Changeset 75f9474f


Ignore:
Timestamp:
11/13/2011 02:22:21 AM (12 years ago)
Author:
Bruce Dubbs <bdubbs@…>
Branches:
10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, 7.10, 7.4, 7.5, 7.6, 7.6-blfs, 7.6-systemd, 7.7, 7.8, 7.9, 8.0, 8.1, 8.2, 8.3, 8.4, 9.0, 9.1, basic, bdubbs/svn, elogind, gnome, kde5-13430, kde5-14269, kde5-14686, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, krejzi/svn, lazarus, lxqt, nosym, perl-modules, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, systemd-11177, systemd-13485, trunk, upgradedb, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal
Children:
fcc6d60
Parents:
ee792ef
Message:

Update swat instructions in samba

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@8957 af4574ff-66df-0310-9fd7-8a98e5e911e0

Files:
3 edited

Legend:

Unmodified
Added
Removed

  • general.ent

    ree792ef r75f9474f  
    44-->
    55
    6 <!ENTITY day          "11">                   <!-- Always 2 digits -->
     6<!ENTITY day          "12">                   <!-- Always 2 digits -->
    77<!ENTITY month        "11">                   <!-- Always 2 digits -->
    88<!ENTITY year         "2011">
    … …  
    1010<!ENTITY copyholder   "The BLFS Development Team">
    1111<!ENTITY version      "&year;-&month;-&day;">
    12 <!ENTITY releasedate  "November 11th, &year;">
     12<!ENTITY releasedate  "November 12th, &year;">
    1313<!-- <!ENTITY releasedate  "November &day;st, &year;"> -->
    1414<!ENTITY pubdate      "&year;-&month;-&day;"> <!-- metadata req. by TLDP -->
    … …  
    5757<!-- End LFS versions -->
    5858
    59 <!ENTITY blfs-bootscripts-version     "20111111">
     59<!ENTITY blfs-bootscripts-version     "20111112">
    6060<!ENTITY blfs-bootscripts-download    "&downloads-root;/blfs-bootscripts-&blfs-bootscripts-version;.tar.bz2">
    6161

  • introduction/welcome/changelog.xml

    ree792ef r75f9474f  
    4141
    4242-->
     43
     44    <listitem>
     45      <para>November 12th, 2011</para>
     46      <itemizedlist>
     47        <listitem>
     48          <para>[bdubbs] - Update swat instructions in samba.</para>
     49        </listitem>
     50      </itemizedlist>
     51    </listitem>
    4352
    4453    <listitem>

  • networking/netprogs/samba3.xml

    ree792ef r75f9474f  
    133133make</userinput></screen>
    134134
    135 <!-- - -enable-socket-wrapper for tests -->
    136 
    137135    <para>To test the results, issue: <command>make test</command>. If you have
    138136    <application>Linux-PAM</application> installed and built the PAM library
    … …  
    419417      </sect4>
    420418
     419      <sect4 id="samba3-init">
     420        <title>Boot Script</title>
     421 
     422        <para>For your convenience, boot scripts have been provided for
     423        <application>Samba</application>. There are two included in the
     424        <xref linkend="bootscripts"/> package. The first,
     425        <filename>samba</filename>, will start the <command>smbd</command>
     426        and <command>nmbd</command> daemons needed to provide SMB/CIFS
     427        services. The second script, <filename>winbind</filename>, starts
     428        the <command>winbindd</command> daemon, used for providing Windows
     429        domain services to Linux clients.</para>
     430 
     431        <indexterm zone="samba3 samba3-init">
     432          <primary sortas="f-samba">samba</primary>
     433        </indexterm>
     434 
     435        <indexterm zone="samba3 samba3-init">
     436          <primary sortas="f-winbind">winbind</primary>
     437        </indexterm>
     438 
     439        <para>The default <application>Samba</application> installation uses the
     440        <systemitem class='username'>nobody</systemitem> user for guest access
     441        to the server. This can be overridden by setting the
     442        <option>guest account =</option> parameter in the
     443        <filename>/etc/samba/smb.conf</filename> file. If you utilize the
     444        <option>guest account =</option> parameter, ensure this user exists in
     445        the <filename>/etc/passwd</filename> file. To use the default user,
     446        issue the following commands as the
     447        <systemitem class='username'>root</systemitem> user:</para>
     448
     449<screen><userinput>groupadd -g 99 nogroup &amp;&amp;
     450useradd -c "Unprivileged Nobody" -d /dev/null -g nogroup \
     451    -s /bin/false -u 99 nobody</userinput></screen>
     452
     453        <para>Install the <filename>samba</filename> script with the following
     454        command issued as the <systemitem class="username">root</systemitem>
     455        user:</para>
     456
     457<screen role="root"><userinput>make install-samba</userinput></screen>
     458
     459        <para>If you also need the <filename>winbind</filename>
     460        script:</para>
     461
     462<screen role="root"><userinput>make install-winbind</userinput></screen>
     463
     464       </sect4>
     465
    421466    </sect3>
    422467
    … …  
    424469      <title>Configuring SWAT</title>
    425470
    426       <para>The built in SWAT (<application>Samba</application> Web
    427       Administration Tool) utility can be used for basic configuration of
    428       the <application>Samba</application> installation, but because it may
    429       be inconvenient, undesirable or perhaps even impossible to gain
    430       access to the console, BLFS recommends setting up access to SWAT using
    431       <application>Stunnel</application>. Without
    432       <application>Stunnel</application>, the
    433       <systemitem class="username">root</systemitem> password is transmitted
    434       in clear text over the wire, and is considered an unacceptable security
    435       risk. After considering the security implications of using SWAT without
    436       <application>Stunnel</application>, and you still wish to implement SWAT
    437       without it, instructions are provided at this end of this section.</para>
    438 
     471      <para>The SWAT (<application>Samba</application> Web Administration Tool)
     472      utility can be used for configuration of the
     473      <application>Samba</application> installation.</para>
     474     
    439475      <indexterm zone="samba3 samba3-swat-config">
    440476        <primary sortas="g-SWAT">SWAT</primary>
    … …  
    442478
    443479      <sect4>
    444         <title>Setting up SWAT using Stunnel</title>
    445 
    446         <para>First install, or ensure you have already installed, the
    447         <xref linkend="stunnel"/> package.</para>
    448 
    449         <para>Next you must add entries to <filename>/etc/services</filename>
    450         and modify the <command>inetd</command>/<command>xinetd</command>
    451         configuration.</para>
     480        <title>Setting up SWAT using inetd</title>
     481
     482        <indexterm zone="samba3 samba3-swat-config">
     483          <primary sortas="e-etc-inetd.conf">/etc/inetd.conf</primary>
     484        </indexterm>
    452485
    453486        <indexterm zone="samba3 samba3-swat-config">
    454487          <primary sortas="e-etc-services">/etc/services</primary>
    455488        </indexterm>
    456 
    457         <indexterm zone="samba3 samba3-swat-config">
    458           <primary sortas="e-etc-inetd.conf">/etc/inetd.conf</primary>
    459         </indexterm>
    460 
    461         <indexterm zone="samba3 samba3-swat-config">
    462           <primary sortas="e-etc-xinetd.conf">/etc/xinetd.conf</primary>
    463         </indexterm>
    464 
    465         <para>Add swat and swat_tunnel entries to
    466         <filename>/etc/services</filename> with the following commands issued
    467         as the <systemitem class="username">root</systemitem> user:</para>
    468 
    469 <screen role="root"><userinput>echo "swat            904/tcp" &gt;&gt; /etc/services &amp;&amp;
    470 echo "swat_tunnel     905/tcp" &gt;&gt; /etc/services</userinput></screen>
    471 
    472         <para>If <command>inetd</command> is used, the following command will
    473         add the swat_tunnel entry to <filename>/etc/inetd.conf</filename> (as
    474         user <systemitem class="username">root</systemitem>):</para>
    475 
    476 <screen role="root"><userinput>echo "swat_tunnel stream tcp nowait.400 root /usr/sbin/swat swat" \
    477     &gt;&gt; /etc/inetd.conf</userinput></screen>
    478 
    479         <para>Issue a <command>killall -HUP inetd</command> to reread the
    480         changed <filename>inetd.conf</filename> file.</para>
    481 
    482         <para>If you use <command>xinetd</command>, the following command will
    483         create the <application>Samba</application> file as
    484         <filename>/etc/xinetd.d/swat_tunnel</filename> (you may need to modify
    485         or remove the <quote>only_from</quote> line to include the desired
    486         host[s]):</para>
    487 
    488 <screen role="root"><userinput>cat &gt;&gt; /etc/xinetd.d/swat_tunnel &lt;&lt; "EOF"
    489 <literal># Begin /etc/xinetd.d/swat_tunnel
    490 
    491 service swat_tunnel
    492 {
    493     port            = 905
    494     socket_type     = stream
    495     wait            = no
    496     only_from       = 127.0.0.1
    497     user            = root
    498     server          = /usr/sbin/swat
    499     log_on_failure  += USERID
    500 }
    501 
    502 # End /etc/xinetd.d/swat_tunnel</literal>
    503 EOF</userinput></screen>
    504 
    505         <indexterm zone="samba3 samba3-swat-config">
    506           <primary sortas="e-etc-xinetd.d-swat-tunnel">/etc/xinetd.d/swat_tunnel</primary>
    507         </indexterm>
    508 
    509         <para>Issue a <command>killall -HUP xinetd</command> to read the new
    510         <filename>/etc/xinetd.d/swat_tunnel</filename> file.</para>
    511 
    512         <para>Next, you must add an entry for the swat service to the
    513         <filename>/etc/stunnel/stunnel.conf</filename> file (as user
    514         <systemitem class="username">root</systemitem>):</para>
    515 
    516         <indexterm zone="samba3 samba3-swat-config">
    517           <primary sortas="e-etc-stunnel-stunnel.conf">/etc/stunnel/stunnel.conf</primary>
    518         </indexterm>
    519 
    520 <screen role="root"><userinput>cat &gt;&gt; /etc/stunnel/stunnel.conf &lt;&lt; "EOF"
    521 <literal>[swat]
    522 accept  = 904
    523 connect = 905
    524 TIMEOUTclose = 1</literal>
    525 
    526 EOF</userinput></screen>
    527 
    528         <para>Restart the <command>stunnel</command> daemon using the following
    529         command as the <systemitem class="username">root</systemitem> user:</para>
    530 
    531 <screen role="root"><userinput>/etc/rc.d/init.d/stunnel restart</userinput></screen>
    532 
    533       <para>SWAT can be launched by pointing your web browser to
    534       <uri>https://<replaceable>&lt;CA_DN_field&gt;</replaceable>:904</uri>.
    535       Substitute the hostname listed in the DN field of the CA certificate
    536       used with <application>Stunnel</application> for
    537       <replaceable>&lt;CA_DN_field&gt;</replaceable>.</para>
    538 
    539       </sect4>
    540 
    541       <sect4>
    542         <title>Setting up SWAT without Stunnel</title>
    543489
    544490        <warning>
    … …  
    550496        </warning>
    551497
    552         <para>Add a swat entry to <filename>/etc/services</filename> with the
    553         following command issued as the
    554         <systemitem class='username'>root</systemitem> user:</para>
    555 
    556 <screen role='root'><userinput>echo "swat            904/tcp" &gt;&gt; /etc/services</userinput></screen>
    557 
    558         <para>If <command>inetd</command> is used, the following command
    559         issued as the <systemitem class='username'>root</systemitem> user will
    560         add a swat entry to the <filename>/etc/inetd.conf</filename> file:</para>
    561 
    562 <screen role='root'><userinput>echo "swat stream tcp nowait.400 root /usr/sbin/swat swat" \
    563     &gt;&gt; /etc/inetd.conf</userinput></screen>
     498        <para>First you must add an entry to <filename>/etc/services</filename>
     499        and modify the <command>inetd</command> configuration. Add this entry
     500        with the following command issued as the <systemitem
     501        class="username">root</systemitem> user:</para>
     502
