Red Hat Linux 7 Unleashed

Red Hat Linux 7 Unleashed

By William Ball

Using Samba as a Logon Server

Samba can be used to authenticate logons on Windows 9x, NT, and 2000 computers. Windows 2000 must have NetBIOS over TCP/IP enabled to interact with Samba.

This section gives instructions for setting up Samba to authenticate logons on Windows 9x clients. The version of Samba shipped with Red Hat Linux 7 is not well suited to authenticate logons on NT or Win2K hosts. Those hosts require Samba running as a PDC. PDC functionality is best accomplished with the Samba_TNG version of Samba, which can be downloaded from http://www.samba.org.

Samba can do all of the following:

Windows profiles are beyond the scope of this chapter. You can get profile details from:

Basic Windows 9x Logon Authentication

In the following sample smb.conf, the server's hostname is mainserv, the workgroup is MYGROUP, the Windows 9x clients all use encrypted passwords, and there is no WINS server or domain controller other than the Samba server:

[global]
netbios name=mainserv
workgroup=MYGROUP
encrypt passwords=yes

wins support=yes
preferred master=yes
domain master=yes
domain logons=yes

[homes]
writeable=yes

Restart Samba and you now have a server capable of assuming the logon authentication duties for Windows 9x clients. The next step is to set up the clients and users.

Each potential user must have a valid UNIX account and a valid smbpasswd entry. Assuming the user has a valid UNIX account, setting up the smbpasswd entry is simply a matter of doing the following as root:


   # smbpasswd -a slitt

The preceding adds an smbpasswd entry for user slitt by prompting for the password and a password confirmation. The password should be the same as used on the client.

Now that the user is taken care of, modify the client computer to authenticate against Samba instead of locally. On the Windows 9x client, right-click any Network Neighborhood icon and choose Properties to pull up the Network dialog box. Select the Configuration tab, and highlight Client for Microsoft Networks in the The Following Network Components Are Installed drop-down list, and click the Properties button to bring up the Client for Microsoft Networks Properties dialog box.

Check the Logon to Windows NT Domain checkbox, type the workgroup name of the Samba server (which should match the client) in the Windows NT Domain text box, and check the Logon and Restore Network Connections radio button. Click OK all the way out of all dialog boxes, and answer affirmatively when asked if you want to restart the computer.

Upon restart, the Windows logon screen contains a third field, the domain. In the domain field, type in the workgroup name for the Samba server (which should already match the client workgroup name on the identification tab of the Network dialog box). If all is well, you're logged in.

If not, verify that the user and password used on the Windows client is matched by a user/password combination in smbpasswd. You can verify that you're really authenticating on the server by changing the password on the server, using the smbpasswd command, and then verifying that client logons now fail. Naturally, the original password must then be restored.

Enabling a Server-Hosted Logon Script

It's very handy to implement a server-hosted logon script. This section outlines a simple scheme, administered only by user root.

Start by creating directory /home/netlogon/scripts, owner and group root, mode 755.

Add the following to the smb.conf [global] section:

logon script=scripts\%U.bat

CAUTION

Danger of time waste! Much time is wasted troubleshooting logon script problems resulting from treating logon scripts as UNIX files. Symptoms resulting from this mistake are elusive to track.

Always use backslashes (never forward slashes) in the logon script= parameter. Always use backslashes in commands within the logon script. Most elusive, always save the logon script as a DOS format file, with CRLF line separators. Within the vi editor, this can be accomplished by executing the following command before writing your file:

:set fileformat=dos

At the risk of beating a dead horse, logon script problems resulting from forward slashes and UNIX style files can bite you over and over again, costing up to an hour each time. The best prevention is to be very aware of this, and check at the first sign of problems with logon scripts.

The preceding Samba parameter specifies that the logon script is a .bat file with a filename identical to the user, located in the scripts directory below the special [netlogon] share.

Create the [netlogon] share as follows:

[netlogon]
path=/home/netlogon
writeable=no
guest ok=no
oplocks=no

Next, assuming you'll log on to the client as user myuid, create the following /home/netlogon/scripts/myuid.bat:

echo This is user myuid
c:\windows\command\choice.com

Restart Samba and log on. If all is well, upon client logon a DOS command prompt appears announcing that this is user myuid, and prompting for a Y or N keypress, after which the logon process completes.

Share ThisShare This

Informit Network