{"id":1768,"date":"2015-12-23T04:38:52","date_gmt":"2015-12-23T04:38:52","guid":{"rendered":"http:\/\/microsoftgeek.com\/?p=1768"},"modified":"2015-12-23T04:38:52","modified_gmt":"2015-12-23T04:38:52","slug":"red-hat-enterprise-linux-3-configuring-a-samba-server","status":"publish","type":"post","link":"https:\/\/microsoftgeek.com\/?p=1768","title":{"rendered":"Red Hat Enterprise Linux 3: Configuring a Samba Server"},"content":{"rendered":"

Configuring a Samba Server<\/h1>\n

The default configuration file (\/etc\/samba\/smb.conf<\/tt>) allows users to view their home directories as a Samba share. It also shares all printers configured for the system as Samba shared printers. In other words, you can attach a printer to the system and print to it from the Windows machines on your network.<\/p>\n

\n

Graphical Configuration<\/h2>\n

To configure Samba using a graphical interface, use the Samba Server Configuration Tool<\/b>. For command line configuration, skip to Section:\u00a0Command Line Configuration<\/i>.<\/p>\n

The Samba Server Configuration Tool<\/b> is a graphical interface for managing Samba shares, users, and basic server settings. It modifies the configuration files in the \/etc\/samba\/<\/tt> directory. Any changes to these files not made using the application are preserved.<\/p>\n

To use this application, you must be running the X Window System, have root privileges, and have the redhat-config-samba<\/tt> RPM package installed. To start the Samba Server Configuration Tool<\/b> from the desktop, go to the Main Menu Button<\/b> (on the Panel) => System Settings<\/b> => Server Settings<\/b> => Samba<\/b> or type the command redhat-config-samba<\/tt> at a shell prompt (for example, in an XTerm or a GNOME terminal).<\/p>\n

\n
\n

\"\"<\/p>\n<\/div>\n

Samba Server Configuration Tool<\/b><\/b><\/p>\n<\/div>\n

\n\n\n\n\n
\"Note\"<\/td>\nNote<\/b><\/th>\n<\/tr>\n
<\/td>\nThe Samba Server Configuration Tool<\/b> does not display shared printers or the default stanza that allows users to view their own home directories on the Samba server.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
\n

Configuring Server Settings<\/h3>\n

The first step in configuring a Samba server is to configure the basic settings for the server and a few security options. After starting the application, select Preferences<\/b> => Server Settings<\/b> from the pulldown menu. The Basic<\/b> tab is displayed as shown in the image below.<\/p>\n

\"\"<\/p>\n

\n
<\/div>\n

Configuring Basic Server Settings<\/b><\/p>\n<\/div>\n

On the Basic<\/b> tab, specify which workgroup the computer should be in as well as a brief description of the computer. They correspond to the workgroup<\/tt> and server string<\/tt> options insmb.conf<\/tt>.<\/p>\n

\n
\n

\"\"<\/p>\n<\/div>\n

Configuring Security Server Settings<\/b><\/p>\n<\/div>\n

The Security<\/b> tab contains the following options:<\/p>\n

    \n
  • Authentication Mode<\/b> \u2014 This corresponds to the security<\/tt> option. Select one of the following types of authentication.\n
      \n
    • ADS<\/b> \u2014 The Samba server acts as a domain member in an Active Directory Domain (ADS) realm. For this option, Kerberos must be installed and configured on the server, and Samba must become a member of the ADS realm using the net<\/tt> utility, which is part of the samba-client<\/tt> package. Refer to the net<\/tt> man page for details. This option does not configure Samba to be an ADS Controller.<\/li>\n
    • Domain<\/b> \u2014 The Samba server relies on a Windows NT Primary or Backup Domain Controller to verify the user. The server passes the username and password to the Controller and waits for it to return. Specify the NetBIOS name of the Primary or Backup Domain Controller in the Authentication Server<\/b> field.\n

      The Encrypted Passwords<\/b> option must be set to Yes<\/b> if this is selected.<\/li>\n

    • Server<\/b> \u2014 The Samba server tries to verify the username and password combination by passing them to another Samba server. If it can not, the server tries to verify using the user authentication mode. Specify the NetBIOS name of the other Samba server in the Authentication Server<\/b> field.<\/li>\n
    • Share<\/b> \u2014 Samba users do not have to enter a username and password combination on a per Samba server basis. They are not prompted for a username and password until they try to connect to a specific shared directory from a Samba server.<\/li>\n
    • User<\/b> \u2014 (Default) Samba users must provide a valid username and password on a per Samba server basis. Select this option if you want the Windows Username<\/b> option to work.<\/li>\n<\/ul>\n<\/li>\n
    • Encrypt Passwords<\/b> \u2014 This option must be enabled if the clients are connecting from a Windows 98, Windows NT 4.0 with Service Pack 3, or other more recent versions of Microsoft Windows. The passwords are transfered between the server and the client in an encrypted format instead of in as a plain-text word that can be intercepted. This corresponds to the\u00a0encrypted passwords<\/tt> option.<\/li>\n
    • Guest Account<\/b> \u2014 When users or guest users log into a Samba server, they must be mapped to a valid user on the server. Select one of the existing usernames on the system to be the guest Samba account. When guests logs in to the Samba server, they have the same privileges as this user. This corresponds to the guest account<\/tt> option.<\/li>\n<\/ul>\n

