[Samba] W2k/SQL Authentication problems 3.0.1, help please
Jerry Haltom
jhaltom at feedbackplusinc.com
Mon Jan 19 20:50:01 GMT 2004
Have you resolved this? I am having the same problem.
On Mon, 2004-01-12 at 13:02, Jason Jeremias wrote:
> I upgraded from Samba 2.2.8a to Samba 3.0.1, since doing I'm having
> problems with my SQL Server and applications running on Windows 2000.
> When a users (running a windows 98 client) attempts to query the SQL
> Server, either using ODBC (even the Test Sources) or an application that
> uses the db. I get a login failed from the sql app, and from the ODBC I
> get:
>
> "Login failed for user '(null)', Reason: Not associated with a trusted
> SQL Server connection."
>
> That error shows up in the SQL Server Logs, and its displayed at the client.
>
> On the Samba side I see some NT user token: (NULL), in the logs but I'm
> not sure what else to look for..
>
> I'm not sure what is going on but it seems like the W2k/SQL Server is
> not doing the Windows Authentication properly.
>
> I've attached a testparm -vs and my smb.conf, I can provide logs or
> whatever is needed to help me solve the problem.
>
>
>
>
>
>
>
> ______________________________________________________________________
> # Global parameters
> [global]
> dos charset = CP850
> unix charset = UTF-8
> display charset = LOCALE
> workgroup = UNICOM
> afs username map =
> netbios name = CARTMAN
> netbios aliases =
> netbios scope =
> server string = Cartman Anchorage Samba Server %v
> interfaces =
> bind interfaces only = No
> security = USER
> auth methods =
> encrypt passwords = Yes
> update encrypted = No
> client schannel = Auto
> server schannel = Auto
> allow trusted domains = Yes
> hosts equiv =
> min passwd length = 5
> map to guest = Never
> null passwords = No
> obey pam restrictions = No
> password server = *
> smb passwd file = /etc/samba/private/smbpasswd
> private dir = /etc/samba/private
> passdb backend = smbpasswd
> algorithmic rid base = 1000
> root directory =
> guest account = nobody
> pam password change = No
> passwd program =
> passwd chat = *new*password* %n\n *new*password* %n\n *changed*
> passwd chat debug = No
> passwd chat timeout = 2
> username map =
> password level = 0
> username level = 0
> unix password sync = No
> restrict anonymous = 0
> lanman auth = Yes
> ntlm auth = Yes
> client NTLMv2 auth = No
> client lanman auth = Yes
> client plaintext auth = Yes
> preload modules =
> log level = 3
> syslog = 1
> syslog only = No
> log file = /var/log/samba3/log.%m
> max log size = 850
> timestamp logs = Yes
> debug hires timestamp = No
> debug pid = No
> debug uid = No
> smb ports = 445 139
> protocol = NT1
> large readwrite = Yes
> max protocol = NT1
> min protocol = CORE
> unicode = Yes
> read bmpx = No
> read raw = Yes
> write raw = Yes
> disable netbios = No
> acl compatibility =
> nt pipe support = Yes
> nt status support = Yes
> announce version = 4.9
> announce as = NT
> max mux = 50
> max xmit = 16644
> name resolve order = lmhosts wins host bcast
> max ttl = 259200
> max wins ttl = 518400
> min wins ttl = 21600
> time server = No
> unix extensions = Yes
> use spnego = Yes
> client signing = auto
> server signing = No
> client use spnego = Yes
> change notify timeout = 60
> deadtime = 0
> getwd cache = Yes
> keepalive = 300
> kernel change notify = Yes
> lpq cache time = 10
> max smbd processes = 0
> paranoid server security = Yes
> max disk size = 0
> max open files = 10000
> read size = 16384
> socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
> use mmap = Yes
> hostname lookups = No
> name cache timeout = 660
> load printers = Yes
> printcap name = cups
> disable spoolss = No
> enumports command =
> addprinter command =
> deleteprinter command =
> show add printer wizard = Yes
> os2 driver map =
> mangling method = hash2
> mangle prefix = 1
> stat cache = Yes
> machine password timeout = 604800
> add user script = /usr/sbin/useradd -s /bin/false '%u'
> delete user script = /usr/sbin/userdel '%s'
> add group script = /usr/sbin/groupadd %g && getent group '%g'|awk -F: '{print $3}'
> delete group script = /usr/sbin/groupdel '%g'
> add user to group script = /usr/bin/gpasswd -a '%u' '%g'
> delete user from group script = /usr/bin/gpasswd -d '%u' '%g'
> set primary group script = /usr/sbin/usermod -g '%g' '%u'
> add machine script = /usr/sbin/useradd -d /dev/null -g machines -c 'Machine Account' -s /bin/false -M %u
> shutdown script =
