2 <body bgcolor="#ffffff">
4 <img src="samba2_xs.gif" border="0" alt=" " height="100" width="76"
5 hspace="10" align="left" />
7 <h1 class="head0">Chapter 1. Learning the Samba</h1>
10 <p><a name="INDEX-1"/>Samba
11 is an extremely useful networking tool for anyone who has both
12 Windows and Unix systems on his network. Running on a Unix system, it
13 allows Windows to share files and printers on the Unix host, and it
14 also allows Unix users to access resources shared by Windows systems.</p>
16 <p>Although it might seem natural to use a Windows server to serve files
17 and printers to a network containing Windows clients, there are good
18 reasons for preferring a Samba server for this duty. Samba is
19 reliable software that runs on reliable Unix operating systems,
20 resulting in fewer problems and a low cost of maintenance. Samba also
21 offers better performance under heavy loads, outperforming Windows
22 2000 Server by a factor of 2 to 1 on identical PC hardware, according
23 to published third-party benchmarks. When common, inexpensive PC
24 hardware fails to meet the demands of a huge client load, the Samba
25 server can easily be moved to a proprietary "big
26 iron" Unix mainframe, which can outperform Windows
27 running on a PC many times. If all that weren't
28 enough, Samba has a very nice cost advantage: it's
29 free. Not only is the software itself freely available, but also no
30 client licenses are required, and it runs on high-quality, free
31 operating systems such as Linux and FreeBSD.</p>
33 <p>After reading the previous paragraph, you might come to the
34 conclusion that Samba is commonly used by large organizations with
35 thousands of users on their networks—and you'd
36 be right! But Samba's user base includes
37 organizations all over the planet, of all types and sizes: from
38 international corporations, to medium and small businesses, to
39 individuals who run Samba on their Linux laptops. In the last case, a
40 tool such as VMware is used to run Windows on the same computer, with
41 Samba enabling the two operating systems to share files.</p>
43 <p>The types of users vary even more—Samba is used by
44 corporations, banks and other financial institutions, government and
45 military organizations, schools, public libraries, art galleries,
46 families, and even authors! This book was developed on a Linux system
47 running VMware and Windows 2000, with Adobe FrameMaker running on
48 Windows and the document files served by Samba from the Linux
51 <p>Does all this whet your technological appetite? If so, we encourage
52 you to keep reading, learn about Samba, and follow our examples to
53 set up a Samba server of your own. In this and upcoming chapters, we
54 will tell you exactly how to get started.</p>
58 <div class="sect1"><a name="samba2-CHP-1-SECT-1"/>
60 <h2 class="head1">What Is Samba?</h2>
62 <p><a name="INDEX-2"/>Samba
63 is a suite of Unix applications that speak the
64 <a name="INDEX-3"/><a name="INDEX-4"/>Server
65 Message Block (SMB) protocol. Microsoft Windows operating systems and
66 the OS/2 operating system use SMB to perform client-server networking
67 for file and printer sharing and associated operations. By supporting
68 this protocol, Samba enables computers running Unix to get in on the
69 action, communicating with the same networking protocol as Microsoft
70 Windows and appearing as another Windows system on the network from
71 the perspective of a Windows client. A <a name="INDEX-5"/>Samba
72 server offers the following services:</p>
75 <p>Share one or more directory trees</p>
77 <p>Share one or more Distributed filesystem (Dfs) trees</p>
79 <p>Share printers installed on the server among Windows clients on the
82 <p>Assist clients with network browsing</p>
84 <p>Authenticate clients logging onto a Windows domain</p>
86 <p>Provide or assist with Windows Internet Name Service (WINS)
87 name-server resolution</p>
89 <p>The Samba suite also includes client tools that allow users on a Unix
90 system to access folders and printers that Windows systems and Samba
91 servers offer on the network.</p>
93 <p>Samba is the brainchild of Andrew <a name="INDEX-6"/>Tridgell, who currently heads the Samba
94 development team. Andrew started the project in 1991, while working
95 with a Digital Equipment Corporation (DEC) software suite called
96 Pathworks, created for connecting DEC VAX computers to computers made
97 by other companies. Without knowing the significance of what he was
98 doing, Andrew created a file-server program for an odd protocol that
99 was part of Pathworks. That protocol later turned out to be SMB. A
100 few years later, he expanded upon his custom-made SMB server and
101 began distributing it as a product on the Internet under the name
102 "SMB Server." However, Andrew
103 couldn't keep that name—it already belonged to
104 another company's product—so he tried the
105 following Unix renaming approach:</p>
107 <blockquote><pre class="code">$ <tt class="userinput"><b>grep -i '^s.*m.*b' /usr/dict/words</b></tt></pre></blockquote>
109 <p>And the response was:</p>
111 <blockquote><pre class="code">salmonberry
114 scramble</pre></blockquote>
116 <p>Thus, the name "Samba" was born.</p>
118 <p>Today, the Samba suite revolves around a pair of Unix daemons that
119 provide shared resources—called <em class="firstterm">shares
120 </em>or s<em class="firstterm">ervices</em>—to SMB clients
121 on the network. These are:</p>
124 <dt><b><a name="INDEX-7"/>smbd</b></dt>
126 <p>A daemon that handles file and printer sharing and provides
127 authentication and authorization for SMB clients.</p>
132 <dt><b><a name="INDEX-8"/>nmbd</b></dt>
134 <p>A daemon that supports NetBIOS Name Service and WINS, which is
135 Microsoft's implementation of a NetBIOS Name Server
136 (NBNS). It also assists with network browsing.</p>
141 <p>Samba is currently maintained and extended by a group of volunteers
142 under the active supervision of Andrew Tridgell. Like the Linux
143 operating system, Samba is distributed as open source software
144 (<a href="http://opensource.org">http://opensource.org</a>) by its
145 authors and is distributed under the GNU General Public License
146 (GPL). Since its inception, development of Samba has been sponsored
147 in part by the Australian National University, where Andrew Tridgell
148 earned his Ph.D. Since then, many other organizations have sponsored
149 Samba developers, including LinuxCare, VA Linux Systems,
150 Hewlett-Packard, and IBM. It is a true testament to Samba that both
151 commercial and noncommercial entities are prepared to spend money to
152 support an open source effort.</p>
154 <p>Microsoft has also contributed by offering its definition of the SMB
155 protocol to the Internet Engineering Task Force (IETF) in 1996 as the
156 <a name="INDEX-9"/><a name="INDEX-10"/>Common
157 Internet File System (CIFS). Although we prefer to use the term
158 "SMB" in this book, you will also
159 often find the protocol being referred to as
160 "CIFS." This is especially true on
161 Microsoft's web site.</p>
168 <div class="sect1"><a name="samba2-CHP-1-SECT-2"/>
170 <h2 class="head1">What Can Samba Do for Me?</h2>
172 <p><a name="INDEX-11"/>As explained earlier, Samba can help
173 Windows and Unix computers coexist in the same network. However,
174 there are some specific reasons why you might want to set up a Samba
175 server on your network:</p>
178 <p>You don't want to pay for—or
179 can't afford—a full-fledged Windows server,
180 yet you still need the functionality that one provides.</p>
182 <p>The Client Access Licenses (CALs) that Microsoft requires for each
183 Windows client to access a Windows server are unaffordable.</p>
185 <p>You want to provide a common area for data or user directories to
186 transition from a Windows server to a Unix one, or vice versa.</p>
188 <p>You want to share printers among Windows and Unix workstations.</p>
190 <p>You are supporting a group of computer users who have a mixture of
191 Windows and Unix computers.</p>
193 <p>You want to integrate Unix and Windows authentication, maintaining a
194 single database of user accounts that works with both systems.</p>
196 <p>You want to network Unix, Windows, Macintosh (OS X), and other
197 systems using a single protocol.</p>
199 <p>Let's take a quick tour of
200 <a name="INDEX-12"/>Samba in action. Assume that we have
201 the following basic network configuration: a Samba-enabled Unix
202 system, to which we will assign the name <tt class="literal">toltec</tt>,
203 and a pair of Windows clients, to which we will assign the names
204 <tt class="literal">maya</tt> and <tt class="literal">aztec</tt>, all connected
205 via a local area network (LAN). Let's also assume
206 that <tt class="literal">toltec</tt> also has a local inkjet printer
207 connected to it, <tt class="literal">lp</tt>, and a disk share named
208 <tt class="literal">spirit</tt>—both of which it can offer to the
209 other two computers. A graphic of this network is shown in <a href="ch01.html#samba2-CHP-1-FIG-1">Figure 1-1</a>.</p>
211 <div class="figure"><a name="samba2-CHP-1-FIG-1"/><img src="figs/sam2_0101.gif"/></div><h4 class="head4">Figure 1-1. A simple network set up with a Samba server</h4>
213 <p>In this network, each computer listed shares the same
214 <em class="firstterm">workgroup</em>. A workgroup is a group name tag
215 that identifies an arbitrary collection of computers and their
216 resources on an SMB network. Several workgroups can be on the network
217 at any time, but for our basic network example,
218 we'll have only one: the METRAN workgroup.</p>
221 <div class="sect2"><a name="samba2-CHP-1-SECT-2.1"/>
223 <h3 class="head2">Sharing a Disk Service</h3>
225 <p><a name="INDEX-13"/><a name="INDEX-14"/><a name="INDEX-15"/>If everything is properly
226 configured, we should be able to see the Samba server,
227 <tt class="literal">toltec</tt>, through the Network Neighborhood of the
228 <tt class="literal">maya</tt> Windows desktop. In fact, <a href="ch01.html#samba2-CHP-1-FIG-2">Figure 1-2</a> shows the Network Neighborhood of the
229 <tt class="literal">maya</tt> computer, including <tt class="literal">toltec</tt>
230 and each computer that resides in the METRAN workgroup. Note the
231 Entire Network icon at the top of the list. As we just mentioned,
232 more than one workgroup can be on an SMB network at any given time.
