Все о Samba

попробовавшие утверждают, что скоростЬ чтения поднимается с 20 до 60 мб/с

#cat /etc/host
::1                     localhost localhost.smbdomain.local
127.0.0.1               localhost localhost.smbdomain.local
192.168.50.195          serv01.smbdomain.local serv01
192.168.50.195          serv01.smbdomain.local.
# cd /usr/ports/net/openldap24-server
# make install clean
# cd /usr/ports/net/samba30
# make install clean
[X] LDAP With LDAP support
[X] ADS With Active Directory support
[X] CUPS With CUPS printing support
[X] WINBIND With WinBIND support
[X] ACL_SUPPORT With ACL support
[X] AIO_SUPPORT With Asyncronous IO support
[ ] FAM_SUPPORT With File Alteration Monitor
[X] SYSLOG With Syslog support
[X] QUOTAS With Disk quota support
[X] UTMP With UTMP accounting support
[ ] PAM_SMBPASS With PAM authentication vs passdb backends
[ ] CLUSTER With experimental cluster support
[ ] DNSUPDATE With dynamic DNS update(require ADS)
[ ] EXP_MODULES With experimental modules
[X] POPT With system-wide POPT library
[X] PCH With precompiled headers optimization
[ ] MAX_DEBUG With maximum debugging
[ ] SMBTORTURE With smbtorture
# cd /usr/ports/net/nss_ldap/
# make install clean
# cd /usr/ports/net/smbldap-tools
# make install clean
# slappasswd -s very-secure-password
{SSHA}2pCGrVMhMh3cC+LakUXApebb9jwICf5e
#vi usr/local/etc/openldap/slapd.conf
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include         /usr/local/etc/openldap/schema/core.schema
include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/misc.schema
include         /usr/local/etc/openldap/schema/nis.schema
include         /usr/local/etc/openldap/schema/openldap.schema
include         /usr/local/etc/openldap/schema/samba.schema

loglevel 256

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

# Load dynamic backend modules:
modulepath      /usr/local/libexec/openldap
moduleload      back_bdb

#######################################################################
# BDB database definitions
#######################################################################

database        bdb
suffix          "dc=smbdomain,dc=local"
rootdn          "cn=Manager,dc=smbdomain,dc=local"
#rootpw = very-secure-password
rootpw          {SSHA}2pCGrVMhMh3cC+LakUXApebb9jwICf5e

directory       /var/db/openldap-data

# Indices to maintain
index   objectClass     eq
index   cn              pres,sub,eq
index   sn              pres,sub,eq
index   uid             pres,sub,eq
index   displayName     pres,sub,eq
index   uidNumber               eq
index   gidNumber               eq
index   memberUID               eq
index   sambaSID                eq
index   sambaPrimaryGroupSID    eq
index   sambaDomainName         eq
index   default                 sub
# mkdir -p /var/db/openldap-data
# cp /usr/local/etc/openldap/DB_CONFIG.example /var/db/openldap-data/DB_CONFIG
# chown -R ldap:ldap /var/db/openldap-data
# chown -R ldap:ldap /usr/local/etc/openldap/
# chmod -R 0700 /var/db/openldap-data
# chmod 0400 /usr/local/etc/openldap/slapd.conf
# cp /usr/local/share/examples/samba/LDAP/samba.schema /usr/local/etc/openldap/schema/
!slapd
*.*                             /var/log/slapd.log
# touch /var/log/slapd.log
# /etc/rc.d/syslogd restart
base dc=smbdomain,dc=local

bind_policy soft
bind_timelimit 10

host localhost
idle_timelimit 3600
ldap_version 3

nss_base_group  ou=Groups,dc=smbdomain,dc=local?one
nss_base_passwd ou=People,dc=smbdomain,dc=local?one
nss_base_passwd ou=Computers,dc=smbdomain,dc=local?one
nss_base_shadow ou=People,dc=smbdomain,dc=local?one

nss_connect_policy persist
nss_paged_results yes

pagesize 1000
port 389
scope one
timelimit 30
# rm -/usr/local/etc/openldap/ldap.conf
# ln -s /usr/local/etc/nss_ldap.conf /usr/local/etc/openldap/ldap.conf
# ln -s /usr/local/etc/nss_ldap.conf /usr/local/etc/ldap.conf
# echo "#enable slapd"  >> /etc/rc.conf
# echo slapd_enable=\"YES\" >> /etc/rc.conf
# echo slapd_flags='-h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/ ldap://0.0.0.0/ ldap://127.0.0.1/"' >> /etc/rc.conf
# echo slapd_sockets="/var/run/openldap/ldapi" >> /etc/rc.conf
# /usr/local/etc/rc.d/slapd start
Starting slapd.
# ps ax | grep slap
11383  ??  Ss     0:00,01 /usr/local/libexec/slapd -h ldapi://%2fvar
11385  p2  S+     0:00,00 grep slap
group: files ldap
group_compat: nis
hosts: files dns
networks: files
passwd: files ldap
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files
# mkdir /usr/local/samba
# vi /usr/local/samba/usermap
root = administrator
#rm /usr/local/etc/smb.conf
# vi /usr/local/etc/smb.conf
# Global parameters
[global]
      workgroup = SMBDOMAIN
      server string = Samba Server
      netbios name = serv01
      hosts allow = 192.168.50. 127. 10.0.1.
      interfaces = fxp0, lo
      bind interfaces only = Yes

# passwd backend
      encrypt passwords = yes
      passdb backend   = ldapsam:ldap://serv01.smbdomain.local/
      enable privileges = yes
      pam password change= Yes
      passwd program = /usr/bin/passwd %u
      passwd chat = *New*UNIX*password* %nn *ReType*new*UNIX*password* %nn * passwd:*all*authentication*tokens*updated*successfully*
      unix password sync = Yes

# Log options
      log level = 1
      log file = /var/log/samba/%m
      max log size = 50
      syslog = 0

# Name resolution
      name resolve order = wins bcast host

# misc
      timeserver = Yes
      socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
      use sendfile = yes
      veto files = /*.eml/*.nws/*.{*}/
      veto oplock files = /*.doc/*.xls/*.mdb/
      deadtime         = 120

# Dos-Attribute
      map hidden = No
      map system = No
      map archive = No
      map read only = No
      store dos attributes = Yes

# printers - configured to use CUPS and automatically load them
      load printers = Yes
      printcap name = CUPS
      printing = cups
      cups options = Raw
      show add printer wizard = No

# scripts invoked by samba
      add user script               = /usr/local/sbin/smbldap-useradd -m %u
      delete user script            = /usr/local/sbin/smbldap-userdel %u
      add group script              = /usr/local/sbin/smbldap-groupadd -p %g
      delete group script           = /usr/local/sbin/smbldap-groupdel %g
      add user to group script      = /usr/local/sbin/smbldap-groupmod -m %u %g
      delete user from group script = /usr/local/sbin/smbldap-groupmod -x %u %g
      set primary group script      = /usr/local/sbin/smbldap-usermod -g %g %u
      add machine script            = /usr/local/sbin/smbldap-useradd -w %m

# LDAP-iConfiguration
      ldap delete dn                = Yes
      ldap ssl                      = off
      ldap passwd sync              = Yes
      ldap suffix                   = dc=smbdomain,dc=local
      ldap machine suffix           = ou=Computers
      ldap user suffix              = ou=People
      ldap group suffix             = ou=Groups
      ldap idmap suffix             = ou=Idmap
      ldap admin dn                 = cn=Manager,dc=smbdomain,dc=local
      idmap backend                 = ldap:ldap://serv01.smbdomain.local
      idmap uid                     = 10000-20000
      idmap gid                     = 10000-20000

# logon options
      logon script = logon.bat
      logon path = \%Lprofiles%u
      logon path =
      logon home = \%L%U
      logon drive = H:

# setting up as domain controller
      username map = /usr/local/samba/usermap
      preferred master = Yes
      wins support = Yes
      domain logons = Yes
      domain master = Yes
      local master = Yes
      os level = 64
      map acl inherit = Yes
      unix charset     = UTF8

#============================ Share Definitions ==============================

[netlogon]
      comment = Network Logon Service
      path = /usr/local/samba/netlogon
      guest ok = yes
      locking = no

