a plain text back end, all usernames and passwords are sent unencrypted between the client and the Samba server. This method is very unsecure and is not recommended for use by any means. It is possible that different Windows clients connecting to the Samba server with plain text passwords cannot support such an authentication method.</para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <command>smbpasswd</command>
- </term>
- <listitem>
- <para>A popular back end used in previous Samba packages, the <command>smbpasswd</command> back end utilizes a plain ASCII text layout that includes the MS Windows LanMan and NT account, and encrypted password information. The <command>smbpasswd</command> back end lacks the storage of the Windows NT/2000/2003 SAM extended controls. The <command>smbpasswd</command> back end is not recommended because it does not scale well or hold any Windows information, such as RIDs for NT-based groups. The <command>tdbsam</command> back end solves these issues for use in a smaller database (250 users), but is still not an enterprise-class solution. <!-- RHEL5: tech review: cut!
- <warning>
- <title>Warning</title>
- <para>This type of backend may be deprecated for future releases and replaced by the <command>tdbsam</command> backend, which does include the SAM extended controls.</para>
- </warning> -->
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <command>ldapsam_compat</command>
- </term>
- <listitem>
- <para>The <command>ldapsam_compat</command> back end allows continued OpenLDAP support for use with upgraded versions of Samba. This option is normally used when migrating to Samba 3.0.</para>
- </listitem>
- </varlistentry>
- <!-- RHEL5: tech review: merge!
- </variablelist>
+...</screen>
</section>
- <section id="s3-samba-new-backends">
- <title>New Backends</title>
- <variablelist> -->
- <varlistentry>
- <term>
- <command>tdbsam</command>
- </term>
- <listitem>
- <para>The new default <command>tdbsam</command> password back end provides an ideal database back end for local servers, servers that do not need built-in database replication, and servers that do not require the scalability or complexity of LDAP. The <command>tdbsam</command> back end includes all of the <command>smbpasswd</command> database information as well as the previously-excluded SAM information. The inclusion of the extended SAM data allows Samba to implement the same account and system access controls as seen with Windows NT/2000/2003/2008-based systems.</para>
- <para>The <command>tdbsam</command> back end is recommended for 250 users at most. Larger organizations should require Active Directory or LDAP integration due to scalability and possible network infrastructure concerns.</para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term>
- <command>ldapsam</command>
- </term>
- <listitem>
- <para>The <command>ldapsam</command> back end provides an optimal distributed account installation method for Samba. LDAP is optimal because of its ability to replicate its database to any number of servers such as an <application>OpenLDAP Server</application>. LDAP databases are light-weight and scalable, and as such are preferred by large enterprises. For more information on LDAP, refer to <xref linkend="s1-OpenLDAP" />.</para>
- <para>If you are upgrading from a previous version of Samba to 3.0, note that the OpenLDAP schema file (<filename>/usr/share/doc/samba/LDAP/samba.schema</filename>) has changed. These files contain the <firstterm>attribute syntax definitions</firstterm> and <firstterm>objectclass definitions</firstterm> that the <command>ldapsam</command> back end needs in order to function properly.</para>
- <para>As such, if you are using the <command>ldapsam</command> back end for your Samba server, you will need to configure <command>slapd</command> to include one of these schema file. See <xref
- linkend="s3-ldap-configuration-schema"/> for directions on how to do this.</para>
- <note>
- <title>Make sure the openldap-server package is installed</title>
- <para>You need to have the <filename>openldap-server</filename> package installed if you want to use the <command>ldapsam</command> back end.</para>
- </note>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
-
- <section
- id="s2-samba-network-browsing">
- <title>Samba Network Browsing</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Network Browsing</secondary>
- </indexterm>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Browsing</secondary>
- </indexterm>
- <para>
- <firstterm>Network browsing</firstterm> enables Windows and Samba servers to appear in the Windows <guilabel>Network Neighborhood</guilabel>. Inside the <guilabel>Network Neighborhood</guilabel>, icons are represented as servers and if opened, the server's shares and printers that are available are displayed.</para>
- <para>Network browsing capabilities require NetBIOS over <systemitem class="protocol">TCP</systemitem>/<systemitem class="protocol">IP</systemitem>. NetBIOS-based networking uses broadcast (<systemitem class="protocol">UDP</systemitem>) messaging to accomplish browse list management. Without NetBIOS and WINS as the primary method for <systemitem class="protocol">TCP</systemitem>/<systemitem class="protocol">IP</systemitem> hostname resolution, other methods such as static files (<filename>/etc/hosts</filename>) or <systemitem class="protocol">DNS</systemitem>, must be used.</para>
- <para>A domain master browser collates the browse lists from local master browsers on all subnets so that browsing can occur between workgroups and subnets. Also, the domain master browser should preferably be the local master browser for its own subnet.</para>
- <section
- id="s3-samba-domain-browsing">
- <title>Domain Browsing</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Network Browsing</secondary>
- <tertiary>Domain Browsing</tertiary>
- </indexterm>
- <para>By default, a Windows server PDC for a domain is also the domain master browser for that domain. A Samba server must <emphasis>not</emphasis> be set up as a domain master server in this type of situation.</para>
- <para>For subnets that do not include the Windows server PDC, a Samba server can be implemented as a local master browser. Configuring the <filename>/etc/samba/smb.conf</filename> file for a local master browser (or no browsing at all) in a domain controller environment is the same as workgroup configuration (see <xref linkend="s2-samba-configuring" />).</para>
- </section>
- <section
- id="s3-samba-wins">
- <title>WINS (Windows Internet Name Server)</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>WINS</secondary>
- </indexterm>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Network Browsing</secondary>
- <tertiary>WINS</tertiary>
- </indexterm>
- <para>Either a Samba server or a Windows NT server can function as a WINS server. When a WINS server is used with NetBIOS enabled, UDP unicasts can be routed which allows name resolution across networks. Without a WINS server, the UDP broadcast is limited to the local subnet and therefore cannot be routed to other subnets, workgroups, or domains. If WINS replication is necessary, do not use Samba as your primary WINS server, as Samba does not currently support WINS replication.</para>
- <para>In a mixed NT/2000/2003/2008 server and Samba environment, it is recommended that you use the Microsoft WINS capabilities. In a Samba-only environment, it is recommended that you use <emphasis>only one</emphasis> Samba server for WINS.</para>
- <para>The following is an example of the <filename>/etc/samba/smb.conf</filename> file in which the Samba server is serving as a WINS server:</para>
- <programlisting>[global]
-wins support = Yes</programlisting>
- <note>
- <title>Using WINS</title>
- <para>All servers (including Samba) should connect to a WINS server to resolve NetBIOS names. Without WINS, browsing only occurs on the local subnet. Furthermore, even if a domain-wide list is somehow obtained, hosts cannot be resolved for the client without WINS.</para>
- </note>
- </section>
- </section>
- <section
- id="s2-samba-cups">
- <title>Samba with CUPS Printing Support</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>CUPS Printing Support</secondary>
- </indexterm>
- <para>Samba allows client machines to share printers connected to the Samba server. In addition, Samba also allows client machines to send documents built in Linux to Windows printer shares. Although there are other printing systems that function with &MAJOROS;, CUPS (Common UNIX Print System) is the recommended printing system due to its close integration with Samba.</para>
- <section
- id="s3-samba-cups-smb.conf">
- <title>Simple <filename>smb.conf</filename> Settings</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>CUPS Printing Support</secondary>
- <tertiary>CUPS smb.conf</tertiary>
- </indexterm>
- <para>The following example shows a very basic <filename>/etc/samba/smb.conf</filename> configuration for CUPS support:</para>
- <programlisting>[global]
-load printers = Yes
+ <section id="sect-Samba_Security_Modes-Share_Level">
+ <title>Share-Level Security</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Security Modes</secondary>
+ <tertiary>Share-Level Security</tertiary>
+ </indexterm>
+ <para>
+ With share-level security, the server accepts only a password without an explicit user name from the client. The server expects a password for each share, independent of the user name. There have been recent reports that Microsoft Windows clients have compatibility issues with share-level security servers. This mode is deprecated and has been removed from Samba. Configurations containing <parameter>security = share</parameter> should be updated to use user-level security. Follow the steps in <xref linkend="proc-Samba_Security_Modes-Samba_Guest_Shares" /> to avoid using the <parameter>security = share</parameter> directive.
+ </para>
+ </section>
+ </section>
+ <section id="sect-Samba-Account_Information-Databases">
+ <title>Samba Account Information Databases</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Account Information Databases</secondary>
+ </indexterm>
+ <para>
+ The following is a list different back ends you can use with Samba. Other back ends not listed here may also be available.
+ </para>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Backward Compatible Database Back Ends</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Account Information Databases</secondary>
+ <tertiary>Plain Text</tertiary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Account Information Databases</secondary>
+ <tertiary><command>smbpasswd</command></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Account Information Databases</secondary>
+ <tertiary><command>ldapsam_compat</command></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>New Database Back Ends</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Account Information Databases</secondary>
+ <tertiary><command>tdbsam</command></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Account Information Databases</secondary>
+ <tertiary><command>ldapsam</command></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Account Information Databases</secondary>
+ <tertiary><command>mysqlsam</command></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Account Information Databases</secondary>
+ <tertiary><command>xmlsam</command></tertiary>
+ </indexterm>
+ <variablelist>
+ <varlistentry>
+ <term>Plain Text</term>
+ <listitem>
+ <para>
+ Plain text back ends are nothing more than the <filename>/etc/passwd</filename> type back ends. With a plain text back end, all user names and passwords are sent unencrypted between the client and the Samba server. This method is very insecure and is not recommended for use by any means. It is possible that different Windows clients connecting to the Samba server with plain text passwords cannot support such an authentication method.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><systemitem>smbpasswd</systemitem></term>
+ <listitem>
+ <para>
+ The <systemitem>smbpasswd</systemitem> back end utilizes a plain ASCII text layout that includes the MS Windows LanMan and NT account, and encrypted password information. The <systemitem>smbpasswd</systemitem> back end lacks the storage of the Windows NT/2000/2003 SAM extended controls. The <systemitem>smbpasswd</systemitem> back end is not recommended because it does not scale well or hold any Windows information, such as RIDs for NT-based groups. The <systemitem>tdbsam</systemitem> back end solves these issues for use in a smaller database (250 users), but is still not an enterprise-class solution.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><systemitem>ldapsam_compat</systemitem></term>
+ <listitem>
+ <para>
+ The <systemitem>ldapsam_compat</systemitem> back end allows continued OpenLDAP support for use with upgraded versions of Samba. </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><systemitem>tdbsam</systemitem></term>
+ <listitem>
+ <para>
+ The default <systemitem>tdbsam</systemitem> password back end provides a database back end for local servers, servers that do not need built-in database replication, and servers that do not require the scalability or complexity of LDAP. The <systemitem>tdbsam</systemitem> back end includes all of the <systemitem>smbpasswd</systemitem> database information as well as the previously-excluded SAM information. The inclusion of the extended SAM data allows Samba to implement the same account and system access controls as seen with Windows NT/2000/2003/2008-based systems.
+ </para>
+ <para>
+ The <systemitem>tdbsam</systemitem> back end is recommended for 250 users at most. Larger organizations should require Active Directory or LDAP integration due to scalability and possible network infrastructure concerns.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><systemitem>ldapsam</systemitem></term>
+ <listitem>
+ <para>
+ The <systemitem>ldapsam</systemitem> back end provides an optimal distributed account installation method for Samba. LDAP is optimal because of its ability to replicate its database to any number of servers such as the <application>Red Hat Directory Server</application> or an <application>OpenLDAP Server</application>. LDAP databases are light-weight and scalable, and as such are preferred by large enterprises. Installation and configuration of directory servers is beyond the scope of this chapter. For more information on the <application>Red Hat Directory Server</application>, see the <citetitle pubwork="book"><ulink url="https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/9....">Red Hat Directory Server 9.0 Deployment Guide</ulink></citetitle>. For more information on LDAP, see <xref linkend="s1-OpenLDAP" />.