233 If a user clicks the Entire Network icon, she will see a list of all
234 the workgroups that currently exist on the network.</p>
236 <div class="figure"><a name="samba2-CHP-1-FIG-2"/><img src="figs/sam2_0102.gif"/></div><h4 class="head4">Figure 1-2. The Network Neighborhood directory</h4>
238 <p>We can take a closer look at the <tt class="literal">toltec</tt> server by
239 double-clicking its icon. This contacts <tt class="literal">toltec</tt>
240 itself and requests a list of its
241 <em class="firstterm">shares</em>—the file and printer
242 resources—that the computer provides. In this case, a printer
243 named <tt class="literal">lp</tt>, a home directory named
244 <tt class="literal">jay</tt>, and a disk share named
245 <tt class="literal">spirit</tt> are on the server, as shown in <a href="ch01.html#samba2-CHP-1-FIG-3">Figure 1-3</a>. Note that the Windows display shows hostnames
246 in mixed case (Toltec). Case is irrelevant in hostnames, so you might
247 see toltec, Toltec, and TOLTEC in various displays or command output,
248 but they all refer to a single system. Thanks to Samba, Windows 98
249 sees the Unix server as a valid SMB server and can access the
250 <tt class="literal">spirit</tt> folder as if it were just another system
253 <div class="figure"><a name="samba2-CHP-1-FIG-3"/><img src="figs/sam2_0103.gif"/></div><h4 class="head4">Figure 1-3. Shares available on the Toltec server as viewed from maya</h4>
255 <p>One popular Windows feature is the ability to map a drive letter
256 (such as E:, F:, or Z:) to a shared directory on the network using
257 the Map Network Drive option in Windows Explorer.<a name="FNPTR-1"/><a href="#FOOTNOTE-1">[1]</a>
258 Once you do so, your applications can access the folder across the
259 network using the drive letter. You can store data on it, install and
260 run programs from it, and even password-protect it against unwanted
261 visitors. See <a href="ch01.html#samba2-CHP-1-FIG-4">Figure 1-4</a> for an example of mapping
262 a <a name="INDEX-16"/><a name="INDEX-17"/>drive letter to a network
265 <div class="figure"><a name="samba2-CHP-1-FIG-4"/><img src="figs/sam2_0104.gif"/></div><h4 class="head4">Figure 1-4. Mapping a network drive to a Windows drive letter</h4>
267 <p>Take a look at the Path: entry in the dialog box of <a href="ch01.html#samba2-CHP-1-FIG-4">Figure 1-4</a>. An equivalent way to represent a directory on
268 a network computer is by using two backslashes, followed by the name
269 of the networked computer, another backslash, and the networked
270 directory of the computer, as shown here:</p>
272 <blockquote><pre class="code">\\<em class="replaceable">network-computer</em>\<em class="replaceable">directory</em></pre></blockquote>
274 <p>This is known as the <em class="firstterm"/><a name="INDEX-18"/>Universal
275 Naming Convention (UNC)</em> in the Windows world. For example, the dialog
276 box in <a href="ch01.html#samba2-CHP-1-FIG-4">Figure 1-4</a> represents the network directory
277 on the <tt class="literal">toltec</tt> server as:</p>
279 <blockquote><pre class="code">\\toltec\spirit</pre></blockquote>
281 <p>If this looks somewhat familiar to you, you're
282 probably thinking of <em class="firstterm">uniform resource
283 locators</em><a name="INDEX-19"/><a name="INDEX-20"/> (URLs), which are addresses that web
284 browsers such as Netscape Navigator and Internet Explorer use to
285 resolve systems across the Internet. Be sure not to confuse the two:
286 URLs such as <a href="http://www.oreilly.com">http://www.oreilly.com</a> use forward slashes
287 instead of backslashes, and they precede the initial slashes with the
288 data transfer protocol (i.e., ftp, http) and a colon (:). In reality,
289 URLs and UNCs are two completely separate things, although sometimes
290 you can specify an SMB share using a URL rather than a UNC. As a URL,
291 the <em class="filename">\\toltec\spirit</em> share would be specified as
292 <em class="filename">smb://toltec/spirit</em>.</p>
294 <p>Once the network drive is set up, Windows and its programs behave as
295 if the networked directory were a local disk. If you have any
296 applications that support multiuser functionality on a network, you
297 can install those programs on the network drive.<a name="FNPTR-2"/><a href="#FOOTNOTE-2">[2]</a> <a href="ch01.html#samba2-CHP-1-FIG-5">Figure 1-5</a> shows the
298 resulting network drive as it would appear with other storage devices
299 in the Windows 98 client. Note the pipeline attachment in the icon
300 for the J: drive; this indicates that it is a network drive rather
301 than a fixed drive.</p>
303 <div class="figure"><a name="samba2-CHP-1-FIG-5"/><img src="figs/sam2_0105.gif"/></div><h4 class="head4">Figure 1-5. The Network directory mapped to the client drive letter J</h4>
305 <p>My Network Places, found in Windows Me, 2000, and XP, works
306 differently from Network Neighborhood. It is necessary to click a few
307 more icons, but eventually we can get to the view of the
308 <tt class="literal">toltec</tt> server as shown in <a href="ch01.html#samba2-CHP-1-FIG-6">Figure 1-6</a>. This is from a Windows 2000 system. Setting
309 up the network drive using the Map Network Drive option in Windows
310 2000 works similarly to other Windows versions. <a name="INDEX-21"/><a name="INDEX-22"/><a name="INDEX-23"/></p>
312 <div class="figure"><a name="samba2-CHP-1-FIG-6"/><img src="figs/sam2_0106.gif"/></div><h4 class="head4">Figure 1-6. Shares available on Toltec (viewed from dine)</h4>
318 <div class="sect2"><a name="samba2-CHP-1-SECT-2.2"/>
320 <h3 class="head2">Sharing a Printer</h3>
322 <p><a name="INDEX-24"/><a name="INDEX-25"/><a name="INDEX-26"/>You probably noticed that the printer
323 <tt class="literal">lp</tt> appeared under the available shares for
324 <tt class="literal">toltec</tt> in <a href="ch01.html#samba2-CHP-1-FIG-3">Figure 1-3</a>. This
325 indicates that the Unix server has a printer that can be shared by
326 the various SMB clients in the workgroup. Data sent to the printer
327 from any of the clients will be spooled on the Unix server and
328 printed in the order in which it is received.</p>
330 <p><a name="INDEX-27"/><a name="INDEX-28"/>Setting up a Samba-enabled
331 printer on the Windows side is even easier than setting up a disk
332 share. By double-clicking the printer and identifying the
333 manufacturer and model, you can install a driver for this printer on
334 the Windows client. Windows can then properly format any information
335 sent to the network printer and access it as if it were a local
336 printer. On Windows 98, double-clicking the Printers icon in the
337 Control Panel opens the Printers window shown in <a href="ch01.html#samba2-CHP-1-FIG-7">Figure 1-7</a>. Again, note the pipeline attachment below the
338 printer, which identifies it as being on a network.</p>
340 <div class="figure"><a name="samba2-CHP-1-FIG-7"/><img src="figs/sam2_0107.gif"/></div><h4 class="head4">Figure 1-7. A network printer available on Toltec</h4>
343 <div class="sect3"><a name="samba2-CHP-1-SECT-2.2.1"/>
345 <h3 class="head3">Seeing things from the Unix side</h3>
347 <p><a name="INDEX-29"/><a name="INDEX-30"/>As mentioned earlier, Samba
348 appears in Unix as a set of daemon programs. You can view them with
349 the Unix <a name="INDEX-31"/><em class="emphasis">ps</em> command; you can
350 read any messages they generate through custom debug files or the
351 Unix <em class="emphasis">syslog</em> (depending on how Samba is set up);
352 and you can configure them from a single Samba configuration file:
353 <em class="emphasis">smb.conf</em>. In addition, if you want to get an idea of
354 what the daemons are doing, Samba has a program called
355 <em class="emphasis">smbstatus</em><a name="INDEX-32"/> that will lay it all on the line. Here
358 <blockquote><pre class="code"># <tt class="userinput"><b>smbstatus</b></tt>
359 Processing section "[homes]"
360 Processing section "[printers]"
361 Processing section "[spirit]"
364 Service uid gid pid machine
365 -----------------------------------------
366 spirit jay jay 7735 maya (172.16.1.6) Sun Aug 12 12:17:14 2002
367 spirit jay jay 7779 aztec (172.16.1.2) Sun Aug 12 12:49:11 2002
368 jay jay jay 7735 maya (172.16.1.6) Sun Aug 12 12:56:19 2002
371 Pid DenyMode R/W Oplock Name
372 --------------------------------------------------
373 7735 DENY_WRITE RDONLY NONE /u/RegClean.exe Sun Aug 12 13:01:22 2002
375 Share mode memory usage (bytes):
376 1048368(99%) free + 136(0%) used + 72(0%) overhead = 1048576(100%) total</pre></blockquote>
378 <p>The Samba status from this output provides three sets of data, each
379 divided into separate sections. The first section tells which systems
380 have connected to the Samba server, identifying each client by its
381 machine name (<tt class="literal">maya</tt> and <tt class="literal">aztec</tt>)
382 and IP (Internet Protocol) address. The second section reports the
383 name and status of the files that are currently in use on a share on
384 the server, including the read/write status and any locks on the
385 files. Finally, Samba reports the amount of memory it has currently
386 allocated to the shares that it administers, including the amount
387 actively used by the shares plus additional overhead. (Note that this
388 is not the same as the total amount of memory that the
389 <em class="emphasis">smbd</em> or <em class="emphasis">nmbd</em> processes are
392 <p>Don't worry if you don't understand
393 these statistics; they will become easier to understand as you move
394 through the book.</p>
407 <div class="sect1"><a name="samba2-CHP-1-SECT-3"/>
409 <h2 class="head1">Getting Familiar with an SMB Network</h2>
411 <p><a name="INDEX-33"/>Now that you have had a brief tour of
412 Samba, let's take some time to get familiar with
413 Samba's adopted environment: an SMB network.
414 Networking with SMB is significantly different from working with
415 common TCP/IP protocols such as FTP and Telnet because there are
416 several new concepts to learn and a lot of information to cover.
417 First, we will discuss the basic concepts behind an SMB network,
418 followed by some Microsoft implementations of it, and finally we will
419 show you where a Samba server can and cannot fit into the picture.</p>
422 <div class="sect2"><a name="samba2-CHP-1-SECT-3.1"/>
424 <h3 class="head2">Understanding NetBIOS</h3>
426 <p>To begin, let's step back in time. In 1984, IBM
427 authored a simple application programming interface (API) for
428 networking its computers, called the <em class="firstterm">Network Basic
430 </em>(<a name="INDEX-34"/>NetBIOS).
431 The NetBIOS API provided a rudimentary design for an application to
432 connect and share data with other computers.</p>
434 <p>It's helpful to think of the NetBIOS API as
435 networking extensions to the standard BIOS API calls. The BIOS
436 contains low-level code for performing filesystem operations on the
437 local computer. NetBIOS originally had to exchange instructions with
438 computers across IBM PC or Token Ring networks. It therefore required
439 a low-level transport protocol to carry its requests from one
440 computer to the next.</p>
442 <p>In late 1985, IBM released one such protocol, which it merged with
443 the NetBIOS API to become the <em class="firstterm">NetBIOS Extended User
444 Interface</em> (<em class="emphasis">NetBEUI</em> ).
445 <a name="INDEX-35"/>NetBEUI was
446 designed for small LANs, and it let each computer claim a name (up to
447 15 characters) that wasn't already in use on the
448 network. By a "small LAN," we mean
449 fewer than 255 nodes on the network—which was considered a
450 generous number in 1985!</p>
452 <p>The NetBEUI protocol was very popular with networking applications,
453 including those running under Windows for Workgroups. Later,
454 implementations of NetBIOS over Novell's IPX
455 networking protocols also emerged, which competed with NetBEUI.
456 However, the networking protocols of choice for the burgeoning
457 Internet community were TCP/IP and UDP/IP, and implementing the
458 NetBIOS APIs over those protocols soon became a necessity.</p>
460 <p>Recall that TCP/IP uses numbers to represent computer addresses
461 (192.168.220.100, for instance) while NetBIOS uses only names. This
462 was a major issue when trying to mesh the two protocols together. In
463 1987, the IETF published standardization documents, titled RFC 1001
464 and 1002, that outlined how NetBIOS would work over a TCP/UDP
465 network. This set of documents still governs each implementation that
466 exists today, including those provided by Microsoft with its Windows
467 operating systems, as well as the Samba suite.</p>
469 <p>Since then, the standard that this document governs has become known
470 as <em class="firstterm">NetBIOS over
471 TCP/IP</em><a name="INDEX-36"/><a name="INDEX-37"/><a name="INDEX-38"/>, or NBT for short.<a name="FNPTR-3"/><a href="#FOOTNOTE-3">[3]</a> </p>
473 <p>The NBT standard (RFC 1001/1002)
474 currently outlines a trio of services on a network:</p>
477 <p>A name service</p>
479 <p>Two communication services:</p>
490 <p>The <a name="INDEX-39"/>name
491 service solves the name-to-address problem mentioned earlier; it
492 allows each computer to declare a specific name on the network that
493 can be translated to a machine-readable IP address, much like
494 today's Domain Name System (DNS) on the Internet.
495 The <a name="INDEX-40"/>datagram and <a name="INDEX-41"/>session services are both
496 secondary communication protocols used to transmit data back and
497 forth from NetBIOS computers across the network.</p>
503 <div class="sect2"><a name="samba2-CHP-1-SECT-3.2"/>
505 <h3 class="head2">Getting a Name</h3>
507 <p><a name="INDEX-42"/><a name="INDEX-43"/>In the NetBIOS world, when each
508 computer comes online, it wants to claim a name for itself; this is
509 called <em class="firstterm">name registration</em>. However, no two
510 computers in the same workgroup should be able to claim the same
511 name; this would cause endless confusion for any computer that wanted
512 to communicate with either of them. There are two different
513 approaches to ensuring that this doesn't happen:</p>
516 <p>Use an <em class="firstterm"/>NBNS</em> to keep track of which hosts have
517 registered a NetBIOS name.</p>
519 <p>Allow each computer on the network to defend its name in the event
520 that another computer attempts to use it.</p>
522 <p><a href="ch01.html#samba2-CHP-1-FIG-8">Figure 1-8</a> illustrates a (failed) name
523 registration, with and without an NBNS.</p>
525 <div class="figure"><a name="samba2-CHP-1-FIG-8"/><img src="figs/sam2_0108.gif"/></div><h4 class="head4">Figure 1-8. Broadcast versus NBNS name registration</h4>
527 <p><a name="INDEX-44"/><a name="INDEX-45"/>As mentioned earlier,
528 there must be a way to resolve a NetBIOS name to a specific IP
529 address; this is known as <em class="firstterm">name resolution</em>.