> abort shutdown script =
> logon script = %U.bat
> logon path =
> logon drive =
> logon home =
> domain logons = Yes
> os level = 65
> lm announce = Auto
> lm interval = 60
> preferred master = Yes
> local master = Yes
> domain master = Yes
> browse list = Yes
> enhanced browsing = Yes
> dns proxy = No
> wins proxy = No
> wins server =
> wins support = Yes
> wins hook =
> wins partners =
> kernel oplocks = Yes
> lock spin count = 3
> lock spin time = 10
> oplock break wait time = 0
> ldap suffix =
> ldap machine suffix =
> ldap user suffix =
> ldap group suffix =
> ldap idmap suffix =
> ldap filter = (uid=%u)
> ldap admin dn =
> ldap ssl =
> ldap passwd sync = no
> ldap delete dn = No
> add share command =
> change share command =
> delete share command =
> config file =
> preload =
> lock directory = /var/cache/samba
> pid directory = /var/run/samba
> utmp directory =
> wtmp directory =
> utmp = No
> default service =
> message command =
> dfree command =
> get quota command =
> set quota command =
> remote announce = 192.168.3.2
> remote browse sync = 192.168.3.2
> socket address = 0.0.0.0
> homedir map = auto.home
> time offset = 0
> NIS homedir = No
> source environment =
> panic action =
> host msdfs = No
> enable rid algorithm = Yes
> idmap backend =
> idmap uid =
> idmap gid =
> template primary group = nobody
> template homedir = /home/%D/%U
> template shell = /bin/false
> winbind separator = \
> winbind cache time = 300
> winbind enable local accounts = Yes
> winbind enum users = Yes
> winbind enum groups = Yes
> winbind use default domain = No
> winbind trusted domains only = No
> comment =
> path =
> username =
> invalid users =
> valid users =
> admin users =
> read list =
> write list =
> printer admin = @domadmin
> force user =
> force group =
> read only = Yes
> create mask = 0744
> force create mode = 00
> security mask = 0777
> force security mode = 00
> directory mask = 0755
> force directory mode = 00
> directory security mask = 0777
> force directory security mode = 00
> inherit permissions = No
> inherit acls = No
> guest only = No
> guest ok = No
> only user = No
> hosts allow = 192.168.1., 192.168.3., 127.
> hosts deny =
> nt acl support = Yes
> profile acls = No
> map acl inherit = No
> afs share = No
> block size = 1024
> max connections = 0
> min print space = 0
> strict allocate = No
> strict sync = No
> sync always = No
> use sendfile = No
> write cache size = 0
> max reported print jobs = 0
> max print jobs = 1000
> printable = No
> printing = cups
> print command = lpr -r -P'%p' %s
> lpq command = lpq -P'%p'
> lprm command = lprm -P'%p' %j
> lppause command =
> lpresume command =
> queuepause command =
> queueresume command =
> printer name =
> use client driver = No
> default devmode = No
> default case = lower
> case sensitive = No
> preserve case = Yes
> short preserve case = Yes
> mangle case = No
> mangling char = ~
> hide dot files = Yes
> hide special files = No
> hide unreadable = No
> hide unwriteable files = No
> delete veto files = No
> veto files =
> hide files =
> veto oplock files =
> map system = No
> map hidden = No
> map archive = Yes
> mangled names = Yes
> mangled map =
> browseable = Yes
> blocking locks = Yes
> csc policy = manual
> fake oplocks = No
> locking = Yes
> oplocks = Yes
> level2 oplocks = Yes
> oplock contention limit = 2
> posix locking = Yes
> strict locking = Yes
> share modes = Yes
> copy =
> include =
> exec =
> preexec close = No
> postexec =
> root preexec =
> root preexec close = No
> root postexec =
> available = Yes
> volume =
> fstype = NTFS
> set directory = No
> wide links = Yes
> follow symlinks = Yes
> dont descend =
> magic script =
> magic output =
> delete readonly = No
> dos filemode = No
> dos filetimes = No
> dos filetime resolution = No
> fake directory create times = No
> vfs objects =
> msdfs root = No
> msdfs proxy =
>
> [homes]
> comment = Home Directories
> read only = No
> browseable = No
>
> [netlogon]
> comment = Network Logon Service
> path = /home/samba/netlogon
> write list = @admins
> guest ok = Yes
> share modes = No
> root preexec = /home/samba/scripts/genlogon.py %U %G %I %m %a %U.bat
> root postexec = /bin/rm -f /home/samba/netlogon/%U.bat
>
> [printers]
> comment = All Printers
> path = /home/samba/spool
> create mask = 0700
> guest ok = Yes
> printable = Yes
> print command = lpr-cups -P %p -o raw %s -J'%J' -r # using client side printer drivers.
