Translations by Anderson Blaine

Ubuntu Server Guide

In addition to the SAMBA suite of file and printer sharing server applications, Ubuntu also includes other powerful server applications designed to provide additional network server functionality to Windows clients similar to the functionality provided by actual Windows servers. For example, Ubuntu offers centralized management of network resources such as computers and users via Directory Services, and facilitates the identification, and authorization of computers and users via Authentication Services.

The following sections will discuss SAMBA and the supporting technologies, such as Lightweight Directory Access Protocol (LDAP) server, and Kerberos authentication server in more detail. You will also learn about some of the available configuration directives available the SAMBA configuration file which facilitate network integration with Windows clients and servers.

Active Directory is a proprietary implementation of Directory Services by Microsoft, and is used to provide a means to share information about network resources and users. In addition to providing a centralized source of such information, Active Directory also acts as a centralized authentication security authority for the network. Active directory combines capabilities traditionally found in separate, specialized directory systems to simplify integration, management, and security of network resources. The SAMBA package may be configured to use Active Directory services from a Windows Domain Controller.

The LDAP server application provides Directory Services functionality to Windows computers in a manner very similar to Microsoft Active Directory services. Such services include managing the identities and relationships of computers, users, and groups of computers or users that participate in the network, and providing a consistent means to describe, locate, and manage these resources. The freely available implementation of LDAP available for your Ubuntu system is called <emphasis role="italic">OpenLDAP</emphasis>. The server daemons responsible for handling OpenLDAP directory requests and the propagation of directory data from one LDAP server to another on Ubuntu, are <application>slapd</application> and <application>slurpd</application>. OpenLDAP may be used in conjunction with SAMBA to provide File, Print, and Directory services in much the same way a Windows Domain Controller does so long as SAMBA is compiled with LDAP support.

The Kerberos authentication security system is a standardized service for providing authentication to computers and users by means of a centralized server which grants encrypted authorization tickets accepted for authorization by any other computer using Kerberos. Benefits of Kerberos authentication include mutual authentication, delegated authentication, interoperability, and simplified trust management. The primary server daemons for handling the Kerberos authentication and Kerberos database administration on Ubuntu are <application>krb5kdc</application> and <application>kadmin</application>. SAMBA may use Kerberos as a mechanism for authenticating computers and users against a Windows Domain Controller. To do so, the Ubuntu system must have Kerberos installed, and the <filename>/etc/samba/smb.conf</filename> must be modified to select the the proper <emphasis role="italic">realm</emphasis> and <emphasis role="italic">security</emphasis> mode. For example, edit the <filename>/etc/samba/smb.conf</filename> file and add the values:

realm = DOMAIN_NAME

Be sure to replace the token DOMAIN_NAME in the example above with the actual name of your specific Windows Domain.

You will need to restart the SAMBA daemons to effect these changes. Restart the SAMBA daemons with the following command entered at a terminal prompt:

A computer account may be added to the SAMBA password file, provided the name of the computer being added exists as a valid user account in the local password database first. The syntax for adding a computer or machine account to the SAMBA password file is to use the <application>smbpasswd</application> command from a terminal prompt as follows:

sudo smbpasswd -a -m COMPUTER_NAME

Be sure to replace the token COMPUTER_NAME in the example above with the actual name of the specific computer you wish to add a machine account for.

File Permissions define the explicit rights a computer or user has to a particular directory, file, or set of files. Such permissions may be defined by editing the <filename>/etc/samba/smb.conf</filename> file and specifying the explicit permissions of a defined file share. For example, if you have defined a SAMBA share called <emphasis role="italic">sourcedocs</emphasis> and wish to give <emphasis role="italic">read-only</emphasis> permissions to the group of users known as <emphasis role="italic">planning</emphasis>, but wanted to allow writing to the share by the group called <emphasis role="italic">authors</emphasis> and the user named <emphasis role="italic">richard</emphasis>, then you could edit the <filename>/etc/samba/smb.conf</filename> file, and add the following entries under the <emphasis role="italic">[sourcedocs]</emphasis> entry:

read list = @planning

write list = @authors, richard

Save the <filename>/etc/samba/smb.conf</filename> for the changes to take effect.