530 There are two different approaches with NBT here as well:</p>
533 <p>Have each computer report back its IP address when it
534 "hears" a broadcast request for its
537 <p>Use an NBNS to help resolve NetBIOS names to IP addresses.</p>
539 <p><a href="ch01.html#samba2-CHP-1-FIG-9">Figure 1-9</a> illustrates the two types of name
542 <div class="figure"><a name="samba2-CHP-1-FIG-9"/><img src="figs/sam2_0109.gif"/></div><h4 class="head4">Figure 1-9. Broadcast versus NBNS name resolution</h4>
544 <p>As you might expect, having an NBNS on your network can help out
545 tremendously. To see exactly why, let's look at the
546 broadcast method.</p>
548 <p>Here, when a client computer boots, it will
549 <a name="INDEX-46"/>broadcast a
550 message declaring that it wishes to register a specified NetBIOS name
551 as its own. If nobody objects to the use of the name, it keeps the
552 name. On the other hand, if another computer on the local subnet is
553 currently using the requested name, it will send a message back to
554 the requesting client that the name is already taken. This is known
555 as <em class="firstterm">defending</em><a name="INDEX-47"/><a name="INDEX-48"/> the hostname. This type of system
556 comes in handy when one client has unexpectedly dropped off the
557 network—another can take its name unchallenged—but it
558 does incur an inordinate amount of traffic on the network for
559 something as simple as name registration.</p>
561 <p>With an NBNS, the same thing occurs, except the communication is
562 confined to the requesting computer and the NBNS. No broadcasting
563 occurs when the computer wishes to register the name; the
564 registration message is simply sent directly from the client to the
565 NBNS, and the NBNS replies regardless of whether the name is already
566 taken. This is known as <em class="firstterm">point-to-point
567 communication</em><a name="INDEX-49"/>, and it is often beneficial on
568 networks with more than one subnet. This is because routers are
569 generally configured to block incoming packets that are broadcast to
570 all computers in the subnet.</p>
572 <p>The same principles apply to name resolution. Without an NBNS,
573 NetBIOS name resolution would also be done with a broadcast
574 mechanism. All request packets would be sent to each computer in the
575 network, with the hope that one computer that might be affected will
576 respond directly back to the computer that asked. Using an NBNS and
577 point-to-point communication for this purpose is far less taxing on
578 the network than flooding the network with broadcasts for every
579 name-resolution request.</p>
581 <p>It can be argued that broadcast packets do not cause significant
582 problems in modern, high-bandwidth networks of hosts with fast CPUs,
583 if only a small number of hosts are on the network, or the demand for
584 bandwidth is low. There are certainly cases where this is true;
585 however, our advice throughout this book is to avoid relying on
586 broadcasts as much as possible. This is a good rule to follow for
587 large, busy networks, and if you follow our advice when configuring a
588 small network, your network will be able to grow without encountering
589 problems later on that might be difficult to diagnose. <a name="INDEX-50"/><a name="INDEX-51"/></p>
595 <div class="sect2"><a name="samba2-CHP-1-SECT-3.3"/>
597 <h3 class="head2">Node Types</h3>
599 <p><a name="INDEX-52"/><a name="INDEX-53"/>How can you tell what strategy each
600 client on your network will use when performing name registration and
601 resolution? Each computer on an NBT network earns one of the
602 following designations, depending on how it handles name registration
603 and resolution: <a name="INDEX-54"/><a name="INDEX-55"/><a name="INDEX-56"/><a name="INDEX-57"/>b-node, p-node, m-node, and h-node. The
604 behaviors of each type of node are summarized in <a href="ch01.html#samba2-CHP-1-TABLE-1">Table 1-1</a>.</p>
606 <a name="samba2-CHP-1-TABLE-1"/><h4 class="head4">Table 1-1. NetBIOS node types</h4><table border="1">
625 <p>Uses broadcast registration and resolution only.</p>
633 <p>Uses point-to-point registration and resolution only.</p>
638 <p>m-node (mixed)</p>
641 <p>Uses broadcast for registration. If successful, it notifies the NBNS
642 of the result. Uses broadcast for resolution; uses the NBNS if
643 broadcast is unsuccessful.</p>
648 <p>h-node (hybrid)</p>
651 <p>Uses the NBNS for registration and resolution; uses broadcast if the
652 NBNS is unresponsive or inoperative.</p>
658 <p>In the case of Windows clients, you will usually find them listed as
659 h-nodes or hybrid nodes. The first three node types appear in RFC
660 1001/1002, and h-nodes were invented later by Microsoft, as a more
661 fault-tolerant method.</p>
663 <p>You can find the node type of a Windows 95/98/Me computer by running
664 the <em class="emphasis">winipcfg</em><a name="INDEX-58"/><a name="INDEX-59"/> command from the Start
665 → Run dialog (or from an MS-DOS prompt) and clicking
666 the More Info>> button. On Windows NT/2000/XP, you can use the
667 <tt class="literal">ipconfig</tt><a name="INDEX-60"/><a name="INDEX-61"/><a name="INDEX-62"/><a name="INDEX-63"/>
668 <tt class="literal">/all</tt> command in a command-prompt window. In either
669 case, search for the line that says <tt class="literal">Node Type</tt>.</p>
675 <div class="sect2"><a name="samba2-CHP-1-SECT-3.4"/>
677 <h3 class="head2">What's in a Name?</h3>
679 <p>The names <a name="INDEX-64"/><a name="INDEX-65"/>NetBIOS uses are quite different
680 from the DNS hostnames you might be familiar with. First, NetBIOS
681 names exist in a flat namespace. In other words, there are no
682 hierarchical levels, such as in <tt class="literal">oreilly.com</tt> (two
683 levels) or <em class="emphasis">ftp</em><em class="emphasis">.samba.org</em> (three
684 levels). NetBIOS names consist of a single unique string such as
685 <tt class="literal">navaho</tt> or <tt class="literal">hopi</tt> within each
686 workgroup or domain. Second, NetBIOS names are allowed to be only 15
687 characters and can consist only of standard alphanumeric characters
688 (a-z, A-Z, 0-9) and the following:</p>
690 <blockquote><pre class="code">! @ # $ % ^ & ( ) - ' { } . ~</pre></blockquote>
692 <p>Although you are allowed to use a <a name="INDEX-66"/><a name="INDEX-67"/><a name="INDEX-68"/>period (.) in a NetBIOS name, we recommend
693 against it because those names are not guaranteed to work in future
696 <p>It's not a coincidence that all valid DNS names are
697 also valid NetBIOS names. In fact, the unqualified DNS name for a
698 Samba server is often reused as its NetBIOS name. For example, if you
699 had a system with a hostname of <tt class="literal">mixtec.ora.com</tt> ,
700 its NetBIOS name would likely be MIXTEC (followed by 9 spaces).</p>
703 <div class="sect3"><a name="samba2-CHP-1-SECT-3.4.1"/>
705 <h3 class="head3">Resource names and types</h3>
707 <p><a name="INDEX-69"/><a name="INDEX-70"/>With NetBIOS, a computer not
708 only advertises its presence, but also tells others what types of
709 services it offers. For example, <tt class="literal">mixtec</tt> can
710 indicate that it's not just a workstation, but that
711 it's also a file server and can receive Windows
712 Messenger messages. This is done by adding a 16th byte to the end of
713 the machine (resource) name, called the <em class="firstterm">resource
714 type</em>, and registering the name multiple times, once for
715 each service that it offers. See <a href="ch01.html#samba2-CHP-1-FIG-10">Figure 1-10</a>.</p>
717 <div class="figure"><a name="samba2-CHP-1-FIG-10"/><img src="figs/sam2_0110.gif"/></div><h4 class="head4">Figure 1-10. The structure of NetBIOS names</h4>
719 <p>The 1-byte resource type indicates a unique service that the named
720 computer provides. In this book, you will often see the resource type
721 shown in angled brackets (<>) after the NetBIOS name, such as:</p>
723 <blockquote><pre class="code">MIXTEC<00></pre></blockquote>
725 <p>You can see which names are registered for a particular NBT computer
726 using the Windows command-line
727 <em class="emphasis">nbtstat</em><a name="INDEX-71"/> utility.
728 Because these services are unique (i.e., there cannot be more than
729 one registered), you will see them listed as type UNIQUE in the
730 output. For example, the following partial output describes the
731 <tt class="literal">toltec</tt> server:</p>
733 <blockquote><pre class="code">C:\><tt class="userinput"><b>nbtstat -a toltec</b></tt>
735 NetBIOS Remote Machine Name Table
737 ---------------------------------------------
738 TOLTEC <00> UNIQUE Registered
739 TOLTEC <03> UNIQUE Registered
740 TOLTEC <20> UNIQUE Registered
741 ...</pre></blockquote>
743 <p>This says the server has registered the NetBIOS name
744 <tt class="literal">toltec</tt> as a machine (computer) name, as a
745 recipient of messages from the Windows Messenger service, and as a
746 file server. Some possible attributes a name can have are listed in
747 <a href="ch01.html#samba2-CHP-1-TABLE-2">Table 1-2</a>.</p>
749 <a name="samba2-CHP-1-TABLE-2"/><h4 class="head4">Table 1-2. NetBIOS unique resource types</h4><table border="1">
755 <p>Named resource</p>
758 <p>Hexadecimal byte value</p>
765 <p>Standard Workstation Service</p>
773 <p>Messenger Service</p>
781 <p>RAS Server Service</p>
789 <p>Domain Master Browser Service (associated with primary domain controller)</p>
797 <p>Master Browser name</p>
805 <p>NetDDE Service</p>
813 <p>Fileserver (including printer server)</p>
821 <p>RAS Client Service</p>
829 <p>Network Monitor Agent</p>
837 <p>Network Monitor Utility</p>
851 <div class="sect3"><a name="samba2-CHP-1-SECT-3.4.2"/>
853 <h3 class="head3">Group names and types</h3>
855 <p>SMB also uses the concept of groups, with which computers can
856 register themselves. Earlier we mentioned that the computers in our
857 example belonged to a
858 <em class="firstterm">workgroup</em><a name="INDEX-73"/>,
859 which is a partition of computers on the same network. For example, a
860 business might very easily have an ACCOUNTING and a SALES workgroup,
861 each with different servers and printers. In the Windows world, a
863 <a name="INDEX-74"/>SMB
864 group are the same thing.</p>
867 <em class="emphasis">nbtstat</em><a name="INDEX-75"/> example,
868 the <tt class="literal">toltec</tt> Samba server is also a member of the
869 METRAN workgroup (the GROUP attribute hex 00) and will participate in
870 elections for the browse master (GROUP attribute 1E). Here is the
871 remainder of the <em class="emphasis">nbtstat</em> output:</p>
873 <blockquote><pre class="code"> NetBIOS Remote Machine Name Table
875 ---------------------------------------------
876 METRAN <00> GROUP Registered
877 METRAN <1E> GROUP Registered
878 ..__MSBROWSE__.<01> GROUP Registered</pre></blockquote>
880 <p>The possible group attributes a computer can have are illustrated in
881 <a href="ch01.html#samba2-CHP-1-TABLE-3">Table 1-3</a>. More
882 <a name="INDEX-76"/><a name="INDEX-77"/>information
883 is available in <em class="emphasis">Windows NT in a Nutshell</em> by Eric
884 <a name="INDEX-78"/>Pearce, also
885 published by O'Reilly.</p>
887 <a name="samba2-CHP-1-TABLE-3"/><h4 class="head4">Table 1-3. NetBIOS group resource types</h4><table border="1">
893 <p>Named resource</p>
896 <p>Hexadecimal byte value</p>
903 <p>Standard Workstation group</p>
919 <p>Master Browser name</p>
927 <p>Normal Group name (used in browser elections)</p>
935 <p>Internet Group name (administrative)</p>
943 <p><tt class="literal"><01><02>_ _MSBROWSE_ _<02></tt></p>
952 <p>The final entry, <tt class="literal">_ _ MSBROWSE _ _</tt>
953 <a name="INDEX-80"/>, is used to announce a group to other
954 master browsers. The nonprinting characters in the name show up as
955 dots in an <em class="emphasis">nbtstat</em> printout.
956 Don't worry if you don't understand
957 all of the resource or group types. Some of them you will not need
958 with Samba, and others you will pick up as you move through the rest
959 of the chapter. The important thing to remember here is the logistics
960 of the naming mechanism.</p>
967 <div class="sect3"><a name="samba2-CHP-1-SECT-3.4.3"/>
969 <h3 class="head3">Scope ID</h3>
971 <p>In the dark ages of SMB networking before NetBIOS groups were
972 introduced, you could use a very primitive method to isolate groups
973 of computers from the rest of the network. Each SMB packet contains a
974 field called the <em class="firstterm">scope
975 ID</em><a name="INDEX-81"/><a name="INDEX-82"/>, with the idea being that
976 systems on the network could be configured to accept only packets
977 with a scope ID matching that of their configuration. This feature
978 was hardly ever used and unfortunately lingers in modern
979 implementations. Some of the utilities included in the Samba
980 distribution allow the scope ID to be set. Setting the scope ID in a
981 network is likely to cause problems, and we are mentioning scope ID
982 only so that you will not be confused by it when you later encounter
983 it in various places.</p>
992 <div class="sect2"><a name="samba2-CHP-1-SECT-3.5"/>
994 <h3 class="head2">Datagrams and Sessions</h3>
996 <p>At this point, let's digress to discuss the
997 responsibility of NBT: to provide connection services between two
999 <a name="INDEX-83"/>NBT
1000 offers two services: the <em class="firstterm">session
1001 service</em><a name="INDEX-84"/> and the
1002 <em class="firstterm">datagram service</em><a name="INDEX-85"/>.
1003 Understanding how these two services work is not essential to using
1004 Samba, but it does give you an idea of how NBT works and how to
1005 troubleshoot Samba when it doesn't work.</p>
1007 <p>The datagram service has no stable connection between computers.