> browseable = No
>
> [print$]
> path = /home/samba/printers
> write list = @domadmin, root
> force user = +root
> force group = +misgroup
> create mask = 02775
> directory mask = 02775
>
> [backup]
> path = /home/samba/backups
> valid users = @misgroup, root
> write list = +misgroup, root
> browseable = No
> delete readonly = Yes
>
> [misgroup]
> comment = The MIS group drive
> path = /home/samba/groups/misgroup
> valid users = @misgroup
> write list = @misgroup
> force group = +misgroup
> create mask = 0760
> directory mask = 0770
> browseable = No
> delete readonly = Yes
>
> [accting]
> comment = The Accounting group drive
> path = /home/samba/groups/accting
> valid users = @accting
> write list = @accting
> force group = +accting
> create mask = 0760
> directory mask = 0770
> browseable = No
> delete readonly = Yes
>
> [custcare]
> comment = The Customer Service group drive
> path = /home/samba/groups/custcare
> valid users = @custcare
> write list = @custcare
> force group = +custcare
> create mask = 0760
> directory mask = 0770
> delete readonly = Yes
>
> [purchase]
> comment = The Purchasing group share
> path = /home/samba/groups/purchase
> valid users = @purch
> write list = @purchase
> force group = +purchase
> create mask = 0760
> directory mask = 0770
> delete readonly = Yes
>
> [nscgroup]
> comment = The NSC group share
> path = /home/samba/groups/nscgroup
> valid users = @nscgroup
> write list = @nscgroup
> force group = +nscgroup
> create mask = 0760
> directory mask = 0770
> delete readonly = Yes
>
> [unicom]
> comment = The Unicom group share
> path = /home/samba/groups/unicom
> valid users = @unicom
> write list = @unicom
> force group = +unicom
> create mask = 0760
> directory mask = 0770
> delete readonly = Yes
>
> [revreq]
> comment = The Revenue Requirements group share
> path = /home/samba/groups/revreq
> valid users = @revreq
> write list = @revreq
> force group = +revreq
> create mask = 0760
> directory mask = 0770
> delete readonly = Yes
>
> [coengnr]
> comment = The Central Office group share
> path = /home/samba/groups/coengnr
> valid users = @coengnr
> write list = @coengnr
> force group = +coengnr
> create mask = 0760
> directory mask = 0770
> delete readonly = Yes
>
> [ospgroup]
> comment = The Outside Plant group share
> path = /home/samba/groups/ospgroup
> valid users = @ospgroup
> write list = @ospgroup
> force group = +ospgroup
> create mask = 0760
> directory mask = 0770
> delete readonly = Yes
>
> [execgrp]
> comment = The Executive group share
> path = /home/samba/groups/execgrp
> valid users = @execgrp
> write list = @execgrp
> force group = +execgrp
> create mask = 0760
> directory mask = 0770
> delete readonly = Yes
>
> [purch]
> comment = The Purchasing group share
> path = /home/samba/groups/purch
> valid users = @purch
> write list = @purch
> force group = +purch
> create mask = 0760
> directory mask = 0770
> delete readonly = Yes
>
> [facmaint]
> comment = The Facility Maintenance
> path = /home/samba/groups/facmaint
> valid users = @facmaint
> write list = @facmaint
> force group = +facmaint
> create mask = 0760
> directory mask = 0770
> delete readonly = Yes
>
> [apps]
> comment = The Applications Share
> path = /home/samba/apps
> valid users = @ancusers, @misgroup
> write list = jasonj, cgreen
> force user = root
> force group = +misgroup
> create mask = 0755
> directory mask = 0775
>
> [open]
> comment = The OpenGroups Share
> path = /home/samba/open
> valid users = @ancusers
> write list = @ancusers
> force group = +ancusers
> create mask = 0766
> directory mask = 0777
>
> [pdfdropbox]
> comment = The pdfdropbox share
> path = /var/spool/cups-pdf
> valid users = @ancusers
> write list = @ancusers
>
> [tsphere]
> comment = The Telesphere Share
> path = /home/samba/tsphere
> valid users = @tsphere
> write list = @tsphere
> force group = +tsphere
> create mask = 0760
> directory mask = 0770
> veto oplock files = /*.ini/
>
> [acaduser]
> comment = The Autocad Data Share
> path = /home/samba/acaddata
> valid users = @acaduser
> write list = @acaduser
> force group = +acaduser
> create mask = 0760
> directory mask = 0770
>
> [images]
> comment = The MIS Images Share
> path = /home/samba/images
> valid users = @misgroup
> write list = @misgroup
> force group = +misgroup
> create mask = 0760
> directory mask = 0770
>
> [audit]
> path = /home/samba/audit
> write list = @cartman, @stan
> force user = root
> force group = +misgroup
> create mask = 0766
> directory mask = 0770
> browseable = No
>
> [admindata]
> path = /home/samba/admin_data
> write list = @misgroup
> force user = root
> force group = +misgroup
> create mask = 0775
> directory mask = 0775
> browseable = No
>
> [VPCFO]
> comment = The VPCFO Share
> path = /home/samba/data/finance
> valid users = @finance
> write list = @finance
> force group = +finance
> create mask = 0760
> directory mask = 0770
>
> [LEGAL]
> comment = The Legal Share
> path = /home/samba/data/legal
> valid users = @legal
> write list = @legal
> force group = +legal
> create mask = 0760
> directory mask = 0770
>
> [pcAnywhere$]
> comment = pcAnywhere host authenticaton
> path = /home/samba/pcAnywhere
> valid users = @rempcaw
> browseable = No
>
> [castelle]
> path = /home/samba/castelle
> read only = No
> guest ok = Yes
>
> [fpressdb]
> path = /home/samba/castelle/archive/database
> read only = No
> guest ok = Yes
>
> [mismp3]
> path = /home/samba/mp3
> valid users = jasonj, cgreen
> write list = jasonj, cgreen
> force user = root
> force group = +misgroup
> create mask = 0760
> directory mask = 0770
> browseable = No
>
> [allhome]
> path = /home
> valid users = root
> browseable = No
>
> [syslog]
> path = /var/log/
> valid users = root
> browseable = No
>
> ______________________________________________________________________
> # This is the main Samba configuration file. You should read the
> # smb.conf(5) manual page in order to understand the options listed
> # here. Samba has a huge number of configurable options (perhaps too
> # many!) most of which are not shown in this example
> #
> # Any line which starts with a ; (semi-colon) or a # (hash)
> # is a comment and is ignored. In this example we will use a #
> # for commentry and a ; for parts of the config file that you
> # may wish to enable
> #
> # NOTE: Whenever you modify this file you should run the command "testparm"
> # to check that you have not made any basic syntactic errors.