[homes]
      comment = Home Directories
      valid users = %S
      read only = No
      browseable = No

[Profiles]
      comment = Network Profiles Service
      path = /usr/local/samba/profiles
      read only = No
      profile acls = yes
      hide files = /desktop.ini/ntuser.ini/NTUSER.*/
      profile acls = Yes

[printers]
      comment = All Printers
      path = /var/spool/samba
      browseable = No
      guest ok = Yes
      printable = Yes
      use client driver = Yes
      default devmode = Yes

[print$]
      comment = Printer Drivers
      path = /usr/local/samba/printer-drivers
      browseable = yes
      guest ok = no
      read only = yes
      write list = root

[data]
      comment = Data Directory
      path = /usr/local/samba/data
      write list = @smbdomain
      read only = No
      create mask = 0777
      directory mask = 0777
interfaces = fxp0, lo
bind interfaces only = Yes
# mkdir /usr/local/samba/netlogon
# mkdir /usr/local/samba/profiles
# mkdir /usr/local/samba/printer-drivers
# mkdir /usr/local/samba/data
# chmod 777 /usr/local/samba/profiles
# testparm /usr/local/etc/smb.conf
Load smb config files from /usr/local/etc/smb.conf
Processing section "[netlogon]"
Processing section "[homes]"
Processing section "[Profiles]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[data]"
Loaded services file OK.
Server role: ROLE_DOMAIN_PDC
Press enter to see a dump of your service definitions
/usr/local/etc/rc.d/slapd stop
Stopping slapd.
Waiting for PIDS: 49851.
# smbpasswd -w very-secure-password
Setting stored password for "cn=Manager,dc=smbdomain,dc=local" in secrets.tdb
# echo "#enable Samba" >> /etc/rc.conf
# echo nmbd_enable="YES" >> /etc/rc.conf
# echo smbd_enable="YES" >> /etc/rc.conf
# echo winbindd_enable="YES" >> /etc/rc.conf
# echo cupsd_enable="YES" >> /etc/rc.conf
# /usr/local/etc/rc.d/samba start
Removing stale Samba tdb files: ....... done
Starting nmbd.
Starting smbd.
Starting winbindd.
# ps -ax | grep mdb
1093  ??  Ss     0:00.03 /usr/local/sbin/nmbd -D -s /usr/local/etc/smb.conf
1095  ??  I      0:00.00 /usr/local/sbin/nmbd -D -s /usr/local/etc/smb.conf
1100  ??  Ss     0:00.01 /usr/local/sbin/smbd -D -s /usr/local/etc/smb.conf
# vi /usr/local/etc/rc.d/samba
#PROVIDE: nmbd smbd
#PROVIDE: winbindd
#REQUIRE: NETWORKING SERVERS DAEMON ldconfig resolv
#REQUIRE: cupsd slapd
#BEFORE: LOGIN
#KEYWORD: shutdown
# /usr/local/share/examples/smbldap-tools/configure.pl
Use of $# is deprecated at /usr/local/share/examples/smbldap-tools/configure.pl line 314.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
       smbldap-tools script configuration
       -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Before starting, check
. if your samba controller is up and running.
. if the domain SID is defined (you can get it with the 'net getlocalsid')

. you can leave the configuration using the Crtl-c key combination
. empty value can be set with the "." character
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Looking for configuration files...

Samba Configuration File Path [/usr/local/etc/smb.conf]  [HIT ENTER]

The default directory in which the smbldap configuration files are stored is shown.
If you need to change this, enter the full directory path, then press enter to continue.
Smbldap-tools Configuration Directory Path [/etc/opt/IDEALX/smbldap-tools/] /usr/local/etc/smbldap-tools [<--- NEEDS CHANGE]
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Let's start configuring the smbldap-tools scripts ...