1008 Packets of data are simply sent or broadcast from one computer to
1009 another, without regard to the order in which they arrive at the
1010 destination, or even if they arrive at all. The use of datagrams
1011 requires less processing overhead than sessions, although the
1012 reliability of the connection can suffer. Datagrams, therefore, are
1013 used for quickly sending nonvital blocks of data to one or more
1014 computers. The datagram service communicates using the simple
1015 primitives shown in <a href="ch01.html#samba2-CHP-1-TABLE-4">Table 1-4</a>.</p>
1017 <a name="samba2-CHP-1-TABLE-4"/><h4 class="head4">Table 1-4. Datagram primitives</h4><table border="1">
1033 <p>Send Datagram</p>
1036 <p>Send datagram packet to computer or groups of computers.</p>
1041 <p>Send Broadcast Datagram</p>
1044 <p>Broadcast datagram to any computer waiting with a Receive Broadcast
1050 <p>Receive Datagram</p>
1053 <p>Receive a datagram from a computer.</p>
1058 <p>Receive Broadcast Datagram</p>
1061 <p>Wait for a Broadcast datagram.</p>
1067 <p>The session service is more complex. Sessions are a communication
1068 method that, in theory, offers the ability to detect problematic or
1069 inoperable connections between two NetBIOS applications. It helps to
1070 think of an NBT session as being similar to a telephone call, an
1071 analogy that obviously influenced the design of the CIFS standard.</p>
1073 <p>Once the connection is made, it remains open throughout the duration
1074 of the conversation, each side knows who the caller and the called
1075 computer are, and each can communicate with the simple primitives
1076 shown in <a href="ch01.html#samba2-CHP-1-TABLE-5">Table 1-5</a>.</p>
1078 <a name="samba2-CHP-1-TABLE-5"/><h4 class="head4">Table 1-5. Session primitives</h4><table border="1">
1097 <p>Initiate a session with a computer listening under a specified name.</p>
1105 <p>Wait for a call from a known caller or any caller.</p>
1121 <p>Send data to the other computer.</p>
1129 <p>Receive data from the other computer.</p>
1134 <p>Session Status</p>
1137 <p>Get information on requested sessions.</p>
1143 <p>Sessions are the backbone of resource sharing on an NBT network. They
1144 are typically used for establishing stable connections from client
1145 computers to disk or printer shares on a server. The client
1146 "calls" the server and starts
1147 trading information such as which files it wishes to open, which data
1148 it wishes to exchange, etc. These calls can last a long
1149 time—hours, even days—and all of this occurs within the
1150 context of a single connection. If there is an error, the session
1151 software (TCP) will retransmit until the data is received properly,
1152 unlike the "punt-and-pray" approach
1153 of the datagram service (UDP).</p>
1155 <p>In truth, while sessions are supposed to handle problematic
1156 communications, they sometimes don't. If the
1157 connection is interrupted, session information that is open between
1158 the two computers might become invalid. If that happens, the only way
1159 to regain the session information is for the same two computers to
1160 call each other again and start over.</p>
1162 <p>If you want more information on each service, we recommend you look
1163 at RFC 1001. However, there are two important things to remember
1167 <p><a name="INDEX-88"/>Sessions always
1168 occur between two NetBIOS computers. If a session service is
1169 interrupted, the client is supposed to store sufficient state
1170 information for it to reestablish the connection. However, in
1171 practice, this often does not happen.</p>
1173 <p><a name="INDEX-89"/>Datagrams can
1174 be broadcast to multiple computers, but they are unreliable. In other
1175 words, there is no way for the source to know that the datagrams it
1176 sent have indeed arrived at their destinations. <a name="INDEX-90"/></p>
1186 <div class="sect1"><a name="samba2-CHP-1-SECT-4"/>
1188 <h2 class="head1">An Introduction to the SMB Protocol</h2>
1190 <p><a name="INDEX-91"/>Now
1191 we're going to cover some low-level technical
1192 details and explore the elementals of the SMB protocol. You probably
1193 don't need to know much about this to implement a
1194 simple Samba network, and therefore you might want to skip or skim
1195 over this section and go on to the next one
1196 ("Windows Workgroups and Domains")
1197 on your first reading. However, assuming you are going to be
1198 responsible for long-term maintenance of a Samba network, it will
1199 help if you understand how it actually works. You will more easily be
1200 able to diagnose and correct any odd problems that pop up.</p>
1202 <p>At a high level, the SMB protocol suite is relatively simple. It
1203 includes commands for all the file and print operations that you
1204 might perform on a local disk or printer, such as:</p>
1207 <p>Opening and closing files</p>
1209 <p>Creating and deleting files and directories</p>
1211 <p>Reading and writing files</p>
1213 <p>Searching for files</p>
1215 <p>Queueing and dequeueing files in a print spool</p>
1217 <p>Each operation can be encoded into an SMB message and transmitted to
1218 and from a server. The original name
1219 "SMB" comes from the way in which
1220 the commands are formatted: they are versions of the standard DOS
1221 system-call data structures, or <em class="firstterm">Server Message
1222 Blocks</em>, redesigned for transmitting to another computer
1223 across a network.</p>
1226 <div class="sect2"><a name="samba2-CHP-1-SECT-4.1"/>
1228 <h3 class="head2">SMB Format</h3>
1230 <p>Richard <a name="INDEX-92"/>Sharpe of the Samba team defines SMB as
1231 a <em class="firstterm">request-response</em> protocol.<a name="FNPTR-4"/><a href="#FOOTNOTE-4">[4]</a> In effect,
1232 this means that a client sends an SMB request to a server and the
1233 server sends an SMB response back to the client. In only one rare
1234 circumstance does a server send a message that is not in response to
1237 <p>An <a name="INDEX-94"/>SMB message is not as complex as you
1238 might think. Let's take a closer look at the
1239 internal structure of such a message. It can be broken down into two
1240 parts: the <em class="firstterm">header</em>, which is a fixed size, and
1241 the <em class="firstterm">command string</em>, whose size can vary
1242 dramatically based on the contents of the message.</p>
1245 <div class="sect3"><a name="samba2-CHP-1-SECT-4.1.1"/>
1247 <h3 class="head3">SMB header format</h3>
1249 <p><a href="ch01.html#samba2-CHP-1-TABLE-6">Table 1-6</a> shows the format of an
1250 <a name="INDEX-95"/>SMB header. The COM field identifies
1251 the command being performed. SMB commands are not required to use all
1252 the fields in the SMB header. For example, when a client first
1253 attempts to connect to a server, it does not yet have a tree
1254 identifier (TID) value—one is assigned after it successfully
1255 connects—so a null TID is placed in its header field. Other
1256 fields can be padded with zeros when not used.</p>
1258 <p>The <a name="INDEX-96"/>SMB header fields are listed in <a href="ch01.html#samba2-CHP-1-TABLE-6">Table 1-6</a>.</p>
1260 <a name="samba2-CHP-1-TABLE-6"/><h4 class="head4">Table 1-6. SMB header fields</h4><table border="1">
1280 <p><tt class="literal">0xFF 'SMB</tt>'</p>
1283 <p><tt class="literal">1</tt></p>
1286 <p>Protocol identifier</p>
1291 <p><tt class="literal">COM</tt></p>
1294 <p><tt class="literal">1</tt></p>
1297 <p>Command code, from 0x00 to 0xFF</p>
1302 <p><tt class="literal">RCLS</tt></p>
1305 <p><tt class="literal">1</tt></p>
1313 <p><tt class="literal">REH</tt></p>
1316 <p><tt class="literal">1</tt></p>
1324 <p><tt class="literal">ERR</tt></p>
1327 <p><tt class="literal">2</tt></p>
1335 <p><tt class="literal">REB</tt></p>
1338 <p><tt class="literal">1</tt></p>
1346 <p><tt class="literal">RES</tt></p>
1349 <p><tt class="literal">14</tt></p>
1357 <p><tt class="literal">TID</tt></p>
1360 <p><tt class="literal">2</tt></p>
1363 <p>TID; a unique ID for a resource in use by the client</p>
1368 <p><tt class="literal">PID</tt></p>
1371 <p><tt class="literal">2</tt></p>
1374 <p>Caller process ID</p>
1379 <p><tt class="literal">UID</tt></p>
1382 <p><tt class="literal">2</tt></p>
1385 <p>User identifier</p>
1390 <p><tt class="literal">MID</tt></p>
1393 <p><tt class="literal">2</tt></p>
1396 <p>Multiplex identifier; used to route requests inside a process</p>
1407 <div class="sect3"><a name="samba2-CHP-1-SECT-4.1.2"/>
1409 <h3 class="head3">SMB command format</h3>
1411 <p>Immediately after the header is a variable number of bytes that
1412 constitute an <a name="INDEX-97"/>SMB command or reply. Each command,
1413 such as Open File (COM field identifier: <tt class="literal">SMBopen</tt>)
1414 or Get Print Queue (<tt class="literal">SMBsplretq</tt> ), has its own set
1415 of parameters and data. Like the SMB header fields, not all of the
1416 command fields need to be filled, depending on the specific command.
1417 For example, the Get Server Attributes
1418 (<tt class="literal">SMBdskattr</tt>) command sets the WCT and BCC fields
1419 to zero. The fields of the command segment are shown in <a href="ch01.html#samba2-CHP-1-TABLE-7">Table 1-7</a>.</p>
1421 <a name="samba2-CHP-1-TABLE-7"/><h4 class="head4">Table 1-7. SMB command contents</h4><table border="1">
1441 <p><tt class="literal">WCT</tt></p>
1444 <p><tt class="literal">1</tt></p>
1452 <p><tt class="literal">VWV</tt></p>
1458 <p>Parameter words (size given by WCT)</p>
1463 <p><tt class="literal">BCC</tt></p>
1466 <p><tt class="literal">2</tt></p>
1469 <p>Parameter byte count</p>
1474 <p><tt class="literal">DATA</tt></p>
1480 <p>Data (size given by BCC)</p>
1486 <p>Don't worry if you don't understand
1487 each field; they are not necessary for using Samba at an
1488 administrator level. However, they do come in handy when debugging
1489 system messages. We will show you some of the more common SMB
1490 messages that clients and servers send using a modified version of
1491 <em class="filename">tcpdump</em> later in this section. (If you prefer an
1492 <a name="INDEX-98"/><a name="INDEX-99"/>SMB sniffer with a graphical
1493 interface, try Ethereal, which uses the GTK libraries; see
1494 <a href="http://www.ethereal.com">http://www.ethereal.com</a> for more
1495 information on this tool.)</p>
1497 <a name="samba2-CHP-1-NOTE-84"/><blockquote class="note"><h4 class="objtitle">TIP</h4>
1498 <p>For more information on each command in the
1499 <a name="INDEX-100"/>SMB protocol, see the
1500 <em class="citetitle">CIFS Technical
1501 Reference</em><a name="INDEX-101"/> at <a href="http://www.snia.org/tech_activities/CIFS">http://www.snia.org/tech_activities/CIFS</a>.</p>
1509 <div class="sect3"><a name="samba2-CHP-1-SECT-4.1.3"/>
1511 <h3 class="head3">SMB variations</h3>
1513 <p>The SMB protocol has been extended with new commands several times
1514 since its inception. Each new version is backward-compatible with the
1515 previous versions, so it is possible for a LAN to have clients and
1516 servers concurrently running different versions of the SMB protocol.</p>
1518 <p><a href="ch01.html#samba2-CHP-1-TABLE-8">Table 1-8</a> outlines the major versions of the
1519 <a name="INDEX-102"/>SMB
1520 protocol. Within each "dialect" of
1521 SMB are many sub-versions that include commands supporting particular
1522 releases of major operating systems. The ID string in column 2 is
1523 used by clients and servers to determine in which level of the
1524 protocol they will speak to each other.</p>
1526 <a name="samba2-CHP-1-TABLE-8"/><h4 class="head4">Table 1-8. SMB protocol dialects</h4><table border="1">
1533 <p>Protocol name</p>
1549 <p><tt class="literal">PC NETWORK PROGRAM 1.0</tt></p>
1556 <p><a name="INDEX-103"/>Core Plus</p>
1559 <p><tt class="literal">MICROSOFT NETWORKS 1.03</tt></p>
1566 <p><a name="INDEX-104"/>LAN Manager 1.0</p>
1569 <p><tt class="literal">LANMAN1.0</tt></p>
1576 <p>LAN Manager 2.0</p>
1579 <p><tt class="literal">LM1.2X002</tt></p>
1586 <p>LAN Manager 2.1</p>
1589 <p><tt class="literal">LANMAN2.1</tt></p>
1596 <p><a name="INDEX-105"/>NT LAN
1600 <p><tt class="literal">NT LM 0.12</tt></p>
1603 <p>Windows NT 4.0</p>
1608 <p><a name="INDEX-106"/>Samba's NT LM 0.12</p>
1611 <p><tt class="literal">Samba</tt></p>
1619 <p><a name="INDEX-107"/><a name="INDEX-108"/>Common
1620 Internet File System</p>
1623 <p><tt class="literal">CIFS 1.0</tt></p>
1626 <p>Windows 2000/XP</p>
1632 <p>Samba implements the NT LM 0.12 specification for NT LAN Manager 1.0.
1633 It is backward-compatible with all the other SMB variants. The CIFS
1634 specification is, in reality, LAN Manager 0.12 with a few specific
1644 <div class="sect2"><a name="samba2-CHP-1-SECT-4.2"/>
1646 <h3 class="head2">SMB Clients and Servers</h3>
1648 <p><a name="INDEX-109"/><a name="INDEX-110"/>As
1649 mentioned earlier, SMB is a client/server protocol. In the purest
1650 sense, this means that a client sends a request to a server, which
1651 acts on the request and returns a reply. However, the client/server
1652 roles can often be reversed, sometimes within the context of a single
1653 SMB session. For example, consider the two Windows 95/98/Me computers
1654 in <a href="ch01.html#samba2-CHP-1-FIG-11">Figure 1-11</a>. The computer named
1655 <tt class="literal">maya</tt> shares a printer to the network, and the
1656 computer named <tt class="literal">toltec</tt> shares a disk directory.