> #
> #======================= Global Settings =====================================
> [global]
>
> # 1. Server Naming Options:
> # workgroup = NT-Domain-Name or Workgroup-Name
> workgroup = UNICOM
>
> # netbios name is the name you will see in "Network Neighbourhood",
> # but defaults to your hostname
> netbios name = cartman
>
> # server string is the equivalent of the NT Description field
> server string = Cartman Anchorage Samba Server %v
>
> # Message command is run by samba when a "popup" message is sent to it.
> # The example below is for use with LinPopUp:
> ; message command = /usr/bin/linpopup "%f" "%m" %s; rm %s
>
> # 2. Printing Options:
> # CHANGES TO ENABLE PRINTING ON ALL CUPS PRINTERS IN THE NETWORK
> # if you want to automatically load your printer list rather
> # than setting them up individually then you'll need this
> printcap name = cups
> load printers = yes
>
> # It should not be necessary to spell out the print system type unless
> # yours is non-standard. Currently supported print systems include:
> # bsd, sysv, plp, lprng, aix, hpux, qnx, cups
> printing = cups
>
> # Samba 3.x supports the Windows NT-style point-and-print feature. To
> # use this, you need to be able to upload print drivers to the samba
> # server. The printer admins (or root) may install drivers onto samba.
> # Note that this feature uses the print$ share, so you will need to
> # enable it below.
> # printer admin = @<group> <user>
> printer admin = @domadmin
> # This should work well for winbind:
> ; printer admin = @"Domain Admins"
>
> # 3. Logging Options:
> # this tells Samba to use a separate log file for each machine
> # that connects
> log file = /var/log/samba3/log.%m
>
> # Put a capping on the size of the log files (in Kb).
> max log size = 850
>
> # Set the log (verbosity) level (0 <= log level <= 10)
> log level = 3
>
> # 4. Security and Domain Membership Options:
> # This option is important for security. It allows you to restrict
> # connections to machines which are on your local network. The
> # following example restricts access to two C class networks and
> # the "loopback" interface. For more examples of the syntax see
> # the smb.conf man page. Do not enable this if (tcp/ip) name resolution does
> # not work for all the hosts in your network.
> hosts allow = 192.168.1. 192.168.3. 127.
>
> # Uncomment this if you want a guest account, you must add this to /etc/passwd
> # otherwise the user "nobody" is used
> ; guest account = pcguest
> # Allow users to map to guest:
> # map to guest = bad user
>
> # Security mode. Most people will want user level security. See
> # security_level.txt for details.
> security = user
> # Use password server option only with security = server or security = domain
> # When using security = domain, you should use password server = *
> ; password server = <NT-Server-Name>
> ; password server = *
>
> # Password Level allows matching of _n_ characters of the password for
> # all combinations of upper and lower case.
> ; password level = 8
> ; username level = 8
>
> # You may wish to use password encryption. Please read
> # ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.
> # Do not enable this option unless you have read those documents
> # Encrypted passwords are required for any use of samba in a Windows NT domain
> # The smbpasswd file is only required by a server doing authentication, thus
> # members of a domain do not need one.
> encrypt passwords = yes
> smb passwd file = /etc/samba/private/smbpasswd
>
> # The following are needed to allow password changing from Windows to
> # also update the Linux system password.
> # NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above.
> # NOTE2: You do NOT need these to allow workstations to change only
> # the encrypted SMB passwords. They allow the Unix password
> # to be kept in sync with the SMB password.
> ; unix password sync = Yes
> # You either need to setup a passwd program and passwd chat, or
> # enable pam password change
> ; pam password change = yes
> ; passwd program = /usr/bin/passwd %u
> ; passwd chat = *New*UNIX*password* %n\n *Re*ype*new*UNIX*password* %n\n \
> ;*passwd:*all*authentication*tokens*updated*successfully*
>
> # Unix users can map to different SMB User names
> ; username map = /etc/samba/smbusers
>
> # Using the following line enables you to customise your configuration
> # on a per machine basis. The %m gets replaced with the netbios name
> # of the machine that is connecting
> ; include = /etc/samba/smb.conf.%m
>
> # Options for using winbind. Winbind allows you to do all account and
> # authentication from a Windows or samba domain controller, creating
> # accounts on the fly, and maintaining a mapping of Windows RIDs to unix uid's
> # and gid's. winbind uid and winbind gid are the only required parameters.
> #
> # winbind uid is the range of uid's winbind can use when mapping RIDs to uid's
> ; winbind uid = 10000-20000
> #
> # winbind gid is the range of uid's winbind can use when mapping RIDs to gid's
> ; winbind gid = 10000-20000
> #
> # winbind separator is the character a user must use between their domain
> # name and username, defaults to "\"
> ; winbind separator = +
> #
> # winbind use default domain allows you to have winbind return usernames
> # in the form user instead of DOMAIN+user for the domain listed in the
> # workgroup parameter.
