CT320: Advanced Network and System Administration
SAMBA(ORIGINAL SLIDES BY
DR. JAMES WALDEN, NKU)
Slide #1
CT320 : Advanced Network and System Administration
Topics
CT320: Advanced Network and System Administration
Slide #2
1. Why Samba?2. Workgroups3. NetBIOS4. Daemons5. samba.conf6. Security7. Users8. Passwords9. Permissions
CT320: Advanced Network and System Administration
What is Samba?Slide
#3
Open source UNIX implementation of SMB.SMB – Server Message BlockProtocol for sharing files, printers, serial ports, Communications such as named pipes
Samba servers provide:• File sharing.• Printer sharing.• Network browsing.• WINS name resolution.• Primary and backup domain controllers.
CT320: Advanced Network and System Administration
Why Samba?Slide
#4
1. Free2. Faster than Windows SMB servers3. More reliable than Windows servers4. Handles heterogenous networks
CT320: Advanced Network and System Administration
WorkgroupsSlide
#5
CT320: Advanced Network and System Administration
NetBIOSSlide
#6
Designed to run over older network types Token ring NetBEUI IPX
NetBIOS over TCP/IP (NBT or NetBT) Name service Datagram communication Session-based communication
CT320: Advanced Network and System Administration
Name RegistrationSlide
#7Machines requests names and either:1. NetBIOS name server (NBNS) handles req.2. Client with name defends ownership.
CT320: Advanced Network and System Administration
Name ResolutionSlide
#8Machines asks which host has name X:NetBIOS name server (NBNS) handles req.Client with name responds with its address.
CT320: Advanced Network and System Administration
Node TypesSlide
#9
b-node: Uses broadcast naming only.p-node: Uses NBNS naming only.m-node: Broadcast registration, then notifies
NBNS of name. Broadcast resolution, fails over to NBNS.
h-node: Uses NBNS, then fails over to broadcast. Default for most Windows.
CT320: Advanced Network and System Administration
NetBIOS NamespaceSlide #10
15-character flat namespace.Legal: A-Za-z0-9 ! @ # $ % ^ & ( ) – ‘ {} ~
Names have an associated resource type.00: Standard workstation service.03: Windows messenger service.1B: Domain master browser service.1D: Master browser.20: File and print server.
CT320: Advanced Network and System Administration
NetBIOS BrowsingSlide #11
Finding computers and resources on net. Contain master for computers. Contain individual host for resources.
Local master browser maintains list of hosts. If local master down, election determines which
machine becomes new local master browser.
CT320: Advanced Network and System Administration
DaemonsSlide #12
nmbdName resolution and registration; browsing.Supports NetBIOS name server and WINS.
smbdFile and print sharing; authentication.
winbinddNT and ADS domain service.Not needed if not using domains.
CT320: Advanced Network and System Administration
/etc/samba/smb.confSlide #13
Ini format configuration file.[section] section descriptors.
[global] section values apply to all sections.
Other sections describe shared resources.var = value formatMany, many options.# and ; are comments
Validate with testparm command.
CT320: Advanced Network and System Administration
Example /etc/samba/smb.confSlide #14
[global] workgroup = DOCS netbios name = DOCS_SRV security = share
[data] comment = Documentation Serverpath = /export read only = Yes guest only = Yes
CT320: Advanced Network and System Administration
Samba FirewallingSlide #15
Port 137: NetBIOS network browsing.
Port 138: NetBIOS name service.
Port 139: File/print sharing.
Port 445: Used by W2k/XP when NetBIOS over TCP/IP disabled.
CT320: Advanced Network and System Administration
Authentication TypesSlide #16
ShareShares have one or more passwords.Anyone with password can access share.
UserEach share configured to allow certain users.Samba server verifies user/password pairs.
ServerSame as user-level, but uses another server.
DomainDomain controller provides authentication types.
CT320: Advanced Network and System Administration
Username mappingSlide #17Samba server username checks
1. Check for exact username.2. Checks for username in lowercase.3. Checks for Username in lc, first letter uc.
Username map fileFile specified in smb.conf.
username map = /etc/samba/usermapContains UNIX / Samba username pairs:
darwin = DouglasArwinjwalden = James Waldenusers = @accountsnobody = *
CT320: Advanced Network and System Administration
Access ControlSlide #18
valid usersOnly these users have access.Group names preceded by @ sign.
invalid usersThese users do not have access.Takes precedence over valid users tag.
admin usersThese users have root access to share.
CT320: Advanced Network and System Administration
Samba PasswordsSlide #19
Stored in /etc/samba/smbpasswdSet by smbpaswd command.
CT320: Advanced Network and System Administration
Account BackendsSlide #20
PlaintextPasses plaintext auth to /etc/{passwd,shadow}
SmbpasswdText file with encrypted NT passwords.
tdbsamBinary database with smbpassword + SAM info.
ldapsamLDAP with POSIX + sambaSamAccount objs.
CT320: Advanced Network and System Administration
Password SynchronizationSlide #21
Configuration options:unix password sync = yespasswd program = /usr/bin/passwd %upasswd chat = *old*password* %o\n *new*password* %n\n *new*password* %n\n *changed*
CT320: Advanced Network and System Administration
Sharing Home DirectoriesSlide #22
Use special [homes] share.If user attempts to connect to share notspecified in /etc/smb.conf:
1. Creates new disk share called [username]2. Share path is set to username’s home dir.3. Options to set to [globals] + [homes] options, with
[homes] options winning any conflicts.4. Samba connects user to new share.
Caveat: may not want root, bin, &c to share.
CT320: Advanced Network and System Administration
Permission MappingSlide #23
MS DOS Permissions Read-only System Hidden Archive
UNIX Permissions Read Write eXecute
Preserve MS DOS file permissions on UNIX:Since MS DOS uses file extensions instead of X bits,map perms to owner, group, and world execute bits.Ex: map archive = yes, map system = yes, map hidden = yes
CT320: Advanced Network and System Administration
Creation MasksSlide #24
Samba masksUNIX octal permissions: file and directory.Execute bits used for permission mapping.Can set user and group ownerships too.
Example[data]create mask = 755directory mask = 755force user = joeforce group = accounting
CT320: Advanced Network and System Administration
ACLsSlide #25
Samba can map NT ACLs to POSIX ACLs. nt acl support = yes If not set, maps NT ACLs to UNIX rwx perms.
POSIX ACLs do not support all NT ACLs Ex: Take Ownership
CT320: Advanced Network and System Administration
Additional FeaturesSlide #26
1. Samba domain controllers.2. Samba/LDAP integration.3. Using Samba from Windows.4. Samba Print servers.
CT320: Advanced Network and System Administration
ReferencesSlide #271. Aeleen Frisch, Essential System Administration, 3rd edition,
O’Reilly, 2002.2. Evi Nemeth et al, UNIX System Administration Handbook, 3rd
edition, Prentice Hall, 2001.3. RedHat, Red Hat Enterprise Linux 4 System Administration
Guide, http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/sysadmin-guide/, 2005.
4. John H. Terpstra,, Jelmer R. Vernooij, Official Samba-3 HOWTO and Reference Guide, 2nd Edition, Prentice Hall PTR, http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/, 2005.
5. John H. Terpstra, Samba-3 by Example: Practical Exercises to Successful Deployment, 2nd Edition, Prentice Hall PTR, http://www.samba.org/samba/docs/Samba3-ByExample.pdf , 2005.
6. Jay Ts, Robert Eckstein, David Collier-Brown, Using Samba, 2nd edition, http://www.samba.org/samba/docs/using_samba/toc.html, O’Reilly, 2003.