1657 <tt class="literal">maya</tt> is in the client role when accessing
1658 <tt class="literal">toltec</tt>'s network drive and in the
1659 server role when printing a job for <tt class="literal">toltec</tt>.</p>
1661 <div class="figure"><a name="samba2-CHP-1-FIG-11"/><img src="figs/sam2_0111.gif"/></div><h4 class="head4">Figure 1-11. Two computers that both have resources to share</h4>
1663 <p>This brings out an important point in Samba terminology:</p>
1666 <p>A <em class="firstterm">server</em> is a computer with a resource to
1669 <p>A <em class="firstterm">client</em> is a computer that wishes to use that
1672 <p>A computer can be a client, a server, or both, or it can be neither
1673 at any given time.</p>
1675 <p>Microsoft Windows products have both the SMB client and server built
1676 into the operating system, and it is common to find Windows acting as
1677 a server, client, both, or neither at any given time in a production
1678 network. Although Samba has been developed primarily to function as a
1679 server, there are also ways that it and associated software can act
1680 as an SMB client. As with Windows, it is even possible to set up a
1681 Unix system to act as an SMB client and not as a server. See <a href="ch05.html">Chapter 5</a> for more details on this topic.</p>
1687 <div class="sect2"><a name="samba2-CHP-1-SECT-4.3"/>
1689 <h3 class="head2">A Simple SMB Connection</h3>
1691 <p><a name="INDEX-111"/>The client and server must complete
1692 three steps to establish a connection to a resource:</p>
1695 <p>Establish a NetBIOS session.</p>
1697 <p>Negotiate the protocol variant.</p>
1699 <p>Set session parameters, and make a tree connection to a resource.</p>
1701 <p>We will examine each step through the eyes of a useful tool that we
1702 mentioned earlier: the modified
1703 <em class="filename">tcpdump</em><a name="INDEX-112"/> that is
1704 available from the Samba web site.</p>
1706 <a name="samba2-CHP-1-NOTE-85"/><blockquote class="note"><h4 class="objtitle">TIP</h4>
1707 <p>You can download the tcpdump program at <a href="http://www.samba.org">http://www.samba.org</a> in the
1708 <em class="filename">samba/ftp/tcpdump-smb</em> directory; the latest
1709 version as of this writing is 3.4-10. Use this program as you would
1710 use the standard <em class="filename">tcpdump</em> application, but add
1711 the <tt class="literal">-s 1500</tt> switch to ensure that you get the
1712 whole packet and not just the first few bytes.</p>
1719 <div class="sect2"><a name="samba2-CHP-1-SECT-4.4"/>
1721 <h3 class="head2">Establishing a NetBIOS Session</h3>
1723 <p><a name="INDEX-113"/>When a user first makes a request
1724 to access a network disk or send a print job to a remote printer,
1725 NetBIOS takes care of making a connection at the session layer. The
1726 result is a bidirectional channel between the client and server. The
1727 client and server need only two messages to establish this
1728 connection. This is shown in the following example session request
1729 and response, as captured by <em class="filename">tcpdump</em> .</p>
1731 <p>First, the client sends a request to open a session, and
1732 <em class="filename">tcpdump </em><a name="INDEX-114"/>reports:</p>
1734 <blockquote><pre class="code">>>> NBT Packet
1737 Destination=TOLTEC NameType=0x20 (Server)
1738 Source=MAYA NameType=0x00 (Workstation)</pre></blockquote>
1740 <p>Then the server responds, granting a session to the client:</p>
1742 <blockquote><pre class="code">>>> NBT Packet
1744 Flags=0x82000000</pre></blockquote>
1746 <p>At this point, there is an open channel between the client and server.</p>
1752 <div class="sect2"><a name="samba2-CHP-1-SECT-4.5"/>
1754 <h3 class="head2">Negotiating the Protocol Variant</h3>
1756 <p>Next, the client sends a message to the server to negotiate an
1757 <a name="INDEX-115"/>SMB protocol. As mentioned
1758 earlier, the client sets its <a name="INDEX-116"/>tree identifier (TID) field to
1759 zero, because it does not yet know what TID to use. A <em class="emphasis">tree
1760 identifier</em> is a number that represents a connection to a
1761 share on a server.</p>
1763 <p>The command in the message is <tt class="literal">SMBnegprot</tt>, a
1764 request to negotiate a protocol variant that will be used for the
1765 entire session. Note that the client sends to the server a list of
1766 all the variants that it can speak, not vice versa:</p>
1768 <blockquote><pre class="code">>>> NBT Packet
1773 SMB PACKET: SMBnegprot (REQUEST)
1784 Dialect=PC NETWORK PROGRAM 1.0
1785 Dialect=MICROSOFT NETWORKS 3.0
1786 Dialect=DOS LM1.2X002
1787 Dialect=DOS LANMAN2.1
1788 Dialect=Windows for Workgroups 3.1a
1789 Dialect=NT LM 0.12</pre></blockquote>
1791 <p>The server responds to the
1792 <tt class="literal">SMBnegprot</tt><a name="INDEX-117"/> request with an index (with counting
1793 starting at 0) into the list of variants that the client offered, or
1794 with the value 0xFF if none of the protocol variants is acceptable:</p>
1796 <blockquote><pre class="code">>>> NBT Packet
1801 SMB PACKET: SMBnegprot (REPLY)
1814 [...]</pre></blockquote>
1816 <p>In this example, the server responds with the value 5, which
1817 indicates that the <tt class="literal">NT</tt> <tt class="literal">LM</tt>
1818 <tt class="literal">0.12</tt> dialect will be used for the remainder of the
1825 <div class="sect2"><a name="samba2-CHP-1-SECT-4.6"/>
1827 <h3 class="head2">Set Session and Login Parameters</h3>
1829 <p><a name="INDEX-118"/><a name="INDEX-119"/>The next step is to transmit session and
1830 login parameters for the session, which you do using the
1831 <a name="INDEX-120"/><tt class="literal">SMBSesssetupX</tt>
1832 command. The parameters include the following:</p>
1835 <p>The account name and password (if there is one)</p>
1837 <p>The workgroup name</p>
1839 <p>The maximum size of data that can be transferred</p>
1841 <p>The number of pending requests that can be in the queue at a time</p>
1843 <p>The resulting output from <em class="filename">tcpdump </em>is:</p>
1845 <blockquote><pre class="code">>>> NBT Packet
1850 SMB PACKET: SMBsesssetupX (REQUEST)
1868 CaseInsensitivePasswordLength=24
1869 CaseSensitivePasswordLength=0
1872 Pass1&Pass2&Account&Domain&OS&LanMan=
1873 JAY METRAN Windows 4.0 Windows 4.0
1875 SMB PACKET: SMBtconX (REQUEST) (CHAINED)
1881 Passwd&Path&Device=
1883 smb_buf[]=\\TOLTEC\SPIRIT</pre></blockquote>
1885 <p>In this example, the <tt class="literal">SMBsesssetupX</tt> Session Setup
1886 command allows for an additional SMB command to be piggybacked onto
1887 it (indicated by the letter X at the end of the command name). The
1888 hexadecimal code of the second command is given in the
1889 <tt class="literal">Com2</tt> field. In this case the command is
1890 <tt class="literal">0x75</tt>, which is the <tt class="literal">SMBtconX</tt>
1891 <tt class="literal">(</tt>Tree Connect and X) command. The
1892 <tt class="literal">SMBtconX</tt><a name="INDEX-121"/> message looks for the name of the
1893 resource in the <em class="emphasis">smb_buf</em> buffer. In this example,
1894 <em class="emphasis">smb_buf</em> contains the string
1895 <tt class="literal">\\TOLTEC\SPIRIT</tt>, which is the full pathname to a
1896 shared directory on <tt class="literal">toltec</tt>. Using the
1897 "and X" commands like this speeds
1898 up each transaction because the server doesn't have
1899 to wait on the client to make a second request.</p>
1901 <p>Note that the TID is still zero. Finally, the server returns a TID to
1902 the client, indicating that the user has been authorized access and
1903 that the resource is ready to be used:</p>
1905 <blockquote><pre class="code">>>> NBT Packet
1910 SMB PACKET: SMBsesssetupX (REPLY)
1924 [000] Unix Samba 2.2.6
1927 SMB PACKET: SMBtconX (REPLY) (CHAINED)
1932 ServiceType=A:</pre></blockquote>
1934 <p>The <em class="emphasis">ServiceType</em> field is set to
1935 "A" to indicate that this is a file
1936 service. Available service types are:</p>
1939 <p>"A" for a disk or file</p>
1941 <p>"LPT1" for a spooled output</p>
1943 <p>"COMM" for a direct-connect printer
1946 <p>"IPC" for a named pipe</p>
1948 <p>Now that a TID has been assigned, the client can use it as a handle
1949 to perform any operation that it would use on a local disk drive. It
1950 can open files, read and write to them, delete them, create new
1951 files, search for filenames, and so on. <a name="INDEX-122"/></p>
1961 <div class="sect1"><a name="samba2-CHP-1-SECT-5"/>
1963 <h2 class="head1">Windows Workgroups and Domains</h2>
1965 <p>Up to now, we've covered basic SMB technology, which
1966 is all you would need if you had nothing more advanced than MS-DOS
1967 clients on your network. We do assume you want to support Windows
1968 clients, especially the more recent versions, so next
1969 we'll describe the enhancements Microsoft has added
1970 to SMB networking—namely, Windows for Workgroups and Windows
1974 <div class="sect2"><a name="samba2-CHP-1-SECT-5.1"/>
1976 <h3 class="head2">Windows Workgroups</h3>
1978 <p><a name="INDEX-123"/><a name="INDEX-124"/>Windows
1979 Workgroups are very similar to the SMB groups already described. You
1980 need to know just a few additional things.</p>
1983 <div class="sect3"><a name="samba2-CHP-1-SECT-5.1.1"/>
1985 <h3 class="head3">Browsing</h3>
1987 <p><a name="INDEX-125"/>Browsing
1988 is the process of finding the other computers and shared resources in
1989 the Windows network. Note that there is no connection with a World
1990 Wide Web browser, apart from the general idea of
1991 "discovering what's
1992 there." On the other hand, browsing the Windows
1993 network is like the Web in that what's out there can
1994 change without warning.</p>
1996 <p>Before browsing existed, users had to know the name of the computer
1997 they wanted to connect to on the network and then manually enter a
1998 UNC such as the following into an application or file manager to
1999 access resources:</p>
2001 <blockquote><pre class="code">\\toltec\spirit\</pre></blockquote>
2003 <p>Browsing is much more convenient, making it possible to examine the
2004 contents of a network by using the point-and-click GUI interface of
2005 the Network Neighborhood (or My Network Places<a name="FNPTR-5"/><a href="#FOOTNOTE-5">[5]</a>) on a Windows client.</p>
2007 <p>You will encounter two types of browsing in an SMB network:</p>
2010 <p><a name="INDEX-129"/>Browsing a list
2011 of computers and shared resources</p>
2013 <p><a name="INDEX-130"/>Browsing the shared resource
2014 of a specific computer</p>
2016 <p>Let's look at the first one. On each LAN (or subnet)
2017 with a Windows workgroup or domain, one computer has the
2018 responsibility of maintaining a list of the computers that are
2019 currently accessible through the network. This computer is called the
2020 <em class="firstterm">local master
2021 browser</em><a name="INDEX-131"/><a name="INDEX-132"/>, and the list that it maintains is
2022 called the <em class="firstterm">browse
2023 list</em><a name="INDEX-133"/>. Computers on a subnet use the browse
2024 list to cut down on the amount of network traffic generated while
2025 browsing. Instead of each computer dynamically polling to determine a
2026 list of the currently available computers, the computer can simply
2027 query the local master browser to obtain a complete, up-to-date list.</p>
2029 <p>To browse the resources on a computer, a user must connect to the
2030 specific computer; this information cannot be obtained from the
2031 browse list. Browsing the list of resources on a computer can be done
2032 by double-clicking the computer's icon when it is
2033 presented in the Network Neighborhood. As you saw at the opening of
2034 the chapter, the computer will respond with a list of shared
2035 resources that can be accessed after the user is successfully
2038 <p>Each server on a Windows workgroup is required to announce its
2039 presence to the local master browser after it has registered a
2040 NetBIOS name, and (theoretically) announce that it is leaving the
2041 workgroup when it is shut down. It is the local master
2042 browser's responsibility to record what the servers
2044 <a name="samba2-CHP-1-NOTE-86"/><blockquote class="note"><h4 class="objtitle">WARNING</h4>
2045 <p>The Windows <a name="INDEX-134"/>Network Neighborhood can behave
2046 oddly: until you select a particular computer to browse, the Network
2047 Neighborhood window might contain data that is not up-to-date. That
2048 means the Network Neighborhood window can be showing computers that
2049 have crashed or can be missing computers that
2050 haven't been noticed yet. Put succinctly, once
2051 you've selected a server and connected to it, you
2052 can be a lot more confident that the shares and printers really exist
2056 <p>Unlike the roles you've seen earlier, almost any
2057 Windows system (including Windows for Workgroups and Windows 95/98/Me
2058 or NT/2000/XP) can act as a local master browser. The local master
2059 browser can have one or more
2060 <em class="firstterm"/><a name="INDEX-135"/><a name="INDEX-136"/>backup
2061 browsers</em> on the local subnet
2062 that will take over in the event that the local master browser fails
2063 or becomes inaccessible. To ensure fluid operation, the local backup
2064 browsers will frequently synchronize their browse list with the local
2067 <p>Here is how to calculate the minimum number of backup browsers that
2068 will be allocated on a workgroup:</p>
2071 <p>If up to 32 Windows NT/2000/XP workstations are on the network, or up
2072 to 16 Windows 95/98/Me computers are on the network, the local master
2073 browser allocates one backup browser in addition to the local master
2076 <p>If the number of Windows NT/2000/XP workstations falls between 33 and
2077 64, or the number of Windows 95/98/Me workstations falls between 17
2078 and 32, the local master browser allocates two backup browsers.</p>
2080 <p>For each group of 32 NT/2000/XP workstations or 16 Windows 95/98/Me
2081 computers beyond this, the local master browser allocates another
2084 <p>There is currently no upper limit on the number of backup browsers
2085 that can be allocated by the local master browser.</p>
2092 <div class="sect3"><a name="samba2-CHP-1-SECT-5.1.2"/>
2094 <h3 class="head3">Browsing elections</h3>
2096 <p><a name="INDEX-137"/>Browsing
2097 is a critical aspect of any Windows workgroup. However, not
2098 everything runs perfectly on any network. For example,
2099 let's say that a computer running Windows on the
2100 desk of a small company's CEO is the local master
2101 browser—that is, until he switches it off while plugging in his
2102 massage chair. At this point the Windows NT Workstation in the spare
2103 parts department might agree to take over the job. However, that
2104 computer is currently running a large, poorly written program that
2105 has brought its processor to its knees. The moral: browsing has to be
2106 very tolerant of servers coming and going. Because nearly every
2107 Windows system can serve as a browser, there has to be a way of
2108 deciding at any time who will take on the job. This decision-making
2109 process is called an <em class="firstterm">election</em>.</p>
2111 <p>An election algorithm is built into nearly all Windows operating
2112 systems such that they can each agree who is going to be a local
2113 master browser and who will be local backup browsers. An election can
2114 be forced at any time. For example, let's assume
2115 that the CEO has finished his massage and reboots his server. As the
2116 server comes online, it will announce its presence, and an election
2117 will take place to see if the PC in the spare parts department should
2118 still be the master browser.</p>
2120 <p>When an election is performed, each computer broadcasts information
2121 about itself via datagrams. This information includes the following:</p>
2124 <p>The version of the election protocol used</p>
2126 <p>The operating system on the computer</p>
2128 <p>The amount of time the client has been on the network</p>
2130 <p>The hostname of the client</p>
2132 <p>These values determine which operating system has seniority and will
2133 fulfill the role of the local master browser. (<a href="ch07.html">Chapter 7</a> describes the election process in more
2134 detail.) The architecture developed to achieve this is not elegant
2135 and has built-in security problems. While a browsing domain can be
2136 integrated with domain security, the election algorithm does not take
2137 into consideration which computers become browsers. Thus it is
2138 possible for any computer running a browser service to register
2139 itself as participating in the browsing election and (after winning)
2140 being able to change the browse list. Nevertheless, browsing is a key
2141 feature of Windows networking, and backward-compatibility
2142 requirements will ensure that it is in use for years to come.
