Translations by ZhongHan Cai

<emphasis>read only:</emphasis> gives write access to the shared directory.

sudo vmbuilder kvm ubuntu --suite jaunty --flavour virtual --arch i386 -o --libvirt qemu:///system --ip 192.168.0.100

domain logons = yes logon path = \\%N\%U\profile logon drive = H: logon home = \\%N\%U logon script = logon.cmd add machine script = sudo /usr/sbin/useradd -n -g machines -c Machine -d /var/lib/samba -s /bin/false %u

Another convenient tool that we want to have on our appliance is OpenSSH, as it will provide our admins to access to access the appliance remotely. However, pushing in the wild an appliance with a pre-installed OpenSSH server is a big security risk as all these server will share the same secret key, making it very easy for hackers to target our appliance with all the tools they need to crack it open in a breeze. As for the user password, we will instead rely on a script that will install OpenSSH the first time a user logs in so that the key generated will be different for each appliance. For this we'll use a <emphasis>--firstboot</emphasis> script, as it does not need any user interaction.

There are several ways to automate the Ubuntu installation process, for example using preseeds, kickstart, etc. Refer to the <ulink url="https://help.ubuntu.com/9.04/installation-guide/">Ubuntu Installation Guide</ulink> for details.

sudo vmbuilder kvm ubuntu --suite jaunty --flavour virtual --arch i386 -o --libvirt qemu:///system

This chapter provides an overview of security related topics as they pertain to Ubuntu 9.04 Server Edition, and outlines simple measures you may use to protect your server and network from any number of potential security threats.

Here is what the command with all the options discussed above:

You should now be able to read, write, and execute files in the shared directory as normal, and the <application>smbd</application> binary will have access to only the configured files and direcotories. Be sure to add entries for each directory you configure Samba to share. Also, any errors will be logged to <filename>/var/log/syslog</filename>.

This will copy the the <filename>/etc/hosts</filename> to <filename>//fs01.example.com/share/hosts</filename>.

<emphasis>read only:</emphasis> gives write access to the shared directory.

&lt;Location /svn&gt; DAV svn SVNParentPath /home/svn AuthType Basic AuthName "Your repository name" AuthUserFile /etc/subversion/passwd &lt;LimitExcept GET PROPFIND OPTIONS REPORT&gt; Require valid-user &lt;/LimitExcept&gt; &lt;/Location&gt;

deb http://archive.ubuntu.com/ubuntu jaunty main restricted universe multiverse /deb-i386 http://archive.ubuntu.com/ubuntu jaunty main restricted universe multiverse deb http://archive.ubuntu.com/ubuntu jaunty-updates main restricted universe multiverse /deb-i386 http://archive.ubuntu.com/ubuntu jaunty-updates main restricted universe multiverse deb http://archive.ubuntu.com/ubuntu/ jaunty-backports main restricted universe multiverse /deb-i386 http://archive.ubuntu.com/ubuntu jaunty-backports main restricted universe multiverse deb http://security.ubuntu.com/ubuntu jaunty-security main restricted universe multiverse /deb-i386 http://security.ubuntu.com/ubuntu jaunty-security main restricted universe multiverse deb http://archive.ubuntu.com/ubuntu jaunty main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer /deb-i386 http://archive.ubuntu.com/ubuntu jaunty main/debian-installer restricted/debian-installer universe/debian-installer multiverse/debian-installer

As this example is based on <application>KVM</application> and Ubuntu 9.04 (Jaunty Jackalope), and we are likely to rebuild the same virtual machine multiple time, we'll invoke vmbuilder with the following first parameters:

sudo vmbuilder kvm ubuntu --suite jaunty --flavour virtual --arch i386 \ -o --libvirt qemu:///system --ip 192.168.0.100 --part vmbuilder.partition

Fortunately, your Ubuntu system may provide all such facilities to Windows clients and share network resources among them. One of the principal pieces of software your Ubuntu system includes for Windows networking is the Samba suite of SMB server applications and tools.