> ; winbind use default domain = yes
> #
> # template homedir determines the home directory for winbind users, with
> # %D expanding to their domain name and %U expanding to their username:
> ; template homedir = /home/%D/%U
>
> # When using winbind, you may want to have samba create home directories
> # on the fly for authenticated users. Ensure that /etc/pam.d/samba is
> # using 'service=system-auth-winbind' in pam_stack modules, and then
> # enable obedience of pam restrictions below:
> ; obey pam restrictions = yes
>
> #
> # template shell determines the shell users authenticated by winbind get
> ; template shell = /bin/bash
>
> # 5. Browser Control and Networking Options:
> # Most people will find that this option gives better performance.
> # See speed.txt and the manual pages for details
> socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
>
> # Configure Samba to use multiple interfaces
> # If you have multiple network interfaces then you must list them
> # here. See the man page for details.
> ; interfaces = 192.168.12.2/24 192.168.13.2/24
>
> # Configure remote browse list synchronisation here
> # request announcement to, or browse list sync from:
> # a specific host or from / to a whole subnet (see below)
> remote browse sync = 192.168.3.2
> # Cause this host to announce itself to local subnets here
> remote announce = 192.168.3.2
>
> # set local master to no if you don't want Samba to become a master
> # browser on your network. Otherwise the normal election rules apply
> local master = yes
>
> # OS Level determines the precedence of this server in master browser
> # elections. The default value should be reasonable
> os level = 65
>
> # Domain Master specifies Samba to be the Domain Master Browser. This
> # allows Samba to collate browse lists between subnets. Don't use this
> # if you already have a Windows NT domain controller doing this job
> domain master = yes
>
> # Preferred Master causes Samba to force a local browser election on startup
> # and gives it a slightly higher chance of winning the election
> preferred master = yes
>
> # 6. Domain Control Options:
> # Enable this if you want Samba to be a domain logon server for
> # Windows95 workstations or Primary Domain Controller for WinNT and Win2k
> domain logons = yes
>
> # if you enable domain logons then you may want a per-machine or
> # per user logon script
> # run a specific logon batch file per workstation (machine)
> ; logon script = %m.bat
> # run a specific logon batch file per username
> logon script = %U.bat
>
> # Where to store roaming profiles for WinNT and Win2k
> # %L substitutes for this servers netbios name, %U is username
> # You must uncomment the [Profiles] share below
> ; logon path = \\%L\Profiles\%U
>
> # Where to store roaming profiles for Win9x. Be careful with this as it also
> # impacts where Win2k finds it's /HOME share
> ; logon home = \\%L\%U\.profile
>
> # This will disable roaming profiles
> logon path =
> logon home =
>
>
> # The add user script is used by a domain member to add local user accounts
> # that have been authenticated by the domain controller, or when adding
> # users via the Windows NT Tools (ie User Manager for Domains).
>
> # Scripts for file (passwd, smbpasswd) backend:
> add user script = /usr/sbin/useradd -s /bin/false '%u'
> delete user script = /usr/sbin/userdel '%s'
> add user to group script = /usr/bin/gpasswd -a '%u' '%g'
> delete user from group script = /usr/bin/gpasswd -d '%u' '%g'
> set primary group script = /usr/sbin/usermod -g '%g' '%u'
> add group script = /usr/sbin/groupadd %g && getent group '%g'|awk -F: '{print $3}'
> delete group script = /usr/sbin/groupdel '%g'
>
> # Scripts for LDAP backend (assumes nss_ldap is in use on the domain controller.
> # Needs IDEALX scripts, and configuration in smbldap_conf.pm.
> # This assumes you've installed the IDEALX scripts into /usr/share/samba/scripts...
> ; add user script = /usr/share/samba/scripts/smbldap-useradd.pl '%u'
> ; delete user script = /usr/share/samba/scripts/smbldap-userdel.pl '%u'
> ; add user to group script = /usr/share/samba/scripts/smbldap-groupmod.pl -m '%u' '%g'
> ; delete user from group script = /usr/share/samba/scripts/smbldap-groupmod.pl -x '%u' '%g'
> ; set primary group script = /usr/share/samba/scripts/smbldap-usermod.pl -g '%g' '%u'
> ; add group script = /usr/share/samba/scripts/smbldap-groupadd.pl '%g' && /usr/share/samba/scripts/smbldap-groupshow.pl %g|awk '/^gidNumber:/ {print $2}'
> ; delete group script = /usr/share/samba/scripts/smbldap-userdel.pl '%g'
>
>
> # The add machine script is use by a samba server configured as a domain
> # controller to add local machine accounts when adding machines to the domain.
> # The script must work from the command line when replacing the macros,
> # or the operation will fail. Check that groups exist if forcing a group.