Another possible permission is to declare <emphasis role="italic">administrative</emphasis> permissions to a particular shared resource. Users having administrative permissions may read, write, or modify any information contained in the resource the user has been given explicit administrative permissions to. For example, if you wanted to give the user <emphasis role="italic">melissa</emphasis> administrative permissions to the example <emphasis role="italic">sourcedocs</emphasis> share, you would edit the <filename>/etc/samba/smb.conf</filename> file, and add the following line under the <emphasis role="italic">[sourcedocs]</emphasis> entry:

Ubuntu includes client applications and capabilities for accessing network resources shared with the SMB protocol. For example, a utility called <application>smbclient</application> allows for accessing remote shared file-systems, in a manner similar to a File Transfer Protocol (FTP) client. To access a shared folder resource known as <emphasis role="italic">documents</emphasis> offered by a remote Windows computer named <emphasis role="italic">bill</emphasis> using <application>smbclient</application> for example, one would enter a command similar to the following at the prompt:

smbclient //bill/documents -U &lt;username&gt;

You will then be prompted for the user password, and after successfully authenticating, the contents of the shared resource will be available locally via the mount-point specified as the last argument to the mount command. To disconnect the shared resource, simply use the <application>umount</application> command as you would with any other mounted file system. For example:

User Accounts define persons with some level of authorization to use certain computer and network resources. Typically, in a network environment, a user account is provided to each person allowed to access a computer or network, where policies and permissions then define what explicit rights that user account has access to. To define SAMBA network users for your Ubuntu system, you may use the <application>smbpasswd</application> command. For example to add a SAMBA user to your Ubuntu system with the user name <emphasis role="italic">jseinfeld</emphasis>, you would enter this command at the prompt:

The <application>smbpasswd</application> application will then prompt you to enter a password for the user:

New SMB password:

Enter the password you wish to set for the user, and the <application>smbpasswd</application> application will ask you to confirm the password:

Retype new SMB password:

Confirm the password, and <application>smbpasswd</application> will add the entry for the user to the SAMBA password file.

Groups define a collection of computers or users which have a common level of access to particular network resources and offer a level of granularity in controlling access to such resources. For example, if a group <emphasis role="italic">qa</emphasis> is defined and contains the users <emphasis role="italic">freda</emphasis>, <emphasis role="italic">danika</emphasis>, and <emphasis role="italic">rob</emphasis> and a second group <emphasis role="italic">support</emphasis> is defined and consists of users <emphasis role="italic">danika</emphasis>, <emphasis role="italic">jeremy</emphasis>, and <emphasis role="italic">vincent</emphasis> then certain network resources configured to allow access by the <emphasis role="italic">qa</emphasis> group will subsequently enable access by freda, danika, and rob, but not jeremy or vincent. Since the user <emphasis role="italic">danika</emphasis> belongs to both the <emphasis role="italic">qa</emphasis> and <emphasis role="italic">support</emphasis> groups, she will be able to access resources configured for access by both groups, whereas all other users will have only access to resources explicitly allowing the group they are part of.

When defining groups in the SAMBA configuration file, <filename>/etc/samba/smb.conf</filename> the recognized syntax is to preface the group name with an "@" symbol. For example, if you wished to define a group named <emphasis role="italic">sysadmin</emphasis> in a certain section of the <filename>/etc/samba/smb.conf</filename>, you would do so by entering the group name as <emphasis role="bold">@sysadmin</emphasis>.

Group Policy

Group Policy defines certain SAMBA configuration settings pertaining to the Domain or Workgroup computer accounts belong to, and other global settings for the SAMBA server. For example, if the SAMBA server belongs to a Workgroup of Windows computers called <emphasis role="italic">LEVELONE</emphasis>, then the <filename>/etc/samba/smb.conf</filename> could be edited, and the following value changed accordingly:

workgroup = LEVELONE

Save the file and restart the SAMBA daemons to affect the change.

Other important global policy settings include the <emphasis role="italic">server string</emphasis> which defines the NETBIOS server name reported by your Ubuntu system to other machines on the Windows-based network. This is the name your Ubuntu system will be recognized as by Windows clients and other computers capable of browsing the network with the SMB protocol. Additionally, you may specify the name and location of the SAMBA server's log file by using the <emphasis role="italic">log file</emphasis> directive in the <filename>/etc/samba/smb.conf</filename> file.

