Samba Question -- Users cannot access home directories
Tim Holmes
tholmes at mcaschool.net
Wed Feb 23 15:57:04 UTC 2005
> > Good Morning Everyone:
> >
> > I am running into a bit of a problem,
> >
> > Yesterday, I set up my webserver with samba so that I can
authenticate
> > against the active directory as per the instructions in
> >
http://www.billboswellconsulting.com/files/Authenticating%20Linux%20desk
> > tops%20with%20AD.pdf
> >
> > When I log in to the fedora box using my Domain admin username and
> > password, it works nicely, the problem that I am hitting is that
any
> > user trying to access the box from the network can hit the two
shares
> > (which happen to contain the websites (for editing purposes) but
cannot
> > access their home directories.
> >
> > There are really two parts to my question
> >
> > 1. How do I get them to be able to access their home directories.
(this
> > will be applied today on another machine which is a file server)
> >
> >
> > 2. Because this is a webserver, how do I make those home directories
go
> > away as the users don't need them on this box, but will need them on
the
> > file server that I am going to be working on)
> >
> > So far my research hasn't turned up any clues to this, though
> > admittedly, I have about 1000 pages of reading left to go.
> >
> > Thanks for all the excellent help I have already received.
> >
> >
> > Tim Holmes
>
> Can you post your /etc/samba/smb.conf file? Does it have a [homes]
> section?
>
> Thomas
[Tim Holmes wrote]
here is the smb.conf file --- Any input would be greatly appreciated.
If it will help anyone to contact me by IM -- im on
AOL IM w8tahham
YAHOO IM w8tah
Thanks again
TIM
# This is the main Samba configuration file. You should read the #
smb.conf(5) manual page in order to understand the options listed #
here. Samba has a huge number of configurable options (perhaps too #
many!) most of which are not shown in this example # # Any line which
starts with a ; (semi-colon) or a # (hash) # is a comment and is
ignored. In this example we will use a # # for commentry and a ; for
parts of the config file that you # may wish to enable # # NOTE:
Whenever you modify this file you should run the command "testparm" # to
check that you have not made any basic syntactic errors. #
#======================= Global Settings
=====================================
[global]
realm = MCASCHOOL.NET
# workgroup = NT-Domain-Name or Workgroup-Name
workgroup = mcaschool
# server string is the equivalent of the NT Description field
server string = Production Web Server
# This option is important for security. It allows you to restrict #
connections to machines which are on your local network. The # following
example restricts access to two C class networks and # the "loopback"
interface. For more examples of the syntax see # the smb.conf man page
hosts allow = 192.168.0. 127.
# if you want to automatically load your printer list rather
# than setting them up individually then you'll need this
printcap name = /etc/printcap
load printers = yes
# It should not be necessary to spell out the print system type unless #
yours is non-standard. Currently supported print systems include: # bsd,
sysv, plp, lprng, aix, hpux, qnx
; printing = bsd
# Uncomment this if you want a guest account, you must add this to
/etc/passwd # otherwise the user "nobody" is used ; guest account =
pcguest
# this tells Samba to use a separate log file for each machine # that
connects
log file = /var/log/samba/%m.log
# all log information in one file
# log file = /var/log/samba/smbd.log
# Put a capping on the size of the log files (in Kb).
max log size = 50
# Security mode. Most people will want user level security. See #
security_level.txt for details.
security = ads
# Use password server option only with security = server
; password server = srvdc01.mcaschool.net
# Password Level allows matching of _n_ characters of the password for #
all combinations of upper and lower case. ; password level = 8 ;
username level = 8
# You may wish to use password encryption. Please read
# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation. #
Do not enable this option unless you have read those documents ;
encrypt passwords = yes ; smb passwd file = /etc/samba/smbpasswd
# The following are needed to allow password changing from Windows to #
update the Linux system password also. # NOTE: Use these with 'encrypt
passwords' and 'smb passwd file' above. # NOTE2: You do NOT need these
to allow workstations to change only
# the encrypted SMB passwords. They allow the Unix password
# to be kept in sync with the SMB password.
; unix password sync = Yes
; passwd program = /usr/bin/passwd %u
; passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password*
%n\n *passwd:*all*authentication*tokens*updated*successfully*
# Unix users can map to different SMB User names
; username map = /etc/samba/smbusers
# Using the following line enables you to customise your configuration #
on a per machine basis. The %m gets replaced with the netbios name # of
the machine that is connecting
; include = /etc/samba/smb.conf.%m
# Most people will find that this option gives better performance. # See
speed.txt and the manual pages for details
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
# Configure Samba to use multiple interfaces
# If you have multiple network interfaces then you must list them #
here. See the man page for details.
; interfaces = 192.168.12.2/24 192.168.13.2/24
# Configure remote browse list synchronisation here
# request announcement to, or browse list sync from:
# a specific host or from / to a whole subnet (see below)
; remote browse sync = 192.168.3.25 192.168.5.255
# Cause this host to announce itself to local subnets here
; remote announce = 192.168.1.255 192.168.2.44
# Browser Control Options:
# set local master to no if you don't want Samba to become a master #
browser on your network. Otherwise the normal election rules apply
; local master = no
# OS Level determines the precedence of this server in master browser #
elections. The default value should be reasonable
; os level = 33
# Domain Master specifies Samba to be the Domain Master Browser. This #
allows Samba to collate browse lists between subnets. Don't use this #
if you already have a Windows NT domain controller doing this job
; domain master = no
# Preferred Master causes Samba to force a local browser election on
startup # and gives it a slightly higher chance of winning the election
; preferred master = no
# Enable this if you want Samba to be a domain logon server for #
Windows95 workstations.