+ </para>
+ <para>
+ If you are upgrading from a previous version of Samba to 3.0, note that the OpenLDAP schema file (<filename>/usr/share/doc/samba-<replaceable>version</replaceable>/LDAP/samba.schema</filename>) and the Red Hat Directory Server schema file (<filename>/usr/share/doc/samba-<replaceable>version</replaceable>/LDAP/samba-schema-FDS.ldif</filename>) have changed. These files contain the <firstterm>attribute syntax definitions</firstterm> and <firstterm>objectclass definitions</firstterm> that the <systemitem>ldapsam</systemitem> back end needs in order to function properly.
+ </para>
+ <para>
+ As such, if you are using the <systemitem>ldapsam</systemitem> back end for your Samba server, you will need to configure <systemitem>slapd</systemitem> to include one of these schema file. See <xref linkend="s3-ldap-configuration-schema"/> for directions on how to do this.
+ </para>
+ <note>
+ <title>Make sure the openldap-servers package is installed</title>
+ <para>
+ You need to have the <package>openldap-servers</package> package installed if you want to use the <systemitem>ldapsam</systemitem> back end. To ensure that the package is installed, execute the following command as <systemitem class="username">roots</systemitem>:
+ </para>
+ <screen>~]# <command>yum install openldap-servers</command></screen>
+ </note>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </section>
+ <section id="sect-Samba-Network_Browsing">
+ <title>Samba Network Browsing</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Network Browsing</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Browsing</secondary>
+ </indexterm>
+ <para>
+ <firstterm>Network browsing</firstterm> enables Windows and Samba servers to appear in the Windows <guilabel>Network Neighborhood</guilabel>. Inside the <guilabel>Network Neighborhood</guilabel>, icons are represented as servers and if opened, the server's shares and printers that are available are displayed.
+ </para>
+ <para>
+ Network browsing capabilities require NetBIOS over <systemitem class="protocol">TCP</systemitem>/<systemitem class="protocol">IP</systemitem>. NetBIOS-based networking uses broadcast (<systemitem class="protocol">UDP</systemitem>) messaging to accomplish browse list management. Without NetBIOS and WINS as the primary method for <systemitem class="protocol">TCP</systemitem>/<systemitem class="protocol">IP</systemitem> host name resolution, other methods such as static files (<filename>/etc/hosts</filename>) or <systemitem class="protocol">DNS</systemitem>, must be used.
+ </para>
+ <para>
+ A domain master browser collates the browse lists from local master browsers on all subnets so that browsing can occur between workgroups and subnets. Also, the domain master browser should preferably be the local master browser for its own subnet.
+ </para>
+ <section id="sect-Samba-Domain-Browsing">
+ <title>Domain Browsing</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Network Browsing</secondary>
+ <tertiary>Domain Browsing</tertiary>
+ </indexterm>
+ <para>
+ By default, a Windows server PDC for a domain is also the domain master browser for that domain. A Samba server must <emphasis>not</emphasis> be set up as a domain master server in this type of situation.
+ </para>
+ <para>
+ For subnets that do not include the Windows server PDC, a Samba server can be implemented as a local master browser. Configuring the <filename>/etc/samba/smb.conf</filename> file for a local master browser (or no browsing at all) in a domain controller environment is the same as workgroup configuration (see <xref linkend="sect-Samba-Configuring_a_Samba_Server" />).
+ </para>
+ </section>
+ <section id="sect-Samba-WINS">
+ <title>WINS (Windows Internet Name Server)</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>WINS</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Network Browsing</secondary>
+ <tertiary>WINS</tertiary>
+ </indexterm>
+ <para>
+ Either a Samba server or a Windows NT server can function as a WINS server. When a WINS server is used with NetBIOS enabled, UDP unicasts can be routed which allows name resolution across networks. Without a WINS server, the UDP broadcast is limited to the local subnet and therefore cannot be routed to other subnets, workgroups, or domains. If WINS replication is necessary, do not use Samba as your primary WINS server, as Samba does not currently support WINS replication.
+ </para>
+ <para>
+ In a mixed NT/2000/2003/2008 server and Samba environment, it is recommended that you use the Microsoft WINS capabilities. In a Samba-only environment, it is recommended that you use <emphasis>only one</emphasis> Samba server for WINS.
+ </para>
+ <para>
+ The following is an example of the <filename>/etc/samba/smb.conf</filename> file in which the Samba server is serving as a WINS server:
+ </para>
+ <example id="exam-Samba-WINS">
+ <title>An Example Configuration of WINS Server</title>
+ <screen>
+[global]
+wins support = yes</screen>
+ </example>
+ <note>
+ <title>Using WINS</title>
+ <para>
+ All servers (including Samba) should connect to a WINS server to resolve NetBIOS names. Without WINS, browsing only occurs on the local subnet. Furthermore, even if a domain-wide list is somehow obtained, hosts cannot be resolved for the client without WINS.
+ </para>
+ </note>
+ </section>
+ </section>
+ <section id="sect-Samba_with_CUPS_Printing_Support">
+ <title>Samba with CUPS Printing Support</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>CUPS Printing Support</secondary>
+ </indexterm>
+ <para>
+ Samba allows client machines to share printers connected to the Samba server. In addition, Samba also allows client machines to send documents built in Linux to Windows printer shares. Although there are other printing systems that function with &MAJOROS;, CUPS (Common UNIX Print System) is the recommended printing system due to its close integration with Samba.
+ </para>
+ <section id="sect-Samba-CUPS-smb.conf">
+ <title>Simple <filename>smb.conf</filename> Settings</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>CUPS Printing Support</secondary>
+ <tertiary>CUPS smb.conf</tertiary>
+ </indexterm>
+ <para>
+ The following example shows a very basic <filename>/etc/samba/smb.conf</filename> configuration for CUPS support:
+ </para>
+ <example id="exam-Samba-CUPS-smb.conf">
+ <title>An Example Configuration of Samba with CUPS Support</title>
+ <screen>
+[global]
+load printers = yes
printing = cups
printcap name = cups
[printers]
comment = All Printers
path = /var/spool/samba
-browseable = No
-public = Yes
-guest ok = Yes
-writable = No
-printable = Yes
+browseable = no
+guest ok = yes
+writable = no
+printable = yes
printer admin = @ntadmins
[print$]
comment = Printer Drivers Share
path = /var/lib/samba/drivers
write list = ed, john
-printer admin = ed, john</programlisting>
- <para>Other printing configurations are also possible. To add additional security and privacy for printing confidential documents, users can have their own print spooler not located in a public path. If a job fails, other users would not have access to the file.</para>
- <para>The <command>print$</command> directive contains printer drivers for clients to access if not available locally. The <command>print$</command> directive is optional and may not be required depending on the organization.</para>
- <para>Setting <command>browseable</command> to <command>Yes</command> enables the printer to be viewed in the Windows Network Neighborhood, provided the Samba server is set up correctly in the domain/workgroup.</para>
- </section>
- </section>
- <section
- id="s2-samba-programs">
- <title>Samba Distribution Programs</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- </indexterm>
- <bridgehead id="s3-samba-programs-findsmb">
- <filename>findsmb</filename>
- </bridgehead>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>findsmb</command>
- </tertiary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>
- <command>findsmb</command> program</primary>
- </indexterm>
- <screen><command>findsmb <replaceable>subnet_broadcast_address</replaceable></command></screen>
- <para>The <command>findsmb</command> program is a Perl script which reports information about <systemitem class="protocol">SMB</systemitem>-aware systems on a specific subnet. If no subnet is specified the local subnet is used. Items displayed include <systemitem class="protocol">IP</systemitem> address, NetBIOS name, workgroup or domain name, operating system, and version.</para>
- <para>The following example shows the output of executing <command>findsmb</command> as any valid user on a system:</para>
- <screen>~]$ <command>findsmb</command>
+printer admin = ed, john</screen>
+ </example>
+ <para>
+ Other printing configurations are also possible. To add additional security and privacy for printing confidential documents, users can have their own print spooler not located in a public path. If a job fails, other users would not have access to the file.
+ </para>
+ <para>
+ The <parameter>print$</parameter> directive contains printer drivers for clients to access if not available locally. The <parameter>print$</parameter> directive is optional and may not be required depending on the organization.
+ </para>
+ <para>
+ Setting <parameter>browseable</parameter> to <literal>yes</literal> enables the printer to be viewed in the Windows Network Neighborhood, provided the Samba server is set up correctly in the domain or workgroup.
+ </para>
+ </section>
+ </section>
+ <section id="sect-Samba_Distribution_Programs">
+ <title>Samba Distribution Programs</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ </indexterm>
+ <!-- [bancinco] commented out as per: https://bugzilla.redhat.com/show_bug.cgi?id=1052228#c8
+
+ <bridgehead id="brid-Samba_Distribution_Programs-findsmb" renderas="sect3"><systemitem>findsmb</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>findsmb</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>findsmb</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>findsmb <replaceable><subnet_broadcast_address></replaceable></command></synopsis>
+ <para>
+ The <systemitem>findsmb</systemitem> program is a Perl script which reports information about <systemitem class="protocol">SMB</systemitem>-aware systems on a specific subnet. If no subnet is specified the local subnet is used. Items displayed include <systemitem class="protocol">IP</systemitem> address, NetBIOS name, workgroup or domain name, operating system, and version. The <command>findsmb</command> command is used in the following format:
+ </para>
+ <para>
+ The following example shows the output of executing <command>findsmb</command> as any valid user on a system:
+ </para>
+ <screen>
+~]$ <command>findsmb</command>
IP ADDR NETBIOS NAME WORKGROUP/OS/VERSION
-------------------------------------------------------------------
+TODO: Do not forget to remove the spaces from the below!!!
+- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
10.1.59.25 VERVE [MYGROUP] [Unix] [Samba 3.0.0-15]
10.1.59.26 STATION22 [MYGROUP] [Unix] [Samba 3.0.2-7.FC1]
10.1.56.45 TREK +[WORKGROUP] [Windows 5.0] [Windows 2000 LAN Manager]
@@ -1193,57 +1286,25 @@ IP ADDR NETBIOS NAME WORKGROUP/OS/VERSION
10.1.57.141 JAWS +[KWIKIMART] [Unix] [Samba 2.2.7a-security-rollup-fix]
10.1.56.159 FRED +[MYGROUP] [Unix] [Samba 3.0.0-14.3E]
10.1.59.192 LEGION *[MYGROUP] [Unix] [Samba 2.2.7-security-rollup-fix]
-10.1.56.205 NANCYN +[MYGROUP] [Unix] [Samba 2.2.7a-security-rollup-fix]</screen>
- <!-- RHEL5: </section> --><!-- RHEL5: peer review: cut!
- <formalpara id="s3-samba-programs-make_smbcodepage">
- <title><filename>make_smbcodepage</filename></title>
- <indexterm significance="normal">
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary><command>make_smbcodepage</command>
- </tertiary>
- </indexterm>
- <indexterm significance="normal">
- <primary><command>make_smbcodepage</command> program</primary>
- </indexterm>
- <para><command>make_smbcodepage <replaceable><c|d> <codepage_number> <inputfile> <outputfile></replaceable></command></para>
- </formalpara>
- <para>The <command>make_smbcodepage</command> program compiles a binary codepage file from a text-format definition. The reverse is also allowed by decompiling a binary codepage file to a text-format definition. This obsolete program is part of the internationalization features of previous versions of Samba which are included by default with the current version of Samba.</para> --><!-- RHEL5: </section> --><!-- RHEL5: tech review: cut!