Some of the additional directives governing global group policy include specification of the global nature of all shared resources. For example, placing certain directives under the <emphasis role="italic">[global]</emphasis> heading of the <filename>/etc/samba/smb.conf</filename> file will affect all shared resources unless an overriding directive is placed under a particular shared resource heading. You specify all shares are browseable by all clients on the network by placing a <emphasis role="italic">browseable</emphasis> directive, which takes a Boolean argument, under the <emphasis role="italic">[global]</emphasis> heading in the <filename>/etc/samba/smb.conf</filename>. That is, if you edit the file and add the line:

browseable = true

under the <emphasis role="italic">[global]</emphasis> section of <filename>/etc/samba/smb.conf</filename>, then all shares provided by your Ubuntu system via SAMBA will be browseable by all authorized clients, unless a specific share contains a <emphasis role="italic">browseable = false</emphasis> directive, which will override the global directive.

Other examples which work in a similar manner, are the <emphasis role="italic">public</emphasis> and <emphasis role="italic">writeable</emphasis> directives. The <emphasis role="italic">public</emphasis> directive accepts a Boolean value and decides whether a particular shared resource is visible by all clients, authorized or not. The <emphasis role="italic">writeable</emphasis> directive also takes a Boolean value and defines whether a particular shared resource is writable by any and all network clients.

References

Configuration

The purpose of IP Masquerading is to allow machines with private, non-routable IP addresses on your network to access the Internet through the machine doing the masquerading. Traffic from your private network destined for the Internet must be manipulated for replies to be routable back to the machine that made the request. To do this, the kernel must modify the <emphasis>source</emphasis> IP address of each packet so that replies will be routed back to it, rather than to the private IP address that made the request, which is impossible over the Internet. Linux uses <emphasis>Connection Tracking</emphasis> (conntrack) to keep track of which connections belong to which machines and reroute each return packet accordingly. Traffic leaving your private network is thus "masqueraded" as having originated from your Ubuntu gateway machine. This process is referred to in Microsoft documentation as Internet Connection Sharing.

The above log will also appear in <filename>/var/log/messages</filename>, <filename>/var/log/syslog</filename>, and <filename>/var/log/kern.log</filename>. This behavior can be modified by editing <filename>/etc/syslog.conf</filename> appropriately or by installing and configuring <application>ulogd</application> and using the ULOG target instead of LOG. The <application>ulogd</application> daemon is a userspace server that listens for logging instructions from the kernel specifically for firewalls, and can log to any file you like, or even to a <application>PostgreSQL</application> or <application>MySQL</application> database. Making sense of your firewall logs can be simplified by using a log analyzing tool such as <application>fwanalog</application>, <application> fwlogwatch</application>, or <application>lire</application>.

The OpenSSH server component, <application>sshd</application>, listens continuously for client connections from any of the client tools. When a connection request occurs, <application>sshd</application> sets up the correct connection depending on the type of client tool connecting. For example, if the remote computer is connecting with the <application>ssh</application> client application, the OpenSSH server sets up a remote control session after authentication. If a remote user connects to an OpenSSH server with <application>scp</application>, the OpenSSH server daemon initiates a secure copy of files between the server and client after authentication. OpenSSH can use many authentication methods, including plain password, public key, and <application>Kerberos</application> tickets.

After making changes to the <filename>/etc/ssh/sshd_config</filename> file, save the file, and restart the <application>sshd</application> server application to effect the changes using the following command at a terminal prompt:

Many other configuration directives for <application>sshd</application> are available for changing the server application's behavior to fit your needs. Be advised, however, if your only method of access to a server is <application>ssh</application>, and you make a mistake in configuring <application>sshd</application> via the <filename>/etc/ssh/sshd_config</filename> file, you may find you are locked out of the server upon restarting it, or that the <application>sshd</application> server refuses to start due to an incorrect configuration directive, so be extra careful when editing this file on a remote server.

Ubuntu features a comprehensive package management system for the installation, upgrade, configuration, and removal of software. In addition to providing access to an organized base of over 17,000 software packages for your Ubuntu computer, the package management facilities also feature dependency resolution capabilities and software update checking.