2143 <a name="INDEX-138"/></p>
2150 <div class="sect3"><a name="samba2-CHP-1-SECT-5.1.3"/>
2152 <h3 class="head3">Windows 95/98/Me authentication</h3>
2154 <p>Three types of passwords arise when
2155 <a name="INDEX-139"/><a name="INDEX-140"/>Windows
2156 95/98/Me is operating in a Windows workgroup:</p>
2159 <p>A Windows password</p>
2161 <p>A Windows Networking password</p>
2163 <p>A password for each shared resource that has been assigned password
2166 <p>The Windows <a name="INDEX-141"/>password functions in a manner
2167 that might be a source of confusion for Unix system administrators.
2168 It is not there to prevent unauthorized users from using the
2169 computer. (If you don't believe that, try clicking
2170 the Cancel button on the password dialog box and see what happens!)
2171 Instead, the Windows password is used to gain access to a file that
2172 contains the Windows Networking and network resource passwords. There
2173 is one such file per registered user of the system, and they can be
2174 found in the <em class="filename">C:\Windows</em> directory with a name
2175 composed of the user's account name, followed by a
2176 <em class="filename">.pwl</em><a name="INDEX-142"/><a name="INDEX-143"/><a name="INDEX-144"/> extension. For example, if the
2177 user's account name is
2178 "sarah," the file will be
2179 <em class="filename">C:\Windows\sarah.pwl</em>. This file is encrypted
2180 using the Windows password as the encryption key.</p>
2182 <a name="samba2-CHP-1-NOTE-87"/><blockquote class="note"><h4 class="objtitle">TIP</h4>
2183 <p>As a security measure, you might want to check for junk
2184 <em class="filename">.pwl</em> files on Windows 95/98/Me clients, which
2185 might have been created by mistakes users made while attempting to
2186 log on. A <em class="filename">.pwl</em> file is easily cracked and can
2187 contain valid passwords for Samba accounts and network shares.</p>
2190 <p>The first time the network is accessed, Windows attempts to use the
2191 Windows password as the Windows Networking password. If this is
2192 successful, the user will not be prompted for two separate passwords,
2193 and subsequent logins to the Windows system will automatically result
2194 in logging on to the Windows network as well, making things much
2195 simpler for the user.</p>
2197 <p>Shared network resources in the workgroup can also have passwords
2198 assigned to them to limit their accessibility. The first time a user
2199 attempts to access the resource, she is asked for its password, and a
2200 checkbox in the password dialog box gives the user the option to add
2201 the password to her password list. This is the default; if it is
2202 accepted, Windows will store the password in the
2203 user's <em class="filename">.pwl</em> file, and all
2204 further authentication to the resource will be handled automatically
2207 <p>Samba's approach to workgroup authentication is a
2208 little different, which is a result of blending the Windows workgroup
2209 model with that of the Unix host upon which Samba runs. This will be
2210 discussed further in <a href="ch09.html">Chapter 9</a>. <a name="INDEX-145"/></p>
2219 <div class="sect2"><a name="samba2-CHP-1-SECT-5.2"/>
2221 <h3 class="head2">Windows NT Domains</h3>
2223 <p><a name="INDEX-146"/>The
2224 peer-to-peer networking model of
2225 <a name="INDEX-147"/>workgroups functions fairly well as long as
2226 the number of computers on the network is small and there is a
2227 close-knit community of users. However, in larger networks the
2228 simplicity of workgroups becomes a limiting factor. Workgroups offer
2229 only the most basic level of security, and because each resource can
2230 have its own password, it is inconvenient (to say the least) for
2231 users to remember the password for each resource in a large network.
2232 Even if that were not a problem, many people find it frustrating to
2233 have to interrupt their creative workflow to enter a shared password
2234 into a dialog box every time another network resource is accessed.</p>
2236 <p>To support the needs of larger networks, such as those found in
2237 departmental computing environments, Microsoft introduced domains
2238 with Windows NT 3.51. A <em class="firstterm">Windows NT domain</em> is
2239 essentially a workgroup of SMB computers that has one addition: a
2240 server acting as a <em class="firstterm">domain
2241 controller</em><a name="INDEX-148"/> (see <a href="ch01.html#samba2-CHP-1-FIG-12">Figure 1-12</a>).</p>
2243 <div class="figure"><a name="samba2-CHP-1-FIG-12"/><img src="figs/sam2_0112.gif"/></div><h4 class="head4">Figure 1-12. A simple Windows domain</h4>
2246 <div class="sect3"><a name="samba2-CHP-1-SECT-5.2.1"/>
2248 <h3 class="head3">Domain controllers</h3>
2250 <p>A domain controller in a Windows NT domain functions much like a
2251 <a name="INDEX-149"/><a name="INDEX-150"/>Network
2252 Information Service (NIS) server in a Unix network, maintaining a
2253 domain-wide database of user and group information, as well as
2254 performing related services. The responsibilities of a domain
2255 controller are mainly centered around security, including
2256 <em class="firstterm">authentication</em><a name="INDEX-151"/>,
2257 the process of granting or denying a user access to the resources of
2258 the domain. This is typically done through the use of a username and
2259 password. The service that maintains the database on the domain
2260 controllers is called the <a name="INDEX-152"/><a name="INDEX-153"/>Security Account Manager (SAM).</p>
2262 <p>The <a name="INDEX-154"/>Windows NT security model revolves
2263 around <em class="firstterm">security
2264 identifiers</em><a name="INDEX-155"/><a name="INDEX-156"/> (SIDs) and <em class="firstterm">access
2265 control lists</em><a name="INDEX-157"/><a name="INDEX-158"/>
2266 (ACLs). Security identifiers are used to represent objects in the
2267 domain, which include (but are not limited to) users, groups,
2268 computers, and processes. SIDs are commonly written in ASCII form as
2269 hyphen-separated fields, like this:</p>
2271 <blockquote><pre class="code">S-1-5-21-1638239387-7675610646-9254035128-545</pre></blockquote>
2273 <p>The part of the SID starting with the
2274 "S" and leading up to the rightmost
2275 hyphen identifies a domain. The number after the rightmost hyphen is
2276 called a <a name="INDEX-159"/>relative identifier (RID) and is a unique
2277 number within the domain that identifies the user, group, computer,
2278 or other object. The RID is the analog of a <a name="INDEX-160"/>user ID (UID) or
2279 <a name="INDEX-161"/>group ID
2280 (GID) on a Unix system or within an NIS domain.</p>
2282 <p>ACLs supply the same function as
2284 <a name="INDEX-162"/><a name="INDEX-163"/><a name="INDEX-164"/><a name="INDEX-165"/><a name="INDEX-166"/>file permissions that are common in Unix
2285 systems. However, ACLs are more versatile. Unix file permissions only
2286 set permissions for the owner and group to which the file belongs,
2287 and "other," meaning everyone else.
2288 Windows NT/2000/XP ACLs allow permissions to be set individually for
2289 any number of arbitrary users and/or groups. ACLs are made up of one
2290 or more <em class="firstterm">access control
2291 entries</em><a name="INDEX-167"/> (ACEs), each of which contains an SID
2292 and the access rights associated with it.</p>
2294 <p>ACL support has been added as a standard feature for some Unix
2295 variants and is available as an add-on for others. Samba supports
2296 mappings between Windows and Unix ACLs, and this will be covered in
2297 <a href="ch08.html">Chapter 8</a>.</p>
2304 <div class="sect3"><a name="samba2-CHP-1-SECT-5.2.2"/>
2306 <h3 class="head3">Primary and backup domain controllers</h3>
2308 <p>You've already read about master and backup
2309 browsers. Domain controllers are similar in that a domain has a
2310 <em class="firstterm">primary domain
2311 controller</em><a name="INDEX-168"/><a name="INDEX-169"/><a name="INDEX-170"/> (PDC) and can have
2312 one or more <em class="firstterm">backup domain
2313 controllers</em><a name="INDEX-171"/> (BDCs) as well. If the PDC fails or
2314 becomes inaccessible, its duties are automatically taken over by one
2315 of the BDCs. BDCs frequently synchronize their SAM data with the PDC
2316 so if the need arises, any one of them can immediately begin
2317 performing domain-controller services without impacting the clients.
2318 However, note that BDCs have read-only copies of the SAM database;
2319 they can update their data only by synchronizing with a PDC. A server
2320 in a Windows domain can use the SAM of any PDC or BDC to authenticate
2321 a user who attempts to access its resources and log on to the domain.</p>
2323 <p>All recent versions of Windows can log on to a domain as clients to
2324 access the resources of the domain servers. The systems that are
2325 considered members of the domain are a more exclusive class, composed
2326 of the PDC and BDCs, as well as domain member servers, which are
2327 systems that have joined a domain as members, and are known to the
2328 domain controllers by having a computer account in the SAM database.</p>
2335 <div class="sect3"><a name="samba2-CHP-1-SECT-5.2.3"/>
2337 <h3 class="head3">Authentication</h3>
2339 <p><a name="INDEX-172"/>When
2340 a user logs on to a Windows domain by typing in a username and
2341 password, a secure challenge and response protocol is invoked between
2342 the client computer and a domain controller to verify that the
2343 username and password are valid. Then the domain controller sends a
2344 SID back to the client, which uses it to create a
2345 <a name="INDEX-173"/>Security Access Token (SAT) that is valid
2346 only for that system, to be used for further authentication. This
2347 access token has information about the user coded into it, including
2348 the username, the group, and the rights the user has within the
2349 domain. At this point, the user is logged on to the domain.</p>
2351 <p>Subsequently, when the client attempts to access a shared resource
2352 within the domain, the client system enters into a secure challenge
2353 and response exchange with the server of the resource. The server
2354 then enters into another secure challenge and response conversation
2355 with a domain controller to check that the client is valid. (What
2356 actually happens is that the server uses information it gets from the
2357 client to pretend to be the client and authenticate itself with the
2358 domain controller. If the domain controller validates the
2359 credentials, it sends an SID back to the server, which uses the SID
2360 to create its own SAT for the client to enable access to its local
2361 resources on the client's behalf.) At this point,
2362 the client is authenticated for resources on the server and is
2363 allowed to access them. The server then uses the SID in the access
2364 token to determine what permissions the client has to use and modify
2365 the requested resource by comparing them to entries in the ACL of the
2368 <p>Although this method of authentication might seem overly complicated,
2369 it allows clients to authenticate without having plain-text passwords
2370 travel through the network, and it is much more difficult to crack
2371 than the relatively weak workgroup security we described earlier.</p>
2378 <div class="sect3"><a name="samba2-CHP-1-SECT-5.2.4"/>
2380 <h3 class="head3">Name service with WINS and DNS</h3>
2382 <p>The <a name="INDEX-174"/><a name="INDEX-175"/>Windows
2383 Internet Name Service (WINS) is Microsoft's
2384 implementation of a NetBIOS name server (NBNS). As such, WINS
2385 inherits much of NetBIOS's characteristics. First,
2386 WINS is flat; you can have only simple machine names such as
2387 <tt class="literal">inca</tt>, <tt class="literal">mixtec</tt>, or
2388 <tt class="literal">navaho</tt>, and workgroups such as PERU, MEXICO, or
2389 USA. In addition, WINS is dynamic: when a client first comes online,
2390 it is required to report its hostname, its address, and its workgroup
2391 to the local WINS server. This WINS server will retain the
2392 information so long as the client periodically refreshes its WINS
2393 registration, which indicates that it's still
2394 connected to the network. Note that WINS servers are not workgroup-
2395 or domain-specific; they can contain information for multiple domains
2396 and/or workgroups, which might exist on more than one subnet.</p>
2398 <p>Multiple <a name="INDEX-176"/>WINS
2399 servers can be set to synchronize with each other. This allows
2400 entries for computers that come online and go offline in the network
2401 to propagate from one WINS server to another. While in theory this
2402 seems efficient, it can quickly become cumbersome if several WINS
2403 servers are covering a network. Because WINS services can cross
2404 multiple subnets (you'll either hardcode the address
2405 of a WINS server in each of your clients or obtain it via DHCP), it
2406 is often more efficient to have each Windows client, regardless of
2407 the number of Windows domains, point themselves to the same WINS
2408 server. That way, only one authoritative WINS server will have the
2409 correct information, instead of several WINS servers continually
2410 struggling to synchronize themselves with the most recent changes.</p>
2412 <p>The currently active WINS server is known as the <em class="firstterm">primary
2413 WINS server</em><a name="INDEX-177"/><a name="INDEX-178"/>. You can also install a secondary WINS
2414 server, which will take over if the primary WINS server fails or
2415 becomes inaccessible. Both the primary and any other WINS servers
2416 will synchronize their address databases on a periodic basis.</p>
2418 <p>In the Windows family of operating systems, only a server edition of
2419 Windows NT/2000 can act as a WINS server. Samba 2.2 can function as a
2420 primary WINS server, but cannot <a name="INDEX-179"/><a name="INDEX-180"/>synchronize
2421 its database with other WINS servers. It therefore cannot act as a
2422 secondary WINS server or as a primary WINS server for a Windows
2423 secondary WINS server.</p>
2425 <p>WINS handles name service by default, although Microsoft added DNS
2426 starting with Windows NT 4 Server. It is compatible with DNS that is
2427 standard on virtually every Unix system, and a Unix server (such as
2428 the Samba host) can also be used for DNS.</p>
2435 <div class="sect3"><a name="samba2-CHP-1-SECT-5.2.5"/>
2437 <h3 class="head3">Trust relationships</h3>
2439 <p>One additional aspect of Windows NT domains not yet supported in
2440 Samba 2.2 is that it is possible to set up a <em class="emphasis">trust
2441 relationship</em><a name="INDEX-181"/><a name="INDEX-182"/><a name="INDEX-183"/> between domains, allowing clients
2442 within one domain to access the resources within another without the
2443 user having to go through additional authentication. The protocol
2444 that is followed is called <em class="emphasis">pass-through authentication</em>,
2445 <a name="INDEX-184"/><a name="INDEX-185"/>in which the
2446 user's credentials are passed from the client system
2447 in the first domain to the server in the second domain, which
2448 consults a domain controller in the first (trusted) domain to check
2449 that the user is valid before granting access to the resource.</p>
2451 <p>Note that in many aspects, the behaviors of a Windows workgroup and a
2452 Windows NT domain overlap. For example, the master and backup
2453 browsers in a domain are always the PDC and BDC, respectively.