- <formalpara id="s3-samba-programs-make_unicodemap">
- <title><filename>make_unicodemap</filename></title>
- <indexterm significance="normal">
+10.1.56.205 NANCYN +[MYGROUP] [Unix] [Samba 2.2.7a-security-rollup-fix]</screen> -->
+ <bridgehead id="brid-Samba_Distribution_Programs-net" renderas="sect3"><systemitem>net</systemitem></bridgehead>
+ <indexterm>
<primary>Samba</primary>
<secondary>Programs</secondary>
- <tertiary><command>make_unicodemap</command>
- </tertiary>
+ <tertiary><command>net</command></tertiary>
</indexterm>
- <indexterm significance="normal">
- <primary><command>make_unicodemap</command> program</primary>
+ <indexterm>
+ <primary><command>net</command> program</primary>
</indexterm>
- <para><command>make_unicodemap <replaceable><codepage_number> <inputfile> <outputfile></replaceable></command></para>
- </formalpara>
- <para>The <command>make_unicodemap</command> program compiles binary Unicode files from text files so Samba can display non-ASCII character sets. This obsolete program was part of the internationalization features of previous versions of Samba which are now included with the current release of Samba.</para> --><!-- RHEL5: </section> -->
- <bridgehead id="s3-samba-programs-net">
- <filename>net</filename>
- </bridgehead>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>net</command>
- </tertiary>
- </indexterm>
- <indexterm
- significance="normal">
- <primary>
- <command>net</command> program</primary>
- </indexterm>
- <screen><command>net <replaceable>protocol function misc_options target_options</replaceable></command></screen>
- <para>The <command>net</command> utility is similar to the <command>net</command> utility used for Windows and MS-DOS. The first argument is used to specify the protocol to use when executing a command. The <command><replaceable>protocol</replaceable>
- </command> option can be <command>ads</command>, <command>rap</command>, or <command>rpc</command> for specifying the type of server connection. Active Directory uses <command>ads</command>, Win9x/NT3 uses <command>rap</command>, and Windows NT4/2000/2003/2008 uses <command>rpc</command>. If the protocol is omitted, <command>net</command> automatically tries to determine it.</para>
- <para>The following example displays a list of the available shares for a host named <command>wakko</command>:</para>
- <screen>~]$ <command>net -l share -S wakko</command>
+ <synopsis><command>net <replaceable><protocol> <function> <misc_options> <target_options></replaceable></command></synopsis>
+ <para>
+ The <systemitem>net</systemitem> utility is similar to the <systemitem>net</systemitem> utility used for Windows and MS-DOS. The first argument is used to specify the protocol to use when executing a command. The <option><replaceable>protocol</replaceable></option> option can be <option>ads</option>, <option>rap</option>, or <option>rpc</option> for specifying the type of server connection. Active Directory uses <option>ads</option>, Win9x/NT3 uses <option>rap</option>, and Windows NT4/2000/2003/2008 uses <option>rpc</option>. If the protocol is omitted, <systemitem>net</systemitem> automatically tries to determine it.
+ </para>
+ <para>
+ The following example displays a list of the available shares for a host named <systemitem role="hostname">wakko</systemitem>:
+ </para>
+ <screen>
+~]$ <command>net -l share -S wakko</command>
Password:
Enumerating shared resources (exports) on remote server:
Share name Type Description
@@ -1252,53 +1313,55 @@ data Disk Wakko data share
tmp Disk Wakko tmp share
IPC$ IPC IPC Service (Samba Server)
ADMIN$ IPC IPC Service (Samba Server)</screen>
- <para>The following example displays a list of Samba users for a host named <command>wakko</command>:</para>
- <screen>~]$ <command>net -l user -S wakko</command>
+ <para>
+ The following example displays a list of Samba users for a host named <systemitem role="hostname">wakko</systemitem>:
+ </para>
+ <screen>
+~]$ <command>net -l user -S wakko</command>
root password:
User name Comment
-----------------------------
andriusb Documentation
joe Marketing
lisa Sales</screen>
- <bridgehead id="s3-samba-programs-nmblookup">
- <filename>nmblookup</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>nmblookup</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>nmblookup</command> program</primary>
- </indexterm>
- <screen><command>nmblookup <replaceable>options netbios_name</replaceable></command></screen>
- <para>The <command>nmblookup</command> program resolves NetBIOS names into <systemitem class="protocol">IP</systemitem> addresses. The program broadcasts its query on the local subnet until the target machine replies.</para>
- <para>The following example displays the <systemitem class="protocol">IP</systemitem> address of the NetBIOS name <literal>trek</literal>:</para>
- <screen>
-<userinput>~]$ nmblookup trek</userinput>
+ <bridgehead id="brid-Samba_Distribution_Programs-nmblookup" renderas="sect3"><systemitem>nmblookup</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>nmblookup</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>nmblookup</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>nmblookup <replaceable><options> <netbios_name></replaceable></command></synopsis>
+ <para>
+ The <systemitem>nmblookup</systemitem> program resolves NetBIOS names into <systemitem class="protocol">IP</systemitem> addresses. The program broadcasts its query on the local subnet until the target machine replies.
+ </para>
+ <para>
+ The following example displays the <systemitem class="protocol">IP</systemitem> address of the NetBIOS name <literal>trek</literal>:
+ </para>
+ <screen>
+~]$ <command>nmblookup trek</command>
querying trek on 10.1.59.255
10.1.56.45 trek<00></screen>
- <bridgehead id="s3-samba-programs-pdbedit">
- <filename>pdbedit</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>pdbedit</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>pdbedit</command> program</primary>
- </indexterm>
- <screen><command>pdbedit <replaceable>options</replaceable></command></screen>
- <para>The <command>pdbedit</command> program manages accounts located in the SAM database. All back ends are supported including <filename>smbpasswd</filename>, LDAP, and the <filename>tdb</filename> database library.</para>
- <para>The following are examples of adding, deleting, and listing users:</para>
- <screen>~]$ <command>pdbedit -a kristin</command>
+ <bridgehead id="brid-Samba_Distribution_Programs-pdbedit" renderas="sect3"><systemitem>pdbedit</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>pdbedit</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>pdbedit</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>pdbedit <replaceable><options></replaceable></command></synopsis>
+ <para>
+ The <systemitem>pdbedit</systemitem> program manages accounts located in the SAM database. All back ends are supported including <systemitem>smbpasswd</systemitem>, LDAP, and the <database>tdb</database> database library.
+ </para>
+ <para>
+ The following are examples of adding, deleting, and listing users:
+ </para>
+ <screen>
+~]$ <command>pdbedit -a kristin</command>
new password:
retype new password:
Unix username: kristin
@@ -1320,7 +1383,7 @@ Kickoff time: Mon, 18 Jan 2038 22:14:07 GMT
Password last set: Thu, 29 Jan 2004 08:29:28
GMT Password can change: Thu, 29 Jan 2004 08:29:28 GMT
Password must change: Mon, 18 Jan 2038 22:14:07 GMT
-<userinput>~]$ pdbedit -v -L kristin</userinput>
+~]$ <command>pdbedit -v -L kristin</command>
Unix username: kristin
NT username:
Account Flags: [U ]
@@ -1341,161 +1404,134 @@ Kickoff time: Mon, 18 Jan 2038 22:14:07 GMT
Password last set: Thu, 29 Jan 2004 08:29:28 GMT
Password can change: Thu, 29 Jan 2004 08:29:28 GMT
Password must change: Mon, 18 Jan 2038 22:14:07 GMT
-<userinput>~]$ pdbedit -L</userinput>
+~]$ <command>pdbedit -L</command>
andriusb:505:
joe:503:
lisa:504:
kristin:506:
-<userinput>~]$ pdbedit -x joe</userinput>
-<userinput>~]$ pdbedit -L</userinput>
+~]$ <command>pdbedit -x joe</command>
+~]$ <command>pdbedit -L</command>
andriusb:505: lisa:504: kristin:506:</screen>
- <bridgehead id="s3-samba-programs-rpcclient">
- <filename>rpcclient</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>rpcclient</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>rpcclient</command> program</primary>
- </indexterm>
- <screen><command>rpcclient <replaceable>server options</replaceable></command></screen>
- <para>The <command>rpcclient</command> program issues administrative commands using Microsoft RPCs, which provide access to the Windows administration graphical user interfaces (GUIs) for systems management. This is most often used by advanced users that understand the full complexity of Microsoft RPCs.</para>
- <bridgehead id="s3-samba-programs-smbcacls">
- <filename>smbcacls</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>smbcacls</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>smbcacls</command> program</primary>
- </indexterm>
- <screen><command>smbcacls <replaceable>//server/share filename options</replaceable></command></screen>
- <para>The <command>smbcacls</command> program modifies Windows ACLs on files and directories shared by a Samba server or a Windows server.</para>
- <bridgehead id="s3-samba-programs-smbclient">
- <filename>smbclient</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>smbclient</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>smbclient</command> program</primary>
- </indexterm>
- <screen><command>smbclient <replaceable>//server/share password options</replaceable></command></screen>
- <para>The <command>smbclient</command> program is a versatile UNIX client which provides functionality similar to <command>ftp</command>.</para>
- <bridgehead id="s3-samba-programs-smbcontrol">
- <filename>smbcontrol</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>smbcontrol</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>smbcontrol</command> program</primary>
- </indexterm>
- <screen><command>smbcontrol -i <replaceable>options</replaceable></command></screen>
- <screen><command>smbcontrol <replaceable>options destination messagetype parameters</replaceable></command></screen>
- <para>The <command>smbcontrol</command> program sends control messages to running <command>smbd</command>, <command>nmbd</command>, or <command>winbindd</command> daemons. Executing <command>smbcontrol -i</command> runs commands interactively until a blank line or a <parameter>'q'</parameter> is entered.</para>
- <bridgehead id="s3-samba-programs-smbpasswd">
- <filename>smbpasswd</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>smbpasswd</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>smbpasswd</command> program</primary>
- </indexterm>
- <screen><command>smbpasswd <replaceable>options username password</replaceable></command></screen>
- <para>The <command>smbpasswd</command> program manages encrypted passwords. This program can be run by a superuser to change any user's password and also by an ordinary user to change their own Samba password.</para>
- <bridgehead id="s3-samba-programs-smbspool">
- <filename>smbspool</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>smbspool</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>smbspool</command> program</primary>
- </indexterm>
- <screen><command>smbspool <replaceable>job user title copies options filename</replaceable></command></screen>
- <para>The <command>smbspool</command> program is a CUPS-compatible printing interface to Samba. Although designed for use with CUPS printers, <command>smbspool</command> can work with non-CUPS printers as well.</para>
- <bridgehead id="s3-samba-programs-smbstatus">
- <filename>smbstatus</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>smbstatus</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>smbstatus</command> program</primary>
- </indexterm>
- <screen><command>smbstatus <replaceable>options</replaceable></command></screen>
- <para>The <command>smbstatus</command> program displays the status of current connections to a Samba server.</para>
- <bridgehead id="s3-samba-programs-smbtar">
- <filename>smbtar</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>smbtar</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>smbtar</command> program</primary>
- </indexterm>
- <screen><command>smbtar <replaceable>options</replaceable></command></screen>
- <para>The <command>smbtar</command> program performs backup and restores of Windows-based share files and directories to a local tape archive. Though similar to the <command>tar</command> command, the two are not compatible.</para>
- <bridgehead id="s3-samba-programs-testparm">
- <filename>testparm</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>testparm</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>testparm</command> program</primary>
- </indexterm>
- <screen><command>testparm <replaceable>options filename hostname IP_address</replaceable></command></screen>
- <para>The <command>testparm</command> program checks the syntax of the <filename>/etc/samba/smb.conf</filename> file. If your <filename>smb.conf</filename> file is in the default location (<filename>/etc/samba/smb.conf</filename>) you do not need to specify the location. Specifying the host name and <systemitem class="protocol">IP</systemitem> address to the <command>testparm</command> program verifies that the <filename>hosts.allow</filename> and <filename>host.deny</filename> files are configured correctly. The <command>testparm</command> program also displays a summary of your <filename>smb.conf</filename> file and the server's role (stand-alone, domain, etc.) after testing. This is convenient when debugging as it excludes comments and concisely presents information for experienced administrators to read.</para>
- <para>For example:</para>
- <screen>~]$ <command>testparm</command>
+ <bridgehead id="brid-Samba_Distribution_Programs-rpcclient" renderas="sect3"><systemitem>rpcclient</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>rpcclient</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>rpcclient</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>rpcclient <replaceable><server> <options></replaceable></command></synopsis>
+ <para>
+ The <systemitem>rpcclient</systemitem> program issues administrative commands using Microsoft RPCs, which provide access to the Windows administration graphical user interfaces (GUIs) for systems management. This is most often used by advanced users that understand the full complexity of Microsoft RPCs.
+ </para>
+ <bridgehead id="brid-Samba_Distribution_Programs-smbcacls" renderas="sect3"><systemitem>smbcacls</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>smbcacls</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>smbcacls</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>smbcacls <replaceable><//server/share> <filename> <options></replaceable></command></synopsis>
+ <para>
+ The <systemitem>smbcacls</systemitem> program modifies Windows ACLs on files and directories shared by a Samba server or a Windows server.
