Chapter 16. File and Print Servers

Configuring the ad Back End on a Domain Member

1. Edit the [global] section in the /etc/samba/smb.conf file:

   1. Add an ID mapping configuration for the default domain (*) if it does not exist. For example:

      idmap config * : backend = tdb
      idmap config * : range = 10000-999999

      For further details about the default domain configuration, see Section 16.1.5.3.2, “The * Default Domain”.

   2. Enable the ad ID mapping back end for the AD domain:

      idmap config DOMAIN : backend = ad

   3. Set the range of IDs that is assigned to users and groups in the AD domain. For example:

      idmap config DOMAIN : range = 2000000-2999999

      Important

      The range must not overlap with any other domain configuration on this server. Additionally, the range must be set big enough to include all IDs assigned in the future. For further details, see Section 16.1.5.3.1, “Planning ID Ranges”.

   4. Set that Samba uses the RFC 2307 schema when reading attributes from AD:

      idmap config DOMAIN : schema_mode = rfc2307

   5. To enable Samba to read the login shell and the path to the users home directory from the corresponding AD attribute, set:

      idmap config DOMAIN : unix_nss_info = yes

      Alternatively, you can set a uniform domain-wide home directory path and login shell that is applied to all users. For example:

      template shell = /bin/bash
      template homedir = /home/%U

      For details about variable substitution, see the VARIABLE SUBSTITUTIONS section in the smb.conf(5) man page.

   6. By default, Samba uses the primaryGroupID attribute of a user object as the user’s primary group on Linux. Alternatively, you can configure Samba to use the value set in the gidNumber attribute instead:

      idmap config DOMAIN : unix_primary_group = yes

2. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.

3. Reload the Samba configuration:

   ~]# smbcontrol all reload-config

4. Verify that the settings work as expected. See the section called “Verifying That the Operating System Can Retrieve Domain User Accounts and Groups”.

Configuring the rid Back End on a Domain Member

1. Edit the [global] section in the /etc/samba/smb.conf file:

   1. Add an ID mapping configuration for the default domain (*) if it does not exist. For example:

      idmap config * : backend = tdb
      idmap config * : range = 10000-999999

      For further details about the default domain configuration, see Section 16.1.5.3.2, “The * Default Domain”.

   2. Enable the rid ID mapping back end for the domain:

      idmap config DOMAIN : backend = rid

   3. Set a range that is big enough to include all RIDs that will be assigned in the future. For example:

      idmap config DOMAIN : range = 2000000-2999999

      Samba ignores users and groups whose RIDs in this domain are not within the range.

      Important

      The range must not overlap with any other domain configuration on this server. For further details, see Section 16.1.5.3.1, “Planning ID Ranges”.

   4. Set a shell and home directory path that will be assigned to all mapped users. For example:

      template shell = /bin/bash
      template homedir = /home/%U

      For details about variable substitution, see the VARIABLE SUBSTITUTIONS section in the smb.conf(5) man page.

2. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.

3. Reload the Samba configuration:

   ~]# smbcontrol all reload-config

4. Verify that the settings work as expected. See the section called “Verifying That the Operating System Can Retrieve Domain User Accounts and Groups”.

Configuring the autorid Back End on a Domain Member

1. Edit the [global] section in the /etc/samba/smb.conf file:

   1. Enable the autorid ID mapping back end for the * default domain:

      idmap config * : backend = autorid

   2. Set a range that is big enough to assign IDs for all existing and future objects. For example:

      idmap config * : range = 10000-999999

      Samba ignores users and groups whose calculated IDs in this domain are not within the range. For details about how the back end calculated IDs, see the THE MAPPING FORMULAS section in the idmap_autorid(8) man page.

      Warning

      After you set the range and Samba starts using it, you can only increase the upper limit of the range. Any other change to the range can result in new ID assignments, and thus in loosing file ownerships.

