SUSE LINUX 9.3

Part III. Services / Chapter 32. Samba
	31.7. Introduction to mailsync		32.2. Samba as Login Server

Chapter 32. Samba

Table of Contents

32.1. Configuring the Server
32.2. Samba as Login Server
32.3. Configuring a Samba Server with YaST
32.4. Configuring Clients
32.5. Optimization

Abstract

Using Samba, a Unix machine can be configured as a file and print server for DOS, Windows, and OS/2 machines. Samba has developed into a fully-fledged and rather complex product. In addition to describing the basic functionality, this chapter introduces the basics of the Samba configuration and describes the YaST modules you can use for configuring Samba in your network.

Detailed Samba information is available in the digital documentation. Enter apropos samba at the command line to display some manual pages or just browse the /usr/share/doc/packages/samba directory if Samba is installed for more online documentation and examples. A commented example configuration (smb.conf.SuSE) can be found in the examples subdirectory.

Some important new features of the enclosed version 3 of the samba package include:

Support for Active Directory
Improved Unicode support
The internal authentication mechanisms have been completely revised
Improved support for the Windows 200x and XP printing system
Servers can be set up as member servers in Active Directory domains
Adoption of an NT4 domain, enabling the migration from the latter to a Samba domain

	Migration to Samba3
There are some special points to take into account when migrating from Samba 2.x to Samba 3. A discussion of this topic is included in the Samba HOWTO Collection, where an entire chapter is dedicated to it. After installing the `samba-doc` package, find the HOWTO in `/usr/share/doc/packages/samba/Samba-HOWTO-Collection.pdf`.

Samba uses the SMB protocol (server message block) that is based on the NetBIOS services. Due to pressure from IBM, Microsoft released the protocol so other software manufacturers could establish connections to a Microsoft domain network. With Samba, the SMB protocol works on top of the TCP/IP protocol, so the TCP/IP protocol must be installed on all clients.

NetBIOS is a software interface (API) designed for communication between machines. Here, a name service is provided. It enables machines connected to the net to reserve names for themselves. After reservation, these machines can be addressed by name. There is no central process that checks names. Any machine on the network can reserve as many names as it wants, if the names are not already in use. The NetBIOS interface can now be implemented for different network architectures. An implementation that works relatively closely with network hardware is called NetBEUI, but this is often referred to as NetBIOS. Network protocols implemented with NetBIOS are IPX from Novell (NetBIOS via TCP/IP) and TCP/IP.

The NetBIOS names sent via TCP/IP have nothing in common with the names used in /etc/hosts or those defined by DNS. NetBIOS uses its own, completely independent naming convention. However, it is recommended to use names that correspond to DNS hostnames to make administration easier. This is the default used by Samba.

All common operating systems, such as Mac OS X, Windows, and OS/2, support the SMB protocol. The TCP/IP protocol must be installed on all computers. Samba provides a client for the different UNIX flavors. For Linux, there is a kernel module for SMB that allows the integration of SMB resources on the Linux system level.

SMB servers provide hardware space to their clients by means of shares. A share includes a directory and its subdirectories on the server. It is exported by means of a name and can be accessed by its name. The share name can be set to any name—it does not have to be the name of the export directory. A printer is also assigned a name. Clients can access the printer by its name.

32.1. Configuring the Server

If you intend to use Samba as a server, install samba. Start the services required for Samba with rcnmb start && rcsmb start and stop them with rcsmb stop && rcnmb stop.

The main configuration file of Samba is /etc/samba/smb.conf. This file can be divided into two logical parts. The [global] section contains the central and global settings. The [share] sections contain the individual file and printer shares. By means of this approach, details regarding the shares can be set differently or globally in the [global] section, which enhances the structural transparency of the configuration file.

32.1.1. The global Section

The following parameters of the [global] section need some adjustment to match the requirements of your network setup so other machines can access your Samba server via SMB in a Windows environment.

workgroup = TUX-NET

This line assigns the Samba server to a workgroup. Replace TUX-NET with an appropriate workgroup of your networking environment. Your Samba server appears under its DNS name unless this name has been assigned to any other machine in the network. If the DNS name is not available, set the server name using netbiosname=MYNAME. See mansmb.conf for more details about this parameter.

os level = 2

This parameter triggers whether your Samba server tries to become LMB (local master browser) for its work group. Choose a very low value to spare the existing Windows network from any disturbances caused by a misconfigured Samba server. More information about this important topic can be found in the files BROWSING.txt and BROWSING-Config.txt under the textdocs subdirectory of the package documentation.

If no other SMB server is present in your network (such as a Windows NT or 2000 server) and you want the Samba server to keep a list of all systems present in the local environment, set the os level to a higher value (for example, 65). Your Samba server is then chosen as LMB for your local network.

