Table of Contents
Using Samba, a Unix machine can be configured as a file and print server for DOS, Windows, and OS/2 machines. Samba has developed into a fully-fledged and rather complex product. In addition to describing the basic functionality, this chapter introduces the basics of the Samba configuration and describes the YaST modules you can use for configuring Samba in your network.
Detailed Samba information is available in the digital
documentation. Enter apropos
the command line to display some manual pages or just browse the
/usr/share/doc/packages/samba directory if
Samba is installed for more online documentation
and examples. A commented example configuration
smb.conf.SuSE) can be found in the
Some important new features of the enclosed version 3 of the
samba package include:
Support for Active Directory
Improved Unicode support
The internal authentication mechanisms have been completely revised
Improved support for the Windows 200x and XP printing system
Servers can be set up as member servers in Active Directory domains
Adoption of an NT4 domain, enabling the migration from the latter to a Samba domain
|Migration to Samba3|
There are some special points to take into account when
migrating from Samba 2.x to Samba
3. A discussion of this topic is included in the Samba HOWTO
Collection, where an entire chapter is dedicated to it. After installing
Samba uses the SMB protocol (server message block) that is based on the NetBIOS services. Due to pressure from IBM, Microsoft released the protocol so other software manufacturers could establish connections to a Microsoft domain network. With Samba, the SMB protocol works on top of the TCP/IP protocol, so the TCP/IP protocol must be installed on all clients.
NetBIOS is a software interface (API) designed for communication between machines. Here, a name service is provided. It enables machines connected to the net to reserve names for themselves. After reservation, these machines can be addressed by name. There is no central process that checks names. Any machine on the network can reserve as many names as it wants, if the names are not already in use. The NetBIOS interface can now be implemented for different network architectures. An implementation that works relatively closely with network hardware is called NetBEUI, but this is often referred to as NetBIOS. Network protocols implemented with NetBIOS are IPX from Novell (NetBIOS via TCP/IP) and TCP/IP.
The NetBIOS names sent via TCP/IP have nothing in common with the
names used in
/etc/hosts or those defined by DNS.
NetBIOS uses its own, completely independent naming convention. However, it
is recommended to use names that correspond to DNS hostnames to make
administration easier. This is the default used by
All common operating systems, such as Mac OS X, Windows, and OS/2, support the SMB protocol. The TCP/IP protocol must be installed on all computers. Samba provides a client for the different UNIX flavors. For Linux, there is a kernel module for SMB that allows the integration of SMB resources on the Linux system level.
SMB servers provide hardware space to their clients by means of shares. A share includes a directory and its subdirectories on the server. It is exported by means of a name and can be accessed by its name. The share name can be set to any name—it does not have to be the name of the export directory. A printer is also assigned a name. Clients can access the printer by its name.
The main configuration file of Samba is
/etc/samba/smb.conf. This file can be divided into two
logical parts. The
[global] section contains the central
and global settings. The
[share] sections contain the
individual file and printer shares. By means of this approach, details
regarding the shares can be set differently or globally in the
[global] section, which enhances the structural
transparency of the configuration file.
The following parameters of the
need some adjustment to match the requirements of your network setup so
other machines can access your Samba server via
SMB in a Windows environment.
This line assigns the Samba server to a
TUX-NET with an
appropriate workgroup of your networking environment. Your
Samba server appears under its DNS name
unless this name has been assigned to any other machine in the
network. If the DNS name is not available, set the server name using
smb.conf for more details about
This parameter triggers whether your
Samba server tries to become LMB (local
master browser) for its work group. Choose a very low value to
spare the existing Windows network from any disturbances caused by a
misconfigured Samba server. More information
about this important topic can be found in the files
BROWSING-Config.txt under the
textdocs subdirectory of the package
If no other SMB server is present in your network (such as a Windows NT
or 2000 server) and you want the Samba
server to keep a list of all systems present in the local environment,
os level to a higher value (for example,
65). Your Samba server
is then chosen as LMB for your local network.
When changing this setting, consider carefully how this could affect an existing Windows network environment. First test the changes in an isolated network or at a noncritical time of day.
To integrate your Samba
server into an existing Windows network with an active WINS server,
wins server option and set its value
to the IP address of that WINS server.
If your Windows machines are connected to separate subnets and
should still be aware of each other, you need to set up a WINS server.
To turn a Samba server into such a WINS
server, set the option
wins support = Yes. Make sure
that only one Samba server of the network has
this setting enabled.
wins server and
support must never be enabled at the same time in your
The following examples illustrate how a CD-ROM drive and the user
homes) are made available to
the SMB clients.
To avoid having the CD-ROM drive accidentally made available, these lines are deactivated with comment marks (semicolons in this case). Remove the semicolons in the first column to share the CD-ROM drive with Samba.
[cdrom] is the name of the share
that can be seen by all SMB clients on the net. An additional
comment can be added to further describe the
path = /media/cdrom
path exports the directory
By means of a very restrictive default configuration, this kind of
share is only made available to the users present on this system. If
this share should be made available to everybody, add a line
guest ok = yes to the configuration. This setting
gives read permissions to anyone on the network. It is recommended to
handle this parameter with great care. This applies even more to the use
of this parameter in the
[home] share is of special
importance here. If the user has a valid account and password for the
Linux file server and his own home directory, he can be connected to
Example 32.2. homes Share
[homes] comment = Home Directories valid users = %S browseable = No read only = No create mask = 0640 directory mask = 0750
As long as there is no other share using the share name of the
user connecting to the SMB server, a share is dynamically generated
[homes] share directives. The resulting
name of the share is the username.
valid users = %S
%S is replaced with the concrete name of the
share as soon as a connection has been successfully established. For
[homes] share, this is always the
username. As a consequence, access rights to a user's share
are restricted exclusively to the user.
browseable = No
This setting makes the share invisible in the network environment.
read only = No
By default, Samba prohibits write
access to any exported share by means of the
read only =
Yes parameter. To make a share writable, set the value
read only = No, which is synonymous with
writeable = Yes.
create mask = 0640
Systems that are not based on MS Windows NT do not understand
the concept of UNIX permissions, so they cannot assign permissions
when creating a file. The parameter
defines the access permissions assigned to newly created files. This
only applies to writable shares. In effect, this setting means the
owner has read and write permissions and the members of the owner's
primary group have read permissions.
valid users =
%S prevents read access even if the group has read
permissions. For the group to have read or write
access, deactivate the line
valid users = %S.
The SMB protocol comes from the DOS and Windows world and directly takes into consideration the problem of security. Each share access can be protected with a password. SMB has three possible ways of checking the permissions:
A password is firmly assigned to a share. Everyone who knows this password has access to that share.
This variation introduces the concept of the user to SMB. Each user must register with the server with his own password. After registration, the server can grant access to individual exported shares dependent on usernames.
To its clients, Samba pretends to be
working in user level mode. However, it passes all password queries to
another user level mode server, which takes care of authentication. This
setting expects an additional parameter (
The distinction between share, user, and server level security applies to the entire server. It is not possible to offer individual shares of a server configuration with share level security and others with user level security. However, you can run a separate Samba server for each configured IP address on a system.
More information about this subject can be found in the Samba HOWTO
Collection. For multiple servers on one system, pay attention to
For simple administration tasks with the
Samba server, there is also the program swat.
It provides a simple Web interface with which to configure the
Samba server conveniently. In a Web browser,
open http://localhost:901 and log in as user