. workgroup name: name of the domain Samba act as a PDC
  workgroup name [smbdomain] [HIT ENTER]
. netbios name: netbios name of the samba controler
  netbios name [serv01] [HIT ENTER]
. logon drive: local path to which the home directory will be connected (for NT Workstations). Ex: 'H:'
  logon drive [H:] [HIT ENTER]
. logon home: home directory location (for Win95/98 or NT Workstation).
  (use %U as username) Ex:'\serv01%U'
  logon home (press the "." character if you don't want homeDirectory) [\%L%U] [HIT ENTER]
. logon path: directory where roaming profiles are stored. Ex:'\serv01profiles%U'
  logon path (press the "." character if you don't want roaming profile) [\serv01profiles%U] [HIT ENTER]
. home directory prefix (use %U as username) [/home/%U] [HIT ENTER]
. default users' homeDirectory mode [700] [HIT ENTER]
. default user netlogon script (use %U as username) [logon.bat] [HIT ENTER]
  default password validation time (time in days) [45] 100000  [<--- NEEDS CHANGE]
. ldap suffix [dc=smbdomain,dc=local] [HIT ENTER]
. ldap group suffix [ou=Groups] [HIT ENTER]
. ldap user suffix [ou=People] [HIT ENTER]
. ldap machine suffix [ou=Computers] [HIT ENTER]
. Idmap suffix [ou=Idmap] [HIT ENTER]
. sambaUnixIdPooldn: object where you want to store the next uidNumber
  and gidNumber available for new users and groups
  sambaUnixIdPooldn object (relative to ${suffix}) [sambaDomainName=smbdomain] [HIT ENTER]
. ldap master server: IP adress or DNS name of the master (writable) ldap server
  ldap master server [serv01.smbdomain.local] [HIT ENTER]
. ldap master port [389] [HIT ENTER]
. ldap master bind dn [cn=Manager,dc=smbdomain,dc=local] [HIT ENTER]
  ldap master bind password [] [<--- NEEDS PASSWORD + ENTER]
. ldap slave server: IP adress or DNS name of the slave ldap server: can also be the master one
  ldap slave server [serv01.smbdomain.local] [HIT ENTER]
. ldap slave port [389] [HIT ENTER]
. ldap slave bind dn [cn=Manager,dc=smbdomain,dc=local] [HIT ENTER]
. ldap slave bind password [] [<--- NEEDS PASSWORD + ENTER]
. ldap tls support (1/0) [0] [HIT ENTER]
. SID for domain smbdomain: SID of the domain (can be obtained with 'net getlocalsid serv01')
  SID for domain smbdomain [S-1-5-21-2609998211-36760486-3473504348] [HIT ENTER]
. unix password encryption: encryption used for unix passwords
  unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] [HIT ENTER]
. default user gidNumber [513] [HIT ENTER]
. default computer gidNumber [515] [HIT ENTER]
. default login shell [/bin/sh] [HIT ENTER]
. default skeleton directory [/etc/skel] [HIT ENTER]
. default domain name to append to mail adress [] [HIT ENTER]
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Use of uninitialized value in concatenation (.) or string at /usr/local/share/examples/smbldap-tools/configure.pl line 314, /usr/local/etc/smbldap-tools/smbldap.conf.old
  /usr/local/etc/smbldap-tools/smbldap_bind.conf->/usr/local/etc/smbldap-tools/smbldap_bind.conf.old
writing new configuration file:
  /usr/local/etc/smbldap-tools/smbldap.conf done.
  /usr/local/etc/smbldap-tools/smbldap_bind.conf done.
# /usr/local/etc/rc.d/slapd start
# smbldap-populate -u 10000 -g 10000 -r 10000
Populating LDAP directory for domain smbdomain (S-1-5-21-2609998211-36760486-3473504348)
(using builtin directory structure)

adding new entry: dc=smbdomain,dc=local
adding new entry: ou=People,dc=smbdomain,dc=local
adding new entry: ou=Groups,dc=smbdomain,dc=local
adding new entry: ou=Computers,dc=smbdomain,dc=local
adding new entry: ou=Idmap,dc=smbdomain,dc=local
adding new entry: uid=root,ou=People,dc=smbdomain,dc=local
adding new entry: uid=nobody,ou=People,dc=smbdomain,dc=local
adding new entry: cn=Domain Admins,ou=Groups,dc=smbdomain,dc=local
adding new entry: cn=Domain Users,ou=Groups,dc=smbdomain,dc=local
adding new entry: cn=Domain Guests,ou=Groups,dc=smbdomain,dc=local

