Tutorial: Setting Up Samba 3.x

Recently I got the opportunity to setup a new lab for a small school. The server runs Linux and the workstations run WindowsXP. There are 3 levels of access on the workstations (admin, teacher, and student) and security on the workstations is based on Windows policies applied at logon.

admin – full access to workstation

teacher – almost full access to workstation – minus certain control panel functions

student – lockdown city – no network browsing, no software installation, no control panel

Workstations are joined to the Samba domain and function the same way they would in a Windows server based domain.

I will detail the steps to get a Samba lab up and running plus some caveats you may encounter.

Install Samba

This step is very distribution specific. Make sure you that the version you install is at least version 3.x and not 2.x.

Create Your Base Users And Groups

groupadd admins<br>
groupadd teachers<br>
groupadd students<br>
useradd -m -s /bin/false -c "Samba Admin" -G admins administrator<br>
useradd -m -s /bin/false -c "Samba Generic Teacher" -G teachers teacher<br>
useradd -m -s /bin/false -c "Samba Generic Student" -G students student<br>
smbpasswd -a administrator<br>
smbpasswd -a teacher<br>
smbpasswd -a student<br>

Setup A Basic Config

a. Determine your NETBIOS server name and domain name
In my example I use FS1 as the server name and ‘IDOM’ as the domain name. Make sure that neither contains spaces and avoiding any punctuation marks is preferable.

b. Create your share directories and permissions

mkdir /home/samba<br>
mkdir /home/samba/netlogon<br>
mkdir /home/samba/teachers<br>
mkdir /home/samba/software<br>
chgrp teachers /home/samba/teachers<br>
chgrp admins /home/samba/software<br>
chmod 775 /home/samba/teachers<br>
chmod 775 /home/samba/software<br>

c. Example config

netbios name = FS1<br>
workgroup = IDOM<br>
passdb backend = smbpasswd<br>
os level = 33<br>
preferred master = yes<br>
domain master = yes<br>
local master = yes<br>
security = user<br>
domain logons = yes<br>
#logon path = \\%N\profiles\%u<br>
logon path =<br>
#logon drive = H:<br>
#logon home = \\homeserver\%u\winprofile<br>
logon script = logon.bat<br>
add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u<br>
# username map = /etc/samba/smbusers<br>
admin users = @admins<br>
printer admin = @admins<br>
printing = cups<br>
load printers = yes<br>
printcap name = /etc/printcap<br>
# print command = lp -c -d%p -oraw; rm %s<br>
print command = lpr -l %s<br>
# prevent mp3 files from being stored on the server<br>
veto files = /*.mp3/*.divx/*.eml/<br>
comment = Home Directories<br>
valid users = %S<br>
browseable = No<br>
read only = No<br>
create mask = 0640<br>
directory mask = 0750<br>
path = /home/samba/netlogon<br>
read only = yes<br>
write list = @admins<br>
read list = @admins, @teachers, @students<br>
path = /var/lib/samba/profiles<br>
read only = no<br>
create mask = 0600<br>
directory mask = 0700<br>
comment = All Printers<br>
path = /var/tmp<br>
create mask = 0666<br>
printable = Yes<br>
guest ok = Yes<br>
browseable = No<br>
comment = Printer Drivers<br>
path = /var/lib/samba/drivers<br>
write list = @admins, root<br>
force group = admins<br>
create mask = 0664<br>
directory mask = 0775<br>
comment = Shared area for teachers<br>
path = /home/samba/teachers<br>
valid users = @teachers<br>
read list = @teachers<br>
write list = @teachers<br>
force group = teachers<br>
read only = No<br>
create mask = 0774<br>
directory mask = 0775<br>
comment = storage area for software and drivers<br>
path = /home/samba/software<br>
valid users = @teachers, @admins<br>
admin users = @admins<br>
read list = @teachers, @admins<br>
write list = @admins<br>
force group = admins<br>
read only = No<br>
create mask = 0774<br>
directory mask = 0775<br>

Mapping Groups

You need to map your unix groups to the domain groups using the ‘net‘ command. The ‘net‘ command is relatively new to Samba. To view a list of the commands available type ‘net view‘ at the console.

net groupmap modify ntgroup="Domain Admins" unixgroup=admins<br>
net groupmap modify ntgroup="Domain Users" unixgroup=users<br>
net groupmap add ntgroup="Teachers" unixgroup=teachers<br>
net groupmap add ntgroup="Students" unixgroup=students<br>

The Login Script

Setup a login script named ‘logon.bat‘ in the /home/samba/netlogon directory. This script MUST be in DOS format meaning that it must have a CRLF at the end of each line as opposed to the Linux LF only way. It is easiest to do the logon script in Notepad and put it in a share on the server, then use the ‘mv’ command to move it to the /home/samba/netlogon dir.

Oddly enough, Microsoft doesn’t include an ‘if member of group’ in the login script processor so you need to download a DOS ‘ifmember.exe’ executable and place it in the netlogon share manually in order to perform mappings based on group membership. You can download it from here . This login script also syncs the workstation time to the server time.

TITLE Domain Login script<br>
net time \\FS1 /set /y<br>
net use h: /home<br>
net use g: \\FS1\apps<br>
%logonserver%\netlogon\ifmember "teachers"<br>
if not errorlevel 1 goto quit<br>
net use f: \\fs1\teachers<br>
goto quit<br>

Workstation Policies

Policies allow an administrator to ‘lock down’ a workstation. For instance, with policies the adminstrator and teachers can have access on the workstations to change control panel settings and add new programs while students can be denied access to the control panel, display settings, command prompt, etc.

Use ‘poledit.exe’ to create an ‘ntconfig.pol’ permissions file and place it in the \\server\netlogon share. This file will contain the permissions for the ‘Domain Admins’, ‘Teachers’, and ‘Students’ groups. Poledit.exe is available from the NT Resource Kit ( from http://www.microsoft.com ) but in order to support XP workstations, custom control files (called ADM files) need to be downloaded and loaded into the Poledit utility. The custom ADM files can be downloaded from – http://www.snipes.org/admfiles.zip .

Importing Workstations

In order to import the Windows 2000/XP workstations into your new Samba domain, you MUST run add the following registry entries into the workstation. The easiest way is to save the following text as a file called ‘samba.reg‘ and then double-click to run it from the workstation.

Windows Registry Editor Version 5.00<br>

After rebooting, right-click on the ‘My Computer’ icon and choose properties. On the resulting screen change the computer from Workgroup to Domain and enter an administrator username and password (ie. a user that is in the ‘Domain Admins’ group). You will be thanked for joining and you will be told to reboot.

Finishing Thoughts

Setting up Samba can be a very interesting adventure but well worth the effort. Once the basics are understood, a new lab can be setup in just a couple of hours and should require very little maintenance. There are many online references for Samba. I suggest going to your closest Samba mirror via http://www.samba.org and looking at the documentation section for further info.

About the Author:
Brian Snipes’ Certifications: RHCE, LCP, MCNE, MCP, CCNA. Brian is the President of Dynamic Network Integrations, Inc.

If you would like to see your thoughts or experiences with technology published, please consider writing an article for OSNews.


  1. 2004-04-10 7:39 am
  2. 2004-04-10 10:23 am
  3. 2004-04-10 1:21 pm
  4. 2004-04-10 1:49 pm
  5. 2004-04-10 2:59 pm
  6. 2004-04-10 3:48 pm
  7. 2004-04-10 5:25 pm
  8. 2004-04-10 6:26 pm
  9. 2004-04-10 10:42 pm
  10. 2004-04-10 10:46 pm
  11. 2004-04-10 10:54 pm
  12. 2004-04-10 11:24 pm
  13. 2004-04-10 11:51 pm
  14. 2004-04-11 3:08 am
  15. 2004-04-11 3:16 am
  16. 2004-04-11 2:08 pm
  17. 2004-04-11 5:18 pm
  18. 2004-04-11 6:29 pm
  19. 2004-04-11 11:43 pm
  20. 2004-04-12 5:03 pm
  21. 2004-04-12 7:47 pm
  22. 2004-04-12 9:10 pm
  23. 2004-04-12 9:29 pm
  24. 2004-04-13 6:13 pm