Translations by ydioma2005

ubuntu-doc@lists.ubuntu.com (Ubuntu Documentation Project)

bhuvan@ubuntu.com (Bhuvaneswaran Arumugam)

robbieboy@gmail.com (Robert Stoffers)

bshumate@openmindshare.com (Brian Shumate)

Ubuntu Server Guide

2006-04-06

An introduction to installing and configuring server applications on Ubuntu.

Windows Networking

Computer networks are often comprised of diverse systems, and while operating a network made up entirely of Ubuntu desktop and server computers would certainly be fun, some network environments must consist of both Ubuntu and <trademark class="registered">Microsoft</trademark><trademark class="registered">Windows</trademark> systems working together in harmony. This section of the <phrase>Ubuntu</phrase> Server Guide introduces principles and tools used in configuring your Ubuntu Server for sharing network resources with Windows computers.

Introduction

Successfully networking your Ubuntu system with Windows clients involves providing and integrating with services common to Windows environments. Such services assist the sharing of data and information about the computers and users involved in the network, and may be classified under three major categories of functionality:

<emphasis role="bold">File and Printer Sharing Services</emphasis>. Using the Server Message Block (SMB) protocol to facilitate the sharing of files, folders, volumes, and the sharing of printers throughout the network.

<emphasis role="bold">Directory Services</emphasis>. Sharing vital information about the computers and users of the network with such technologies as the Lightweight Directory Access Protocol (LDAP) and Microsoft <trademark class="registered">Active Directory</trademark>.

<emphasis role="bold">Authentication and Access</emphasis>. Establishing the identity of a computer or user of the network and determining the information the computer or user is authorized to access using such principles and technologies as file permissions, group policies, and the Kerberos authentication service.

Fortunately, your Ubuntu system may provide all such facilities to Windows clients and share network resources among them. One of the principle pieces of software your Ubuntu system includes for Windows networking is the SAMBA suite of SMB server applications and tools. This section of the <phrase>Ubuntu</phrase> Server Guide will briefly introduce the installation and limited configuration of the SAMBA suite of server applications and utilities. Additional, detailed documentation and information on SAMBA is beyond the scope of this documentation, but exists on the <ulink url="http://www.samba.org">SAMBA website</ulink>.

Installing SAMBA

At the prompt enter the following command to install the SAMBA server applications:

Configuring SAMBA

You may configure the SAMBA server by editing the <filename>/etc/samba/smb.conf</filename> file to change the default settings or add new settings. More information about each setting is available in the comments of the <filename>/etc/samba/smb.conf</filename> file or by viewing the <filename>/etc/samba/smb.conf</filename> manual page from the prompt with the following command typed at a terminal prompt:

Prior to editing the configuration file, you should make a copy of the original file and protect it from writing so you will have the original settings as a reference and to re-use as necessary.

Backup the <filename>/etc/samba/smb.conf</filename> file:

Now, edit the <filename>/etc/samba/smb.conf</filename> file and make your changes.

In addition to the SAMBA suite of file and printer sharing server applications, Ubuntu also includes other powerful server applications designed to provide additional network server functionality to Windows clients similar to the functionality provided by actual Windows servers. For example, Ubuntu offers centralized management of network resources such as computers and users via Directory Services, and facilitates the identification, and authorization of computers and users via Authentication Services.

The following sections will discuss SAMBA and the supporting technologies, such as Lightweight Directory Access Protocol (LDAP) server, and Kerberos authentication server in more detail. You will also learn about some of the available configuration directives available the SAMBA configuration file which facilitate network integration with Windows clients and servers.

Active Directory

Active Directory is a proprietary implementation of Directory Services by Microsoft, and is used to provide a means to share information about network resources and users. In addition to providing a centralized source of such information, Active Directory also acts as a centralized authentication security authority for the network. Active directory combines capabilities traditionally found in separate, specialized directory systems to simplify integration, management, and security of network resources. The SAMBA package may be configured to use Active Directory services from a Windows Domain Controller.

The LDAP server application provides Directory Services functionality to Windows computers in a manner very similar to Microsoft Active Directory services. Such services include managing the identities and relationships of computers, users, and groups of computers or users that participate in the network, and providing a consistent means to describe, locate, and manage these resources. The freely available implementation of LDAP available for your Ubuntu system is called <emphasis role="italic">OpenLDAP</emphasis>. The server daemons responsible for handling OpenLDAP directory requests and the propagation of directory data from one LDAP server to another on Ubuntu, are <application>slapd</application> and <application>slurpd</application>. OpenLDAP may be used in conjunction with SAMBA to provide File, Print, and Directory services in much the same way a Windows Domain Controller does so long as SAMBA is compiled with LDAP support.

