samba - Nov 2000 - samba digest, Vol 1 #189 - 15 msgs

Martin

If you set up a share by editing smb.conf or using swat you can use Windows
Explorer/ Network Neighbourhood to see if you can access the samba server.

It is not clear exactly how you want to set up things up.  We are only doing
file system sharing  and have the following set in smb.conf

        workgroup = HR
        security = DOMAIN
        encrypt passwords = Yes
        password server = DRIZZLE HAIL SNOW SUPERIOR
        username map = /etc/samba/usermap.txt

This uses our existing NT domain servers for authentication.  Where
usernames differ between NT and Unix we use the "username map" to map
them.
Users log in as before.  Generally we use the swat tool for all
administration, which is easier than having to look up smb.conf options. We
set up Unix groups which equate to any NT groups we have and use the @group
notation as appropriate in smb.conf eg 

[Ema]
        comment = Ema directory
        path = /export/services
        write list = @services
        force group = services 

Everyone has read access as it is not specified, but services group have
write access.  

We don't use spaces in any group names, so I can't help you there. 

For further information look at the DOMAIN_MEMBER document supplied with the
distribution and chapter 6 of "Using Samba" which is also supplied in
html
format with the distribution. 

David Evans-Roberts
> Message: 6
> Date: Mon, 13 Nov 2000 15:42:27 -0800
> From: Martin <martin@mediax.com>
> Organization: MediaX Inc.
> To: samba@lists.samba.org
> Subject: Domain Authentication
> 
> I've been poking through docs and non-searchable mailing lists, but I 
> haven't found the answer to this yet. First of all, how do I 
> verify that 
> my domain registration is accurate? My system seems to be in the NT4 
> domain, how do I prove it?
> 
> Second, how do I specify users and groups in a domain as 
> valid users for 
> a resource? Do users still log in as DOMAIN\username? And how 
> do I add 
> users and/or groups with spaces in them to the list of valid 
> users for 
> accessing a resource?
> 
> Thanks.
> 
> 

"Faxes and emails are used by HR Wallingford as a convenience for
confidential,
and often legally privileged, business communications both within the firm and 
and with clients.  Disclosure to parties other than addressees through for
example
forwarding, copying, printing, distribution etc requires HR Wallingford's
specific consent.  HR Wallingford is not liable for unauthorised disclosures
nor for subsequent actions or omissions in reliance upon them.  If you have 
received this message in error please notify us immediately and destroy  all 
copies of it."

David Evans-Roberts wrote:
> Martin
> 
> If you set up a share by editing smb.conf or using swat you can use Windows
> Explorer/ Network Neighbourhood to see if you can access the samba server.
> 
> It is not clear exactly how you want to set up things up.  We are only
doing
> file system sharing  and have the following set in smb.conf
...

It looks to me like even while using domain level security, you must 
have local accounts in order for someone to connect to resources on your 
box, using the username map where necessary. Is this true, and if so, 
how has the Samba team managed to miss that the whole point of domain 
authentication is to not have to maintain users on multiple machines?

If this in fact is the case, does anyone have any enhanced (READ: Low 
Maintenance) solutions for allowing my users to connect WITHOUT manually 
creating local users and mapping usernames?

Also, does all this stop working when I go to 2k, even if I support 
NT4-style clients? If it does work, are there any caveats I need to 
watch out for regardless? I know some of this is covered in FAQ, but it 
doesn't seem to be covered completely, so I'm asking regardless. If 
you're going to just tell me RTFM, and you can't restrain yourself, 
please reply privately to save list bandwidth.