This section of the <phrase>Ubuntu</phrase> Server Guide will introduce some of the common Samba use cases, and how to install and configure the necessary packages. Additional detailed documentation and information on Samba can be found on the <ulink url="http://www.samba.org">Samba website</ulink>.

Samba File Server

One of the most common ways to network Ubuntu and Windows computers is to configure Samba as a File Server. This section covers setting up a <application>Samba</application> server to share files with Windows clients.

The server will be configured to share files with any client on the network without prompting for a password. If your environment requires stricter Access Controls see <xref linkend="samba-fileprint-security"/>

The first step is to install the <application>samba</application> package. From a terminal prompt enter:

sudo apt-get install samba

That's all there is to it; you are now ready to configure Samba to share files.

The main Samba configuration file is located in <filename>/etc/samba/smb.conf</filename>. The default configuration file has a significant amount of comments in order to document various configuration directives.

Not all the available options are included in the default configuration file. See the <filename>smb.conf</filename><application>man</application> page or the <ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/">Samba HOWTO Collection</ulink> for more details.

First, edit the following key/value pairs in the <emphasis>[global]</emphasis> section of <filename>/etc/samba/smb.conf</filename>:

workgroup = EXAMPLE ... security = user

The <emphasis>security</emphasis> parameter is farther down in the [global] section, and is commented by default. Also, change <emphasis>EXAMPLE</emphasis> to better match your environment.

Create a new section at the bottom of the file, or uncomment one of the examples, for the directory to be shared:

[share] comment = Ubuntu File Server Share path = /srv/samba/share browsable = yes guest ok = yes read only = no create mask = 0755

<emphasis>comment:</emphasis> a short description of the share. Adjust to fit your needs.

<emphasis>path:</emphasis> the path to the directory to share.

This example uses <filename>/srv/samba/sharename</filename> because, according to the <emphasis>Filesystem Hierarchy Standard (FHS)</emphasis>, <ulink url="http://www.pathname.com/fhs/pub/fhs-2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM">/srv</ulink> is where site-specific data should be served. Technically Samba shares can be placed anywhere on the filesystem as long as the permissions are correct, but adhering to standards is recommended.

<emphasis>browsable:</emphasis> enables Windows clients to browse the shared directory using <application>Windows Explorer</application>.

<emphasis>guest ok:</emphasis> allows clients to connect to the share without supplying a password.

<emphasis>create mask:</emphasis> determines the permissions new files will have when created.

Now that <application>Samba</application> is configured, the directory needs to be created and the permissions changed. From a terminal enter:

sudo mkdir -p /srv/samba/share

sudo chown nobody.nogroup /srv/samba/share/

The <emphasis>-p</emphasis> switch tells mkdir to create the entire directory tree if it doesn't exist. Change the share name to fit your environment.

Finally, restart the <application>samba</application> services to enable the new configuration:

Once again, the above configuration gives all access to any client on the local network. For a more secure configuration see <xref linkend="samba-fileprint-security"/>.

From a Windows client you should now be able to browse to the Ubuntu file server and see the shared directory. To check that everything is working try creating a directory from Windows.

To create additional shares simply create new <emphasis>[dir]</emphasis> sections in <filename>/etc/samba/smb.conf</filename>, and restart <emphasis>Samba</emphasis>. Just make sure that the directory you want to share actually exists and the permissions are correct.

For in depth Samba configurations see the <ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/">Samba HOWTO Collection</ulink>

The guide is also available in <ulink url="http://www.amazon.com/exec/obidos/tg/detail/-/0131882228">printed format</ulink>.

O'Reilly's <ulink url="http://www.oreilly.com/catalog/9780596007690/">Using Samba</ulink> is another good reference.

Samba Print Server

Another common use of Samba is to configure it to share printers installed, either locally or over the network, on an Ubuntu server. Similar to <xref linkend="samba-fileserver"/> this section will configure Samba to allow any client on the local network to use the installed printers without prompting for a username and password.