Samba-3.0.14a

Choose this variant if you only want to transfer files using smbclient, mount Windows shares and print to Windows printers, and don't want to share your files and printers to Windows machines.

A /etc/samba/smb.conf file with the following three parameters is sufficient:

[global]
    workgroup = MYGROUP
    dos charset = cp850
    unix charset = ISO-8859-1

The values in this example specify that the computer belongs to a Windows workgroup named “MYGROUP”, uses the “cp850” character set on the wire when talking to MS-DOS and MS Windows 9x, and that the filenames are stored in the “ISO-8859-1” encoding on the disk. Adjust these values appropriately for your installation. The “unix charset” value must be the same as the output of locale charmap when executed with the LANG variable set to your preferred locale, otherwise the ls command may not display correct filenames of downloaded files.

There is no need to run any Samba servers in this scenario, thus you don't need to install the provided bootscripts.

Choose this variant if you want to share your files and printers to Windows machines in your workgroup in addition to the capabilities described in Scenario 1.

In this case, the /etc/samba/smb.conf.default file may be a good template to start from. Also add “dos charset” and “unix charset” parameters to the “[global]” section as described in Scenario 1 in order to prevent filename corruption.

The following configuration file creates a separate share for each user's home directory and also makes all printers available to Windows machines:

[global]
    workgroup = MYGROUP
    dos charset = cp850
    unix charset = ISO-8859-1

[homes]
    comment = Home Directories
    browseable = no
    writable = yes

[printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    guest ok = no
    printable = yes

Other parameters you may wish to customize in the “[global]” section include:

    server string =
    security =
    hosts allow =
    load printers =
    log file =
    max log size =
    socket options =
    local master =

Reference the comments in the /etc/samba/smb.conf.default file for information regarding these parameters.

Since the smbd and nmbd daemons are needed in this case, install the samba bootscript. Be sure to run smbpasswd (with the -a option to add users) to enable and set passwords for all accounts that need Samba access, or use the SWAT web interface (see below) to do the same. Using the default Samba passdb backend, any user you attempt to add will also be required to exist in the /etc/passwd file.

More complex scenarios involving domain control or membership are possible if the right flags are passed to the ./configure script when the package is built. Such setups are advanced topics and cannot be adequately covered in BLFS. Many complete books have been written on these topics alone. It should be noted, however, that a Samba BDC cannot be used as a fallback for a Windows PDC, and conversely, a Windows BDC cannot be used as a fallback for a Samba PDC. Also in some domain membership scenarios, the winbindd daemon and the corresponding bootscript are needed.

There is quite a bit of documentation available which covers many of these advanced configurations. Point your web browser to the links below to view some of the documentation included with the Samba package:

First install, or ensure you have already installed, the Stunnel-4.11 package.

Next you must add entries to /etc/services and modify the inetd/xinetd configuration.

Add swat and swat_tunnel entries to /etc/services with the following commands issued as the root user:

echo "swat            901/tcp" >> /etc/services &&
echo "swat_tunnel     902/tcp" >> /etc/services

If inetd is used, the following command will add the swat_tunnel entry to /etc/inetd.conf (as user root):

echo "swat_tunnel stream tcp nowait.400 root /usr/sbin/swat swat" \
    >> /etc/inetd.conf

Issue a killall -HUP inetd to reread the changed inetd.conf file.

If you use xinetd, the following command will create the Samba file as /etc/xinetd.d/swat_tunnel (you may need to modify or remove the “only_from” line to include the desired host[s]):

cat >> /etc/xinetd.d/swat_tunnel << "EOF"
# Begin /etc/xinetd.d/swat_tunnel

service swat_tunnel
{
    port            = 902
    socket_type     = stream
    wait            = no
    only_from       = 127.0.0.1
    user            = root
    server          = /usr/sbin/swat
    log_on_failure  += USERID
}

# End /etc/xinetd.d/swat_tunnel
EOF

Issue a killall -HUP xinetd to read the new /etc/xinetd.d/swat_tunnel file.

Next, you must add an entry for the swat service to the /etc/stunnel/stunnel.conf file (as user root):

cat >> /etc/stunnel/stunnel.conf << "EOF"
[swat]
accept  = 901
connect = 902

EOF

Restart the stunnel daemon using the following command as the root user:

/etc/rc.d/init.d/stunnel restart

SWAT can be launched by pointing your web browser to https://[CA_DN_field]:901. Substitute the hostname listed in the DN field of the CA certificate used with Stunnel for [CA_DN_field].

Add a swat entry to /etc/services with the following command issued as the root user:

echo "swat            901/tcp" >> /etc/services

If inetd is used, the following command issued as the root user will add a swat entry to the /etc/inetd.conf file:

echo "swat stream tcp nowait.400 root /usr/sbin/swat swat" \
    >> /etc/inetd.conf

Issue a killall -HUP inetd to reread the changed inetd.conf file.

If xinetd is used, the following command issued as the root user will create an /etc/xinetd.d/swat file:

cat >> /etc/xinetd.d/swat << "EOF"
# Begin /etc/xinetd.d/swat

service swat
{
    port            = 901
    socket_type     = stream
    wait            = no
    only_from       = 127.0.0.1
    user            = root
    server          = /usr/sbin/swat
    log_on_failure  += USERID
}

# End /etc/xinetd.d/swat
EOF

Issue a killall -HUP xinetd to read the new /etc/xinetd.d/swat file.

SWAT can be launched by pointing your web browser to http://localhost:901.