; domain logons = no
# if you enable domain logons then you may want a per-machine or # per
user logon script # run a specific logon batch file per workstation
(machine)
; logon script = %m.bat
# run a specific logon batch file per username
; logon script = %U.bat
# Where to store roving profiles (only for Win95 and WinNT)
# %L substitutes for this servers netbios name, %U is username
# You must uncomment the [Profiles] share below
; logon path = \\%L\Profiles\%U
# All NetBIOS names must be resolved to IP Addresses
# 'Name Resolve Order' allows the named resolution mechanism to be
specified # the default order is "host lmhosts wins bcast". "host" means
use the unix # system gethostbyname() function call that will use either
/etc/hosts OR # DNS or NIS depending on the settings of
/etc/host.config, /etc/nsswitch.conf # and the /etc/resolv.conf file.
"host" therefore is system configuration # dependant. This parameter is
most often of use to prevent DNS lookups # in order to resolve NetBIOS
names to IP Addresses. Use with care! # The example below excludes use
of name resolution for machines that are NOT # on the local network
segment # - OR - are not deliberately to be known via lmhosts or via
WINS. ; name resolve order = wins lmhosts bcast
# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS
Server
; wins support = no
# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but
NOT
both
; wins server = w.x.y.z
# WINS Proxy - Tells Samba to answer name resolution queries on # behalf
of a non WINS capable client, for this to work there must be
# at least one WINS Server on the network. The default is NO.
; wins proxy = no
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups. The built-in default for versions 1.9.17 is yes, #
this has been changed in version 1.9.18 to no.
dns proxy = no
# Case Preservation can be handy - system default is _no_
# NOTE: These can be set on a per share basis
; preserve case = no
; short preserve case = no
# Default case is normally upper case for all DOS files
; default case = lower
# Be very careful with case sensitivity - it can break things! ; case
sensitive = no
#============================ Share Definitions
==============================
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
template shell = /bin/bash
username map = /etc/samba/smbusers
winbind use default domain = no
password server = srvdc01.mcaschool.net srvdc01.mcaschool.net
realm = MCASCHOOL.NET
security = ads
[homes]
comment = Home Directories
browseable = no
writeable = yes
# Un-comment the following and create the netlogon directory for Domain
Logons ; [netlogon]
; comment = Network Logon Service
; path = /home/netlogon
; guest ok = yes
; writable = no
; share modes = no
# Un-comment the following to provide a specific roving profile share #
the default is to use the user's home directory ;[Profiles]
; path = /home/profiles
; browseable = no
; guest ok = yes
# NOTE: If you have a BSD-style print system there is no need to #
specifically define each individual printer [printers]
comment = All Printers
path = /var/spool/samba
browseable = no
# Set public = yes to allow user 'guest account' to print
printable = yes
# This one is useful for people to share files
;[tmp]
; comment = Temporary file space
; path = /tmp
; read only = no
; public = yes
# A publicly accessible directory, but read only, except for people in #
the "staff" group ;[public]
; comment = Public Stuff
; path = /home/samba
; public = yes
; read only = yes
; write list = @staff
# Other examples.
#
# A private printer, usable only by fred. Spool data will be placed in
fred's # home directory. Note that fred must have write access to the
spool directory, # wherever it is. ;[fredsprn]
; comment = Fred's Printer
; valid users = fred
; path = /homes/fred
; printer = freds_printer
; public = no
; writable = no
; printable = yes
# A private directory, usable only by fred. Note that fred requires
write # access to the directory. ;[fredsdir]
; comment = Fred's Service
; path = /usr/somewhere/private
; valid users = fred
; public = no
; writable = yes
; printable = no
# a service which has a different directory for each machine that
connects # this allows you to tailor configurations to incoming
machines. You could # also use the %u option to tailor it by user name.
# The %m gets replaced with the machine name that is connecting.
;[pchome] ; comment = PC Directories ; path = /usr/pc/%m ; public =
no ; writable = yes
# A publicly accessible directory, read/write to all users. Note that
all files # created in the directory by users will be owned by the
default user, so # any user with access can delete any other user's
files. Obviously this # directory must be writable by the default user.
Another user could of course # be specified, in which case all files
would be owned by that user instead. ;[public]
; path = /usr/somewhere/else/public
; public = yes
; only guest = yes
; writable = yes
; printable = no
# The following two entries demonstrate how to share a directory so that
two # users can place files there that will be owned by the specific
users. In this # setup, the directory should be writable by both users
and should have the # sticky bit set on it to prevent abuse. Obviously
this could be extended to # as many users as required. ;[myshare]
; comment = Mary's and Fred's stuff
; path = /usr/somewhere/shared
; valid users = mary fred
; public = no
; writable = yes
; printable = no
; create mask = 0765
[www]
writeable = yes
path = /var/www
[html]
writeable = yes
path = /var/www/html
More information about the fedora-list
mailing list