     503<screen role="root"><userinput>echo "swat            905/tcp" &gt;&gt; /etc/services</userinput></screen>
     504
     505        <para>Now add this entry to the <filename>/etc/inetd.conf</filename>
     506        file, again as the <systemitem class="username">root</systemitem>
     507        user:</para>
     508
     509<screen role="root"><userinput>echo "swat stream tcp nowait.5 root /usr/sbin/swat swat &gt;&gt; /etc/inetd.conf</userinput></screen>
    564510
    565511        <para>Issue a <command>killall -HUP inetd</command> to reread the
    566512        changed <filename>inetd.conf</filename> file.</para>
    567513
    568         <para>If <command>xinetd</command> is used, the following command
    569         issued as the <systemitem class='username'>root</systemitem> user
    570         will create an <filename>/etc/xinetd.d/swat</filename> file:</para>
    571 
    572 <screen role='root'><userinput>cat &gt;&gt; /etc/xinetd.d/swat &lt;&lt; "EOF"
     514        <para>SWAT can be launched by pointing your web browser to
     515        http://localhost:905.</para>
     516       
     517      </sect4>
     518
     519      <sect4>
     520        <title>Setting up SWAT using xinetd</title>
     521
     522        <indexterm zone="samba3 samba3-swat-config">
     523          <primary sortas="e-etc-xinetd.conf">/etc/xinetd.conf</primary>
     524        </indexterm>
     525
     526        <para>If not already done, add an entry to <filename>/etc/services</filename> file
     527        as the <systemitem class="username">root</systemitem> user:</para>
     528
     529<screen role="root"><userinput>echo "swat            905/tcp" &gt;&gt; /etc/services</userinput></screen>
     530
     531        <para>Create the <application>Samba</application> <xref
     532        linkend='xinetd'/> file as <filename>/etc/xinetd.d/swat</filename>.</para>
     533       
     534        <warning>
     535          <para>You may modify or remove the <quote>only_from</quote> line
     536          below to include other host(s).  BLFS does not recommend doing this
     537          because of the security risk involved. However, in a home network
     538          environment, disclosure of the <systemitem
     539          class='username'>root</systemitem> password may be an acceptable
     540          risk.</para>
     541        </warning>
     542
     543<screen role="root"><userinput>cat &gt;&gt; /etc/xinetd.d/swat &lt;&lt; "EOF"
    573544<literal># Begin /etc/xinetd.d/swat
    574545
    575546service swat
    576547{
    577     port            = 904
     548    port            = 905
    578549    socket_type     = stream
    579550    wait            = no
     551    instances       = 5
    580552    only_from       = 127.0.0.1
    581553    user            = root
    582554    server          = /usr/sbin/swat
    583     log_on_failure  += USERID
     555    log_on_failure += USERID
    584556}
    585557
    … …  
    587559EOF</userinput></screen>
    588560
    589         <para>Issue a <command>killall -HUP xinetd</command> to read the
    590         new <filename>/etc/xinetd.d/swat</filename> file.</para>
    591 
    592         <para>SWAT can be launched by pointing your web browser to
    593         http://localhost:904.</para>
     561        <para>Issue a <command>killall -HUP xinetd</command> to read the new
     562        <filename>/etc/xinetd.d/swat</filename> file.</para>
     563
     564        <note>
     565          <para>If you linked <application>Linux-PAM</application> into the
     566          <application>Samba</application> build, you'll need to create an
     567          <filename>/etc/pam.d/samba</filename> file.</para>
     568        </note>
     569
     570        <para>SWAT can now be launched by pointing your web browser to
     571        http://localhost:905.</para>
     572
     573      </sect4>
     574
     575      <sect4>
     576        <title>Setting up SWAT using stunnel</title>
     577
     578        <para>A better way to set up SWAT for network access is through
     579        <xref linkend='stunnel'/>.  For convenience, a boot scripts has
     580        been provided for SWAT via stunnel.  First, create the stunnel
     581        configuration file:</para>
     582
     583        <indexterm zone="samba3 samba3-swat-config">
     584          <primary sortas="e-etc-stunnel-swat.conf">/etc/stunnel/swat.conf</primary>
     585        </indexterm>
     586
     587<screen role="root"><userinput>cat &gt;&gt; /etc/stunnel/swat.conf &lt;&lt; "EOF"
     588<literal>; File: /etc/stunnel/swat.conf
     589
     590pid    = /run/stunnel-swat.pid
     591setuid = root
     592setgid = root
     593cert   = /etc/stunnel/stunnel.pem
     594
     595[swat]
     596accept = swat
     597exec   = /usr/sbin/swat
     598</literal>
     599EOF</userinput></screen>
     600
     601        <para>Next, install the swat bootscript:</para>
     602
     603<screen role="root"><userinput>make install-swat</userinput></screen>
     604
     605        <para>After starting the SWAT boot script the tool can be accessed by
     606        pointing your web browser to https://localhost:905.  Note:
     607        <emphasis>https</emphasis>.  If access to the tool needs to be
