Configuring a Samba server

Updated 14 January 2020

Samba

Contents

# Introduction

Samba is a popular open source software package that provides Microsoft® Windows® file and print services to clients. You can configure your Samba server with Calculate Utilities, found in the sys-apps/calculate-server package. Calculate Utilities use an OpenLDAP server to store and manage users, groups and hosts. All necessary software comes out of box in Calculate Directory Server.

You can use any Calculate Linux Desktop as the Linux client (CLD, CLDC, CLDL, CLDM, or else CLDX). Different Windows operating systems can be used as Windows clients. Microsoft Windows does not support NT4 domains any more. However, with some modifications, you can still use latest Windows operating systems with a Samba NT4 domain.

# Server configuration

A Samba server is configured in several steps. Since all user and host data are stored in LDAP, it is necessary to first configure the OpenLDAP server and then configure LDAP to store Linux user accounts. You need this to run Linux clients. You can now configure your Samba server.

# # LDAP server configuration

Configure your LDAP server according to the manual.

# # Samba configuration

Before setting up a Samba server, let us configure LDAP for storage of Unix user accounts. To do so, run:

? ? ? exec " cl-setup unix"
`
* WARNING: Running this program will modify the configuration files and the LDAP database. If you want to continue, enter 'yes', else enter 'no': yes

      * Added ldif file ...                                                                                        [ ok ]
      * Unix service configured ...                                                                               [ ok ]
     ` ` `

To configure your Samba server, please run:

? ? ? exec " cl-setup [options] samba"
`
* WARNING: Running this program will modify the configuration files and the LDAP database. If you want to continue, enter 'yes', else enter 'no': yes

      * Added ldif file ...                                                                                        [ ok ]
      * Starting Samba ...                                                                                         [ ok ]
      * User client added to Unix service
      * User client added to Samba service
      * User admin added to Unix service
      * User admin added to Samba service
      * Samba service configured ...                                                                              [ ok ]
     ` ` `

You can specify netbios or workgroup as options.

-n name sets the NetBIOS name for the Samba server. By default, it is set to be equal to the first part of the DNS hostname.
- w workgroup is the name of the domain or NT workgroup for computers that will access this server.

Set the administrator password (user login admin ):

? ? ? exec " cl-passwd --smb admin samba"
Enter a new password:
Repeat the new password:
* Password of user admin of Samba service modified

! ! ! note
admin is only used to add a Windows client computer to the domain. Admin has no home directory.

If you need a domain administrator to manage your Windows network, create a new user and add it to the Domain Admins domain group.

Here is an example of creating a domain administrator:

? ? ? exec " cl-useradd -p --gid "Domain Admins" -c "Domain Admin" d_admin samba"
New SMB password: Repeat SMB password: * User d_admin added to Unix service * User d_admin added to Samba service

# # Add and remove users

Calculate commands used to manage users are derived from the same on Unix: cl-useradd, cl-userdel, cl-usermod, cl-passwd, cl-groupadd, cl-groupdel, cl-groupmod. Their syntax largely coincides with the ones of the system utilities of the same name.

Try adding the ~~test~~ user and give them a password:

? ? ? exec " cl-useradd test samba"
* User test added to Unix service * User test added to Samba service

? ? ? exec " cl-passwd test samba"
New password: Repeat new password: * Password of user of Unix service modified * Password of user test of Samba service modified

# Privileges settings

# # Configuring file system access rights

To edit file permissions on the server, use ACL ( Access Control List ). By modifying permissions on files, you define specific access privileges for them for both Windows and Linux clients. The files and directories you have no access to will not be displayed in the Samba volume.

Access permissions are applied to both files and directories. You can specify permissions for the file owner or a group.
While Windows will recognize only Samba groups, Linux will see both Unix and Samba groups. Therefore, it is preferable to use Samba groups to differentiate access rights.

For instance, create a Samba group called ~~manager~~.

? ? ? exec " cl-groupadd manager samba"
* Group 'manager' added to Samba service

To create a Unix group ~~job~~, just type:

? ? ? exec " cl-groupadd job unix"
* Group 'job' added to Unix service

# # Configuring access rights for Windows users

To edit additional privileges for Windows computers, such as: the right to install programs, the right to exit a domain, etc., use Samba groups.

Below is an example of giving domain administrator's privileges to the ~~test~~ user:

? ? ? exec " cl-groupmod -a test 'Domain Admins' samba"
* Users added to group Domain Admins

# Organization of Samba groups

Samba groups may be of the following types:

Domain groups (type group number 2)
Local groups (type group number 4)
Built-in groups (group type number 5 )

Default groups:

Domain Samba groups, which are global for a given domain
* Domain Admins for domain administrators (full access privileges inside the domain).
* Domain Guests for domain guests (minimal privileges).
* Domain Users for domain users.
* Domain Computers for domain computers.
Local Samba group, which are only relevant for a given client
There is no local groups.
Built-in groups are groups embedded in the system.
* Administrators - Administrators (full privileges)
* Account Operators are account operators. They create and manage groups and user account information, back up files and directories.
* Backup Operators are archive operators. They backup and restore from backup, and also shut down the system.
* Print Operators are print operators. They manage printers and backup.
* Replicators are replicators. This group is used by the File Replication service on domain controllers.
* System Operators are system operators. They handle system time setup, system shutdown, including remotely, backup and restoring from a backup, server locking and unlocking, hard disk format, network directories management, and also printers.