   3. Optionally, set a range size. For example:

      idmap config * : rangesize = 200000

      Samba assigns this number of continuous IDs for each domain’s object until all IDs from the range set in the idmap config * : range parameter are taken. For further details, see the rangesize parameter description in the idmap_autorid(8) man page.

   4. Set a shell and home directory path that will be assigned to all mapped users. For example:

      template shell = /bin/bash
      template homedir = /home/%U

      For details about variable substitution, see the VARIABLE SUBSTITUTIONS section in the smb.conf(5) man page.

   5. Optionally, add additional ID mapping configuration for domains. If no configuration for an individual domain is available, Samba calculates the ID using the autorid back end settings in the previously configured * default domain.

      Important

      If you configure additional back ends for individual domains, the ranges for all ID mapping configuration must not overlap. For further details, see Section 16.1.5.3.1, “Planning ID Ranges”.

2. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.

3. Reload the Samba configuration:

   ~]# smbcontrol all reload-config

4. Verify that the settings work as expected. See the section called “Verifying That the Operating System Can Retrieve Domain User Accounts and Groups”.

Adding a Share That Uses POSIX ACLs

1. Optionally, create the folder if it does not exist. For example:

   ~]# mkdir -p /srv/samba/example/

2. If you run SELinux in enforcing mode, set the samba_share_t context on the directory:

   ~]# semanage fcontext -a -t samba_share_t "/srv/samba/example(/.*)?"
   ~]# restorecon -Rv /srv/samba/example/

3. Set file system ACLs on the directory. For details, see Section 16.1.6.1.2, “Setting ACLs”.

4. Add the example share to the /etc/samba/smb.conf file. For example, to add the share write-enabled:

   [example]
   	path = /srv/samba/example/
   	read only = no

   Note

   Regardless of the file system ACLs; if you do not set read only = no, Samba shares the directory in read-only mode.

5. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.

6. Open the required ports and reload the firewall configuration using the firewall-cmd utility:

   ~]# firewall-cmd --permanent --add-service=samba
   ~]# firewall-cmd --reload

7. Restart the smb service:

   ~]# systemctl restart smb

8. Optionally, enable the smb service to start automatically at boot time:

   ~]# systemctl enable smb

Enabling Extended POSIX ACLs on a Share

1. Enable the following parameter in the share’s section in the /etc/samba/smb.conf file to enable ACL inheritance of extended ACLs:

   inherit acls = yes

   For details, see the parameter description in the smb.conf(5) man page.

2. Restart the smb service:

   ~]# systemctl restart smb

3. Optionally, enable the smb service to start automatically at boot time:

   ~]# systemctl enable smb

4. Set the ACLs on the directory. For details about using extended ACLs, see Chapter 5, Access Control Lists.

   Example 16.4. Setting Extended ACLs

   The following procedure sets read, write, and execute permissions for the Domain Admins group, read, and execute permissions for the Domain Users group, and deny access to everyone else on the /srv/samba/example/ directory:

   Setting Extended ACLs

   1. Disable auto-granting permissions to the primary group of user accounts:

      ~]# setfacl -m group::--- /srv/samba/example/
      ~]# setfacl -m default:group::--- /srv/samba/example/

      The primary group of the directory is additionally mapped to the dynamic CREATOR GROUP principal. When you use extended POSIX ACLs on a Samba share, this principal is automatically added and you cannot remove it.

   2. Set the permissions on the directory:

      1. Grant read, write, and execute permissions to the Domain Admins group:

         ~]# setfacl -m group:"DOMAIN\Domain Admins":rwx /srv/samba/example/

      2. Grant read and execute permissions to the Domain Users group:

         ~]# setfacl -m group:"DOMAIN\Domain Users":r-x /srv/samba/example/

      3. Set permissions for the other ACL entry to deny access to users that do not match the other ACL entries:

         ~]# setfacl -R -m other::--- /srv/samba/example/

         These settings apply only to this directory. In Windows, these ACLs are mapped to the This folder only mode.

   3. To enable the permissions set in the previous step to be inherited by new file system objects created in this directory:

      ~]# setfacl -m default:group:"DOMAIN\Domain Admins":rwx /srv/samba/example/
      ~]# setfacl -m default:group:"DOMAIN\Domain Users":r-x /srv/samba/example/
      ~]# setfacl -m default:other::--- /srv/samba/example/

      With these settings, the This folder only mode for the principals is now set to This folder, subfolders, and files.

   Samba maps the previously set permissions to the following Windows ACLs:

   Principal	Access	Applies to
   DOMAIN\Domain Admins	Full control	This folder, subfolders, and files
   DOMAIN\Domain Users	Read & execute	This folder, subfolders, and files
   Everyone [a]	None	This folder, subfolders, and files
   owner (Unix Userpass:attributes[]owner) [b]	Full control	This folder only
   primary_group (Unix Userpass:attributes[]primary_group) [c]	None	This folder only
   CREATOR OWNER [d] [e]	Full control	Subfolders and files only
   CREATOR GROUP [f]	None	Subfolders and files only
   [a] Samba maps the permissions for this principal from the other ACL entry. [b] Samba maps the owner of the directory to this entry. [c] Samba maps the primary group of the directory to this entry. [d] On new file system objects, the creator inherits automatically the permissions of this principal. [e] Configuring or removing these principals from the ACLs not supported on shares that use POSIX ACLs. [f] On new file system objects, the creator’s primary group inherits automatically the permissions of this principal.

Configuring Host-based Share Access

1. Add the following parameters to the configuration of the share in the /etc/samba/smb.conf:

   hosts allow = 127.0.0.1 192.0.2.0/24 client1.example.com
   hosts deny = client2.example.com

2. Reload the Samba configuration

   ~]# smbcontrol all reload-config

Adding a Share That Uses Windows ACLs

1. Optionally, create the folder if it does not exists. For example:

   ~]# mkdir -p /srv/samba/example/

2. If you run SELinux in enforcing mode, set the samba_share_t context on the directory:

   ~]# semanage fcontext -a -t samba_share_t "/srv/samba/example(/.*)?"
   ~]# restorecon -Rv /srv/samba/example/

3. Add the example share to the /etc/samba/smb.conf file. For example, to add the share write-enabled:

   [example]
   	path = /srv/samba/example/
   	read only = no

   Note

   Regardless of the file system ACLs; if you do not set read only = no, Samba shares the directory in read-only mode.

4. If you have not enabled Windows ACL support in the [global] section for all shares, add the following parameters to the [example] section to enable this feature for this share:

   vfs objects = acl_xattr
   map acl inherit = yes
   store dos attributes = yes

5. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.

6. Open the required ports and reload the firewall configuration using the firewall-cmd utility:

   ~]# firewall-cmd --permanent --add-service=samba
   ~]# firewall-cmd --reload

7. Restart the smb service:

   ~]# systemctl restart smb

8. Optionally, enable the smb service to start automatically at boot time:

   ~]# systemctl enable smb

Enabling User Shares

1. Create the local example group, if it does not exist:

   ~]# groupadd example

2. Prepare the directory for Samba to store the user share definitions and set its permissions properly. For example:

   1. Create the directory:

      ~]# mkdir -p /var/lib/samba/usershares/

   2. Set write permissions for the example group:

      ~]# chgrp example /var/lib/samba/usershares/
      ~]# chmod 1770 /var/lib/samba/usershares/

      Set the sticky bit to prevent users to rename or delete files stored by other users in this directory.

3. Edit the /etc/samba/smb.conf file and add the following to the [global] section:

   1. Set the path to the directory you configured to store the user share definitions. For example:

      usershare path = /var/lib/samba/usershares/

   2. Set how many user shares Samba allows to be created on this server. For example:

      usershare max shares = 100

      If you use the default of 0 for the usershare max shares parameter, user shares are disabled.

   3. Optionally, set a list of absolute directory paths. For example, to configure that Samba only allows to share subdirectories of the /data and /srv directory to be shared, set:

      usershare prefix allow list = /data /srv

      For a list of further user share-related parameters you can set, see the USERSHARES section in the smb.conf(5) man page.

4. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.

5. Reload the Samba configuration:

   ~]# smbcontrol all reload-config

Setting up the print$ Share

1. Add the [print$] section to the /etc/samba/smb.conf file:

   [print$]
   	path = /var/lib/samba/drivers/
   	read only = no
   	write list = @printadmin
   	force group = @printadmin
   	create mask = 0664
   	directory mask = 2775

   Using these settings:

   • Only members of the printadmin group can upload printer drivers to the share.
   • The group of new created files and directories will be set to printadmin.
   • The permissions of new files will be set to 664.
   • The permissions of new directories will be set to 2775.

2. To upload only 64-bit drivers for a printer, include this setting in the [global] section in the /etc/samba/smb.conf file:

   spoolss: architecture = Windows x64

   Without this setting, Windows only displays drivers for which you have uploaded at least the 32-bit version.

3. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.

4. Reload the Samba configuration

   ~]# smbcontrol all reload-config

5. Create the printadmin group if it does not exists:

   ~]# groupadd printadmin

6. Grant the SePrintOperatorPrivilege privilege to the printadmin group.

   ~]# net rpc rights grant "printadmin" SePrintOperatorPrivilege \
       -U "DOMAIN\administrator"
   Enter DOMAIN\administrator's password:
   Successfully granted rights.

   For further details, see Section 16.1.7.4.2, “Enabling Users to Upload and Preconfigure Drivers”.

7. If you run SELinux in enforcing mode, set the samba_share_t context on the directory:

   ~]# semanage fcontext -a -t samba_share_t "/var/lib/samba/drivers(/.*)?"
   ~]# restorecon -Rv /var/lib/samba/drivers/

8. Set the permissions on the /var/lib/samba/drivers/ directory:

   • If you use POSIX ACLs, set:

     ~]# chgrp -R "printadmin" /var/lib/samba/drivers/
     ~]# chmod -R 2775 /var/lib/samba/drivers/

   • If you use Windows ACLs, set:

     Principal	Access	Apply to
     CREATOR OWNER	Full control	Subfolders and files only
     Authenticated Users	Read & execute, List folder contents, Read	This folder, subfolders and files
     printadmin	Full control	This folder, subfolders and files

     For details about setting ACLs on Windows, see your Windows documentation.

Creating a GPO to Enable Clients to Trust the Samba Print Server

1. Log into a Windows computer using an account that is allowed to edit group policies, such as the AD domain Administrator user.
2. Open the Group Policy Management Console.

3. Right-click to your AD domain and select Create a GPO in this domain, and Link it here

   
4. Enter a name for the GPO, such as Legacy printer Driver Policy and click OK. The new GPO will be displayed under the domain entry.
5. Right-click to the newly-created GPO and select Edit to open the Group Policy Management Editor.

6. Navigate to Computer Configuration → Policies → Administrative Templates → Printers.

   

7. On the right side of the window, double-click Point and Print Restriction to edit the policy:

   1. Enable the policy and set the following options:

      1. Select Users can only point and print to these servers and enter the fully-qualified domain name (FQDN) of the Samba print server to the field next to this option.

      2. In both check boxes under Security Prompts, select Do not show warning or elevation prompt.

         
   2. Click OK.

8. Double-click Package Point and Print - Approved servers to edit the policy:

   1. Enable the policy and click the Show button.

   2. Enter the FQDN of the Samba print server.

      
   3. Close both the Show Contents and policy properties window by clicking OK.
9. Close the Group Policy Management Editor.
10. Close the Group Policy Management Console.