+ </para>
+ <bridgehead id="brid-Samba_Distribution_Programs-smbclient" renderas="sect3"><systemitem>smbclient</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>smbclient</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>smbclient</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>smbclient <replaceable><//server/share> <password> <options></replaceable></command></synopsis>
+ <para>
+ The <systemitem>smbclient</systemitem> program is a versatile UNIX client which provides functionality similar to the <systemitem>ftp</systemitem> utility.
+ </para>
+ <bridgehead id="brid-Samba_Distribution_Programs-smbcontrol" renderas="sect3"><systemitem>smbcontrol</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>smbcontrol</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>smbcontrol</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>smbcontrol -i <replaceable><options></replaceable></command></synopsis>
+ <synopsis><command>smbcontrol <replaceable><options> <destination> <messagetype> <parameters></replaceable></command></synopsis>
+ <para>
+ The <systemitem>smbcontrol</systemitem> program sends control messages to running <systemitem class="daemon">smbd</systemitem>, <systemitem class="daemon">nmbd</systemitem>, or <systemitem class="daemon">winbindd</systemitem> daemons. Executing <command>smbcontrol -i</command> runs commands interactively until a blank line or a <parameter>'q'</parameter> is entered.
+ </para>
+ <bridgehead id="brid-Samba_Distribution_Programs-smbpasswd" renderas="sect3"><systemitem>smbpasswd</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>smbpasswd</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>smbpasswd</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>smbpasswd <replaceable><options> <username> <password></replaceable></command></synopsis>
+ <para>
+ The <systemitem>smbpasswd</systemitem> program manages encrypted passwords. This program can be run by a superuser to change any user's password and also by an ordinary user to change their own Samba password.
+ </para>
+ <bridgehead id="brid-Samba_Distribution_Programs-smbspool" renderas="sect3"><systemitem>smbspool</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>smbspool</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>smbspool</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>smbspool <replaceable><job> <user> <title> <copies> <options> <filename></replaceable></command></synopsis>
+ <para>
+ The <systemitem>smbspool</systemitem> program is a CUPS-compatible printing interface to Samba. Although designed for use with CUPS printers, <command>smbspool</command> can work with non-CUPS printers as well.
+ </para>
+ <bridgehead id="brid-Samba_Distribution_Programs-smbstatus" renderas="sect3"><systemitem>smbstatus</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>smbstatus</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>smbstatus</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>smbstatus <replaceable><options></replaceable></command></synopsis>
+ <para>
+ The <systemitem>smbstatus</systemitem> program displays the status of current connections to a Samba server.
+ </para>
+ <bridgehead id="brid-Samba_Distribution_Programs-smbtar" renderas="sect3"><systemitem>smbtar</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>smbtar</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>smbtar</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>smbtar <replaceable><options></replaceable></command></synopsis>
+ <para>
+ The <systemitem>smbtar</systemitem> program performs backup and restores of Windows-based share files and directories to a local tape archive. Though similar to the <systemitem>tar</systemitem> utility, the two are not compatible.
+ </para>
+ <bridgehead id="brid-Samba_Distribution_Programs-testparm" renderas="sect3"><systemitem>testparm</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>testparm</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>testparm</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>testparm <replaceable><options> <filename> <hostname IP_address></replaceable></command></synopsis>
+ <para>
+ The <systemitem>testparm</systemitem> program checks the syntax of the <filename>/etc/samba/smb.conf</filename> file. If your <filename>smb.conf</filename> file is in the default location (<filename>/etc/samba/smb.conf</filename>) you do not need to specify the location. Specifying the host name and <systemitem class="protocol">IP</systemitem> address to the <systemitem>testparm</systemitem> program verifies that the <filename>hosts.allow</filename> and <filename>host.deny</filename> files are configured correctly. The <systemitem>testparm</systemitem> program also displays a summary of your <filename>smb.conf</filename> file and the server's role (stand-alone, domain, etc.) after testing. This is convenient when debugging as it excludes comments and concisely presents information for experienced administrators to read. For example:
+ </para>
+ <screen>
+~]$ <command>testparm</command>
Load smb config files from /etc/samba/smb.conf
Processing section "[homes]"
Processing section "[printers]"
@@ -1513,146 +1549,145 @@ Press enter to see a dump of your service definitions
log file = /var/log/samba/%m.log
max log size = 50
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
- dns proxy = No
+ dns proxy = no
[homes]
comment = Home Directories
- read only = No
- browseable = No
+ read only = no
+ browseable = no
[printers]
comment = All Printers
path = /var/spool/samba
- printable = Yes
- browseable = No
+ printable = yes
+ browseable = no
[tmp]
comment = Wakko tmp
path = /tmp
- guest only = Yes
+ guest only = yes
[html]
comment = Wakko www
path = /var/www/html
force user = andriusb
force group = users
- read only = No
- guest only = Yes</screen>
-
- <bridgehead id="s3-samba-programs-wbinfo">
- <filename>wbinfo</filename>
- </bridgehead>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Programs</secondary>
- <tertiary>
- <command>wbinfo</command>
- </tertiary>
- </indexterm>
- <indexterm>
- <primary>
- <command>wbinfo</command> program</primary>
- </indexterm>
- <screen><command>wbinfo <replaceable>options</replaceable></command></screen>
- <para>The <command>wbinfo</command> program displays information from the <command>winbindd</command> daemon. The <command>winbindd</command> daemon must be running for <command>wbinfo</command> to work.</para>
- </section>
- <section
- id="s2-samba-resources">
- <title>Additional Resources</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Additional Resources</secondary>
- </indexterm>
- <para>The following sections give you the means to explore Samba in greater detail.</para>
- <section
- id="s3-samba-resources-installed">
- <title>Installed Documentation</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Additional Resources</secondary>
- <tertiary>installed documentation</tertiary>
- </indexterm>
- <itemizedlist>
- <listitem>
-
- <para>
-<filename>/usr/share/doc/samba/</filename> — All additional files included with the Samba distribution. This includes all helper scripts, sample configuration files, and documentation.</para>
- </listitem>
- </itemizedlist>
- <para>
- See the following manual pages for detailed information about <application>Samba</application>:
- </para>
- <itemizedlist>
- <listitem>
- <para>
- <command>smb.conf</command>
- </para>
- </listitem>
- <listitem>
- <para>
- <command>samba</command>
- </para>
- </listitem>
- <listitem>
- <para>
- <command>smbd</command>
- </para>
- </listitem>
- <listitem>
- <para>
- <command>nmbd</command>
- </para>
- </listitem>
- <listitem>
- <para>
- <command>winbind</command>
- </para>
- </listitem>
- </itemizedlist>
- </section>
- <section
- id="s3-samba-resources-published">
- <title>Related Books</title>
- <indexterm
- significance="normal">
- <primary>Samba</primary>
- <secondary>Additional Resources</secondary>
- <tertiary>related books</tertiary>
- </indexterm>
- <itemizedlist>
- <listitem>
- <para>
- <citetitle>The Official Samba-3 HOWTO-Collection</citetitle> by John H. Terpstra and Jelmer R. Vernooij; Prentice Hall — The official Samba-3 documentation as issued by the Samba development team. This is more of a reference guide than a step-by-step guide.</para>
- </listitem>
- <listitem>
- <para>
- <citetitle>Samba-3 by Example</citetitle> by John H. Terpstra; Prentice Hall — This is another official release issued by the Samba development team which discusses detailed examples of OpenLDAP, DNS, DHCP, and printing configuration files. This has step-by-step related information that helps in real-world implementations.</para>
- </listitem>
- <listitem>
- <para>
- <citetitle>Using Samba, 2nd Edition</citetitle> by Jay T's, Robert Eckstein, and David Collier-Brown; O'Reilly — A good resource for novice to advanced users, which includes comprehensive reference material.</para>
- </listitem>
- </itemizedlist>
- </section>
- <section
- id="s3-samba-resources-community">
- <title>Useful Websites</title>
- <indexterm>
- <primary>Samba</primary>
- <secondary>Additional Resources</secondary>
- <tertiary>useful websites</tertiary>
- </indexterm>
- <itemizedlist>
- <listitem>
- <para>
- <ulink
- url="http://www.samba.org/">http://www.samba.org/</ulink> — Homepage for the Samba distribution and all official documentation created by the Samba development team. Many resources are available in HTML and PDF formats, while others are only available for purchase. Although many of these links are not &MAJOROS; specific, some concepts may apply.</para>
- </listitem>
- <listitem>
- <para>
- <ulink
- url="http://us1.samba.org/samba/archives.html">http://samba.org/samba/archives.html </ulink> — Active email lists for the Samba community. Enabling digest mode is recommended due to high levels of list activity.</para>
- </listitem>
- <listitem>
- <para>Samba newsgroups — Samba threaded newsgroups, such as <ulink url="http://www.gmane.org/">www.gmane.org</ulink>, that use the <systemitem class="protocol">NNTP</systemitem> protocol are also available. This an alternative to receiving mailing list emails.</para>
- </listitem>
- </itemizedlist>
- </section>
- </section>
+ read only = no
+ guest only = yes</screen>
+ <bridgehead id="brid-Samba_Distribution_Programs-wbinfo" renderas="sect3"><systemitem>wbinfo</systemitem></bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Programs</secondary>
+ <tertiary><systemitem>wbinfo</systemitem></tertiary>
+ </indexterm>
+ <indexterm>
+ <primary><systemitem>wbinfo</systemitem> program</primary>
+ </indexterm>
+ <synopsis><command>wbinfo <replaceable><options></replaceable></command></synopsis>
+ <para>
+ The <systemitem>wbinfo</systemitem> program displays information from the <systemitem class="daemon">winbindd</systemitem> daemon. The <systemitem class="daemon">winbindd</systemitem> daemon must be running for <systemitem>wbinfo</systemitem> to work.
+ </para>
+ </section>
+<section id="sect-Samba-Resources">
+ <title>Additional Resources</title>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Additional Resources</secondary>
+ </indexterm>
+ <para>
+ The following sections give you the means to explore Samba in greater detail.
+ </para>
+ <bridgehead id="brid-Samba-Resources-Installed_Documentation" renderas="sect3">Installed Documentation</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Additional Resources</secondary>
+ <tertiary>installed documentation</tertiary>
+ </indexterm>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <filename>/usr/share/doc/samba-<<replaceable>version-number</replaceable>>/</filename> — All additional files included with the Samba distribution. This includes all helper scripts, sample configuration files, and documentation.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ See the following man pages for detailed information specific <application>Samba</application> features:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <citerefentry><refentrytitle>smb.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <citerefentry><refentrytitle>samba</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <citerefentry><refentrytitle>smbd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <citerefentry><refentrytitle>nmbd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <citerefentry><refentrytitle>winbindd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+ </para>
+ </listitem>
+ </itemizedlist>
+ </listitem>
+ </itemizedlist>
+ <!--<bridgehead id="brid-Samba-Resources-Related_Books" renderas="sect3">Related Books</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Additional Resources</secondary>
+ <tertiary>related books</tertiary>
+ </indexterm>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <citetitle>The Official Samba-3 HOWTO-Collection</citetitle> by John H. Terpstra and Jelmer R. Vernooij; Prentice Hall — The official Samba-3 documentation as issued by the Samba development team. This is more of a reference guide than a step-by-step guide.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <citetitle>Samba-3 by Example</citetitle> by John H. Terpstra; Prentice Hall — This is another official release issued by the Samba development team which discusses detailed examples of OpenLDAP, DNS, DHCP, and printing configuration files. This has step-by-step related information that helps in real-world implementations.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <citetitle>Using Samba, 2nd Edition</citetitle> by Jay Ts, Robert Eckstein, and David Collier-Brown; O'Reilly — A good resource for novice to advanced users, which includes comprehensive reference material.