The Kerberos authentication security system is a standardized service for providing authentication to computers and users by means of a centralized server which grants encrypted authorization tickets accepted for authorization by any other computer using Kerberos. Benefits of Kerberos authentication include mutual authentication, delegated authentication, interoperability, and simplified trust management. The primary server daemons for handling the Kerberos authentication and Kerberos database administration on Ubuntu are <application>krb5kdc</application> and <application>kadmin</application>. SAMBA may use Kerberos as a mechanism for authenticating computers and users against a Windows Domain Controller. To do so, the Ubuntu system must have Kerberos installed, and the <filename>/etc/samba/smb.conf</filename> must be modified to select the the proper <emphasis role="italic">realm</emphasis> and <emphasis role="italic">security</emphasis> mode. For example, edit the <filename>/etc/samba/smb.conf</filename> file and add the values:

realm = DOMAIN_NAME

security = ADS

to the file, and save the file.

Be sure to replace the token DOMAIN_NAME in the example above with the actual name of your specific Windows Domain.

You will need to restart the SAMBA daemons to effect these changes. Restart the SAMBA daemons with the following command entered at a terminal prompt:

Computer Accounts are used in Directory Services to uniquely identify computer systems participating in a network, and are even treated in the same manner as users in terms of security. Computer accounts may have passwords just as user accounts do, and are subject to authorization to network resources in the same manner as user accounts. For example, if a network user, with a valid account for a particular network attempts to authenticate with a network resource from a computer which does not have a valid computer account, depending upon policies enforced on the network, the user may be denied access to the resource if the computer the user is attempting authentication from is considered to be an unauthorized computer.

A computer account may be added to the SAMBA password file, provided the name of the computer being added exists as a valid user account in the local password database first. The syntax for adding a computer or machine account to the SAMBA password file is to use the <application>smbpasswd</application> command from a terminal prompt as follows:

sudo smbpasswd -a -m COMPUTER_NAME

Be sure to replace the token COMPUTER_NAME in the example above with the actual name of the specific computer you wish to add a machine account for.

File Permissions define the explicit rights a computer or user has to a particular directory, file, or set of files. Such permissions may be defined by editing the <filename>/etc/samba/smb.conf</filename> file and specifying the explicit permissions of a defined file share. For example, if you have defined a SAMBA share called <emphasis role="italic">sourcedocs</emphasis> and wish to give <emphasis role="italic">read-only</emphasis> permissions to the group of users known as <emphasis role="italic">planning</emphasis>, but wanted to allow writing to the share by the group called <emphasis role="italic">authors</emphasis> and the user named <emphasis role="italic">richard</emphasis>, then you could edit the <filename>/etc/samba/smb.conf</filename> file, and add the following entries under the <emphasis role="italic">[sourcedocs]</emphasis> entry:

read list = @planning

write list = @authors, richard

Save the <filename>/etc/samba/smb.conf</filename> for the changes to take effect.

Another possible permission is to declare <emphasis role="italic">administrative</emphasis> permissions to a particular shared resource. Users having administrative permissions may read, write, or modify any information contained in the resource the user has been given explicit administrative permissions to. For example, if you wanted to give the user <emphasis role="italic">melissa</emphasis> administrative permissions to the example <emphasis role="italic">sourcedocs</emphasis> share, you would edit the <filename>/etc/samba/smb.conf</filename> file, and add the following line under the <emphasis role="italic">[sourcedocs]</emphasis> entry:

Ubuntu includes client applications and capabilities for accessing network resources shared with the SMB protocol. For example, a utility called <application>smbclient</application> allows for accessing remote shared file-systems, in a manner similar to a File Transfer Protocol (FTP) client. To access a shared folder resource known as <emphasis role="italic">documents</emphasis> offered by a remote Windows computer named <emphasis role="italic">bill</emphasis> using <application>smbclient</application> for example, one would enter a command similar to the following at the prompt:

You will then be prompted for the password for the user name specified after the -U switch, and upon successful authentication, will be presented with a prompt where commands may be entered for manipulating and transferring files in a syntax similar to that used by non-graphical FTP clients. For more information on the <application>smbclient</application> utility, read the utility's manual page with the command: <screen> <command> man smbclient </command> </screen>

Local mounting of remote network resources using the SMB protocol is also possible using the <application>mount</application> command. For example, to mount a shared folder named <emphasis role="italic">project-code</emphasis> on a Windows server named <emphasis role="italic">development</emphasis> as the user <emphasis role="italic">dlightman</emphasis> to your Ubuntu system's /mnt/pcode mount-point, you would issue this command at the prompt:

You will then be prompted for the user password, and after successfully authenticating, the contents of the shared resource will be available locally via the mount-point specified as the last argument to the mount command. To disconnect the shared resource, simply use the <application>umount</application> command as you would with any other mounted file system. For example:

User Accounts define persons with some level of authorization to use certain computer and network resources. Typically, in a network environment, a user account is provided to each person allowed to access a computer or network, where policies and permissions then define what explicit rights that user account has access to. To define SAMBA network users for your Ubuntu system, you may use the <application>smbpasswd</application> command. For example to add a SAMBA user to your Ubuntu system with the user name <emphasis role="italic">jseinfeld</emphasis>, you would enter this command at the prompt: