2.3 Creating and Enabling Samba Users and Groups

This section discusses the following topics.

2.3.1 Samba Users Are Both Windows and eDirectory Users

As stated earlier, the purpose of Samba in OES is to provide Windows file services for Windows client users to data directories on OES Linux servers.

Both the Windows workstations and the OES Linux servers require authenticated access. On the Windows workstation, users log in using their Windows usernames and passwords. When they log in to the OES Linux server, they use their eDirectory usernames and passwords. Samba requires that these usernames and passwords match.

In other words, the Windows usernames on your network workstations and the eDirectory usernames you create for Samba access must be the same and must have the same password.

2.3.2 Creating an eDirectory Container for User Objects

IMPORTANT:Samba users must be created in a container within the Base Context for Samba Users that you specified when you installed Samba (Step 6).

User objects that don’t meet this requirement cannot be enabled for Samba access. If you need to change the context, see the instructions in Section C.1, A sambaDomain Object Error Occurs.

  1. In your browser, enter the iManager URL (http://IP_or_DNS_name/nps) and log in to iManager as the eDirectory Admin user or equivalent.

  2. If the container for your new Samba users already exists, skip to Creating eDirectory Users.

  3. To create a context in iManager for your users, click Roles and Tasks > eDirectory Administration > Create Object > Organizational Unit and create the (OU) object before proceeding.

    For more information on context requirements for the object, see the previously referenced Section A.1, Samba Enabling Problems and the Base Context for Samba Users Field.

Continue with Creating eDirectory Users.

2.3.3 Creating eDirectory Users

IMPORTANT:If you want to create home directories for your users as part of the user-creation process, you must create an NCP or an NSS volume for the directories prior to completing the following procedure. For more information, see Creating NCP Volumes in the NCP Server for Linux Administration Guide or Creating NSS Storage Objects in eDirectory in the Novell Storage Services File System Administration Guide for OES.

  1. If the users you plan to enable for Samba are already defined as eDirectory users, skip to Creating an eDirectory Group and Assigning the Users to It.

  2. In iManager, click Roles and Tasks > Users > Create User.

    HINT:To see whether a User object already exists using iManager, click the View Objects icon. Click the Search tab. Set the Type to User, and click Search. All currently-defined User objects are listed.

  3. Be sure to select the context you have identified for your Samba users (Step 3 in the previous section).

  4. Specify an eDirectory password, then scroll down to see more of the dialog.

  5. Do not set a simple password even though the interface indicates it is required for native Windows access. Enabling a user for Samba access creates a Universal Password by default, making it much easier for users to keep their passwords synchronized.

  6. (Conditional) You can create a home directory for the user if you have an NCP volume available (either created on a traditional Linux partition or existing an NSS partition on the server).

    For more information and some helpful tips, see Creating and Enabling Samba Users and Groups. See also, Samba on NSS Can Be a Good Combination for Performance.

  7. Type (or select if defined) any other information you want associated with the user, such as Title, Telephone, etc.

  8. Click OK.

  9. Click Repeat Task to create another user, or click OK to finish.

After creating all the users, continue with Creating an eDirectory Group and Assigning the Users to It.

2.3.4 Creating an eDirectory Group and Assigning the Users to It

An eDirectory Group object consists of users who have common needs, such as file service needs. Working with Group objects makes it easier to enable or disable policies for multiple users at a time.

You can create a new Group object just for managing Samba users, or you can use an existing Group object.

  1. If your eDirectory users are already members of a group you can enable for Linux access, skip to Enabling the Group and Users for Linux Access (LUM).

  2. Click Groups > Create Group,

  3. Type a name for the group.

  4. Select a context for the group. Although Group objects are often in the same container as the User objects assigned to them, this is not required.

  5. Click OK.

  6. Click Modify.

  7. Select the Members drop-down option below the page title, or in Internet Explorer, click the Members tab.

  8. Browse iManager Browse icon to the users you want to add to the group, click each User object, then click OK.

  9. Click Apply > OK.

Continue with Enabling the Group and Users for Linux Access (LUM).

2.3.5 Enabling the Group and Users for Linux Access (LUM)

  1. Enable the group you just created for Linux access by clicking Linux User Management > Enable Groups for Linux.

  2. In the Enable Groups page, after selecting the group, make sure that the Linux-Enable All Users in These Groups option is selected, then click Next.

  3. Confirm that you want to enable the users for Linux by clicking Next.

  4. On the next page, browse iManager Browse icon to and select the UNIX Workstation - server_name object of each server you want users to have Samba access to, then click OK.

    UNIX Workstation objects are created in the same context as the servers they represent.

  5. Click Next, then click Finish.

If you have multiple eDirectory users to enable for Samba access, you might want to create a text file and use the smbbulkadd utility as explained in Enabling Multiple eDirectory Users with smbbulkadd (next).

If you want to enable the users individually, skip to Enabling Users for Samba Access Using iManager.

2.3.6 Enabling Multiple eDirectory Users with smbbulkadd

You can enable multiple eDirectory users for Samba by running the smbbulkadd utility at the shell prompt. The users must already exist in eDirectory and must be enabled for Linux access as instructed in the previous section—Enabling the Group and Users for Linux Access (LUM)).

To enable Linux-enabled users for Samba access do the following:

  1. Before running smbbulkadd, you should ensure that a Samba-qualified password policy is in place. Otherwise, users are assigned a Samba-hash (Simple) password, which is not recommended. (See Section B.5.4, About Samba Hash Passwords.)

    Step 2 instructs you on how to assign the default Samba policy to User object parent containers. However, you also have two other options:

    Otherwise, continue with Step 2.

  2. Assign the Samba Default Password Policy (Universal Password policy) or other Samba-qualified policy (see Samba Passwords) to the immediate parent containers (OU objects) of the users you want to enable for Samba.

    1. Log in to iManager as the eDirectory Admin user.

    2. In Roles and Tasks, click Passwords > Password Policies.

    3. Select Samba Default Password Policy, then click Edit.

    4. In the Password Policy drop-down list, click Policy Assignment, or in Internet Explorer click the Policy Assignment tab.

    5. Click the Object Selector iManager Browse icon next to the Assign to field.

    6. Browse to and select the parent containers (OU objects) of the users you are enabling.

      For example, if your users are in an OU container object named users, you would browse to and select the users container.

    7. Click OK.

    8. Click Apply > OK.

  3. Using your favorite Linux text editor (such as Kwrite or Kate), create a text file that lists the following information for each user on a separate line. Be sure to include a blank line at the end of the file as indicated:

    -u username -x edir,context -p password (blank line—no text)

    where username is the eDirectory username, edir,context is the full eDirectory context of the user expressed using LDAP (comma-delimited) syntax, and password is the same password used to log in to the Windows workstation.

    IMPORTANT:Both the eDirectory password and the Universal Password will be set to the password you specify.

    For example, to Samba-enable three Linux-enabled eDirectory users named win1, win2, and win3 in users.doc.company, with the passwords pass1, pass2, and pass3, respectively, you could create a file named smbusers.txt in the /tmp directory with the following contents:

    -u win1 -x ou=users,ou=doc,o=company -p pass1

    -u win2 -x ou=users,ou=doc,o=company -p pass2

    -u win3 -x ou=users,ou=doc,o=company -p pass3

    (blank line—no text)

    NOTE:You can also create the text file on a Macintosh or Windows workstation, but you must convert the file to UNIX text format using the dos2unix utility before using it with smbbulkadd.

  4. While logged in to the server as the root user, run the smbbulkadd command.

    To see the various command options, enter smbbulkadd at the shell prompt.

    For example, to process the smbusers.txt file mentioned in the example in Step 3, you would enter the following command at the shell prompt:

    smbbulkadd -a cn=admin,o=company -w adpass -f /tmp/smbusers.txt

    where adpass is the eDirectory Admin user password.

    The system reports the status for each user being enabled for Samba.

  5. Check the status reported to ensure that all users were enabled. If not, correct any errors in the smbusers.txt file, such as no blank line at the end, and run smbbulkadd again.

    Users that are already enabled are ignored.

Now that your users are enabled to use Samba file services, you need to provide access to those services. Continue with the next section, Providing Access to Samba File Services.

2.3.7 Enabling Users for Samba Access Using iManager

HINT:The following procedure enables users for Samba access one at a time. You can enable multiple users with the smbbulkadd utility. For more information, see Section 2.3.6, Enabling Multiple eDirectory Users with smbbulkadd.

  1. In iManager, click Samba Management > Enable Linux User for Samba.

  2. Browse iManager Browse icon to and select a User object, then click OK.

  3. If you see options for replacing or keeping an existing policy on the screen, skip to Step 4.

    If you see only a statement about having users authenticate through eDirectory with no other text below it, then iManager has either

    • Determined that the user has a Samba-qualified password policy already assigned.

      or

    • Determined that no password policy is in place and therefore assigned the Samba Default Password Policy to the User object.

    Click OK and skip to Step 6.

  4. The following options appear below the statement about authenticating through eDirectory:

    • Replace the existing policy with default Samba policy
    • Keep the existing policy and use Samba hashes (not recommended)

    To understand why these options appear, continue reading. Otherwise, skip to Step 5.

    When you choose to enable a User object for Samba, iManager searches eDirectory to see whether the object already has a password policy in place by checking the following objects in order:

    • The User object
    • The User object’s parent Container object
    • The Container object at the root of the tree (usually an Organization object)
    • The Security > Login Policy object

    When the search finds a password policy, it evaluates whether the policy is valid for Samba, meaning that the policy

    • Has Universal Password enabled
    • Allows the Admin user to retrieve the password.

    The reason that the two options appear on the Enable Linux User for Samba screen is that iManager found an assigned password policy that is not valid for Samba.

  5. Choose to either

    Do not choose to use Samba hashes unless you fully understand the issues associated with them. For more information, see About Samba Hash Passwords.

  6. If you are not prompted to enter a new password, skip to Step 7.

    If the Universal Password has not been set previously, or if the previously assigned password policy doesn’t allow checking whether a Universal Password is already set, you are prompted to specify and confirm a password for the user.

    Type and confirm the user password, matching the password you entered when creating the user in eDirectory, then click OK.

    Both the eDirectory password and the Universal Password are set.

    If you choose to not specify a password, you need to instruct the user to create a Universal Password by logging in to the network through iManager or using the Novell Client prior to attempting a Samba connection. Users will cannot connect until they create a Universal Password.

  7. Click Repeat Task and repeat from Step 2 until each Samba user is enabled.

  8. Click OK to finish.

Now that your users are enabled to use Samba file services, you need to provide access to the services. Continue with the next section, Providing Access to Samba File Services.