howto use ./bin/samba_setup on hpux

[Steve Post]

When I run samba_setup on hpux11.x I get these questions and don't know how to answer them..... I will put MY questions to THEIR questions in parentheses.

Configure this HP CIFS Server to --BE-- a WINS server?
(what is a WINS server?)

Configure this HP CIFS Server to use an NDS LDAP directory server
for user authentication:
: N
(what is a LDAP. I bet I'm not holding one.)

You now must choose a role for your server.
1) primary_domain_controller (what is a primary_domain_controller)
2) backup_domain_controller(what is a backup_domain_controller)
3) NT_domain_member_server (what is a NT_domain_member_server)
4) ADS_domain_member_server (what is a....you get the picture. right?)
5) workgroup (what is a.....)
6) CANCEL
#? 6

I know the PC is on an internal network.
I know I don't use workgroups (whatever that is).
I know I log into a domain.
I know my unix login is different from my windows login.
I know when I mount a unix filesystem to a windows box, I would be prompted to give it my unix login name and password.
I know I would only mount the filesystem as a network drive by hand, for a short duration of time, to my pc only.
I know how to use winscp, and scp, and ftp, and dos.
I don't know windows.

[Tim Nelson]

Most of these questions relate to if you want this server running samba to act like a Windows Domain controller. If you simply wish to share drives to windows platforms with no domain authentication or domain browsing then NO to all questions.

WINS server would be that weird M$ stuff where Gates tried to erradicate the use of DNS.

LDAP ( light-weight domain authentication protocal ) unless you know that you have LDAP servers then NO.

Primary and backup domain controllers, if you want this to be windows domain controllers ( doubt it ).

NT_DOMAIN_Member: Do you want this server to actively be part of the domain and exchange authentication trusts with Windows ?

ADS: Replacement for the old PDC, Active Directory Service. Do you ?

Workgroup: The workgroup name typically assigned to a Windows Domain.

Cancel: :)

[Steve Post]

so if I hit cancel, I know this doesn't run.
That's fine by me.
But I'm still not mounting a unix filesystem on my pc.
It doesn't suddenly read my mind and appear as drive X.

I know there is something called "swat". This gives me a nice user interface to samba. I started it up on my browser with no problem. But it says I have to run samba_setup first.



fyi: The theme to S.W.A.T was a pretty song from the 1970's.

[Doug Burton · Accepted solution]

I know this doesn't answer all your quetions but this is what I did to get an HP-UX 11.11 server to "share" it's filesystem(s) to Windows (scroll down to my answer):
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1172025

[Steven Schweda]

> But I'm still not mounting a unix filesystem on my pc.
> It doesn't suddenly read my mind and appear as drive X.

I hardly ever deal with any of this stuff,
but I believe that you should be able to work
around the Windows system's lack of intuition
by looking in its Network Neighborhood, or
Network Places, or whatever your
(undisclosed) Windows version calls it.
(Start at [My] Computer in the Start menu?)
The Samba server system should appear there
if the Samba server is running (and properly
configured).

If it appears, click on it until the pain
worsens.

[Matti_Kurkela]

WINS server = a system that finds all the Windows boxes on a network segment and keeps a list of them, so that the windows boxes won't need to broadcast a query each time user opens the "Network Neighborhood" or "My Network Places" window. This was used mainly in Windows 9x and NT era, but the technology is still available.

In your situation, you probably won't need this functionality: your network is likely to already have a WINS server, if one is needed.

LDAP = Lightweight Directory Access Protocol. A LDAP server is a modern "cross-platform" way to implement a directory server for various kinds of information. It can be used as a company central phone/email directory, or a centralized password database for Unix hosts, or for many other uses.

If you don't know what this is, you don't need it.

The "server role" question is related to Windows authentication. It requires a bit of explanation:
First, a "domain" in this context means more properly a Windows authentication/logon domain. All machines in a domain will use a common authentication data. A "domain controller" is a server that holds the authentication data for a given domain. To avoid a single point of failure, there can be several domain controllers, but only one of them can be a "primary" one. If a primary domain controller is lost, one of the backup domain controllers becomes the new primary domain controller.

Second, there are two types of domains. The old type is known as "NT Domain", and was used with Windows 9x/ME and Windows NT systems. If your network contains a Windows 2000 Server or a Windows 2003 Server, you can have a newer type of domain, an "Active Directory" doman aka ADS domain. The management of these two types of domains is very different.

You don't want your server to become a domain controller of any sort: if you used the domain name of your Windows domain, the unix box would "compete" with the real Windows domain controllers and your Windows sysadmins would not like it. If you used another domain name, it would just add unnecessary complexity to the setup.

As you said you want to use your unix login and password for authentication, you don't want to become a domain member server either.
(It would allow you to connect to your unix box using your Windows login: it might be way cool, but it's more complex to set up and it is not in your requirements.)

So that leaves the "workgroup" option. Any host in a Windows network must state the name of a group it belongs to. There is no central coordination for workgroup names: any host in a Windows network can announce a new group. A domain is also a "group" in this sense, but a domain has a centralized control and more functionality.

When you open a "Network Neighborhood" or "My Network Places" window, it will show the machines in your default group (which can be a workgroup or a domain). To see all the groups available in your network, you must click the "Entire Network" icon (Windows 2000 and below) or "Microsoft Windows Network" icon (Windows XP, probably Vista too?)

In short: select your server role as "workgroup", and pick a name that does NOT match the name of your Windows domain, to keep your Windows sysadmins happy.

Note that if you want to use your Unix password for connecting from a Windows box, the password must go unencrypted over the network: the password hashing scheme used by Windows networking is irreversible like the Unix password, but the two hashing schemes are incompatible. A password that is encrypted/hashed in Windows style cannot be compared to any Unix password hash stored in /etc/passwd or in /tcb/files/auth/?/*: the passwords would never match.

Furthermore, most Windows 2000 and XP hosts will refuse to send your password to the network in plaintext unless some registry changes are done. These changes are *not recommended* if you can avoid them.

You should use the "smbpasswd" command to set up a separate Windows password for your unix account: it will be stored in a way that is compatible with the Windows password hashing scheme, so you can use password encryption.

MK

[Steve Post]

Thanks for the info! My brain is moving again.