adding new entry: cn=Domain Computers,ou=Groups,dc=smbdomain,dc=local
adding new entry: cn=Administrators,ou=Groups,dc=smbdomain,dc=local
adding new entry: cn=Account Operators,ou=Groups,dc=smbdomain,dc=local
adding new entry: cn=Print Operators,ou=Groups,dc=smbdomain,dc=local
adding new entry: cn=Backup Operators,ou=Groups,dc=smbdomain,dc=local
adding new entry: cn=Replicators,ou=Groups,dc=smbdomain,dc=local
adding new entry: sambaDomainName=smbdomain,dc=smbdomain,dc=local

Please provide a password for the domain root:
Changing UNIX and samba passwords for root
New password:[<--- NEEDS PASSWORD + ENTER]
Retype new password:[<--- NEEDS PASSWORD + ENTER]
# net rpc join -S serv01 -Uroot
password:
joined domain smbdomain
#net rpc rights list accounts -U administrator%пароль_администратора
#net rpc rights grant -U administrator%пароль_администратора 'SMBDOMAIN\Domain Admins' SeAddUsersPrivilege
#net rpc rights grant -U administrator%пароль_администратора 'SMBDOMAIN\Domain Admins' SeMachineAccountPrivilege
#net rpc rights grant -U administrator%пароль_администратора 'SMBDOMAIN\Domain Admins' SeTakeOwnershipPrivilege
#net rpc rights grant -U administrator%пароль_администратора 'SMBDOMAIN\Domain Admins' SeBackupPrivilege
#net rpc rights grant -U administrator%пароль_администратора 'SMBDOMAIN\Domain Admins' SeRestorePrivilege
#net rpc rights grant -U administrator%пароль_администратора 'SMBDOMAIN\Domain Admins' SeRemoteShutdownPrivilege
#net rpc rights grant -U administrator%пароль_администратора 'SMBDOMAIN\Domain Admins' SePrintOperatorPrivilege
#net rpc rights grant -U administrator%пароль_администратора 'SMBDOMAIN\Domain Admins' SeDiskOperatorPrivilege
aio_load="YES"
#cd /usr/ports/net/samba33 & make config
#make install & clean
socket options=SO_RCVBUF=131072 SO_SNDBUF=131072 TCP_NODELAY
min receivefile size=16384
use sendfile=true
aio read size = 16384
aio write size = 16384
aio write behind = true
dns proxy = no
kern.ipc.maxsockbuf=16777216
kern.ipc.nmbclusters=32768
kern.ipc.somaxconn=32768
kern.maxfiles=65536
kern.maxfilesperproc=32768
kern.maxvnodes=800000
net.inet.tcp.delayed_ack=0
net.inet.tcp.inflight.enable=0
net.inet.tcp.path_mtu_discovery=0
net.inet.tcp.recvbuf_auto=1
net.inet.tcp.recvbuf_inc=524288
net.inet.tcp.recvbuf_max=16777216
net.inet.tcp.recvspace=65536
net.inet.tcp.rfc1323=1
net.inet.tcp.sendbuf_auto=1
net.inet.tcp.sendbuf_inc=524288
net.inet.tcp.sendspace=65536
net.inet.udp.maxdgram=57344
net.inet.udp.recvspace=65536
net.local.stream.recvspace=65536
net.inet.tcp.sendbuf_max=16777216
net.inet.tcp.mssdflt=1460
#kldload aio
#/usr/local/etc/rc.d/samba restart

Все о Samba

Samba-3 в примерах. От простого к сложному. Пример 2. Samba-сервер в одноранговой сети. Персональные общие папки.

Samba 3 в примерах. От простого к сложному. Пример 1. Простой Samba-сервер. Доступ всем на все.

Контроллер домена Samba с базой данных в LDAP

Оптимизация работы Samba-сервера

Smbldap-tools. Руководство пользователя

CentOS 5.x контроллер домена Samba с LDAP Backend

Неофициальное Samba HOWTO

profiles (migrating profiles from one domain to another)

log2pcap (generate pcap files from samba log files)

smbpasswd (SMB password file)