topic Re: CIFS server in Operating System - HP-UX

CIFS server

j773303 — Wed, 14 Jul 2004 00:38:43 GMT

Is it possible no need popup a window for user password authentication while access HP-UX as CIFS server from windows client ? Because I have a Applicaton need access CIFS Server (hp-ux), and I don't want to see the use login prompt.

Re: CIFS server

Ravi_8 — Wed, 14 Jul 2004 01:51:43 GMT

Hi

It's possible, you need to map the user in samba's username.map file

Re: CIFS server

j773303 — Wed, 14 Jul 2004 02:02:35 GMT

Where is the user map file? How to configure it ? Thanks in advanced.

Re: CIFS server

Stefan Schulz — Wed, 14 Jul 2004 03:17:34 GMT

Hi,

first create a username.map file in the form

unixuser = ntuser1, ntuser2, ...

store this file wherever you want. But the default name an location is: /etc/opt/samba/username.map

then go to the smb.conf and edit the entry

username map = /etc/opt/samba/username.map

This should do the trick.

Hope this helps

Regards Stefan

Re: CIFS server

j773303 — Wed, 14 Jul 2004 03:39:41 GMT

Sorry, I still not understanding.

I've using "smbpasswd -a root". You mean I need to set root = ??? in the username.map ???

Re: CIFS server

Geoff Wild — Wed, 14 Jul 2004 07:47:07 GMT

First - what is security = to in your /etc/opt/samba/smb.conf file?

If you live in a Windows domain, then you can use security = SERVER and point password server = NTDOMAINCONTROLLER

That way, all Windows authentication happens on NT - the users will not get prompted.

If you open up a web browser, go to:

http://yourhpserver:901/

Sign in as root, go to "Globals", click on "Advanced View"....scroll down to "username map", then click on "Help".

A lot of good online documentation to help you setup samba.

Rgds...Geoff

Re: CIFS server

j773303 — Wed, 14 Jul 2004 21:24:46 GMT

I set the smb.conf as below, but it seems windows still pop-up a window for ask me enter username and password.
Can you tell me what I set wrong? Thanks.

smb.conf
[global]
workgroup = atriecom
security = SERVER
encrypt passwords = yes
password server = NTDOMAINCONTROLLER

[tmp]
comment = Temporayr Directory
path = /tmp/123
browseable = yes

Re: CIFS server

Franky_1 — Thu, 15 Jul 2004 02:16:37 GMT

Hi,

password server=
You should use the real name not the expression "NTDOMAINCONTROLLER"

HTH

Franky

Re: CIFS server

Franky_1 — Thu, 15 Jul 2004 06:07:50 GMT

Hi,

just to be curious - did my answer help you in any way ?

Franky

Re: CIFS server

sreejith_4 — Thu, 15 Jul 2004 06:31:36 GMT

Hi,

In smb.conf file,
workgroup = your NT domainname
security = server
password server = Your domain controller

Thanks
Sreejith M

Re: CIFS server

Stefan Schulz — Thu, 15 Jul 2004 06:36:03 GMT

Hi again,

if you have an NT Domain it is reconmendet to set the security level to "DOMAIN" and not to "SERVER".

This is more reliable and produces less load on the network.

Also you can have more than one entry in the server field. So if one server is unavailable the authentfication can still be processed.

Hope this helps

Regards Stefan

Re: CIFS server

Geoff Wild — Thu, 15 Jul 2004 07:33:34 GMT

I disagree - SECURITY=DOMAIN has been plagued with troubles since it's inception - the only safe way is to have Samba be the domain controller....from Samba Help:

SECURITY = DOMAIN

This mode will only work correctly if smbpasswd(8) has been used to add this machine into a Windows NT Domain. It expects the encrypted passwords parameter to be set to yes. In this mode Samba will try to validate the username/password by passing it to a Windows NT Primary or Backup Domain Controller, in exactly the same way that a Windows NT Server would do.

SECURITY = SERVER

This is the best in a "mixed mode" environment

SECURITY = SERVER

In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box. If this fails it will revert to security = user, but note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid smbpasswd file to check users against. See the documentation file in the docs/ directory ENCRYPTION.txt for details on how to set this up.

As far as pop up, here's my smb.conf:

# Global parameters
[global]
workgroup = $PCA
netbios name = IPRCI
netbios aliases = IPRDB
interfaces = 192.168.176.30 192.168.176.31 127.0.0.1
bind interfaces only = Yes
security = SERVER
encrypt passwords = Yes
password server = PCBDC01, PCBDC02, PCBDC03, PCBDC04
username map = /etc/opt/samba/username.map
log level = 2
syslog = 0
log file = /var/opt/samba/log.%m
max log size = 10000
keepalive = 0
load printers = No
show add printer wizard = No
preferred master = No
domain master = No
wins server = PCANS01
valid users = gwild, user1, user2, myadmin, sapservice1, smbnull, doc-link, ardschq, pm_doclink_sap
read only = No
create mask = 0664
force create mode = 0664
directory mask = 0775
short preserve case = No
dos filetime resolution = Yes

Did you restart samba after making changes to your smb.conf?

I have also found that sometimes, you have to add the Unix Server to the Windows Domain as a Workstation in the Domain.

Rgds...Geoff

Re: CIFS server

Stefan Schulz — Thu, 15 Jul 2004 07:43:49 GMT

Hi,

this is starting to become an interesting discussion. I have to agree and disagree with Goeff.

I have to disagree that security = DOMAIN is a plague. Our experience is that is much more relieable than security = SERVER.

But i have to agree:

IF you set security = DOMAIN you HAVE to add the samba server to the Domain using smbpassd. If you are NOT willing to do this DONT use security = DOMAIN.

Hope this makes my previous posting clearer.

Regards Stefan

Re: CIFS server

Geoff Wild — Thu, 15 Jul 2004 07:59:31 GMT

Also, with SECURITY=DOMAIN, if your Windows is now using Active Directory (or will be soon) - it will break Samba - unless you are running Samba 3.X - which has limited support for Active Directory.

Don't get me wrong, I run SECURITY=DOMAIN on my home Network, and it works quite well - but I have no NT Servers - just my Linux server acting as a Domain controller for my 3 Windows clients.

At work, the Windows Guys don't want us in their sandbox - if you catch my drift - that's why we use SECURITY=SERVER.

Remember - you still need to have Unix accounts = to the Windows accounts and/or map multiple Windows id's to a single Unix id.

Rgds...Geoff