Here is how you create a domain ~~test~~ group. A domain group with group type number 2 is created by default.

? ? ? exec " cl-groupadd test samba"
* Group 'test' added to Samba service

For example, create a built-in group, named ~~Power Users~~ , to put together users with advanced privileges.

? ? ? exec " cl-groupadd -g 547 --rid 547 -t 5 'Power Users' samba"
* Group 'Power Users' added to Samba service

Where:

g is the group ID, ~~547~~
rid is the RID, which stands for relative ID, ~~547~~
t is the group type, 5 (built-in group)

# Adding Unix clients

? ? ? important " If you have no DNS"
The client must resolve the ~~calculate.example.org~~ server (hostname -f). If you have no DNS connection yet, two solutions are possible:

     *   On the client, add the server's IP to ++/etc/hosts++:
     ` ` ` 
     <IP address> calculate.example.org
     ` ` ` 
     *   On the server, edit ++/var/calculate/remote/calculate.env++, adding the server's IP
     ` ` ` 
     [client]
     sr_samba_host = <IP address>
     ` ` `

To add Unix clients, set the password for the

? ? ? exec " cl-passwd --smb client samba"
New password: Repeat new password: * Password of user client of Samba service modified
Run the following on the client computer:

? ? ? exec " cl-client DOMAIN"
* Check DOMAIN for domain locations ... [ok] Password to add the workstation to the domain: * Samba location [remote] connected * Templates for joining the domain applied ... * The computer has been configured to work in the domain * Computer added to DOMAIN domain

where DOMAIN is the network name or the IP of the server.

# Adding Windows clients

! ! ! important
In Windows, activate the Admin account by running the following:
net user Administrator /active:yes

# # Adding a Windows 7 client

To add a client running Windows 7, log in to the system under the Administrator account and use the text editor to create a text file named samba_7_2008_fix.reg, containing the following:

! ! ! file " samba_7_2008_fix. reg"
`
Windows Registry Editor Version 5.00

     [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters]
     "DomainCompatibilityMode"=dword:00000001
     "DNSNameResolutionRequired"=dword:00000000
     ` ` `

Double-click the file to import it to the registry. Reboot to apply.

Now join the Samba domain. To do so, go to the computer's Properties, and from there on to the Remote Access settings. Click on the "Change" button in the Computer Name tab.

Adding a Windows system in the Samba domain

Next, enter the domain name for your computer:

Specifying domain name of a computer

Enter the login/password pair of the user created on the Samba server and belonging to the group of the domain admins:

Authenticate computer in the domain

The computer now belongs to the domian:

Adding computer to the domain

# # # Adding a Windows 10 client

To connect a client using Windows 10, log in as the Administrator and create a text file named samba_7_2008_fix.reg , containing the following:

! ! ! file " samba_7_2008_fix. reg"
`
Windows Registry Editor Version 5.00

     [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters]
     "DomainCompatibilityMode"=dword:00000001
     "DNSNameResolutionRequired"=dword:00000000
     ` ` `

Double-click the file to import it to the registry. Reboot to apply.

Edit the /etc/samba/smb.conf configuration file, adding the following to the "global" section:

! ! ! file " / etc/ samba/ smb. conf"
[global] ... server max protocol = NT1 ...

Now restart the samba service:

? ? ? exec " /etc/init.d/samba restart"
samba | * samba -> stop: smbd ... [ ok ] samba | * samba -> stop: nmbd ... [ ok ] samba | * samba -> start: smbd ... [ ok ] samba | * samba -> start: nmbd ... [ ok ]

Now join the Samba domain. To do so, go to the computer's Properties, and from there on to the Remote Access settings. Click on the "Change" button in the Computer Name tab.

Adding a Windows system in the Samba domain

Next, enter the domain name for your computer:

Specifying domain name of a computer

Enter the login/password pair of the user created on the Samba server and belonging to the group of the domain admins:

Authenticate computer in the domain

The computer now belongs to the domian:

Adding computer to the domain

# # Adding a Windows Server 2008 client

To connect a client using Windows 2008, log in as the Administrator and create a text file named samba_7_2008_fix.reg , containing the following:

! ! ! file " samba_7_2008_fix. reg"
`
Windows Registry Editor Version 5.00

     [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters]
     "DomainCompatibilityMode"=dword:00000001
     "DNSNameResolutionRequired"=dword:00000000
     ` ` `

Double-click the file to import it to the registry. Reboot to apply.

And add the client to the Samba domain. To do so, go to the computer's Properties, and from there on to the Remote Access settings. Click on the "Change" button in the Computer Name tab.

Adding a Windows system in the Samba domain