      After clicking OK<\/b>, the changes are written to the configuration file and the daemon is restart; thus, the changes take effect immediately.<\/p>\n<\/div>\n

      \n

      Managing Samba Users<\/h3>\n

      The Samba Server Configuration Tool<\/b> requires that an existing user account be active on the system acting as the Samba server before a Samba user can be added. The Samba user is associated with the existing user account.<\/p>\n

      \n
      \n

      \"\"<\/p>\n<\/div>\n

      Managing Samba Users<\/b><\/p>\n<\/div>\n

      To add a Samba user, select Preferences<\/b> => Samba Users<\/b> from the pulldown menu, and click the Add User<\/b> button. On the Create New Samba User<\/b> window select a Unix Username<\/b> from the list of existing users on the local system.<\/p>\n

      If the user has a different username on a Windows machine and will be logging into the Samba server from the Windows machine, specify that Windows username in the Windows Username<\/b>field. The Authentication Mode<\/b> on the Security<\/b> tab of the Server Settings<\/b> preferences must be set to User<\/b> for this option to work.<\/p>\n

      Also configure a Samba Password<\/b> for the Samba User and confirm the Samba Password by typing it again. Even if you select to use encrypted passwords for Samba, it is recommended that the Samba passwords for all users are different from their system passwords.<\/p>\n

      To edit an existing user, select the user from the list, and click Edit User<\/b>. To delete an existing Samba user, select the user, and click the Delete User<\/b> button. Deleting a Samba user does not delete the associated system user account.<\/p>\n

      The users are modified immediately after clicking the OK<\/b> button.<\/p>\n<\/div>\n

      \n

      Adding a Share<\/h3>\n
      \n
      \n

      \"\"<\/p>\n<\/div>\n

      Adding a Share<\/b><\/p>\n<\/div>\n

      To add a share, click the Add<\/b> button. The Basic<\/b> tab configures the following options:<\/p>\n

        \n
      • Directory<\/b> \u2014 The directory to share via Samba. The directory must exist.<\/li>\n
      • Descriptions<\/b> \u2014 A brief description of the share.<\/li>\n
      • Basic Permissions<\/b> \u2014 Whether users should only be able to read the files in the shared directory or whether they should be able to read and write to the shared directory.<\/li>\n<\/ul>\n

        On the Access<\/b> tab, select whether to allow only specified users to access the share or whether to allow all Samba users to access the share. If you select to allow access to specific users, select the users from the list of available Samba users.<\/p>\n

        The share is added immediately after clicking OK<\/b>.<\/p>\n<\/div>\n<\/div>\n

        \n

        Command Line Configuration<\/h2>\n

        Samba uses \/etc\/samba\/smb.conf<\/tt> as its configuration file. If you change this configuration file, the changes do not take effect until you restart the Samba daemon with the command service smb restart<\/tt>.<\/p>\n