> # Script for domain controller for adding machines:
> add machine script = /usr/sbin/useradd -d /dev/null -g machines -c 'Machine Account' -s /bin/false -M %u
> # Script for domain controller with LDAP backend for adding machines (You need
> # the IDEALX scripts, and to configure the smbldap_conf.pm first):
> ; add machine script = /usr/share/samba/scripts/smbldap-useradd.pl -w -d /dev/null -g machines -c 'Machine Account' -s /bin/false %u
>
> # Domain groups:
> # Domain groups are now configured by using the 'net groupmap' tool
>
> # Samba Password Database configuration:
> # Samba now has runtime-configurable password database backends. Multiple
> # passdb backends may be used, but users will only be added to the first one
> # Default:
> ; passdb backend = smbpasswd guest
> # TDB backen with fallback to smbpasswd and guest
> ; passdb backend = tdbsam smbpasswd guest
> # LDAP with fallback to smbpasswd guest
> # Enable SSL by using an ldaps url, or enable tls with 'ldap ssl' below.
> ; passdb backend = ldapsam:ldaps://ldap.mydomain.com smbpasswd guest
> # Use the samba2 LDAP schema:
> ; passdb backend = ldapsam_compat:ldaps://ldap.mydomain.com smbpasswd guest
>
> # idmap uid account range:
> # This is a range of unix user-id's that samba will map non-unix RIDs to,
> # such as when using Winbind
> ; idmap uid = 10000-20000
> ; idmap gid = 10000-20000
>
> # LDAP configuration for Domain Controlling:
> # The account (dn) that samba uses to access the LDAP server
> # This account needs to have write access to the LDAP tree
> # You will need to give samba the password for this dn, by
> # running 'smbpasswd -w mypassword'
> ; ldap admin dn = cn=root,dc=mydomain,dc=com
> ; ldap ssl = start_tls
> # start_tls should run on 389, but samba defaults incorrectly to 636
> ; ldap port = 389
> ; ldap suffix = dc=mydomain,dc=com
> ; ldap server = ldap.mydomain.com
> # Seperate suffixes are available for machines, users, groups, and idmap, if
> # ldap suffix appears first, it is appended to the specific suffix.
> # Example for a unix-ish directory layout:
> ; ldap machine suffix = ou=Hosts
> ; ldap user suffix = ou=People
> ; ldap group suffix = ou=Group
> ; ldap idmap suffix = ou=Idmap
> # Example for AD-ish layout:
> ; ldap machine suffix = cn=Computers
> ; ldap user suffix = cn=Users
> ; ldap group suffix = cn=Groups
> ; ldap idmap suffix = cn=Idmap
>
>
> # 7. Name Resolution Options:
> # All NetBIOS names must be resolved to IP Addresses
> # 'Name Resolve Order' allows the named resolution mechanism to be specified
> # the default order is "host lmhosts wins bcast". "host" means use the unix
> # system gethostbyname() function call that will use either /etc/hosts OR
> # DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf
> # and the /etc/resolv.conf file. "host" therefore is system configuration
> # dependant. This parameter is most often of use to prevent DNS lookups
> # in order to resolve NetBIOS names to IP Addresses. Use with care!
> # The example below excludes use of name resolution for machines that are NOT
> # on the local network segment
> # - OR - are not deliberately to be known via lmhosts or via WINS.
> ; name resolve order = wins lmhosts bcast
>
> # Windows Internet Name Serving Support Section:
> # WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
> wins support = yes
>
> # WINS Server - Tells the NMBD components of Samba to be a WINS Client
> # Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
> ; wins server = w.x.y.z
>
> # WINS Proxy - Tells Samba to answer name resolution queries on
> # behalf of a non WINS capable client, for this to work there must be
> # at least one WINS Server on the network. The default is NO.
> ; wins proxy = yes
>
> # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
> # via DNS nslookups. The built-in default for versions 1.9.17 is yes,
> # this has been changed in version 1.9.18 to no.
> dns proxy = no
>
> # 8. File Naming Options:
> # Case Preservation can be handy - system default is _no_
> # NOTE: These can be set on a per share basis
> ; preserve case = no
> ; short preserve case = no
> # Default case is normally upper case for all DOS files
> ; default case = lower
> # Be very careful with case sensitivity - it can break things!
> ; case sensitive = no
>
> # Enabling internationalization:
> # you can match a Windows code page with a UNIX character set.
> # Windows: 437 (US), 737 (GREEK), 850 (Latin1 - Western European),
> # 852 (Eastern Eu.), 861 (Icelandic), 932 (Cyrillic - Russian),
> # 936 (Japanese - Shift-JIS), 936 (Simpl. Chinese), 949 (Korean Hangul),
> # 950 (Trad. Chin.).
> # UNIX: ISO8859-1 (Western European), ISO8859-2 (Eastern Eu.),
> # ISO8859-5 (Russian Cyrillic), KOI8-R (Alt-Russ. Cyril.)
> # This is an example for french users:
> ; dos charset = 850
> ; unix charset = ISO8859-1
>
>
> #============================ Share Definitions ==============================
> [homes]
> comment = Home Directories
> browseable = no
> writable = yes
> # You can enable VFS recycle bin on a per share basis:
> # Uncomment the next 2 lines (make sure you create a
> # .recycle folder in the base of the share and ensure
> # all users will have write access to it. See
> # examples/VFS/recycle/REAME in the samba docs for details
> ; vfs object = /usr/lib/samba/vfs/recycle.so
>
>
> [netlogon]
> comment = Network Logon Service
> path = /home/samba/netlogon
> guest ok = yes
> writable = no
> share modes = no
> write list = @admins
> # The lines below call our login script generator when a user connects
> # then deletes the login script after.