+ </para>
+ </listitem>
+ </itemizedlist>-->
+ <bridgehead id="brid-Samba-Resources-Useful_Websites" renderas="sect3">Useful Websites</bridgehead>
+ <indexterm>
+ <primary>Samba</primary>
+ <secondary>Additional Resources</secondary>
+ <tertiary>useful websites</tertiary>
+ </indexterm>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <ulink url="http://www.samba.org/">http://www.samba.org/</ulink> — Homepage for the Samba distribution and all official documentation created by the Samba development team. Many resources are available in HTML and PDF formats, while others are only available for purchase. Although many of these links are not &MAJOROS; specific, some concepts may apply.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <ulink url="https://wiki.samba.org/index.php/User_Documentation">https://wiki.samba.org/index.php/User_Documentation</ulink> — Samba 4.x official documentation.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <ulink url="http://us1.samba.org/samba/archives.html">http://samba.org/samba/archives.html </ulink> — Active email lists for the Samba community. Enabling digest mode is recommended due to high levels of list activity.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Samba newsgroups — Samba threaded newsgroups, such as <ulink url="http://www.gmane.org/">www.gmane.org</ulink>, that use the <systemitem class="protocol">NNTP</systemitem> protocol are also available. This an alternative to receiving mailing list emails.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </section>
</section>
8 years, 6 months
[system-administrators-guide/22] typo
by stephenw
commit 48e53ef630ae464bc6cbca6c8f8a73f0e5afe445
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Thu Jun 11 00:15:12 2015 +0200
typo
en-US/Viewing_and_Managing_Log_Files.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
---
diff --git a/en-US/Viewing_and_Managing_Log_Files.xml b/en-US/Viewing_and_Managing_Log_Files.xml
index 4010be1..cea5109 100644
--- a/en-US/Viewing_and_Managing_Log_Files.xml
+++ b/en-US/Viewing_and_Managing_Log_Files.xml
@@ -2628,7 +2628,7 @@ Fri 2013-08-02 14:41:22 CEST [s=e1021ca1b81e4fc688fad6a3ea21d35b;i=55c;b=78c8144
When you have at least one filter defined, it can be selected from the <guilabel>Filters</guilabel> menu and it will automatically search for the strings you have defined in the filter and highlight or hide every successful match in the log file you are currently viewing.
</para>
<figure id="fig-redhat-filter-enable">
- <title>System Log - enabled filter</title>
+ <title>System Log - enabling a filter</title>
<mediaobject>
<imageobject>
<imagedata fileref="images/redhat-filter-enable.png" format="PNG"/>
8 years, 6 months
[system-administrators-guide/22] Configuring rsyslog on a Logging Server
by stephenw
commit 3512a482359f188fea543b8b34015cb50e8187ce
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Thu Jun 11 00:12:51 2015 +0200
Configuring rsyslog on a Logging Server
en-US/Viewing_and_Managing_Log_Files.xml | 138 ++++++++++++++++++++++++++++++
1 files changed, 138 insertions(+), 0 deletions(-)
---
diff --git a/en-US/Viewing_and_Managing_Log_Files.xml b/en-US/Viewing_and_Managing_Log_Files.xml
index 6287d8b..4010be1 100644
--- a/en-US/Viewing_and_Managing_Log_Files.xml
+++ b/en-US/Viewing_and_Managing_Log_Files.xml
@@ -1409,6 +1409,144 @@ $ActionQueueSaveOnShutdown on
mentioned already? Sending syslog Messages over the Network
</para>
</section> -->
+
+ </section>
+ <section id="s1-configuring_rsyslog_on_a_logging_server">
+ <title>Configuring rsyslog on a Logging Server</title>
+ <para>
+ The <systemitem class="service">rsyslog</systemitem> service provides facilities both for running a logging server and for configuring individual systems to send their log files to the logging server. See <xref linkend="ex-net_forwarding_with_queue" /> for information on client rsyslog configuration.
+ </para>
+ <para>
+ The <systemitem class="service">rsyslog</systemitem> service must be installed on the system that you intend to use as a logging server and all systems that will be configured to send logs to it. Rsyslog is installed by default in &MAJOROSVER;. If required, to ensure that it is, enter the following command as <systemitem class="username">root</systemitem>:
+ </para>
+ <screen>~]# <command>yum install rsyslog</command></screen>
+ <para>
+ The steps in this procedure must be followed on the system that you intend to use as your logging server. All steps in this procedure must be made as the <systemitem>root</systemitem> user:
+ </para>
+ <procedure>
+ <step>
+ <para>
+ Configure the firewall to allow <systemitem>rsyslog</systemitem> <systemitem class="protocol">TCP</systemitem> traffic.
+ </para>
+ <substeps>
+ <step>
+ <para>
+ The default port for <systemitem class="service">rsyslog</systemitem> <systemitem class="protocol">TCP</systemitem> traffic is <literal>514</literal>. To allow <systemitem class="protocol">TCP</systemitem> traffic on this port, enter a command as follows:
+ </para>
+ <screen>~]# <command>firewall-cmd --zone=<replaceable>zone</replaceable> --add-port=514/tcp</command>
+success</screen>
+<para>
+Where <replaceable>zone</replaceable> is the zone of the interface to use.
+</para>
+ </step>
+ </substeps>
+ </step>
+ <step>
+ <para>
+ Open the <filename>/etc/rsyslog.conf</filename> file in a text editor and proceed as follows:
+ </para>
+ <substeps>
+ <step>
+ <para>
+ Add these lines below the modules section but above the <literal>Provides UDP syslog reception</literal> section:
+ </para>
+ <screen># Define templates before the rules that use them
+
+### Per-Host Templates for Remote Systems ###
+$template TmplAuthpriv, "/var/log/remote/auth/%HOSTNAME%/%PROGRAMNAME:::secpath-replace%.log"
+$template TmplMsg, "/var/log/remote/msg/%HOSTNAME%/%PROGRAMNAME:::secpath-replace%.log"</screen>
+ </step>
+ <step>
+ <para>
+ Replace the default <literal>Provides TCP syslog reception</literal> section with the following:
+ </para>
+ <screen># Provides TCP syslog reception
+$ModLoad imtcp
+# Adding this ruleset to process remote messages
+$RuleSet remote1
+authpriv.* ?TmplAuthpriv
+*.info;mail.none;authpriv.none;cron.none ?TmplMsg
+$RuleSet RSYSLOG_DefaultRuleset #End the rule set by switching back to the default rule set
+$InputTCPServerBindRuleset remote1 #Define a new input and bind it to the "remote1" rule set
+$InputTCPServerRun 514</screen>
+ </step>
+ </substeps>
+ <para>
+ Save the changes to the <filename>/etc/rsyslog.conf</filename> file.
+ </para>
+ </step>
+ <step>
+ <para>
+ The <systemitem>rsyslog</systemitem> service must be running on both the logging server and the systems attempting to log to it.
+ </para>
+ <substeps>
+ <step>
+ <para>
+ Use the <command>systemctl</command> command to start the <systemitem>rsyslog</systemitem> service.
+ </para>
+ <screen>~]# <userinput><command>systemctl start rsyslog</command></userinput></screen>
+ </step>
+ <step>
+ <para>
+ To ensure the <systemitem>rsyslog</systemitem> service starts automatically in future, enter the following command as root:
+ </para>
+ <screen>~]# <userinput><command>systemctl enable rsyslog</command></userinput></screen>
+ </step>
+ </substeps>
+ </step>
+ </procedure>
+ <para>
+ Your log server is now configured to receive and store log files from the other systems in your environment.
+ </para>
+
+ <section id="sec-Using_The_New_Template_Syntax_on_a_Logging_Server">
+ <title>Using The New Template Syntax on a Logging Server</title>
+ <para>
+ Rsyslog 7 has a number of different templates styles. The string template most closely resembles the legacy format. Reproducing the templates from the example above using the string format would look as follows:
+ <screen>template(name="TmplAuthpriv" type="string"
+ string="/var/log/remote/auth/%HOSTNAME%/%PROGRAMNAME:::secpath-replace%.log"
+ )
+
+template(name="TmplMsg" type="string"
+ string="/var/log/remote/msg/%HOSTNAME%/%PROGRAMNAME:::secpath-replace%.log"
+ )
+ </screen>
+ </para>
+<para>
+ These templates can also be written in the list format as follows:
+ <screen>
+template(name="TmplAuthpriv" type="list") {
+ constant(value="/var/log/remote/auth/")
+ property(name="hostname")
+ constant(value="/")
+ property(name="programname" SecurePath="replace")
+ constant(value=".log")
+ }</screen>
+ <screen>template(name="TmplMsg" type="list") {
+ constant(value="/var/log/remote/msg/")
+ property(name="hostname")
+ constant(value="/")
+ property(name="programname" SecurePath="replace")
+ constant(value=".log")
+ }</screen>
+ This template text format might be easier to read for those new to rsyslog and therefore can be easier to adapt as requirements change.</para>
+ <para>
+ To complete the change to the new syntax, we need to reproduce the module load command, add a rule set, and then bind the rule set to the protocol, port, and ruleset:
+ </para>
+<screen>
+module(load="imtcp")
+
+ruleset(name="remote1"){
+ authpriv.* action(type="omfile" DynaFile="TmplAuthpriv")
+ *.info;mail.none;authpriv.none;cron.none action(type="omfile" DynaFile="TmplMsg")
+}
+
+input(type="imtcp" port="514" ruleset="remote1")</screen>
+ <para>
+
+ </para>
+ </section>
+
</section>
<section id="s1-using_rsyslog_modules">
<title>Using Rsyslog Modules</title>
8 years, 6 months
[system-administrators-guide/22] Improvements from upstream version
by stephenw
commit 36d8225e50bd017501ca827444b4868be16911a2
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Thu Jun 11 00:08:54 2015 +0200
Improvements from upstream version
en-US/Viewing_and_Managing_Log_Files.xml | 149 +++++++++++++++++++++---------
1 files changed, 106 insertions(+), 43 deletions(-)
---
diff --git a/en-US/Viewing_and_Managing_Log_Files.xml b/en-US/Viewing_and_Managing_Log_Files.xml
index 9df50fe..6287d8b 100644
--- a/en-US/Viewing_and_Managing_Log_Files.xml
+++ b/en-US/Viewing_and_Managing_Log_Files.xml
@@ -11,9 +11,12 @@
<primary>log files</primary>
<secondary>description</secondary>
</indexterm>
- <para>
- <firstterm>Log files</firstterm> are files that contain messages about the system, including the kernel, services, and applications running on it. There are several types of log files for storing various information. For example, there is a default system log file, a log file just for security messages, and a log file for cron tasks. Log files can be very useful in many situations, for instance to troubleshoot a problem with the system, when trying to load a kernel driver, or when looking for unauthorized login attempts to the system.
- </para>
+ <para>
+ <firstterm>Log files</firstterm> are files that contain messages about the system, including the kernel, services, and applications running on it. There are different log files for different information. For example, there is a default system log file, a log file just for security messages, and a log file for cron tasks.
+ </para>
+ <para>
+ Log files can be very useful when trying to troubleshoot a problem with the system such as trying to load a kernel driver or when looking for unauthorized login attempts to the system. This chapter discusses where to find log files, how to view log files, and what to look for in log files.
+ </para>
<indexterm>
<primary>log files</primary>
<secondary><command>rsyslogd daemon</command></secondary>
@@ -22,7 +25,7 @@
<primary><application>rsyslog</application></primary>
</indexterm>
<para>
- Some log files are controlled by a daemon called <systemitem class="daemon">rsyslogd</systemitem>. The <systemitem class="daemon">rsyslogd</systemitem> daemon is an enhanced replacement for <application>syslogd</application>, and provides extended filtering, various configuration options, input and output modules, support for transportation via the <systemitem class="protocol">TCP</systemitem> or <systemitem class="protocol">UDP</systemitem> protocols. A list of log files maintained by <systemitem class="daemon">rsyslogd</systemitem> can be found in the <filename>/etc/rsyslog.conf</filename> configuration file. Most log files are located in the <filename>/var/log/</filename> directory.
+ Some log files are controlled by a daemon called <systemitem class="daemon">rsyslogd</systemitem>. The <systemitem class="daemon">rsyslogd</systemitem> daemon is an enhanced replacement for <application>sysklogd</application>, and provides extended filtering, encryption protected relaying of messages, various configuration options, input and output modules, support for transportation via the <systemitem class="protocol">TCP</systemitem> or <systemitem class="protocol">UDP</systemitem> protocols. Note that <application>rsyslog</application> is compatible with <application>sysklogd</application>.