Joining a Domain Using the net Command

1. Manually create the /etc/samba/smb.conf file with the following settings:

   • For an AD domain member:

     [global]
     workgroup = domain_name
     security = ads
     passdb backend = tdbsam
     realm = AD_REALM

   • For an NT4 domain member:

     [global]
     workgroup = domain_name
     security = user
     passdb backend = tdbsam

2. Add an ID mapping configuration for the * default domain and for the domain you want to join to the [global] section in the /etc/samba/smb.conf. For details, see Section 16.1.5.3, “Understanding ID Mapping”.

3. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.

4. Join the domain as the domain administrator:

   • To join an AD domain:

     ~]# net ads join -U "DOMAINpass:quotes[administrator]"

   • To join an NT4 domain:

     ~]# net rpc join -U "DOMAINpass:quotes[administrator]"

5. Append the winbind source to the passwd and group database entry in the /etc/nsswitch.conf file:

   passwd:   files winbind
   group:   files winbind

6. Enable and start the winbind service:

   ~]# systemctl enable winbind
   ~]# systemctl start winbind

7. Optionally, configure PAM using the authconf utility.

   For details, see the Using Pluggable Authentication Modules (PAM) section in the Red Hat System-Level Authentication Guide.

8. Optionally for AD environments, configure the Kerberos client.

   For details, see the Configuring a Kerberos Client section in the Red Hat System-Level Authentication Guide.

Adding a User Account to the Domain

1. Add the account:

   ~]# net user add user password -U "DOMAIN\administrator"
   User user added

2. Optionally, use the remote procedure call (RPC) shell to enable the account on the AD DC or NT4 PDC. For example:

   ~]# net rpc shell -U DOMAIN\administrator -S DC_or_PDC_name
   Talking to domain DOMAIN (S-1-5-21-1424831554-512457234-5642315751)
   
   net rpc> user edit disabled user no
   Set user's disabled flag from [yes] to [no]
   
   net rpc> exit

Downloading a File from an SMB Share Using smbclient

1. Connect to the share:

   ~]# smbclient -U "DOMAINpass:quotes[user_name]" //server_name/share_name

2. Change into the /example/ directory:

   smb: \> cd /example/

3. List the files in the directory:

   smb: \example\> ls
    .          D     0 Mon Sep 1 10:00:00 2017
    ..          D     0 Mon Sep 1 10:00:00 2017
    example.txt     N  1048576 Mon Sep 1 10:00:00 2017
   
        9950208 blocks of size 1024. 8247144 blocks available

4. Download the example.txt file:

   smb: \example\> get example.txt
   getting file \directory\subdirectory\example.txt of size 1048576 as example.txt (511975,0 KiloBytes/sec) (average 170666,7 KiloBytes/sec)

5. Disconnect from the share:

   smb: \example\> exit

Enabling IPP Service in firewalld

1. To start the graphical firewall-config tool, press the Super key to enter the Activities Overview, type firewall and then press Enter. The Firewall Configuration window opens. You will be prompted for an administrator or root password.

   Alternatively, to start the graphical firewall configuration tool using the command line, enter the following command as root user:

   ~]# firewall-config

   The Firewall Configuration window opens.

   Look for the word "Connected" in the lower left corner. This indicates that the firewall-config tool is connected to the user space daemon, firewalld.

   To immediately change the current firewall settings, ensure the drop-down selection menu labeled Configuration is set to Runtime. Alternatively, to edit the settings to be applied at the next system start, or firewall reload, select Permanent from the drop-down list.

2. Select the Zones tab and then select the firewall zone to correspond with the network interface to be used. The default is the public zone. The Interfaces tab shows what interfaces have been assigned to a zone.
3. Select the Services tab and then select the ipp service to enable sharing. The ipp-client service is required for accessing network printers.
4. Close the firewall-config tool.