        To specify the Windows workgroup and a brief description of the Samba server, edit the following lines in your smb.conf<\/tt> file:<\/p>\n\n\n\n
        \n
        workgroup = WORKGROUPNAME<\/var>\r\nserver string = BRIEF COMMENT ABOUT SERVER<\/var><\/samp><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
        Replace WORKGROUPNAME<\/var> with the name of the Windows workgroup to which this machine should belong. The BRIEF COMMENT ABOUT SERVER<\/var> is optional and is used as the Windows comment about the Samba system.<\/p>\n
        To create a Samba share directory on your Linux system, add the following section to your smb.conf<\/tt> file (after modifying it to reflect your needs and your system):<\/p>\n\n\n\n
        \n
        [sharename<\/var>]\r\ncomment = Insert a comment here<\/var>\r\npath = \/home\/share\/<\/var>\r\nvalid users = tfox carole<\/var>\r\npublic = no\r\nwritable = yes\r\nprintable = no\r\ncreate mask = 0765<\/samp><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
        The above example allows the users tfox and carole to read and write to the directory \/home\/share<\/tt>, on the Samba server, from a Samba client.<\/p>\n<\/div>\n
        \n
        Encrypted Passwords<\/h2>\n
        Encrypted passwords are enabled by default because it is more secure. If encrypted passwords are not used, plain text passwords are used, which can be intercepted by someone using a network packet sniffer. It is recommended that encrypted passwords be used.<\/p>\n
        The Microsoft SMB Protocol originally used plaintext passwords. However, Windows NT 4.0 with Service Pack 3 or higher, Windows 98, Windows 2000, Windows ME, and Windows XP require encrypted Samba passwords. To use Samba between a Linux system and a system running one of these Windows operating systems, you can either edit your Windows registry to use plaintext passwords or configure Samba on your Linux system to use encrypted passwords. If you choose to modify your registry, you must do so for all your Windows machines \u2014 this is risky and may cause further conflicts. It is recommended that you use encrypted passwords for better security.<\/p>\n
        To configure Samba to use encrypted passwords, follow these steps:<\/p>\n
          \n
        1. Create a separate password file for Samba. To create one based on your existing \/etc\/passwd<\/tt> file, at a shell prompt, type the following command:
          \n\n\n\n
          \n
          cat \/etc\/passwd | mksmbpasswd.sh > \/etc\/samba\/smbpasswd<\/tt><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          If the system uses NIS, type the following command:<\/p>\n\n\n\n
          \n
          ypcat passwd | mksmbpasswd.sh > \/etc\/samba\/smbpasswd<\/tt><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          The mksmbpasswd.sh<\/tt> script is installed in your \/usr\/bin<\/tt> directory with the samba<\/tt> package.<\/li>\n
        2. Change the permissions of the Samba password file so that only root has read and write permissions:
          \n\n\n\n
          \n
          chmod 600 \/etc\/samba\/smbpasswd<\/tt><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
        3. The script does not copy user passwords to the new file, and a Samba user account is not active until a password is set for it. For higher security, it is recommended that the user’s Samba password be different from the user’s system password. To set each Samba user’s password, use the following command (replace username<\/var> with each user’s username):
          \n\n\n\n
          \n
          smbpasswd username<\/var><\/tt><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
        4. Encrypted passwords must be enabled. Since they are enabled by default, they do not have to be specifically enabled in the configuration file. However, they can not be disabled in the configuration file either. In the file \/etc\/samba\/smb.conf<\/tt>, verify that the following line does not exist:
          \n\n\n\n
          \n
          encrypt passwords = no<\/samp><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          If it does exist but is commented out with a semi-colon (;<\/samp>) at the beginning of the line, then the line is ignored, and encrypted passwords are enabled. If this line exist but is not commented out, either remove it or comment it out.<\/p>\n
          To specifically enable encrypted passwords in the configuration file, add the following lines to etc\/samba\/smb.conf<\/tt>:<\/p>\n\n\n\n
          \n
          encrypt passwords = yes\r\nsmb passwd file = \/etc\/samba\/smbpasswd<\/samp><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n
        5. Make sure the smb<\/tt> service is started by typing the command service smb restart<\/tt> at a shell prompt.<\/li>\n
        6. If you want the smb<\/tt> service to start automatically, use ntsysv<\/b>, chkconfig<\/tt>, or the Services Configuration Tool<\/b> to enable it at runtime. Refer to Chapter 21 Controlling Access to Services<\/i>for details.<\/li>\n<\/ol>\n
          The pam_smbpass<\/tt> PAM module can be used to sync users’ Samba passwords with their system passwords when the passwd<\/tt> command is used. If a user invokes the passwd<\/tt> command, the password he uses to log in to the Red Hat Enterprise Linux system as well as the password he must provide to connect to a Samba share are changed.<\/p>\n
          To enable this feature, add the following line to \/etc\/pam.d\/system-auth<\/tt> below the pam_cracklib.so<\/samp> invocation:<\/p>\n\n\n\n
          \n
          password required \/lib\/security\/pam_smbpass.so nullok use_authtok try_first_pass<\/samp><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
          \n
          Starting and Stopping the Server<\/h2>\n
          On the server that is sharing directories via Samba, the smb<\/tt> service must be running.<\/p>\n
          View the status of the Samba daemon with the following command:<\/p>\n\n\n\n
          \n
          \/sbin\/service smb status<\/tt><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          Start the daemon with the following command:<\/p>\n\n\n\n
          \n
          \/sbin\/service smb start<\/tt><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          Stop the daemon with the following command:<\/p>\n\n\n\n
          \n
          \/sbin\/service smb stop<\/tt><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          To start the smb<\/tt> service at boot time, use the command:<\/p>\n\n\n\n
          \n
          \/sbin\/chkconfig --level 345 smb on<\/tt><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          You can also use chkconfig<\/tt>, ntsysv<\/b> or the Services Configuration Tool<\/b> to configure which services start at boot time.<\/p>\n
          \n\n\n\n\n
          \"Tip\"<\/td>\nTip<\/b><\/th>\n<\/tr>\n
          <\/td>\nTo view active connections to the system, execute the command smbstatus<\/tt>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
          Configuring a Samba Server The default configuration file (\/etc\/samba\/smb.conf) allows users to view their home directories as a Samba share. It also shares all printers configured for the system as Samba shared printers. In other words, you can attach a printer to the system and print to it from the Windows machines on your network. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-1768","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/1768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1768"}],"version-history":[{"count":1,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/1768\/revisions"}],"predecessor-version":[{"id":1769,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/1768\/revisions\/1769"}],"wp:attachment":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}