Translations by ZhongHan Cai

To match the Samba configuration above the <emphasis>sysadmin</emphasis> group will be given read, write, and execute permissions to <filename>/srv/samba/share</filename>, the <emphasis>qa</emphasis> group will be given read and execute permissions, and the files will be owned by the username <emphasis>melissa</emphasis>. Enter the following in a terminal:

sudo chown -R melissa /srv/samba/share/

sudo chgrp -R sysadmin /srv/samba/share/

sudo setfacl -R -m g:qa:rx /srv/samba/share/

The <application>setfacl</application> command above gives <emphasis>execute</emphasis> permissions to all files in the <filename>/srv/samba/share</filename> directory, which you may or may not want.

Now from a Windows client you should notice the new file permissions are implemented. See the <application>acl</application> and <application>setfacl</application> man pages for more information on POSIX ACLs.

Samba AppArmor Profile

Ubuntu comes with the <application>AppArmor</application> security module, which provides mandatory access controls. The default AppArmor profile for Samba will need to be adapted to your configuration. For more details on using AppArmor see <xref linkend="apparmor"/>.

There are default AppArmor profiles for <filename>/usr/sbin/smbd</filename> and <filename>/usr/sbin/nmbd</filename>, the Samba daemon binaries, as part of the <application>apparmor-profiles</application> packages. To install the package, from a terminal prompt enter:

sudo apt-get install apparmor-profiles

This package contains profiles for several other binaries.

By default the profiles for <application>smbd</application> and <application>nmbd</application> are in <emphasis>complain</emphasis> mode allowing Samba to work without modifying the profile, and only logging errors. To place the <application>smbd</application> profile into <emphasis>enforce</emphasis> mode, and have Samba work as expected, the profile will need to be modified to reflect any directories that are shared.

Edit <filename>/etc/apparmor.d/usr.sbin.smbd</filename> adding information for <emphasis>[share]</emphasis> from the file server example:

/srv/samba/share/ r, /srv/samba/share/** rwkix,

Now place the profile into <emphasis>enforce</emphasis> and reload it:

sudo aa-enforce /usr/sbin/smbd

cat /etc/apparmor.d/usr.sbin.smbd | sudo apparmor_parser -r

O'Reilly's <ulink url="http://www.oreilly.com/catalog/9780596007690/">Using Samba</ulink> is also a good reference.

<ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-samba.html">Chapter 18</ulink> of the Samba HOWTO Collection is devoted to security.

For more information on Samba and ACLs see the <ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/AccessControls.html#id397568">Samba ACLs page </ulink>.

Samba as a Domain Controller

Although it cannot act as an Active Directory Primary Domain Controller (PDC), a Samba server can be configured to appear as a Windows NT4-style domain controller. A major advantage of this configuration is the ability to centralize user and machine credentials. Samba can also use multiple backends to store the user information.

Primary Domain Controller

This section covers configuring Samba as a Primary Domain Controller (PDC) using the default smbpasswd backend.

First, install Samba, and <application>libpam-smbpass</application> to sync the user accounts, by entering the following in a terminal prompt:

sudo apt-get install samba libpam-smbpass

Next, configure Samba by editing <filename>/etc/samba/smb.conf</filename>. The <emphasis>security</emphasis> mode should be set to <emphasis role="italic">user</emphasis>, and the <emphasis>workgroup</emphasis> should relate to your organization:

In the commented <quote>Domains</quote> section add or uncomment the following:

<emphasis>domain logons:</emphasis> provides the netlogon service causing Samba to act as a domain controller.

<emphasis>logon path:</emphasis> places the user's Windows profile into their home directory. It is also possible to configure a <emphasis>[profiles]</emphasis> share placing all profiles under a single directory.

<emphasis>logon drive:</emphasis> specifies the home directory local path.

<emphasis>logon home:</emphasis> specifies the home directory location.

<emphasis>logon script:</emphasis> determines the script to be run locally once a user has logged in. The script needs to be placed in the <emphasis>[netlogon]</emphasis> share.

<emphasis>add machine script:</emphasis> a script that will automatically create the <emphasis>Machine Trust Account</emphasis> needed for a workstation to join the domain.

In this example the <emphasis>machines</emphasis> group will need to be created using the <application>addgroup</application> utility see <xref linkend="adding-deleting-users"/> for details.

If you wish to not use <emphasis>Roaming Profiles</emphasis> leave the <emphasis>logon home</emphasis> and <emphasis>logon path</emphasis> options commented.

Uncomment the <emphasis>[homes]</emphasis> share to allow the <emphasis role="italic">logon home</emphasis> to be mapped:

[homes] comment = Home Directories browseable = no read only = no create mask = 0700 directory mask = 0700 valid users = %S

When configured as a domain controller a <emphasis>[netlogon]</emphasis> share needs to be configured. To enable the share, uncomment:

[netlogon] comment = Network Logon Service path = /srv/samba/netlogon guest ok = yes read only = yes share modes = no

The original <emphasis>netlogon</emphasis> share path is <filename>/home/samba/netlogon</filename>, but according to the Filesystem Hierarchy Standard (FHS), <ulink url="http://www.pathname.com/fhs/pub/fhs-2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM">/srv</ulink> is the correct location for site-specific data provided by the system.

Now create the <filename role="directory">netlogon</filename> directory, and an empty (for now) <filename>logon.cmd</filename> script file:

sudo mkdir -p /srv/samba/netlogon

sudo touch /srv/samba/netlogon/logon.cmd

You can enter any normal Windows logon script commands in <filename>logon.cmd</filename> to customize the client's environment.

With <emphasis>root</emphasis> being disabled by default, in order to join a workstation to the domain, a system group needs to be mapped to the Windows <emphasis>Domain Admins</emphasis> group. Using the <application>net</application> utility, from a terminal enter:

sudo net groupmap add ntgroup="Domain Admins" unixgroup=sysadmin rid=512 type=d