2454 Let's update our Windows domain diagram to include
2455 both a local master and local backup browser. The result is shown in
2456 <a href="ch01.html#samba2-CHP-1-FIG-13">Figure 1-13</a>.</p>
2458 <div class="figure"><a name="samba2-CHP-1-FIG-13"/><a name="INDEX-186"/><img src="figs/sam2_0113.gif"/></div><h4 class="head4">Figure 1-13. A Windows domain with a local master and local backup browser</h4>
2460 <p>The similarity between workgroups and NT domains is not accidental
2461 because the concept of Windows domains did not evolve until Windows
2462 NT 3.5 was introduced, and Windows domains were forced to remain
2463 backward-compatible with the workgroups present in Windows for
2466 <p>Samba can function as a primary domain controller for Windows
2467 95/98/Me and Windows NT/2000/XP clients with the limitation that it
2468 can act as a PDC only, and not as a BDC.</p>
2470 <p>Samba can also function as a <em class="firstterm">domain member
2471 server</em><a name="INDEX-187"/><a name="INDEX-188"/>, meaning that it has a computer account
2472 in the PDC's account database and is therefore
2473 recognized as being part of the domain. A domain member server does
2474 not authenticate users logging on to the domain, but still handles
2475 security functions (such as file permissions) for domain users
2476 accessing its resources.</p>
2485 <div class="sect2"><a name="samba2-CHP-1-SECT-5.3"/>
2487 <h3 class="head2">Active Directory Domains</h3>
2489 <p>Starting with Windows 2000, Microsoft has introduced
2490 <a name="INDEX-189"/><a name="INDEX-190"/>Active
2491 Directory, the next step beyond Windows NT domains. We
2492 won't go into much detail concerning Active
2493 Directory because it is a huge topic. <a name="INDEX-191"/>Samba 2.2 doesn't
2494 support Active Directory at all, and support in Samba 3.0 is limited
2495 to acting as a client. For now, be aware that with Active Directory,
2496 the authentication model is centered around
2497 <a name="INDEX-192"/>Lightweight Directory
2498 Access Protocol (LDAP), and name service is provided by DNS instead
2499 of WINS. Domains in Active Directory can be organized in a
2500 hierarchical tree structure, in which each domain controller operates
2501 as a peer, with no distinction between primary and backup controllers
2502 as in Windows NT domains.</p>
2504 <p>Windows 2000/XP systems can be set up as simple workgroup or Windows
2505 NT domain clients (which will function with Samba). The server
2506 editions of Windows 2000 can be set up to run Active Directory and
2507 support Windows NT domains for backward compatibility
2508 (<em class="firstterm">mixed mode</em>). In this case, Samba 2.2 works
2509 with Windows 2000 servers in the same way it works with Windows NT
2510 4.0 servers. When set up to operate in <em class="firstterm">native mode,
2511 </em><a name="INDEX-193"/>Windows 2000 servers support only
2512 Active Directory. Even so, <a name="INDEX-194"/>Samba 2.2 can operate as a server
2513 in a domain hosted by a native-mode Windows 2000 server, using the
2514 <a name="INDEX-195"/>Windows 2000 server's
2515 <em class="firstterm">PDC emulation mode</em>. However, it is not
2516 possible for Samba 2.2 or 3.0 to operate as a domain controller in a
2517 Windows 2000 Active Directory domain.</p>
2519 <p>If you want to know more about Active Directory, we encourage you to
2520 obtain a copy of the O'Reilly book,
2521 <em class="emphasis">Windows 2000 Active Directory</em>. <a name="INDEX-196"/></p>
2527 <div class="sect2"><a name="samba2-CHP-1-SECT-5.4"/>
2529 <h3 class="head2">Can a Windows Workgroup Span Multiple Subnets?</h3>
2531 <p><a name="INDEX-197"/><a name="INDEX-198"/>Yes, but most people who have
2532 done it have had their share of headaches. Spanning multiple subnets
2533 was not part of the initial design of Windows NT 3.5 or Windows for
2534 Workgroups. As a result, a Windows domain that spans two or more
2535 subnets is, in reality, the
2536 "gluing" together of two or more
2537 workgroups that share an identical name. The good news is that you
2538 can still use a PDC to control authentication across each subnet. The
2539 bad news is that things are not as simple with browsing.</p>
2541 <p>As mentioned previously, each subnet must have its own local master
2542 browser. When a Windows domain spans multiple subnets, a system
2543 administrator will have to assign one of the computers as the
2544 <em class="firstterm">domain master
2545 browser</em><a name="INDEX-199"/><a name="INDEX-200"/>. The domain master browser will keep a
2546 browse list for the entire Windows domain. This browse list is
2547 created by periodically synchronizing the browse lists of each local
2548 master browser with the browse list of the domain master browser.
2549 After the synchronization, the local master browser and the domain
2550 master browser should contain identical entries. See <a href="ch01.html#samba2-CHP-1-FIG-14">Figure 1-14</a> for an illustration.</p>
2552 <div class="figure"><a name="samba2-CHP-1-FIG-14"/><img src="figs/sam2_0114.gif"/></div><h4 class="head4">Figure 1-14. A workgroup that spans more than one subnet</h4>
2554 <p>Sound good? <a name="INDEX-201"/>Well, it's not quite
2555 nirvana for the following reasons:</p>
2558 <p>If it exists, a PDC always plays the role of the domain master
2559 browser. By Microsoft design, the two always share the NetBIOS
2560 resource type <tt class="literal"><1B></tt> and (unfortunately)
2561 cannot be separated.</p>
2563 <p>Windows 95/98/Me computers cannot become <em class="emphasis">or</em>
2564 <em class="emphasis">even contact</em> a domain master browser. This means
2565 that it is necessary to have at least one Windows NT/2000/XP system
2566 (or Samba server) on each subnet of a multisubnet workgroup.</p>
2568 <p>Each subnet's local master browser continues to
2569 maintain the browse list for its subnet, for which it becomes
2570 authoritative. So if a computer wants to see a list of servers within
2571 its own subnet, the local master browser of that subnet will be
2572 queried. If a computer wants to see a list of servers outside the
2573 subnet, it can still go only as far as the local master browser. This
2574 works because at appointed intervals, the authoritative browse list
2575 of a subnet's local master browser is synchronized
2576 with the domain master browser, which is synchronized with the local
2577 master browser of the other subnets in the domain. This is called
2578 <em class="firstterm">browse list propagation</em>.</p>
2580 <p>Samba can act as a domain master browser in a Windows NT domain, or
2581 it can act as a local master browser for a subnet, synchronizing its
2582 browse list with the domain master browser.</p>
2592 <div class="sect1"><a name="samba2-CHP-1-SECT-6"/>
2594 <h2 class="head1">What's New in Samba 2.2?</h2>
2596 <p><a name="INDEX-202"/><a name="INDEX-203"/>In
2597 Version 2.2, Samba has more advanced support for Windows networking,
2598 including the ability to perform the more important tasks necessary
2599 for acting in a Windows NT domain. In addition, Samba 2.2 has some
2600 support for technologies that Microsoft introduced in Windows 2000,
2601 although the Samba team has saved Active Directory support for
2605 <div class="sect2"><a name="samba2-CHP-1-SECT-6.1"/>
2607 <h3 class="head2">PDC Support for Windows 2000/XP Clients</h3>
2609 <p>Samba previously could act as a PDC to authenticate Windows 95/98/Me
2610 and Windows NT 4 systems. This functionality has been extended in
2611 Release 2.2 to include Windows 2000 and Windows XP. Thus, it is
2612 possible to have a Samba server supporting domain logons for a
2613 network of Windows clients, including the most recent releases from
2614 Microsoft. This can result in a very stable, high-performance, and
2615 more secure network, and gives you the added benefit of not having to
2616 purchase per-seat Windows CALs from Microsoft.</p>
2622 <div class="sect2"><a name="samba2-CHP-1-SECT-6.2"/>
2624 <h3 class="head2">Microsoft Dfs Support</h3>
2626 <p><a name="INDEX-204"/>Microsoft Dfs allows shared resources that
2627 are dispersed among a number of servers in the network to be gathered
2628 together and appear to users as if they all exist in a single
2629 directory tree on one server. This method of organization makes life
2630 much simpler for users. Instead of having to browse around the
2631 network on a treasure hunt to locate the resource they want to use,
2632 they can go directly to the Dfs server and grab what they want. Samba
2633 2.2 offers support for serving Dfs, so a Windows server is no longer
2634 needed for this purpose.</p>
2640 <div class="sect2"><a name="samba2-CHP-1-SECT-6.3"/>
2642 <h3 class="head2">Windows NT/2000/XP Printing Support</h3>
2644 <p>Windows NT/2000/XP has a different Remote Procedure Call (RPC)-based
2645 printer interface than Windows 95/98/Me does. In Samba 2.2, the
2646 Windows NT/2000/XP interface is supported. Along with this, the Samba
2647 team has been adding support for automatically downloading the
2648 printer driver from the Samba server while adding a new printer to a
2655 <div class="sect2"><a name="samba2-CHP-1-SECT-6.4"/>
2657 <h3 class="head2">ACLs</h3>
2659 <p>Samba now supports
2660 <a name="INDEX-205"/>ACLs on its Unix host for Unix variants
2661 that support them. The list includes Solaris 2.6, 7, and 8, Irix,
2662 AIX, Linux (with either the ACL patch for the
2663 <a name="INDEX-206"/>ext2/ext3 filesystem from <a href="http://acl.bestbits.at">http://acl.bestbits.at</a> or when using the
2664 <a name="INDEX-207"/>XFS
2665 filesystem), and FreeBSD (Version 5.0 and later). When using ACL
2666 support, Samba translates between Unix ACLs and Windows NT/2000/XP
2667 ACLs, making the Samba host look and act more like a Windows
2668 NT/2000/XP server from the point of view of Windows clients.</p>
2674 <div class="sect2"><a name="samba2-CHP-1-SECT-6.5"/>
2676 <h3 class="head2">Support for Windows Client Administration Tools</h3>
2678 <p>Windows comes with tools that can be used from a client to manage
2679 shared resources remotely on a Windows server. Samba 2.2 allows these
2680 tools to operate on shares on the Samba server as well.</p>
2686 <div class="sect2"><a name="samba2-CHP-1-SECT-6.6"/>
2688 <h3 class="head2">Integration with Winbind</h3>
2690 <p><a name="INDEX-208"/>Winbind is a
2691 facility that allows users whose account information is stored in a
2692 Windows domain database to authenticate on a Unix system. The result
2693 is a unified logon environment, in which a user account can be kept
2694 on either the Unix system or a Windows NT/2000 domain controller.
