Advanced Samba
Advanced Samba Modifications
Maintainer
Description
Advanced Samba is a SME Server contrib to extend SME Servers Samba functionality to support all standard Windows server roles. Out-of-the-box, SME Server supports workgroup and primary domain controller (PDC) server roles. These, out-of-the-box, server roles address many Windows Network needs, but they do not provide all of the functionality available to todays typical Windows Server.
This document provides procedural and SME Server specific RPM(s) to configure SME Server to function in all mainstream Windows server roles:
Workgroup server
In this server role, SME Server will act as a typical Windows NT, 2000, XP, or Vista machine in a windows peer-to-peer network. Access to network shares on the SME Server requires a local user account with appropriate network privileges.
Primary domain controller
In this server role, SME Server will function as a Windows NT4 style domain controller, providing client/user authentication, WINS, windows user profile management, and print services.
Domain member
In this server role, SME Server will present ibays to a domain as Windows network shares, relying on a separate domain controller for client/user authentication. That is, authenticated Windows network users can access ibays on SME Server domain member machines without needing a local user account.
Backup domain controller
In this server role, SME Server will provide all functionality available as a domain member, but it can also take over the role as the domain controller if certain network conditions exist. As with the domain member server role, it is not necessary for the network administrator to create user accounts on the SME Server backup domain controller machine. SME Server, in this server role, will maintain (or replicate) a local copy of user/client authentication information from the primary domain controller in the event that it needs to take on the role of primary domain controller.
Active Directory domain controller
This server role is very similar to the out-of-the-box SME server role primary domain controller. In addition to those functions provided by the PDC, the SME Server Active Directory domain controller will maintain a directory of Windows Active Directory services.
Active Directory domain member
This server role is nearly identical to the domain member server role except that in this server role, SME Server will have access to Active Directory services provided by an Active Directory server.
It should be noted that this contrib is a work in progress. Preliminary support is provided for all Server Roles and full support for a selection of them, as detailed below. In time, all server roles listed here in will be fully supported by this contrib.
Prerequisites
The current releases of SME Server do not support Samba server roles directly. Modification of several core SME Server packages is required to support Samba server roles, therefore it is not possible to provide advanced Samba functions with a typical contrib RPM.
An effort to update the necessary core SME Server packages is being tracked in the following SME Server bug report:
bugzilla:4172.
It is the maintainers opinion that these changes will ultimately be included in the core SME Server packages. When this occurs, it is very likely that this section of this contrib will be removed.
Until these changes are incorporated into the core packages, patched versions of the current release SME Server packages will be provided as part of this contrib. It is necessary that users install these "patched" core packages to take advantage of Samba server roles. Every effort is made to provide this additional functionality without changing standard SME Server functionality. In other words, the patched core SME Server packages will not change the way SME Server currently functions -- the modified core packages simply provide the additional server role functionality.
Install necessary patched packages
1. Download the patched server role RPMs from my contribs repository:
wget -nd -r -l1 --no-parent -A.rpm http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/gzartman/Contribs/7/Samba/
2. Install the patched RPMs:
yum localinstall *.rpm
3. Reconfigure and reboot machine:
signal-event post-upgrade; signal-event reboot.
Install Advanced Samba RPM
It is necessary to install one additional RPM prior to configuring SME Server in advanced server roles. This package provides necessary Samba functionality that may not be available in Core SME Server packages:
1. Install the latest advanced samba rpm from the contribs repos:
yum --enablerepo smecontribs install smeserver-adv-samba
2. Reconfigure machine:
signal-event post-upgrade; signal-event reboot
Configure server roles
As most of those familiar with SME Server know, much of the configuration (management) of the SME Server can be done through the server-manager web interface. The current SME Server server-manager includes a panel, Workgroup, which provides the Administrator the ability to configure SME Server as either a workgroup server of a primary domain controller. Nothing presented in this contrib (software or documentation) will change this. We have worked to provide seamless integration of new functionality with the current SME Server -- nothing will change if you desire to stick with the standard options.
However, further functionality with respect to Samba server roles is provided via shell command line options
Samba server role support is provided as follows:
Workgroup server
This server role configures SME Server to function as a member of a Microsoft Windows peer-to-peer network. In order to access network shares on the SME Server machine when it is configured in this server role, users/clients must have local user accounts on the SME Server machine. This is the simplest of Microsoft network configurations. In this server role, SME Server will act as a typical Windows client (e.g., Win 95, Win XP, Win 2000, etc.)
Configuration
Currently supported via the standard Server Manager Panel
Primary domain controller
This server role configures SME Server to function as a Windows NT4 type domain controller.
Configuration
Currently supported via the standard server-manager panel
Domain member
In this server role, SME Server will act as a file and/or print server to an existing Windows network domain. User/client accounts on the local machine are not required to access domain member resources (shares). Ibays created will be presented as standard Windows shares.
Configuration
1. Open a SME Server shell session and log into your SME Server box with root access.
2. At the SME Server prompt:
config setprop smb ServerName machine_name_of_domain_member_box
3. At the SME Server prompt:
config setprop smb Workgroup workgroup_or_domain_name
4. At the SME Server prompt:
config setprop smb ServerRole DM
5. At the SME Server prompt:
config setprop smb WINSServer ip_address_of_domain_PDC
6. Verify settings:
config show smb
Should show you an output similar to this:
[root@testbed ~]# config show smb smb=service DeadTime=10080 DomainMaster=no KeepVersions=disabled OpLocks=enabled OsLevel=35 RecycleBin=disabled RoamingProfiles=no ServerName=testbed2 ServerRole=DM ShadowCount=10 ShadowDir=/home/e-smith/files/.shadow UnixCharSet=UTF8 UseClientDriver=yes WINSServer=90.0.0.20 Workgroup=lei-salem status=enabled
7. At SME Server prompt:
signal-event workgroup-update
8. At the SME Server prompt:
net rpc join -U pdc_admin_username%pdc_admin_password
Output:
[root@testbed2 ~]# net rpc join -U admin%pdc_admin_password Joined domain LEI-SALEM. [root@testbed2 ~]#
9. At the SME Server prompt:
signal-event workgroup-update
Your SME Server domain member shares should now be accessible from authenticated windows network clients.
Backup domain controller
Active Directory domain controller
Active Directory domain member
Known issues
Domain Users and Groups, SME Server as a domain member
It is not currently possible to restrict access to network resources by username or groupname when SME Server is functioning as a domain member. This is because SME Server as a domain member relies on the domain controller for authentication. Therefore, local authentication databases (e.g., passwd, groups) do not contain the user and group names of domain users accessing the SME Server domain member box.
Access control to network resources is specified in the SME server-manager web interface, which only recognizes local groups, not domain groups. To maintain current SME Server functionality, this contrib treats all authenticated users as if they are members of the local group assigned to the network resource in the server-manager interface. At some point in the future, this contrib may provide functionality that would allow the administrator to restrict access to network resources based on domain groups.
Active Directory
NONE of the currently supported server roles will fully integrate with an Active Directory network environment. The currently supported server roles will work with NT4 network or windows workgroup environments only. Specifically, those who desire to deploy the Domain Member server role need to be aware that this server role WILL NOT provide domain membership in a Active Directory domain, only a NT4 domain.
Bugs
Please raise bugs under the SME Contribs section in bugzilla .