> root preexec = /home/samba/scripts/genlogon.py %U %G %I %m %a %U.bat
> root postexec = /bin/rm -f /home/samba/netlogon/%U.bat
>
>
>
>
> # Un-comment the following to provide a specific roving profile share
> # the default is to use the user's home directory
> ;[Profiles]
> ; path = /var/lib/samba/profiles
> ; browseable = no
> ; guest ok = yes
> # This script can be enabled to create profile directories on the fly
> # You may want to turn off guest acces if you enable this, as it
> # hasn't been thoroughly tested.
> ;root preexec = PROFILE=/var/lib/samba/profiles/%u; if [ ! -e $PROFILE ]; \
> ; then mkdir -pm700 $PROFILE; chown %u:%g $PROFILE;fi
>
> # NOTE: If you have a CUPS print system there is no need to
> # specifically define each individual printer.
> # You must configure the samba printers with the appropriate Windows
> # drivers on your Windows clients. On the Samba server no filtering is
> # done. If you wish that the server provides the driver and the clients
> # send PostScript ("Generic PostScript Printer" under Windows), you have
> # to swap the 'print command' line below with the commented one.
> [printers]
> comment = All Printers
> path = /home/samba/spool
> browseable = yes
> # to allow user 'guest account' to print.
> guest ok = yes
> writable = no
> printable = yes
> create mode = 0700
> # =====================================
> # print command: see above for details.
> # =====================================
> print command = lpr-cups -P %p -o raw %s -J'%J' -r # using client side printer drivers.
> ; print command = lpr-cups -P %p %s # using cups own drivers (use generic PostScript on clients).
> # The following two commands are the samba defaults for printing=cups
> # change them only if you need different options:
> ; lpq command = lpq -P %p
> ; lprm command = cancel %p-%j
>
> # This share is used for Windows NT-style point-and-print support.
> # To be able to install drivers, you need to be either root, or listed
> # in the printer admin parameter above. Note that you also need write access
> # to the directory and share definition to be able to upload the drivers.
> # For more information on this, please see the Printing Support Section of
> # /usr/share/doc/samba-<version>/Samba-HOWTO-Collection.pdf
> [print$]
> path = /home/samba/printers
> browseable = yes
> read only = yes
> write list = @domadmin, root
> guest ok = no
> create mode = 2775
> directory mode = 2775
> force group = +misgroup
> force user = +root
>
>
>
> #
> # Main Shares
> #
> #
> # Everything below is group specific shares (G drives)
>
>
> [backup]
> delete readonly = yes
> valid users = @misgroup, root
> browseable = no
> writelist = +misgroup, root
> path = /home/samba/backups
> public = no
>
> [misgroup]
> comment = The MIS group drive
> valid users = @misgroup
> delete readonly = yes
> path = /home/samba/groups/misgroup
> browseable = no
> public = no
> write list = @misgroup
> create mode = 0760
> directory mode = 0770
> force group = +misgroup
>
> [accting]
> comment = The Accounting group drive
> valid users = @accting
> delete readonly = yes
> path = /home/samba/groups/accting
> browseable = no
> public = no
> write list = @accting
> create mode = 0760
> directory mode = 0770
> force group = +accting
>
> [custcare]
> comment = The Customer Service group drive
> valid users = @custcare
> delete readonly = yes
> path = /home/samba/groups/custcare
> public = no
> browseable = yes
> write list = @custcare
> create mode = 0760
> directory mode = 0770
> force group = +custcare
>
> [purchase]
> comment = The Purchasing group share
> valid users = @purch
> delete readonly = yes
> path = /home/samba/groups/purchase
> public = no
> browseable = yes
> write list = @purchase
> create mode = 0760
> directory mode = 0770
> force group = +purchase
>
> [nscgroup]
> delete readonly = yes
> valid users = @nscgroup
> comment = The NSC group share
> path = /home/samba/groups/nscgroup
> public = no
> browseable = yes
> write list = @nscgroup
> create mode = 0760
> directory mode = 0770
> force group = +nscgroup
>
> [unicom]
> delete readonly = yes
> valid users = @unicom
> comment = The Unicom group share
> write list = @unicom
> create mode = 0760
> public = no
> browseable = yes
> directory mode = 0770
> force group = +unicom
> path = /home/samba/groups/unicom
>
> [revreq]
> delete readonly = yes
> valid users = @revreq
> comment = The Revenue Requirements group share
> write list = @revreq
> create mode = 0760
> public = no
> browseable = yes
> directory mode = 0770
> force group = +revreq
> path = /home/samba/groups/revreq
>
> [coengnr]
> delete readonly = yes
> valid users = @coengnr
> comment = The Central Office group share
> write list = @coengnr
> create mode = 0760
> public = no
> browseable = yes
> directory mode = 0770
> force group = +coengnr
> path = /home/samba/groups/coengnr
>
>
> [ospgroup]
> delete readonly = yes
> valid users = @ospgroup
> comment = The Outside Plant group share
> write list = @ospgroup
> create mode = 0760
> public = no
> browseable = yes