</para>
<para>
Log files can also be managed by the <systemitem class="daemon">journald</systemitem> daemon – a component of <systemitem class="daemon">systemd</systemitem>. The <systemitem class="daemon">journald</systemitem> daemon captures Syslog messages, kernel log messages, initial RAM disk and early boot messages as well as messages written to standard output and standard error output of all services, indexes them and makes this available to the user. The native journal file format, which is a structured and indexed binary file, improves searching and provides faster operation, and it also stores meta data information like time stamps or user IDs. Log files produced by <systemitem class="daemon">journald</systemitem> are by default not persistent, log files are stored only in memory or a small ring-buffer in the <filename class="directory">/run/log/journal/</filename> directory. The amount of logged data depends on free memory, when you reach the capacity limit, the oldes
t entries are deleted. However, this setting can be altered – see <xref linkend="s2-Enabling_Persistent_Storage"/>. For more information on Journal see <xref linkend="s1-Using_the_Journal"/>.
@@ -36,23 +39,32 @@
<primary>log files</primary>
<secondary>locating</secondary>
</indexterm>
- <para>Most log files are located in the <filename>/var/log/</filename> directory. Some applications such as <command>httpd</command> and <command>samba</command> have a directory within <filename>/var/log/</filename> for their log files.</para>
+ <para>
+ A list of log files maintained by <systemitem class="daemon">rsyslogd</systemitem> can be found in the <filename>/etc/rsyslog.conf</filename> configuration file. Most log files are located in the <filename>/var/log/</filename> directory. Some applications such as <command>httpd</command> and <command>samba</command> have a directory within <filename>/var/log/</filename> for their log files.</para>
<indexterm>
<primary>log files</primary>
<secondary>rotating</secondary>
</indexterm>
<indexterm>
<primary><command>logrotate</command></primary>
- </indexterm>
+ </indexterm>
<para>You may notice multiple files in the <filename>/var/log/</filename> directory with numbers after them (for example, <filename>cron-20100906</filename>). These numbers represent a time stamp that has been added to a rotated log file. Log files are rotated so their file sizes do not become too large. The <filename>logrotate</filename> package contains a cron task that automatically rotates log files according to the <filename>/etc/logrotate.conf</filename> configuration file and the configuration files in the <filename class="directory">/etc/logrotate.d/</filename> directory.</para>
</section>
<section id="s1-basic_configuration_of_rsyslog">
<title>Basic Configuration of Rsyslog</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>configuration</secondary>
+ </indexterm>
<para>
The main configuration file for <application>rsyslog</application> is <filename>/etc/rsyslog.conf</filename>. Here, you can specify <firstterm>global directives</firstterm>, <firstterm>modules</firstterm>, and <firstterm>rules</firstterm> that consist of <firstterm>filter</firstterm> and <firstterm>action</firstterm> parts. Also, you can add comments in the form of text following a hash sign (<literal>#</literal>).
</para>
<section id="s2-Filters">
<title>Filters</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>filters</secondary>
+ </indexterm>
<para>
A rule is specified by a <emphasis>filter</emphasis> part, which selects a subset of syslog messages, and an <emphasis>action</emphasis> part, which specifies what to do with the selected messages. To define a rule in your <filename>/etc/rsyslog.conf</filename> configuration file, define both, a filter and an action, on one line and separate them with one or more spaces or tabs.
</para>
@@ -238,7 +250,7 @@ cron.!info,!debug
<term>Expression-based filters</term>
<listitem>
<para>
- Expression-based filters select syslog messages according to defined arithmetic, Boolean or string operations. Expression-based filters use <application>rsyslog</application>'s own scripting language called <emphasis>RainerScript</emphasis> to build complex filters. See <xref linkend="brid-Log_Files-Resources-Online"/> for the syntax definition of this script along with examples of various expression-based filters. Also RainerScript is a basis for <application>rsyslog</application>'s new configuration format, see <xref linkend="s2-using_the_new_configuration_format"/>
+ Expression-based filters select syslog messages according to defined arithmetic, Boolean or string operations. Expression-based filters use <application>rsyslog</application>'s own scripting language called <emphasis>RainerScript</emphasis> to build complex filters.
</para>
<para>
The basic syntax of expression-based filter looks as follows:
@@ -257,17 +269,17 @@ if <replaceable>EXPRESSION</replaceable> then <replaceable>ACTION</replaceable>
</listitem>
<listitem>
<para>
- The <replaceable>action</replaceable> attribute represents an action to be performed if the expression returns the value <literal>true</literal>. this can be a single action, or an arbitrary complex script enclosed in curly braces.
+ The <replaceable>ACTION</replaceable> attribute represents an action to be performed if the expression returns the value <literal>true</literal>. This can be a single action, or an arbitrary complex script enclosed in curly braces.
</para>
</listitem>
<listitem>
<para>
- Expression-based filters are indicated by the keyword <emphasis>if</emphasis> at the start of a new line. the <emphasis>then</emphasis> keyword separates the <replaceable>expression</replaceable> from the <replaceable>action</replaceable>. optionally, you can employ the <emphasis>else</emphasis> keyword to specify what action is to be performed in case the condition is not met.
+ Expression-based filters are indicated by the keyword <emphasis>if</emphasis> at the start of a new line. The <emphasis>then</emphasis> keyword separates the <replaceable>EXPRESSION</replaceable> from the <replaceable>ACTION</replaceable>. Optionally, you can employ the <emphasis>else</emphasis> keyword to specify what action is to be performed in case the condition is not met.
</para>
</listitem>
</itemizedlist>
<para>
- With expression-based filters, you can nest the conditions by using a script enclosed in curly braces as in <xref linkend="ex-expression-based_filters"/>. the script allows you to use <emphasis>facility/priority-based</emphasis> filters inside the expression. on the other hand, <emphasis>property-based</emphasis> filters are not recommended here. RainerScript supports regular expressions with specialized functions <function>re_match()</function> and <function>re_extract()</function>.
+ With expression-based filters, you can nest the conditions by using a script enclosed in curly braces as in <xref linkend="ex-expression-based_filters"/>. The script allows you to use <emphasis>facility/priority-based</emphasis> filters inside the expression. On the other hand, <emphasis>property-based</emphasis> filters are not recommended here. RainerScript supports regular expressions with specialized functions <function>re_match()</function> and <function>re_extract()</function>.
</para>
<example id="ex-expression-based_filters">
<title>Expression-based Filters</title>
@@ -287,9 +299,16 @@ if $programname == 'prog1' then {
</listitem>
</varlistentry>
</variablelist>
+ <para>
+ See <xref linkend="brid-Log_Files-Resources-Online"/> for more examples of various expression-based filters. RainerScript is the basis for <application>rsyslog</application>'s new configuration format, see <xref linkend="sec-using_the_new_configuration_format"/>
+ </para>
</section>
<section id="s2-Actions">
<title>Actions</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>actions</secondary>
+ </indexterm>
<para>
Actions specify what is to be done with the messages filtered out by an already-defined selector. The following are some of the actions you can define in your rule:
</para>
@@ -554,7 +573,7 @@ $ModLoad ompgsql # Output module for PostgreSQL support
</variablelist>
<bridgehead>Specifying Multiple Actions</bridgehead>
<para>
- For each selector, you are allowed to specify multiple actions. To specify multiple actions for one selector, write each action on a separate line and precede it with an ampersand character (&):
+ For each selector, you are allowed to specify multiple actions. To specify multiple actions for one selector, write each action on a separate line and precede it with an ampersand (&) character:
</para>
<screen>
<replaceable>FILTER</replaceable> <replaceable>ACTION</replaceable>
@@ -587,6 +606,10 @@ kern.=crit user1
</section>
<section id="s2-Templates">
<title>Templates</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>templates</secondary>
+ </indexterm>
<para>
Any output that is generated by <application>rsyslog</application> can be modified and formatted according to your needs with the use of <emphasis>templates</emphasis>. To create a template use the following syntax in <filename>/etc/rsyslog.conf</filename>:
</para>
@@ -783,6 +806,10 @@ kern.=crit user1
</section>
<section id="s2-global_directives">
<title>Global Directives</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>global directives</secondary>
+ </indexterm>
<para>
Global directives are configuration options that apply to the <systemitem class="daemon">rsyslogd</systemitem> daemon. They usually specify a value for a specific predefined variable that affects the behavior of the <systemitem class="daemon">rsyslogd</systemitem> daemon or a rule that follows. All of the global directives must start with a dollar sign (<literal>$</literal>). Only one directive can be specified per line. The following is an example of a global directive that specifies the maximum size of the syslog message queue:
</para>
@@ -793,11 +820,15 @@ $MainMsgQueueSize 50000
The default size defined for this directive (<constant>10,000</constant> messages) can be overridden by specifying a different value (as shown in the example above).
</para>
<para>
- You may define multiple directives in your <filename>/etc/rsyslog.conf</filename> configuration file. A directive affects the behavior of all configuration options until another occurrence of that same directive is detected. Global directives can be used to configure actions, queues and for debugging. A comprehensive list of all available configuration directives can be found in <xref linkend="brid-Log_Files-Resources-Online"/>. Currently, a new configuration format has been developed that replaces the $-based syntax (see <xref linkend="s2-using_the_new_configuration_format"/>). However, classic global directives remain supported as a legacy format.
+ You can define multiple directives in your <filename>/etc/rsyslog.conf</filename> configuration file. A directive affects the behavior of all configuration options until another occurrence of that same directive is detected. Global directives can be used to configure actions, queues and for debugging. A comprehensive list of all available configuration directives can be found in <xref linkend="brid-Log_Files-Resources-Online"/>. Currently, a new configuration format has been developed that replaces the $-based syntax (see <xref linkend="sec-using_the_new_configuration_format"/>). However, classic global directives remain supported as a legacy format.
</para>
</section>
<section id="s2-log_rotation">
<title>Log Rotation</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>log rotation</secondary>
+ </indexterm>
<para>
The following is a sample <filename>/etc/logrotate.conf</filename> configuration file:
</para>
@@ -881,7 +912,7 @@ compress
</listitem>
<listitem>
<para>
- <parameter>compressoptions</parameter> — Lets you specify any options that may be passed to the used compression program.
+ <parameter>compressoptions</parameter> — Specifies any options to be passed to the compression program used.
</para>
</listitem>
<listitem>
@@ -926,16 +957,22 @@ compress
For the full list of directives and various configuration options, see the <filename>logrotate(5)</filename> manual page.
</para>
</section>
- <section id="s2-using_the_new_configuration_format">
+ </section>
+ <section id="sec-using_the_new_configuration_format">
<title>Using the New Configuration Format</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>new configuration format</secondary>
+ </indexterm>
+
<para>
- In <application>rsyslog</application> version 6, a new configuration syntax has been introduced. This new configuration format aims to be more powerful, more intuitive, and to prevent common mistakes by not permitting certain invalid constructs. The syntax enhancement is enabled by the new configuration processor that relies on RainerScript. The legacy format is still fully supported and it is used by default in the <filename>/etc/rsyslog.conf</filename> configuration file.
+ In <application>rsyslog</application> version 6, a new configuration syntax was introduced. This new configuration format aims to be more powerful, more intuitive, and to prevent common mistakes by not permitting certain invalid constructs. The syntax enhancement is enabled by the new configuration processor that relies on RainerScript. The legacy format is still fully supported and it is used by default in the <filename>/etc/rsyslog.conf</filename> configuration file.
</para>
<para>
- RainerScript is a scripting language designed for processing network events and configuring event processors such as <application>rsyslog</application>. RainerScript was primarily used to define expression-based filters, see <xref linkend="ex-expression-based_filters"/>. The newest version of RainerScript implements the <function>input()</function> and <function>ruleset()</function> statements, which permit the <filename>/etc/rsyslog.conf</filename> configuration file to be written in the new style only.
+ RainerScript is a scripting language designed for processing network events and configuring event processors such as <application>rsyslog</application>. RainerScript was first used to define expression-based filters, see <xref linkend="ex-expression-based_filters"/>. The version of RainerScript in rsyslog version 7 implemented the <function>input()</function> and <function>ruleset()</function> statements, which permit the <filename>/etc/rsyslog.conf</filename> configuration file to be written in the new syntax. The new syntax differs mainly in that it is much more structured; parameters are passed as arguments to statements, such as input, action, template, and module load. The scope of options is limited by blocks. This enhances readability and reduces the number of bugs caused by misconfiguration. There is also a significant performance gain. Some functionality is exposed in both syntaxes, some only in the new one.
