Secure Socket Layer options
The ssl CA certFile option lets you define
the location of a file that contains all certificate authorities Samba
uses. By default, Red Hat Linux uses the following file:
/usr/share/ssl/certs/ca-bundle.crt.
Logging options
The following options help define how logging
is done on your Samba server.
Debug Level - Sets the level
of debugging messages that are produced in the log files for Samba. The
number can be between 1 and 10. During normal operations (and after you
have debugged any problems), you should probably set this back to 1 to
avoid unnecessary messages.
Log File - Defines the
location of the Samba smb log file. By default, Samba log files are
contained in /var/log/samba (with file names log.nmbd, log.smbd, and
smb.log). In this option, the %m is replaced by smb to set the smb log
file as /var/log/samba/smb.log.
Max Log Size - Sets the maximum amount of space, in kilobytes,
that the log files can consume. By default, the value is set to 0 (no
limit).
Tuning option
The Socket Options option lets you pass
options to the protocols Samba uses to communicate. The following
options are set by default: TCP_NODELAY, SO_RCVBUF=8192, and
SO_SNDBUF=8192. The first option disables Nagle's algorithm, which is
used to manage the transmission of TCP/IP packets. The other two options
set the maximum size of the sockets receive buffer and send buffer to
8192, respectively. These options are set to improve performance
(reportedly up to 10 times faster than without setting these options).
In general, you shouldn't change these options.
Printing option
The Printing option is used to define how
printer status information is presented. For Linux systems (including
Red Hat Linux), the value is typically LPRNG. You can use printing
styles from other types of operating systems, such as UNIX System V
(sysv), AIX (aix), HP UNIX (hpux), and Berkeley UNIX (bsd), to name a
few.
Browse options
A browse list is a list of computers that are
available on the network to SMB services. Clients use this list to find
computers that are not only on their own LAN, but also computers in
their workgroups that might be on other reachable networks.
With the latest release of Samba, browsing is
supported. In Samba, browsing is configured by the following options and
implemented by the nmbd daemon. If you are using Samba for a workgroup
within a single LAN, you probably don't need to concern yourself with
the browsing options. If, however, you are using Samba to provide
services across several physical subnetworks, you might consider
configuring Samba as a domain master browser. Here are some points to
think about:
Samba can be configured as a master
browser. This allows it to gather lists of computers from local browse
masters to form a wide-area server list.
If Samba is acting as a domain
master browser, Samba should use a WINS server to help browse clients
resolve the names from this list.
Samba can be used as a WINS server,
although it can also rely on other types of operating systems to provide
that service.
There should be only one domain master browser for each workgroup.
Don't use Samba as a domain master for a workgroup with the same name as
an NT domain.
If you are working in an environment that has
a mix of Samba and Windows NT servers, you should use an NT server as
your WINS server. If Samba is your only file server, you should choose a
single Samba server (nmbd daemon) to supply the WINS services.
To configure the browsing feature in
Samba, you must have the workgroup named properly (described earlier in
this section). Here are the global options related to SMB browsing.
OS Level - Set a value to control whether your Samba server
(nmbd daemon) might become the local master browser for your workgroup.
Raising this setting increases the Samba server's chance to control the
browser list for the workgroup in the local broadcast area.
If the value is 0, a Windows machine will probably be selected. A value
of 60 will probably ensure that the Samba server is chosen over an NT
server. The default value is 20.
Preferred Master - Set this to
Yes if you want to force selection of a master browser. By setting this
to Yes, the Samba server also has a better chance of being elected.
(Setting Domain Master to Yes along with this option should ensure that
the Samba server will be selected.) This is set to No by default.
Local Master - Set this to Yes
if you want the Samba server to become the local browser master. (This
is not a guarantee, but gives it a chance.) Set the value to No if you
do not want your Samba server selected as the local master. Local Master
is Yes by default.
Domain Master - Set this to Yes if you want the Samba server
(nmbd daemon) to identify itself as the domain master browser for its
workgroup. This list will then allow client computers assigned to the
workgroup to use SMB-shared files and printers from subnetworks that are
outside of their own subnetwork. This is set to No by default.
WINS options
Use the WINS options if you want to have a
particular WINS server provide the name-to-address translation of
NetBIOS names used by SMB clients. As noted earlier, you probably don't
need to use a WINS server if all of the clients and servers in your SMB
workgroup are on the same subnetwork. That's because NetBIOS names can
be obtained through addresses that are broadcast. It is possible to have
your Samba server provide WINS services.
DNS Proxy - By setting this to
Yes, Samba will use Domain Name Service (DNS) to determine the IP
address of each NetBIOS name that is requested. This assumes that your
NetBIOS names are the same as your TCP/IP names for each computer. One
restriction is that NetBIOS names cannot be more than 15 characters,
which could be a problem with long domain/host names.
WINS Server - If there is a
WINS server on your network that you want to use to resolve the NetBIOS
names for your workgroup, you can enter the IP address of that server
here. Again, you will probably want to use a WINS server if your
workgroup extends outside of the local subnetwork.
WINS Support - Set this value to Yes if you want your Samba
server to act as a WINS server. Again, this is not needed if all the
computers in your workgroup are on the same subnetwork. Only one
computer on your network should be assigned as the WINS server.
Besides the values described here, you can
access dozens more options by clicking the Advanced View button. When
you have filled in all the fields you need, click Commit Changes at the
bottom of the screen to have the changes written to the
/etc/samba/smb.conf file.
Configuring shared file systems with SWAT
To make your shared directory available to
others, you can add an entry to the SWAT window. To use SWAT to set up
Samba to share directories, do the following:
- From the main SAMBA window, click Shares.
- Type the name of the directory that you want to
share in the Create Share box, then click Create Share.
- Add any of these options:
Comment - A few words to
describe the shared directory (optional).
Path - The path name of the
directory you are sharing.
Guest Account - If Guest OK
is selected, then the user name that is defined here is assigned to
users accessing the file system. The nobody user account (which is used
only by users who access your computer remotely) is the default name
used. (The FTP user is also a recommended value.)
Writable - If No, then files
can only be read from this file system, but no remote user can save or
modify files on the file system. Select Yes if you want users to be
allowed to save files to this directory over the network.
Guest OK - Select Yes to
enable anyone access to this directory without requiring a password.
Hosts Allow - Add the names of the computers that you want to
allow access to this file system. You can separate hostnames by commas,
spaces, or tabs. Here are some valid ways of entering hostnames:
localhost - Allow access to the local host.
192.168.74.18 - IP address. Enter an individual IP address.
192.168.74. - Enter a network address to include all hosts on a
network.
maple, pine - Enable access to individual hosts by name.
EXCEPT host- If you
are allowing access to a group of hosts (such as by entering a network
address), use EXCEPT to specifically deny access from one host from that
group.
Hosts Deny - Deny access to
specific computers by placing their names here. By default, no
particular computers are excluded. Enter hostnames in the same forms you
used for Hosts Allow.
Browseable - Indicates
whether you can view this directory on the list of shared directories.
This is on (Yes) by default. (See Viewing Available Samba File Systems
for a description of how to view shared file systems.)
Available - Enables you to
leave this entry intact, but turns off the service. This is useful if
you want to close access to a directory temporarily. This is on (Yes) by
default. Select No to turn it off.
- Select Commit Changes.
At this point, the shared file systems should
be available to the Samba client computers (Windows 9x, Windows
NT, Windows 2000, OS/2, Linux, and so on) that have access to your Linux
Samba server. Before you try that, however, you can check a few things
about your Samba configuration.
Checking your Samba setup with SWAT
From the SWAT window, select Status. From
this window you can restart your smbd and nmbd processes. Likewise, you
can see lists of active connections, active shares, and open files.
Testing Your Samba permissions
You can run several commands from a shell to
work with Samba. One is the testparm command. Use the testparm command
to check the access permissions you have set up. It lists global
parameters that are set, along with any shared directories or printers.
Checking the status of shared file systems
The smbstatus command can be used to view who
is currently using Samba shared resources offered from your Red Hat
Linux system. The following is an example of the output from smbstatus:
Samba version 2.0.7
Service uid gid pid machine
----------------------------------------
Temp nobody nobody 2943 snowbird (10.0.0.12) Mon Feb 26 10:52:22 2001
Locked files:
Pid DenyMode R/W Oplock Name
-------------------------------------------
2943 DENY_NONE RDONLY EXCLUSIVE+BATCH /tmp/install.log Mon Feb 26 11:17:04 2001
Share mode memory usage (bytes):
1048360(99%) free + 136(0%) used + 80(0%) overhead = 1048576(100%) total
This output shows that from your Red Hat
Linux Samba server, the Temp service (which is a share of the /tmp
directory) is currently open by the computer named snowbird. The user
and group nobody is being used to access the resource. The PID (2943) is
the process number of the smbd daemon on the Red Hat Linux server that
is handling the service. The only file that has been opened is the
/tmp/install.log file. The file is available as read-only (RDONLY).
Setting up Samba clients for Windows systems
To be able to share Samba file systems from
your Red Hat Linux system over your network with users on Windows 95/98
client computers, there is some configuration required of those clients.
On Windows 95/98 and similar systems, most of the configuration is done
from the Network window. To open the Network window, do the following
from Windows 95:
Click on Start --> Settings
--> Control Panel.
From the Control Panel, double-click on the Network icon.
On the Network window, you can see the
network components (protocols, clients, adapters, and services). Samba
relies on a working TCP/IP network, so you should have already set up
TCP/IP on your LAN. To be able to use Samba file systems,
you also need to have at least the following network components
configured:
Client for Microsoft Networks
- The client that allows print and file sharing. If it is not listed,
you can add it by clicking Add --> Client --> Add --> Microsoft
--> Client for Microsoft Networks --> OK.
NetBEUI protocol - The
protocol used to carry out file and print sharing among MS Windows (and
other) systems. If it is not listed, add it by clicking Add -->
Protocol --> Add --> Microsoft --> NetBEUI --> OK. (NetBEUI
is a raw NetBIOS protocol. If your computer lets you run NetBIOS over
TCP and bypass NetBEUI, you should do so.)
A Network Adapter - Represents
the networking medium that actually connects the computer together.
Chances are this represents a LAN card, such as an Ethernet card.
TCP/IP protocol - If TCP/IP is not yet added for your network
adapter, click Add --> Protocol --> Add --> Microsoft -->
TCP/IP. Then click OK. Click on the TCP/IP entry for your network
adapter, then click Properties. From the Bindings tab, make sure that
Client for Microsoft Networks is checked. From the WINS Configuration
tab, click Enable WINS Resolution, type the IP address for your Linux
server, and click Add. Then click OK.
Other information that you need to add relates to the client computer's
identity and access. On the Network window, click the Identification
tab. On that tab, enter a name for the client computer, the name of the
workgroup and a description of the computer. Next, click the Access
Control tab. From there, select either User-level or Share-level access
control (to match the type of control set up on the server). Click OK
when you are done. (At this point, you may need to reboot Windows.)
To see the file and print services available from your Red Hat Linux
Samba server (as well as from other computers on the network), open the
Network Neighborhood window. To open the window, double-click the
Network Neighborhood icon on the Windows 95 desktop. The figure
below shows an example of the Network Neighborhood window for a small
LAN.
View your Red Hat Linux Samba server from the Network Neighborhood
window.
The Network Neighborhood window shows the
computers that Windows found on your network. If your server appears on
the screen (in my case, the server's name is maple), double-click on it.