2695 This greatly facilitates account management because administrators no
2696 longer need to keep the two systems synchronized, and it is possible
2697 for users whose accounts are held in a Windows domain to authenticate
2698 when accessing Samba shares.</p>
2704 <div class="sect2"><a name="samba2-CHP-1-SECT-6.7"/>
2706 <h3 class="head2">Unix CIFS Extensions</h3>
2708 <p>The <a name="INDEX-209"/><a name="INDEX-210"/>Unix CIFS extensions were developed
2709 at Hewlett-Packard and introduced in Samba 2.2.4. They allow Samba
2710 servers to support Unix filesystem attributes, such as links and
2711 permissions, when sharing files with other Unix systems. This allows
2712 Samba to be used as an alternative to network file sharing (NFS) for
2713 Unix-to-Unix file sharing. An advantage of using Samba is that it
2714 authenticates individual users, whereas NFS authenticates only
2715 clients (based on their IP addresses, which is a poor security
2716 model). This gives Samba an edge in the area of security, along with
2717 its much greater configurability. See <a href="ch05.html">Chapter 5</a>
2718 for information on how to operate Unix systems as Samba clients.</p>
2724 <div class="sect2"><a name="samba2-CHP-1-SECT-6.8"/>
2726 <h3 class="head2">And More...</h3>
2728 <p>As usual, the code has numerous improvements that do not show up at
2729 the administrative level in an immediate or obvious way. Samba now
2730 functions better on systems that employ <a name="INDEX-211"/>PAM
2731 (Pluggable Authentication Modules), and there is new support for
2732 profiling. Samba's support for oplocks has been
2733 strengthened, offering better integration with NFS server-terminated
2734 leases (currently on Irix and Linux only) and in the local filesystem
2735 with SMB locks mapped to POSIX locks (which is dependent on each Unix
2736 variant's implementation of POSIX locks). And of
2737 course there have been the usual bug fixes.</p>
2747 <div class="sect1"><a name="samba2-CHP-1-SECT-7"/>
2749 <h2 class="head1">What's New in Samba 3.0?</h2>
2751 <p>The main distinguishing feature of <a name="INDEX-212"/><a name="INDEX-213"/>Samba 3.0
2752 is that it includes support for <a name="INDEX-214"/>Kerberos 5 authentication and
2753 <a name="INDEX-215"/>LDAP, which are
2754 required to act as clients in an Active Directory domain. Another
2755 feature that appeared in Samba 3.0 is support for Unicode, which
2756 greatly simplifies supporting international languages.</p>
2758 <p>In later Version 3 releases, the Samba team plans to develop support
2760 <a name="INDEX-216"/>WINS
2761 replication, allowing Samba to act as a secondary WINS server or as a
2762 primary WINS server with Windows or Samba secondary WINS servers.
2763 Also planned are support for acting as a Windows NT BDC and support
2764 for Windows NT domain trust relationships.</p>
2771 <div class="sect1"><a name="samba2-CHP-1-SECT-8"/>
2773 <h2 class="head1">What Can Samba Do?</h2>
2775 <p>Now let's wrap up by showing where Samba can help
2776 out and where it is limited. <a href="ch01.html#samba2-CHP-1-TABLE-9">Table 1-9</a> summarizes
2777 which roles Samba can and cannot play in a Windows NT or Active
2778 Directory domain or a Windows workgroup. Many of the Windows domain
2779 protocols are proprietary and have not been documented by Microsoft
2780 and therefore must be reverse-engineered by the Samba team before
2781 Samba can support them. As of Version 3.0, Samba cannot act as a
2782 backup in most roles and does not yet fully support Active Directory.</p>
2784 <a name="samba2-CHP-1-TABLE-9"/><h4 class="head4">Table 1-9. Samba roles (as of Version 3.0)</h4><table border="1">
2800 <p><a name="INDEX-217"/>File server</p>
2808 <p>Printer server</p>
2816 <p>Microsoft Dfs server</p>
2824 <p>Primary domain controller</p>
2832 <p>Backup domain controller</p>
2840 <p>Active Directory domain controller</p>
2848 <p>Windows 95/98/Me authentication</p>
2856 <p>Windows NT/2000/XP authentication</p>
2864 <p>Local master browser</p>
2872 <p>Local backup browser</p>
2880 <p>Domain master browser</p>
2888 <p>Primary WINS server</p>
2896 <p>Secondary WINS server</p>
2910 <div class="sect1"><a name="samba2-CHP-1-SECT-9"/>
2912 <h2 class="head1">An Overview of the Samba Distribution</h2>
2914 <p><a name="INDEX-218"/>As mentioned earlier, Samba actually
2915 contains several programs that serve different but related purposes.
2916 These programs are documented more fully in <a href="appc.html">Appendix C</a>. For now, we will introduce each of them
2917 briefly and describe how they work together.</p>
2919 <p>The majority of the programs that come with Samba center on its two
2920 daemons. Let's take a refined look at the
2921 responsibilities of each daemon:</p>
2924 <dt><b><em class="emphasis">nmbd</em></b></dt>
2926 <p>The <em class="emphasis">nmbd</em><a name="INDEX-219"/> daemon is a simple name server that
2927 supplies WINS functionality. This daemon listens for name-server
2928 requests and provides the appropriate IP addresses when called upon.
2929 It also provides browse lists for the Network Neighborhood and
2930 participates in browsing elections.</p>
2935 <dt><b><em class="emphasis">smbd</em></b></dt>
2937 <p>The <em class="emphasis">smbd</em><a name="INDEX-220"/> daemon manages the shared resources
2938 between the Samba server and its clients. It provides file, print,
2939 and browse services to <span class="acronym">SMB</span> clients across one or
2940 more networks and handles all notifications between the Samba server
2941 and the network clients. In addition, it is responsible for user
2942 authentication, resource locking, and data sharing through the
2943 <span class="acronym">SMB</span> protocol.</p>
2948 <p>New with Version 2.2, there is an additional daemon:</p>
2951 <dt><b><a name="INDEX-221"/><em class="emphasis">winbindd</em></b></dt>
2953 <p>This daemon is used along with the name service switch to get
2954 information on users and groups from a Windows NT server and allows
2955 Samba to authorize users through a Windows NT/2000 server.</p>
2960 <p>The Samba distribution also comes with a small set of Unix
2961 command-line tools:</p>
2964 <dt><b><em class="emphasis">findsmb</em><a name="INDEX-222"/></b></dt>
2966 <p>A program that searches the local network for computers that respond
2967 to SMB protocol and prints information on them.</p>
2972 <dt><b><em class="emphasis">make_smbcodepage</em><a name="INDEX-223"/></b></dt>
2974 <p>A program used when working with Samba's
2975 internationalization features for telling Samba how to convert
2976 between upper- and lowercase in different character sets.</p>
2981 <dt><b><em class="emphasis">make_unicodemap</em><a name="INDEX-224"/></b></dt>
2983 <p>Another internationalization program used with Samba for compiling
2984 Unicode map files that Samba uses to translate DOS codepages or Unix
2985 character sets into 16-bit unicode.</p>
2990 <dt><b><a name="INDEX-225"/><em class="emphasis">net</em></b></dt>
2992 <p>A new program distributed with Samba 3.0 that can be used to perform
2993 remote administration of servers.</p>
2998 <dt><b><em class="emphasis">nmblookup</em><a name="INDEX-226"/></b></dt>
3000 <p>A program that provides NBT name lookups to find a
3001 computer's IP address when given its machine name.</p>
3006 <dt><b><a name="INDEX-227"/><em class="emphasis">pdbedit</em></b></dt>
3008 <p>A new program distributed with Samba 3.0 that is helpful for managing
3009 user accounts held in SAM databases.</p>
3014 <dt><b><em class="emphasis">rpcclient</em><a name="INDEX-228"/></b></dt>
3016 <p>A program that can be used to run MS-RPC functions on Windows clients.</p>
3021 <dt><b><em class="emphasis">smbcacls</em><a name="INDEX-229"/></b></dt>
3023 <p>A program that is used to set or show ACLs on Windows NT filesystems.</p>
3028 <dt><b><em class="emphasis">smbclient</em><a name="INDEX-230"/></b></dt>
3030 <p>An <em class="emphasis">ftp</em>-like Unix client that can be used to connect to
3031 SMB shares and operate on them. The <em class="emphasis">smbclient</em>
3032 command is discussed in detail in <a href="ch05.html">Chapter 5</a>.</p>
3037 <dt><b><em class="emphasis">smbcontrol</em><a name="INDEX-231"/></b></dt>
3039 <p>A simple administrative utility that sends messages to <em class="emphasis">nmbd</em>
3040 or <em class="emphasis">smbd</em>.</p>
3045 <dt><b><a name="INDEX-232"/><em class="emphasis">smbgroupedit</em></b></dt>
3047 <p>A command that can be used to define mappings between Windows NT
3048 groups and Unix groups. It is new in Samba 3.0.</p>
3053 <dt><b><em class="emphasis">smbmnt</em><a name="INDEX-233"/></b></dt>
3055 <p>A helper utility used along with <em class="emphasis">smbmount.</em></p>
3060 <dt><b><em class="emphasis">smbmount</em><a name="INDEX-234"/></b></dt>
3062 <p>A program that mounts an smbfs filesystem, allowing remote SMB shares
3063 to be mounted in the filesystem of the Samba host.</p>
3068 <dt><b><em class="emphasis">smbpasswd</em><a name="INDEX-235"/></b></dt>
3070 <p>A program that allows an administrator to change the passwords used
3076 <dt><b><em class="emphasis">smbsh</em><a name="INDEX-236"/></b></dt>
3078 <p>A tool that functions like a command shell to allow access to a
3079 remote SMB filesystem and allow Unix utilities to operate on it. This
3080 command is covered in <a href="ch05.html">Chapter 5</a>.</p>
3085 <dt><b><em class="emphasis">smbspool</em><a name="INDEX-237"/></b></dt>
3087 <p>A print-spooling program used to send files to remote printers that
3088 are shared on the SMB network.</p>
3093 <dt><b><em class="emphasis">smbstatus</em><a name="INDEX-238"/></b></dt>
3095 <p>A program that reports the current network connections to the shares
3096 on a Samba server.</p>
3101 <dt><b><em class="emphasis">smbtar</em><a name="INDEX-239"/></b></dt>
3103 <p>A program similar to the Unix <em class="filename">tar</em> command, for
3104 backing up data in SMB shares.</p>
3109 <dt><b><em class="emphasis">smbumount</em><a name="INDEX-240"/></b></dt>
3111 <p>A program that works along with <em class="emphasis">smbmount</em> to unmount
3112 smbfs filesystems.</p>
3117 <dt><b><em class="emphasis">testparm</em><a name="INDEX-241"/></b></dt>
3119 <p>A simple program for checking the Samba configuration file.</p>
3124 <dt><b><em class="emphasis">testprns</em><a name="INDEX-242"/></b></dt>
3126 <p>A program that tests whether printers on the Samba host are
3127 recognized by the <em class="filename">smbd</em> daemon.</p>
3132 <dt><b><em class="emphasis">wbinfo</em><a name="INDEX-243"/></b></dt>
3134 <p>A utility used to query the <em class="filename">winbindd
3135 </em><a name="INDEX-244"/>daemon.</p>
3140 <p>Each major release of Samba goes through an exposure test before
3141 it's announced. In addition, it is quickly updated
3142 afterward if problems or unwanted side effects are found. The latest
3143 stable distribution as of this writing is Samba 2.2.6, and this book
3144 focuses mainly on the functionality supported in Samba 2.2.6, as
3145 opposed to older versions of Samba.</p>
3152 <div class="sect1"><a name="samba2-CHP-1-SECT-10"/>
3154 <h2 class="head1">How Can I Get Samba?</h2>
3156 <p><a name="INDEX-245"/><a name="INDEX-246"/>Source
3157 and binary distributions of Samba are available from mirror sites
3158 across the Internet. The primary web site for Samba is located at
3159 <a href="http://www.samba.org/">http://www.samba.org/</a>. From there, you
3160 can select a mirror site that is geographically near you.</p>
3162 <p>Most Linux and many Unix vendors provide binary packages. These can
3163 be more convenient to install and maintain than the Samba
3164 team's source or binary packages, due to the
3165 vendor's efforts to supply a package that matches
3166 its specific products. <a name="INDEX-247"/></p>
3171 <hr/><h4 class="head4">Footnotes</h4><blockquote><a name="FOOTNOTE-1"/> <p><a href="#FNPTR-1">[1]</a> You
3172 can also right-click the shared resource in the Network Neighborhood
3173 and then select the Map Network Drive menu item.</p> <a name="FOOTNOTE-2"/> <p><a href="#FNPTR-2">[2]</a> Be
3174 warned that many end-user license agreements forbid installing a
3175 program on a network so that multiple clients can access it. Check
3176 the legal agreements that accompany the product to be absolutely
3177 sure.</p> <a name="FOOTNOTE-3"/> <p><a href="#FNPTR-3">[3]</a> You
3178 might also see the abbreviation NetBT, which is common in Microsoft
3179 literature.</p> <a name="FOOTNOTE-4"/>
3180 <p><a href="#FNPTR-4">[4]</a> See
3181 <a href="http://www.samba.org/cifs/docs/what-is-smb.html">http://www.samba.org/cifs/docs/what-is-smb.html</a>
3182 for Richard's excellent summary of
3183 <a name="INDEX-93"/>SMB.</p> <a name="FOOTNOTE-5"/> <p><a href="#FNPTR-5">[5]</a> This
3184 was originally called <a name="INDEX-126"/><a name="INDEX-127"/><a name="INDEX-128"/>Network Neighborhood in Windows 95/98/NT,
3185 but Microsoft has changed the name to My Network Places in the more
3186 recent Windows Me/2000/XP. We will continue to call it Network
3187 Neighborhood, and if you're using a new version of
3188 Windows, be aware that My Network Places can act a little differently
3189 in some ways.</p> </blockquote>
3192 <hr/><h4 class="head4"><a href="toc.html">TOC</a></h4>
projects / samba / blob