     608        further restricted, then <xref linkend='iptables'/> can be
     609        used.</para>
    594610
    595611      </sect4>
    … …  
    600616      <title/>
    601617
    602       <note>
    603         <para>If you linked <application>Linux-PAM</application> into the
    604         <application>Samba</application> build, you'll need to create an
    605         <filename>/etc/pam.d/samba</filename> file.</para>
    606       </note>
    607618
    608619      <indexterm zone="samba3 samba3-swat-config">
    … …  
    612623    </sect3>
    613624
    614     <sect3 id="samba3-init">
    615       <title>Boot Script</title>
    616 
    617       <para>For your convenience, boot scripts have been provided for
    618       <application>Samba</application>. There are two included in the
    619       <xref linkend="bootscripts"/> package. The first,
    620       <filename>samba</filename>, will start the <command>smbd</command>
    621       and <command>nmbd</command> daemons needed to provide SMB/CIFS
    622       services. The second script, <filename>winbind</filename>, starts
    623       the <command>winbindd</command> daemon, used for providing Windows
    624       domain services to Linux clients.</para>
    625 
    626       <indexterm zone="samba3 samba3-init">
    627         <primary sortas="f-samba">samba</primary>
    628       </indexterm>
    629 
    630       <indexterm zone="samba3 samba3-init">
    631         <primary sortas="f-winbind">winbind</primary>
    632       </indexterm>
    633 
    634       <para>The default <application>Samba</application> installation uses the
    635       <systemitem class='username'>nobody</systemitem> user for guest access
    636       to the server. This can be overridden by setting the
    637       <option>guest account =</option> parameter in the
    638       <filename>/etc/samba/smb.conf</filename> file. If you utilize the
    639       <option>guest account =</option> parameter, ensure this user exists in
    640       the <filename>/etc/passwd</filename> file. To use the default user,
    641       issue the following commands as the
    642       <systemitem class='username'>root</systemitem> user:</para>
    643 
    644 <screen><userinput>groupadd -g 99 nogroup &amp;&amp;
    645 useradd -c "Unprivileged Nobody" -d /dev/null -g nogroup \
    646     -s /bin/false -u 99 nobody</userinput></screen>
    647 
    648       <para>Install the <filename>samba</filename> script with the following
    649       command issued as the <systemitem class="username">root</systemitem>
    650       user:</para>
    651 
    652 <screen role="root"><userinput>make install-samba</userinput></screen>
    653 
    654       <para>If you also need the <filename>winbind</filename>
    655       script:</para>
    656 
    657 <screen role="root"><userinput>make install-winbind</userinput></screen>
    658 
    659     </sect3>
    660625
    661626  </sect2>
    … …  
    671636      <seglistitem>
    672637        <seg>cifs.upcall, eventlogadm, findsmb, ldbadd, ldbdel, ldbedit,
    673         ldbmodify, ldbrename, ldbsearch, mount.cifs, net, nmbd,
     638        ldbmodify, ldbrename, ldbsearch, net, nmbd,
    674639        nmblookup, ntlm_auth, pdbedit, profiles, rpcclient, sharesec, smbcacls,
    675640        smbclient, smbcontrol, smbcquotas, smbd, smbget, smbpasswd, smbspool,
    676         smbstatus, smbtar, smbtree, swat, testparm, umount.cifs, wbinfo,
     641        smbstatus, smbtar, smbtree, swat, testparm, wbinfo,
    677642        winbindd, and (if not using system TDB) tdbbackup, tdbdump, and
    678643        tdbtool</seg>
    … …  
    790755      </varlistentry>
    791756
    792       <varlistentry id="mount.cifs">
    793         <term><command>mount.cifs</command></term>
    794         <listitem>
    795           <para>mounts a Linux CIFS filesystem. It is usually invoked
    796           indirectly by the <command>mount</command> command when using the
    797           <option>-t cifs</option> option.</para>
    798           <indexterm zone="samba3 mount.cifs">
    799             <primary sortas="b-mount.cifs">mount.cifs</primary>
    800           </indexterm>
    801         </listitem>
    802       </varlistentry>
    803 
    804757      <varlistentry id="net">
    805758        <term><command>net</command></term>
    … …  
    10641017      </varlistentry>
    10651018
    1066       <varlistentry id="umount.cifs">
    1067         <term><command>umount.cifs</command></term>
    1068         <listitem>
    1069           <para>is used by normal, non-<systemitem
    1070           class="username">root</systemitem> users, to
    1071           <command>unmount</command> their own Common Internet File System
    1072           (CIFS) mounts.</para>
    1073           <indexterm zone="samba3 umount.cifs">
    1074             <primary sortas="b-umount.cifs">umount.cifs</primary>
    1075           </indexterm>
    1076         </listitem>
    1077       </varlistentry>
    1078 
    10791019      <varlistentry id="wbinfo">
    10801020        <term><command>wbinfo</command></term>
Note: See TracChangeset for help on using the changeset viewer.