Translations by Daniel LeBlanc

[share] comment = Ubuntu File Server Share path = /srv/samba/share browsable = yes guest ok = yes read only = no create mask = 0755

<emphasis>browsable:</emphasis> enables Windows clients to browse the shared directory using <application>Windows Explorer</application>.

Resources

Another common use of Samba is to configure it to share printers installed, either locally or over the network, on an Ubuntu server. Similar to <xref linkend="samba-fileserver"/> this section will configure Samba to allow any client on the local network to use the installed printers without prompting for a username and password.

browsable = yes guest ok = yes

guest ok = no

Groups

read list = @qa write list = @sysadmin, vincent

admin users = melissa

UUID=66bcdd2e-8861-4fb0-b7e4-e61c569fe17d /srv ext3 noatime,relatime,acl 0 1

By default the profiles for <application>smbd</application> and <application>nmbd</application> are in <emphasis>complain</emphasis> mode allowing Samba to work without modifying the profile, and only logging errors. To place the <application>smbd</application> profile into <emphasis>enforce</emphasis> mode, and have Samba work as expected, the profile will need to be modified to reflect any directories that are shared.

Edit <filename>/etc/apparmor.d/usr.sbin.smbd</filename> adding information for <emphasis>[share]</emphasis> from the file server example:

/srv/samba/share/ r, /srv/samba/share/** rwkix,

Now place the profile into <emphasis>enforce</emphasis> and reload it:

sudo aa-enforce /usr/sbin/smbd

cat /etc/apparmor.d/usr.sbin.smbd | sudo apparmor_parser -r

O'Reilly's <ulink url="http://www.oreilly.com/catalog/9780596007690/">Using Samba</ulink> is also a good reference.

<ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-samba.html">Chapter 18</ulink> of the Samba HOWTO Collection is devoted to security.

For more information on Samba and ACLs see the <ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/AccessControls.html#id397568">Samba ACLs page </ulink>.

Samba as a Domain Controller

Although it cannot act as an Active Directory Primary Domain Controller (PDC), a Samba server can be configured to appear as a Windows NT4-style domain controller. A major advantage of this configuration is the ability to centralize user and machine credentials. Samba can also use multiple backends to store the user information.

Primary Domain Controller

This section covers configuring Samba as a Primary Domain Controller (PDC) using the default smbpasswd backend.

First, install Samba, and <application>libpam-smbpass</application> to sync the user accounts, by entering the following in a terminal prompt:

sudo apt-get install samba libpam-smbpass

Next, configure Samba by editing <filename>/etc/samba/smb.conf</filename>. The <emphasis>security</emphasis> mode should be set to <emphasis role="italic">user</emphasis>, and the <emphasis>workgroup</emphasis> should relate to your organization:

In the commented <quote>Domains</quote> section add or uncomment the following:

<emphasis>domain logons:</emphasis> provides the netlogon service causing Samba to act as a domain controller.

<emphasis>logon path:</emphasis> places the user's Windows profile into their home directory. It is also possible to configure a <emphasis>[profiles]</emphasis> share placing all profiles under a single directory.

<emphasis>logon drive:</emphasis> specifies the home directory local path.

<emphasis>logon home:</emphasis> specifies the home directory location.

<emphasis>logon script:</emphasis> determines the script to be run locally once a user has logged in. The script needs to be placed in the <emphasis>[netlogon]</emphasis> share.

<emphasis>add machine script:</emphasis> a script that will automatically create the <emphasis>Machine Trust Account</emphasis> needed for a workstation to join the domain.

In this example the <emphasis>machines</emphasis> group will need to be created using the <application>addgroup</application> utility see <xref linkend="adding-deleting-users"/> for details.

If you wish to not use <emphasis>Roaming Profiles</emphasis> leave the <emphasis>logon home</emphasis> and <emphasis>logon path</emphasis> options commented.

Uncomment the <emphasis>[homes]</emphasis> share to allow the <emphasis role="italic">logon home</emphasis> to be mapped:

[homes] comment = Home Directories browseable = no read only = no create mask = 0700 directory mask = 0700 valid users = %S

When configured as a domain controller a <emphasis>[netlogon]</emphasis> share needs to be configured. To enable the share, uncomment:

[netlogon] comment = Network Logon Service path = /srv/samba/netlogon guest ok = yes read only = yes share modes = no

The original <emphasis>netlogon</emphasis> share path is <filename>/home/samba/netlogon</filename>, but according to the Filesystem Hierarchy Standard (FHS), <ulink url="http://www.pathname.com/fhs/pub/fhs-2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM">/srv</ulink> is the correct location for site-specific data provided by the system.

Now create the <filename role="directory">netlogon</filename> directory, and an empty (for now) <filename>logon.cmd</filename> script file:

sudo mkdir -p /srv/samba/netlogon

sudo touch /srv/samba/netlogon/logon.cmd

You can enter any normal Windows logon script commands in <filename>logon.cmd</filename> to customize the client's environment.

With <emphasis>root</emphasis> being disabled by default, in order to join a workstation to the domain, a system group needs to be mapped to the Windows <emphasis>Domain Admins</emphasis> group. Using the <application>net</application> utility, from a terminal enter:

sudo net groupmap add ntgroup="Domain Admins" unixgroup=sysadmin rid=512 type=d

Change <emphasis role="italic">sysadmin</emphasis> to whichever group you prefer. Also, the user used to join the domain needs to be a member of the <emphasis>sysadmin</emphasis> group, as well as a member of the system <emphasis>admin</emphasis> group. The <emphasis>admin</emphasis> group allows <application>sudo</application> use.

Finally, restart Samba to enable the new domain controller:

You should now be able to join Windows clients to the Domain in the same manner as joining them to an NT4 domain running on a Windows server.