When changing this setting, consider carefully how this could affect an existing Windows network environment. First test the changes in an isolated network or at a noncritical time of day.

wins support and wins server

To integrate your Samba server into an existing Windows network with an active WINS server, enable the wins server option and set its value to the IP address of that WINS server.

If your Windows machines are connected to separate subnets and should still be aware of each other, you need to set up a WINS server. To turn a Samba server into such a WINS server, set the option wins support = Yes. Make sure that only one Samba server of the network has this setting enabled. The options wins server and wins support must never be enabled at the same time in your smb.conf file.

32.1.2. Shares

The following examples illustrate how a CD-ROM drive and the user directories (homes) are made available to the SMB clients.

[cdrom]

To avoid having the CD-ROM drive accidentally made available, these lines are deactivated with comment marks (semicolons in this case). Remove the semicolons in the first column to share the CD-ROM drive with Samba.

Example 32.1. A CD-ROM Share

;[cdrom]
;       comment = Linux CD-ROM
;       path = /media/cdrom
;       locking = No

[cdrom] and comment: The entry [cdrom] is the name of the share that can be seen by all SMB clients on the net. An additional comment can be added to further describe the share.
path = /media/cdrom: path exports the directory /media/cdrom.

By means of a very restrictive default configuration, this kind of share is only made available to the users present on this system. If this share should be made available to everybody, add a line guest ok = yes to the configuration. This setting gives read permissions to anyone on the network. It is recommended to handle this parameter with great care. This applies even more to the use of this parameter in the [global] section.

[homes]

The [home] share is of special importance here. If the user has a valid account and password for the Linux file server and his own home directory, he can be connected to it.

Example 32.2. homes Share

[homes]
	comment = Home Directories
	valid users = %S
	browseable = No
	read only = No
	create mask = 0640
	directory mask = 0750

[homes]: As long as there is no other share using the share name of the user connecting to the SMB server, a share is dynamically generated using the [homes] share directives. The resulting name of the share is the username.
valid users = %S: %S is replaced with the concrete name of the share as soon as a connection has been successfully established. For a [homes] share, this is always the username. As a consequence, access rights to a user's share are restricted exclusively to the user.
browseable = No: This setting makes the share invisible in the network environment.
read only = No: By default, Samba prohibits write access to any exported share by means of the read only = Yes parameter. To make a share writable, set the value read only = No, which is synonymous with writeable = Yes.
create mask = 0640: Systems that are not based on MS Windows NT do not understand the concept of UNIX permissions, so they cannot assign permissions when creating a file. The parameter create mask defines the access permissions assigned to newly created files. This only applies to writable shares. In effect, this setting means the owner has read and write permissions and the members of the owner's primary group have read permissions. valid users = %S prevents read access even if the group has read permissions. For the group to have read or write access, deactivate the line valid users = %S.

32.1.3. Security Levels

The SMB protocol comes from the DOS and Windows world and directly takes into consideration the problem of security. Each share access can be protected with a password. SMB has three possible ways of checking the permissions:

Share Level Security (security = share):: A password is firmly assigned to a share. Everyone who knows this password has access to that share.
User Level Security (security = user):: This variation introduces the concept of the user to SMB. Each user must register with the server with his own password. After registration, the server can grant access to individual exported shares dependent on usernames.
Server Level Security (security = server):: To its clients, Samba pretends to be working in user level mode. However, it passes all password queries to another user level mode server, which takes care of authentication. This setting expects an additional parameter (password server =).

The distinction between share, user, and server level security applies to the entire server. It is not possible to offer individual shares of a server configuration with share level security and others with user level security. However, you can run a separate Samba server for each configured IP address on a system.

More information about this subject can be found in the Samba HOWTO Collection. For multiple servers on one system, pay attention to the options interfaces and bind interfaces only.

Tip

	Tip
For simple administration tasks with the Samba server, there is also the program swat. It provides a simple Web interface with which to configure the Samba server conveniently. In a Web browser, open http://localhost:901 and log in as user `root`. However, swat must also be activated in the files `/etc/xinetd.d/samba` and `/etc/services`. To do so in `/etc/xinetd.d/samba`, edit the `disable` line so it reads `disable = no`. More information about swat is provided in the man page.

For simple administration tasks with the Samba server, there is also the program swat. It provides a simple Web interface with which to configure the Samba server conveniently. In a Web browser, open http://localhost:901 and log in as user root. However, swat must also be activated in the files /etc/xinetd.d/samba and /etc/services. To do so in /etc/xinetd.d/samba, edit the disable line so it reads disable = no. More information about swat is provided in the man page.