Otherwise, you may need to double-click on Entire Network, then open
the workgroup that your server is a part of to find your server. The
server should show two kinds of resources:
Printers - A name and a
printer icon should represent each printer shared from the server. To
access a printer, double-click on it. Windows will have you set up the
printer for your computer. After that, you can print with it as you
would any local printer.
Directories - A name and folder icon should represent shared
directories from the server. Open the directory to see the files and
folders in that directory.
Double-click on a folder to view the contents
of that folder. At this point, you may receive a request to enter a
password. Type the password and click OK. You should be able to view the
contents of the folder, and its subfolders, at this time.
If the file server that you are looking for does not appear in your
Network Neighborhood, you can try to search for it. Click Start -->
Find --> Computer. Type the name of the computer to search for, then
select Find Now. If the computer name appears, double-click on it. A
window should open, displaying the shared directories and printers from
the server.
Another thing you can do to help your Windows 95 computer find your
Linux Samba server is to create an lmhosts file. Copy the sample
C:\windows\lmhosts.sam file to C:\windows\lmhosts. Then edit the file to
add the hostnames and IP addresses of the SMB servers on your network.
Sample Samba file/print sharing procedure
The procedure in this section steps you
through an example of a Red Hat Linux system configured as a Samba
server. In this example, the Linux Samba server uses "user" security to
share home directories and printers with users from Windows workstations
on the local LAN. The procedure consists of three basic steps:
- Editing the smb.conf file.
- Starting the Samba service
Editing the smb.conf file
Using either SWAT or a regular text editor
(as root user), create an /etc/samba/smb.conf file. Here is an example
of an smb.conf file (with comment lines removed) that can be used to
share printers and directories with several Windows systems on a single
LAN.
[global]
workgroup = Physics
server string = Samba Server on Einstein
hosts allow = 140.106.
printcap name = /etc/printcap
load printers = yes
printing = lprng
log file = /var/log/samba/%m.log
max log size = 0
security = user
encrypt passwords = yes
smb passwd file = /etc/samba/smbpasswd
ssl CA certFile = /usr/share/ssl/certs/ca-bundle.crt
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
dns proxy = no
[homes]
comment = Home Directories
browseable = no
writable = yes
[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
printable = yes
In the [global] section, the workgroup is set
to Physics, the server is identified as the Samba Server on Einstein,
and only computers that are on the local network (140.106.) are allowed
access to the Samba service. Definitions for the local printers that
will be shared are taken from the /etc/printcap file, the printers are
loaded (yes), and the lprng printing service (which is the default print
service used by Red Hat Linux) is used.
Separate log files for each host that tries
to use the service is created in /var/log/samba/%m.log (with %m
automatically replaced with each host name). There is no limit to the
size of each log file (0).
In this case, we are using user-level security (security = user). This
allows a user to log in once, then easily access the printers and the
user's home directory on the Red Hat Linux system. Password encryption
is on (encrypt passwords = yes) because Windows 95, Windows 98, and
other Windows systems have password encryption on by default. Passwords
are stored in the /etc/samba/smbpasswd file on your Linux system.
The ssl CA certFile option and the socket options are security and
socket (network internal) options, respectively. These options are
described earlier in this chapter.
The dns proxy = no option prevents Linux from looking up system
names on the DNS server (used for TCP/IP lookups). You may need to add
host names and IP addresses of the computers on your LAN to your
/etc/hosts file to resolve these addresses.
The [homes] section allows each user to be able to access his or her
Linux home directory from a Windows system on the LAN. The user will be
able to write to the home directory. However, other users will not be
able see or share this directory. The [printers] section allows all
users to print to any printer that is configured on the local Linux
system.