</para>
<para>
- In the following examples you can compare the configuration written with legacy-style parameters:
+ Compare the configuration written with legacy-style parameters:
</para>
<screen>
$InputFileName /tmp/inputfile
@@ -944,7 +981,7 @@ $InputFileStateFile inputfile-state
$InputRunFileMonitor
</screen>
<para>
- and the same configuration with use of the new format statement:
+ and the same configuration with the use of the new format statement:
</para>
<screen>
input(type="imfile" file="/tmp/inputfile" tag="tag1:" statefile="inputfile-state")
@@ -952,31 +989,37 @@ input(type="imfile" file="/tmp/inputfile" tag="tag1:" statefile="inputfile-state
<para>
This significantly reduces the number of parameters used in configuration, improves readability, and also provides higher execution speed. For more information on RainerScript statements and parameters see <xref linkend="brid-Log_Files-Resources-Online"/>.
</para>
- </section>
- <section id="s2-Rulesets">
+
+ <section id="sec-Rulesets">
<title>Rulesets</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>rulesets</secondary>
+ </indexterm>
+
<para>
Leaving special directives aside, <application>rsyslog</application> handles messages as defined by <emphasis>rules</emphasis> that consist of a filter condition and an action to be performed if the condition is true. With a traditionally written <filename>/etc/rsyslog.conf</filename> file, all rules are evaluated in order of appearance for every input message. This process starts with the first rule and continues until all rules have been processed or until the message is discarded by one of the rules.
</para>
<para>
- However, rules can be grouped into sequences called <firstterm>rulesets</firstterm>. With rulesets, you can limit the effect of certain rules only to selected inputs or enhance the performance of <application>rsyslog</application> by defining a distinct set of actions bound to a specific input. In other words, filter conditions that will be inevitably evaluated as false for certain types of messages can be skipped. With the new configuration format, the <function>input()</function> and <function>ruleset()</function> statements are reserved for this operation. The ruleset definition in <filename>/etc/rsyslog.conf</filename> can look as follows:
+ However, rules can be grouped into sequences called <firstterm>rulesets</firstterm>. With rulesets, you can limit the effect of certain rules only to selected inputs or enhance the performance of <application>rsyslog</application> by defining a distinct set of actions bound to a specific input. In other words, filter conditions that will be inevitably evaluated as false for certain types of messages can be skipped. The legacy ruleset definition in <filename>/etc/rsyslog.conf</filename> can look as follows:</para>
+ <screen>
+$RuleSet <replaceable>rulesetname</replaceable>
+<replaceable>rule</replaceable>
+<replaceable>rule2</replaceable></screen>
+<para>
+The rule ends when another rule is defined, or the default ruleset is called as follows:</para>
+<screen>$RuleSet RSYSLOG_DefaultRuleset</screen>
+ <para>
+ With the new configuration format in rsyslog 7, the <function>input()</function> and <function>ruleset()</function> statements are reserved for this operation. The new format ruleset definition in <filename>/etc/rsyslog.conf</filename> can look as follows:
</para>
<screen>
ruleset(name="<replaceable>rulesetname</replaceable>") {
- <replaceable>rule</replaceable>
+ <replaceable>rule</replaceable>
<replaceable>rule2</replaceable>
call <replaceable>rulesetname2</replaceable>
…
}
</screen>
- <!--
- <screen>
-$RuleSet <replaceable>rulesetname</replaceable>
-<replaceable>rule</replaceable>
-<replaceable>rule2</replaceable>
-call <replaceable>rulesetname2</replaceable>
-…
- </screen>-->
<para>
Replace <replaceable>rulesetname</replaceable> with an identifier for your ruleset. The ruleset name cannot start with <literal>RSYSLOG_</literal> since this namespace is reserved for use by <application>rsyslog</application>. <literal>RSYSLOG_DefaultRuleset</literal> then defines the default set of rules to be performed if the message has no other ruleset assigned. With <replaceable>rule</replaceable> and <replaceable>rule2</replaceable> you can define rules in filter-action format mentioned above. With the <parameter>call</parameter> parameter, you can nest rulesets by calling them from inside other ruleset blocks.
</para>
@@ -1016,7 +1059,7 @@ input(type="imtcp" port="10515" ruleset="remote-10515");
<section id="s2-compatibility_with_syslogd">
<title>Compatibility with syslogd</title>
<para>
- From <application>rsyslog</application> version 6, compatibility mode specified via the <option>-c</option> option has been removed. Also, the syslogd-style command line options are deprecated and configuring <application>rsyslog</application> through these command line options should be avoided. However, you can use several templates and directives to configure <systemitem class="daemon">rsyslogd</systemitem> to emulate syslogd-like behavior.
+ From <application>rsyslog</application> version 6, compatibility mode specified via the <option>-c</option> option has been removed. Also, the syslogd-style command-line options are deprecated and configuring <application>rsyslog</application> through these command-line options should be avoided. However, you can use several templates and directives to configure <systemitem class="daemon">rsyslogd</systemitem> to emulate syslogd-like behavior.
</para>
<para>
For more information on various <systemitem class="daemon">rsyslogd</systemitem> options, see the <filename>rsyslogd(8)</filename>manual page.
@@ -1025,6 +1068,11 @@ input(type="imtcp" port="10515" ruleset="remote-10515");
</section>
<section id="s1-working_with_queues_in_rsyslog">
<title>Working with Queues in Rsyslog</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>queues</secondary>
+ </indexterm>
+
<para>
Queues are used to pass content, mostly syslog messages, between components of <application>rsyslog</application>. With queues, rsyslog is capable of processing multiple messages simultaneously and to apply several actions to a single message at once. The data flow inside <application>rsyslog</application> can be illustrated as follows:
</para>
@@ -1066,6 +1114,11 @@ input(type="imtcp" port="10515" ruleset="remote-10515");
<para>
Apart from this, queues can be configured with several directives to provide optimal performance for your system. These configuration options are covered in the following sections.
</para>
+ <warning>
+ <para>
+ If an output plug-in is unable to deliver a message, it is stored in the preceding message queue. If the queue fills, the inputs block until it is no longer full. This will prevent new messages from being logged via the blocked queue. In the absence of separate action queues this can have severe consequences, such as preventing <systemitem class="protocol">SSH</systemitem> logging, which in turn can prevent <systemitem class="protocol">SSH</systemitem> access. Therefore it is advised to use dedicated action queues for outputs which are forwarded over a network or to a database.
+ </para>
+ </warning>
<section id="s2-defining_queues">
<title>Defining Queues</title>
<para>
@@ -1081,7 +1134,7 @@ input(type="imtcp" port="10515" ruleset="remote-10515");
</para>
<!-- about action queues in new fmt
<para>
- Queues are defined inside the <function>action()</function> object that can stand both separately or inside a ruleset in <filename>etc/rsyslog.conf</filename> . To configure an action queue, type:
+ Queues are defined inside the <function>action()</function> object that can stand both separately or inside a ruleset in <filename>/etc/rsyslog.conf</filename>. To configure an action queue, type:
</para>
<synopsis>action(type="<replaceable>action_type</replaceable>" queue.size="<replaceable>queue_size</replaceable>" queue.type="<replaceable>queue_type</replaceable>" file="<replaceable>path</replaceable>")</synopsis>
<para>
@@ -1090,7 +1143,7 @@ input(type="imtcp" port="10515" ruleset="remote-10515");
<example id="ex-defining_an_action_queue">
<title>Defining an Action Queue</title>
<para>
- To configures the output action with an (asynchronous) linked-list based action queue which can hold a maximum of 10,000 messages, use the following syntax:
+ To configure the output action with an (asynchronous) linked-list based action queue which can hold a maximum of 10,000 messages, use the following syntax:
</para>
<synopsis>action(type="omfile" queue.size="10000" queue.type="linkedlist" file="/var/log/logfile")</synopsis>
</example>
@@ -1177,7 +1230,7 @@ input(type="imtcp" port="10515" ruleset="remote-10515");
<step>
<para>
Create a working directory to store the queue files. For example:
- </para>
+ </para>
<synopsis>~]# <command>mkdir</command> <filename class="directory">/rsyslog/work/</filename></synopsis>
</step>
<step>
@@ -1265,7 +1318,7 @@ $ActionQueueSaveOnShutdown on
<section id="s2-managing_queues">
<title>Managing Queues</title>
<para>
- All types of queues can be further configured to match your requirements. You can use several directives to modify both action queues and the main message queue. Currently, there are more than 20 queue parameters available, see <xref linkend="brid-Log_Files-Resources-Online"/>. Some of these settings are used commonly, others, such as worker thread management, provide closer control over the queue behavior and are reserved for advanced users. With advanced settings, you can optimize <application>rsyslog</application>'s performance, schedule queuing, or modify the behavior of queue on system shutdown.
+ All types of queues can be further configured to match your requirements. You can use several directives to modify both action queues and the main message queue. Currently, there are more than 20 queue parameters available, see <xref linkend="brid-Log_Files-Resources-Online"/>. Some of these settings are used commonly, others, such as worker thread management, provide closer control over the queue behavior and are reserved for advanced users. With advanced settings, you can optimize <application>rsyslog</application>'s performance, schedule queuing, or modify the behavior of a queue on system shutdown.
</para>
<bridgehead id="br-limiting_queue_size">Limiting Queue Size</bridgehead>
<para>
@@ -1359,6 +1412,11 @@ $ActionQueueSaveOnShutdown on
</section>
<section id="s1-using_rsyslog_modules">
<title>Using Rsyslog Modules</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>modules</secondary>
+ </indexterm>
+
<para>
Due to its modular design, <application>rsyslog</application> offers a variety of <firstterm>modules</firstterm> which provide additional functionality. Note that modules can be written by third parties. Most modules provide additional inputs (see <emphasis>Input Modules</emphasis> below) or outputs (see <emphasis>Output Modules</emphasis> below). Other modules provide special functionality specific to each module. The modules may provide additional configuration directives that become available after a module is loaded. To load a module, use the following syntax:
</para>
@@ -1377,12 +1435,12 @@ $ModLoad imfile
<itemizedlist>
<listitem>
<para>
- Input Modules — Input modules gather messages from various sources. The name of an input module always starts with the <literal>im</literal> prefix, such as <command>imfile</command>, <command>imjournal</command>, etc.
+ Input Modules — Input modules gather messages from various sources. The name of an input module always starts with the <literal>im</literal> prefix, such as <command>imfile</command> and <command>imjournal</command>.
</para>
</listitem>
<listitem>
<para>
- Output Modules — Output modules provide a facility to issue message to various targets such as sending across a network, storing in a database, or encrypting. The name of an output module always starts with the <literal>om</literal> prefix, such as <command>omsnmp</command>, <command>omrelp</command>, etc.
+ Output Modules — Output modules provide a facility to issue message to various targets such as sending across a network, storing in a database, or encrypting. The name of an output module always starts with the <literal>om</literal> prefix, such as <command>omsnmp</command>, <command>omrelp</command>, and so on.
</para>
</listitem>
<listitem>
@@ -1417,7 +1475,7 @@ $ModLoad imfile
<section id="s2-importing_text_files">
<title>Importing Text Files</title>
<para>
- The Text File Input Module, abbreviated as <command>imfile</command>, enables <application>rsyslog</application> to convert any text file into a stream of syslog messages. You can use <command>imfile</command> to import log messages from applications that create their own text file logs. To load <command>imfile</command>, add the following into <filename>etc/rsyslog.conf</filename>:
+ The Text File Input Module, abbreviated as <command>imfile</command>, enables <application>rsyslog</application> to convert any text file into a stream of syslog messages. You can use <command>imfile</command> to import log messages from applications that create their own text file logs. To load <command>imfile</command>, add the following into <filename>/etc/rsyslog.conf</filename>:
</para>
<screen>
$ModLoad imfile
@@ -1508,7 +1566,7 @@ $ActionLibdbiDBName <replaceable>db_name</replaceable>
*.* :omlibdbi:
</screen>
<para>
- Here, replace <replaceable>driver</replaceable> with a driver name (mysql), <replaceable>host</replaceable> with a hostname <replaceable>user</replaceable> with username, <replaceable>pwd</replaceable> with a pasword for your database, <replaceable>db_name</replaceable> with a unique name for your database.
+ Here, replace <replaceable>driver</replaceable> with a driver name (mysql), <replaceable>host</replaceable> with a host name <replaceable>user</replaceable> with user name, <replaceable>pwd</replaceable> with a password for your database, <replaceable>db_name</replaceable> with a unique name for your database.