> directory mode = 0770
> force group = +ospgroup
> path = /home/samba/groups/ospgroup
>
>
> [execgrp]
> delete readonly = yes
> valid users = @execgrp
> comment = The Executive group share
> browseable = yes
> write list = @execgrp
> create mode = 0760
> public = no
> directory mode = 0770
> force group = +execgrp
> path = /home/samba/groups/execgrp
>
>
> [purch]
> delete readonly = yes
> valid users = @purch
> comment = The Purchasing group share
> write list = @purch
> create mode = 0760
> public = no
> browseable = yes
> directory mode = 0770
> force group = +purch
> path = /home/samba/groups/purch
>
> [facmaint]
> delete readonly = yes
> valid users = @facmaint
> comment = The Facility Maintenance
> write list = @facmaint
> create mode = 0760
> public = no
> browseable = yes
> directory mode = 0770
> force group = +facmaint
> path = /home/samba/groups/facmaint
>
> # End of G Drives
>
>
> # This is our apps share (X drive)
> [apps]
> comment = The Applications Share
> path = /home/samba/apps
> public = no
> write list = jasonj ,cgreen
> create mode = 0755
> directory mode = 0775
> browseable = yes
> valid users = @ancusers, at misgroup
> force user = root
> force group = +misgroup
>
> # Everyone can read and write here (O drive)
> [open]
> comment = The OpenGroups Share
> path = /home/samba/open
> public = no
> browseable = yes
> write list = @ancusers
> create mode = 0766
> directory mode = 0777
> valid users = @ancusers
> force group = +ancusers
>
> # PDFDROP where pdffiles will be placed
> [pdfdropbox]
> comment = The pdfdropbox share
> path = /var/spool/cups-pdf
> browseable = yes
> public = no
> write list = @ancusers
> valid users = @ancusers
>
> # Telesphere users Drive (T drive)
> [tsphere]
> comment = The Telesphere Share
> path = /home/samba/tsphere
> public = no
> browseable = yes
> # level2 oplocks = no
> # oplocks = no
> veto oplock files = /*.ini/
> write list = @tsphere
> create mode = 0760
> directory mode = 0770
> valid users = @tsphere
> force group = +tsphere
>
> # Acaddata share for AutoCad users Autocad
> # files. (I drive)
> [acaduser]
> comment = The Autocad Data Share
> path = /home/samba/acaddata
> public = no
> browseable = yes
> write list = @acaduser
> valid users = @acaduser
> force group = +acaduser
> create mode = 0760
> directory mode = 0770
>
> # A place to put our computer images
> [images]
> comment = The MIS Images Share
> path = /home/samba/images
> public = no
> write list = @misgroup
> create mode = 0760
> directory mode = 0770
> valid users = @misgroup
> force group = +misgroup
>
> # A Place to put the EZ Audit info
> [audit]
> comment =
> path = /home/samba/audit
> public = no
> browseable = no
> write list = @cartman, at stan
> create mode = 0766
> directory mode = 0770
> force user = root
> force group = +misgroup
>
> # This is a place to put admin type scripts
> # reg edits etc.
> [admindata]
> comment =
> path = /home/samba/admin_data
> public = no
> browseable = no
> write list = @misgroup
> create mode = 0775
> directory mode = 0775
> force user = root
> force group = +misgroup
>
> # This share was created to allow marianne
> # and mike wardman to share files they both
> # need to work on but don't want anyone else
> # to see. It allows access to members of the
> # finance group.
> [VPCFO]
> comment = The VPCFO Share
> path = /home/samba/data/finance
> public = no
> write list = @finance
> create mode = 0760
> directory mode = 0770
> valid users = @finance
> force group = +finance
>
> # Legal share for people shareing leagle data
> [LEGAL]
> comment = The Legal Share
> path = /home/samba/data/legal
> public = no
> write list = @legal
> create mode = 0760
> directory mode = 0770
> valid users = @legal
> force group = +legal
>
> # This share is used for pcAnywhere host authentication
> [pcAnywhere$]
> comment = pcAnywhere host authenticaton
> path = /home/samba/pcAnywhere
> public = no
> read only = yes
> browseable = no
> valid users = @rempcaw
>
> # These shares are for the Faxpress server
> [castelle]
> path = /home/samba/castelle
> writable = yes
> browseable = yes
> public = yes
>
> [fpressdb]
> path = /home/samba/castelle/archive/database
> writable = yes
> browseable = yes
> public = yes
> # End Faspress stuff
>
> # MIS Mp3 Share (Shhhhhhhhhhhhh don't tell the RIAA)
> [mismp3]
> path = /home/samba/mp3
> public = no
> browseable = no
> write list = jasonj,cgreen
> create mode = 0760
> directory mode = 0770
> valid users = jasonj,cgreen
> force group = +misgroup
> force user = root
>
> [allhome]
> path = /home
> public = no
> browseable = no
> valid users = root
>
> [syslog]
> path = /var/log/
> public = no
> browseable = no
> valid users = root
>
>
> ______________________________________________________________________
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: http://lists.samba.org/mailman/listinfo/samba
--
Jerry Haltom <jhaltom at feedbackplusinc.com>
Feedback Plus, Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba/attachments/20040119/c1051b9d/attachment.bin
More information about the samba
mailing list