Adding Samba users
Doing user-style Samba security means
assigning a Linux user account to each person using the Linux file
systems and printers from his or her Windows workstation. (You could
assign users to a guest account instead, but in this example all users
have their own accounts.) Then you need to add SMB passwords for each
user. For example, here is how you would add a user whose Windows 98
workstation login is student:
Type the following as root user from a Terminal window to add a Linux
user account:
# useradd -m student
Add a Linux password for the new user as follows:
# passwd student
Changing password for user boogy
New UNIX password: ********
Retype new UNIX password: ********
Repeat the previous steps to add
user accounts for all users from Windows workstations on your LAN that
you want to give access to your Linux system.
Type the following command to create the Samba password file
(smbpasswd):
# cat /etc/passwd | sh mksmbpasswd.sh > /etc/samba/smbpasswd
Add an SMB password for the user as follows:
# smbpasswd student
New SMB password: **********
Retype new SMB password: **********
Repeat this step for each user. Later, each user can then log in to
Linux and rerun the passwd and smbpasswd commands to set private
passwords.
Starting the Samba service
To start the Samba SMB and NMB daemons, you
can run the /etc/init.d/smb startup script by typing the following as
the root user:
/etc/rc.d/init.d/smb start
This runs the Samba service during the
current session. To set up Samba to start automatically when your Linux
system starts, type the following:
chkconfig smb on
This turns on the Samba service to start
automatically in run levels 3, 4, or 5.
At this point, you can open the Network
Neighborhood icon from a Windows desktop on the local LAN for a user you
have just set up. An icon representing the Linux Samba server you just
configured should appear in the Network Neighborhood window. When you
open the server icon, you should see an icon representing the user's
home directory (/home/user) and one icon for each shared printer
available from the Linux Samba server.
Appendix of sample smb.conf files
Example 1 for
Hawkins.linuxindayton.com
# Samba config file created using SWAT
# from Hawkins.linuxindayton.com
(127.0.0.1)
# Date: 2002/03/07 20:14:24
# Global parameters
[global]
workgroup = SCIENTISTS
netbios name = HAWKINS
server string = Samba SMB Server
interfaces = 192.168.1.5/24
127.0.0.1/24
bind interfaces only = Yes
encrypt passwords = Yes
log file = /var/log/samba/log.%m
max log size = 50
time server = Yes
os level = 65
preferred master = Yes
dns proxy = No
guest account = smbuser
hide dot files = No
[homes]
comment = Home directories
writeable = Yes
guest ok = Yes
browseable = No
[HostFS]
comment = VMware host filesystem
path = /
guest account = aross
writeable = Yes
[Smb_Home]
comment = Smbuser home directory
path = /home/smbuser
guest ok = Yes
Example 2 for Hugyen.linuxindayton.com
# Samba config file created using SWAT
# from Hugyen.linuxindayton.com
(192.168.1.2)
# Date: 2001/01/25 17:58:20
# Global parameters
[global]
workgroup = SCIENTISTS
netbios name = Hugyen
server string = Samba SMB Server
interfaces = 192.168.1.30/24
127.0.0.1/24
bind interfaces only = Yes
security = SHARE
log file = /var/log/samba/log.%m
max log size = 50
time server = Yes
socket options = TCP_NODELAY
os level = 65
preferred master = Yes
dns proxy = No
guest account = smbuser
hide dot files = No
[public]
comment = Public
path = /home/public
guest account = aross
read only = No
directory mask = 0775
guest ok = Yes
[data]
comment = Data
path = /home/samba/data
guest account = aross
read only = No
guest ok = Yes
[printers]
comment = Printer on Linux Box
path = /var/spool/samba
read only = No
guest ok = Yes
print ok = Yes
printer name = lp
oplocks = No
share modes = No
[zip]
comment = The Linux Zip Drive
path = /mnt/zip
guest account = nobody
read only = No
guest ok = Yes
[cdrom]
comment = The Linux Box CDROM
path = /mnt/cdrom
[My_Documents]
comment = My Documents for all work
path = /My_Documents
guest account = aross
read only = No
guest ok = Yes