</para> -->
<example id="ex-exporting_rsyslog_messages_to_a_database">
<title>Exporting Rsyslog Messages to a Database</title>
@@ -1897,7 +1955,7 @@ $AddUnixListenSocket /run/systemd/journal/syslog
template(name="CEETemplate" type="string" string="%TIMESTAMP% %HOSTNAME% %syslogtag% @cee: %$!all-json%\n")
</screen>
<para>
- This template prepends the <literal>@cee:</literal> string to the JSON string and can be applied, for example, when creating an output file with <systemitem>omfile</systemitem> module. To access JSON field names, use the <emphasis role="bold">$!</emphasis> prefix. For example, the following filter condition searches for messages with specific <emphasis>hostname</emphasis> and <emphasis>UID</emphasis> :
+ This template prepends the <literal>@cee:</literal> string to the JSON string and can be applied, for example, when creating an output file with <systemitem>omfile</systemitem> module. To access JSON field names, use the <emphasis role="bold">$!</emphasis> prefix. For example, the following filter condition searches for messages with specific <emphasis>hostname</emphasis> and <emphasis>UID</emphasis>:
</para>
<screen>
($!hostname == "<replaceable>hostname</replaceable>" && $!UID== "<replaceable>UID</replaceable>")
@@ -1928,7 +1986,7 @@ $ModLoad mmjsonparse
<application>Rsyslog</application> supports storing JSON logs in the <database class="name">MongoDB</database> document database through the <emphasis>ommongodb</emphasis> output module.
</para>
<para>
- To forward log messages into <database class="name">MongoDB</database>, use the following syntax in the <filename>/etc/rsyslog.conf</filename> (configuration parameters for <emphasis>ommongodb</emphasis> are available only in the new configuration format; see <xref linkend="s2-using_the_new_configuration_format" />):
+ To forward log messages into <database class="name">MongoDB</database>, use the following syntax in the <filename>/etc/rsyslog.conf</filename> (configuration parameters for <emphasis>ommongodb</emphasis> are available only in the new configuration format; see <xref linkend="sec-using_the_new_configuration_format" />):
</para>
<screen>
$ModLoad ommongodb
@@ -1953,12 +2011,17 @@ $ModLoad ommongodb
</listitem>
</itemizedlist>
<para>
- You can shape the form of the final database output with use of templates. By default, <application>ryslog</application> uses a template based on standard <application>lumberjack</application> field names.
+ You can shape the form of the final database output with use of templates. By default, <application>rsyslog</application> uses a template based on standard <application>lumberjack</application> field names.
</para>
</section>
</section>
<section id="s1-debugging_rsyslog">
<title>Debugging Rsyslog</title>
+ <indexterm>
+ <primary><application>rsyslog</application></primary>
+ <secondary>debugging</secondary>
+ </indexterm>
+
<para>
To run <systemitem class="daemon">rsyslogd</systemitem> in debugging mode, use the following command:
</para>
@@ -1974,7 +2037,7 @@ export RSYSLOG_DEBUG="Debug"
Replace <replaceable>path</replaceable> with a desired location for the file where the debugging information will be logged. For a complete list of options available for the RSYSLOG_DEBUG variable, see the related section in the <filename>rsyslogd(8)</filename> manual page.
</para>
<para>
- To check if syntax used in the <filename>etc/rsyslog.conf</filename> file is valid use:
+ To check if syntax used in the <filename>/etc/rsyslog.conf</filename> file is valid use:
</para>
<synopsis><systemitem class="daemon">rsyslogd</systemitem> <option>-N</option> <literal>1</literal></synopsis>
<para>
8 years, 6 months
[system-administrators-guide] Enabling and Disabling SSL and TLS in mod_ssl
by stephenw
commit 9f447a87095466c6005af454a602a4e659ae437f
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Mon Oct 26 08:40:47 2015 +0100
Enabling and Disabling SSL and TLS in mod_ssl
en-US/The_Apache_HTTP_Server.xml | 101 +++++++++++++++++++++++++++++++++++++-
1 files changed, 100 insertions(+), 1 deletions(-)
---
diff --git a/en-US/The_Apache_HTTP_Server.xml b/en-US/The_Apache_HTTP_Server.xml
index 7a31005..139ca52 100644
--- a/en-US/The_Apache_HTTP_Server.xml
+++ b/en-US/The_Apache_HTTP_Server.xml
@@ -3954,7 +3954,106 @@ ErrorDocument 404 /404-not_found.html</programlisting>
<para>
This will create the <systemitem class="resource">mod_ssl</systemitem> configuration file at <filename>/etc/httpd/conf.d/ssl.conf</filename>, which is included in the main Apache HTTP Server configuration file by default. For the module to be loaded, restart the <systemitem class="service">httpd</systemitem> service as described in <xref linkend="s3-apache-running-restarting" />.
</para>
- </section>
+
+ <important>
+ <para>
+ Due to the SSL3.0 protocol vulnerability CVE-2014-3566, described in <ulink url="https://www.us-cert.gov/ncas/alerts/TA14-290A">SSL 3.0 Protocol Vulnerability and POODLE Attack</ulink>, it is recommended to disable <systemitem class="protocol">SSL</systemitem> and use only <systemitem class="protocol">TLSv1.1</systemitem> or <systemitem class="protocol">TLSv1.2</systemitem>. Backwards compatibility can be achieved using <systemitem class="protocol">TLSv1.0</systemitem>. Many products have the ability to use <systemitem class="protocol">SSLv2</systemitem> or <systemitem class="protocol">SSLv3</systemitem> protocols, or enable them by default. However, the use of <systemitem class="protocol">SSLv2</systemitem> or <systemitem class="protocol">SSLv3</systemitem> is now strongly recommended against.
+ </para>
+ </important>
+
+ </section>
+
+ <section id="s3-apache-Enabling_and_Disabling_SSL_and_TLS_in_mod_ssl">
+ <title>Enabling and Disabling SSL and TLS in mod_ssl</title>
+ <para>
+ To disable and enable specific versions of the SSL and TLS protocol, either do it globally by adding the <command>SSLProtocol</command> directive in the <quote>## SSL Global Context</quote> section of the configuration file and removing it everywhere else, or edit the default entry under <quote># SSL Protocol support</quote> in all <quote>VirtualHost</quote> sections. If you do not specify it in the per-domain VirtualHost section then it will inherit the settings from the global section. To make sure that a protocol version is being disabled the administrator should either <emphasis role="bold">only</emphasis> specify <command>SSLProtocol</command> in the <quote>SSL Global Context</quote> section, or specify it in <emphasis role="bold">all</emphasis> per-domain VirtualHost sections.
+ </para>
+<procedure id="proc-Disable_SSLv2_and_SSLv3">
+<title>Disable SSLv2 and SSLv3</title>
+<para>
+ To disable SSL version 2 and SSL version 3, which implies enabling everything except SSL version 2 and SSL version 3, in all VirtualHost sections, proceed as follows:
+</para>
+<step>
+ <para>
+ As <systemitem class="username">root</systemitem>, open the <filename>/etc/httpd/conf.d/ssl.conf</filename> file and search for <emphasis role="bold">all</emphasis> instances of the <command>SSLProtocol</command> directive. By default, the configuration file contains one section that looks as follows:
+ <screen>~]# <command>vi /etc/httpd/conf.d/ssl.conf</command>
+# SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect. Disable SSLv2 access by default:
+SSLProtocol all -SSLv2</screen>
+This section is within the VirtualHost section.
+ </para>
+</step>
+<step>
+ <para>
+ Edit the <command>SSLProtocol</command> line as follows:
+<screen># SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect. Disable SSLv2 access by default:
+SSLProtocol All -SSLv2 -SSLv3</screen>
+Repeat this action for all VirtualHost sections.
+ </para>
+</step>
+<step>
+ <para>
+ Verify that all occurrences of the <command>SSLProtocol</command> directive have been changed as follows:
+ <screen>~]# <command>grep SSLProtocol /etc/httpd/conf.d/ssl.conf</command>
+<emphasis role="bold">SSLProtocol</emphasis> all -SSLv2 -SSLv3</screen>
+This step is particularly important if you have more than the one default VirtualHost section.
+ </para>
+</step>
+<step>
+ <para>
+ Restart the Apache daemon as follows:
+ <screen>~]# <command>service httpd restart</command></screen>
+ Note that any sessions will be interrupted.
+ </para>
+</step>
+
+</procedure>
+
+<procedure id="proc-Disable_All_SSL_and_TLS_Except_TLS1_and_Up">
+<title>Disable All SSL and TLS Protocols Except TLS 1 and Up</title>
+<para>
+ To disable all SSL and TLS protocol versions except TLS version 1 and higher, proceed as follows:
+</para>
+<step>
+ <para>
+ As <systemitem class="username">root</systemitem>, open the <filename>/etc/httpd/conf.d/ssl.conf</filename> file and search for <emphasis role="bold">all</emphasis> instances of <command>SSLProtocol</command> directive. By default the file contains one section that looks as follows:
+ <screen>~]# <command>vi /etc/httpd/conf.d/ssl.conf</command>
+# SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect. Disable SSLv2 access by default:
+SSLProtocol all -SSLv2</screen>
+ </para>
+</step>
+<step>
+ <para>
+ Edit the <command>SSLProtocol</command> line as follows:
+ <screen># SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect. Disable SSLv2 access by default:
+SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2</screen>
+ </para>
+</step>
+<step>
+ <para>
+ Verify the change as follows:
+ <screen>~]# <command>grep SSLProtocol /etc/httpd/conf.d/ssl.conf </command>
+<emphasis role="bold">SSLProtocol</emphasis> -All +TLSv1 +TLSv1.1 +TLSv1.2</screen>
+ </para>
+</step>
+<step>
+ <para>
+ Restart the Apache daemon as follows:
+ <screen>~]# <command>service httpd restart</command></screen>
+ Note that any sessions will be interrupted.
+ </para>
+</step>
+
+</procedure>
+ </section>
+
<section id="s3-apache-mod_ssl-keypair">
<title>Using an Existing Key and Certificate</title>
<indexterm>
8 years, 6 months
[release-notes] adding metadata
by Pete Travis
commit 299f445c7bf0c67eadc16d69ba4df7d33a0577cf
Author: Pete Travis <immanetize(a)fedoraproject.org>
Date: Sun Oct 25 18:00:47 2015 -0500
adding metadata
en-US/Article_Info.xml | 10 ++++++++++
1 files changed, 10 insertions(+), 0 deletions(-)
---
diff --git a/en-US/Article_Info.xml b/en-US/Article_Info.xml
index c50a1f7..db05106 100644
--- a/en-US/Article_Info.xml
+++ b/en-US/Article_Info.xml
@@ -3,6 +3,16 @@
]>
<articleinfo id="arti-Release_Notes-Release_Notes">
+<subjectset>
+ <subject>
+ <subjectterm>Users/Installation</subjectterm>
+ </subject>
+</subjectset>
+<keywordset>
+ <keyword>release notes</keyword>
+ <keyword>changelog</keyword>
+</keywordset>
+
<title>Release Notes</title>
<subtitle>Release Notes for Fedora &PRODVER;</subtitle>
<productname>Fedora</productname>
8 years, 6 months
[software-collections-guide] adding metadata
by Pete Travis
commit 49edb1dad92622c2fc99f36bccdff3664243e03d
Author: Pete Travis <immanetize(a)fedoraproject.org>
Date: Sun Oct 25 17:59:39 2015 -0500
adding metadata
en-US/Book_Info.xml | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
---
diff --git a/en-US/Book_Info.xml b/en-US/Book_Info.xml
index 3ce4d74..6abcfd1 100644
--- a/en-US/Book_Info.xml
+++ b/en-US/Book_Info.xml
@@ -4,6 +4,15 @@
%BOOK_ENTITIES;
]>
<bookinfo id="book-Software_Collections_Guide-Software_Collections_Guide">
+<subjectset>
+ <subject>
+ <subjectterm>Users/Administration</subjectterm>
+ </subject>
+</subjectset>
+<keywordset>
+ <keyword>SCL</keyword>
+</keywordset>
+
<title>Software Collections Guide</title>
<subtitle>A guide to &DSCL;s for &MAJOROS;</subtitle>
<productname>Fedora Contributor Documentation</productname>
8 years, 6 months