Graphical Configuration

To configure Samba using a graphical interface, use the Samba Server Configuration Tool. For command line configuration, skip to Section: Command Line Configuration.

The Samba Server Configuration Tool is a graphical interface for managing Samba shares, users, and basic server settings. It modifies the configuration files in the /etc/samba/ directory. Any changes to these files not made using the application are preserved.

To use this application, you must be running the X Window System, have root privileges, and have the redhat-config-samba RPM package installed. To start the Samba Server Configuration Tool from the desktop, go to the Main Menu Button (on the Panel) => System Settings => Server Settings => Samba or type the command redhat-config-samba at a shell prompt (for example, in an XTerm or a GNOME terminal).

	Note
	The Samba Server Configuration Tool does not display shared printers or the default stanza that allows users to view their own home directories on the Samba server.

Command Line Configuration

Samba uses /etc/samba/smb.conf as its configuration file. If you change this configuration file, the changes do not take effect until you restart the Samba daemon with the command service smb restart.

To specify the Windows workgroup and a brief description of the Samba server, edit the following lines in your smb.conf file:

workgroup = WORKGROUPNAME
server string = BRIEF COMMENT ABOUT SERVER

Replace WORKGROUPNAME with the name of the Windows workgroup to which this machine should belong. The BRIEF COMMENT ABOUT SERVER is optional and is used as the Windows comment about the Samba system.

To create a Samba share directory on your Linux system, add the following section to your smb.conf file (after modifying it to reflect your needs and your system):

[sharename]
comment = Insert a comment here
path = /home/share/
valid users = tfox carole
public = no
writable = yes
printable = no
create mask = 0765

The above example allows the users tfox and carole to read and write to the directory /home/share, on the Samba server, from a Samba client.

Encrypted Passwords

Encrypted passwords are enabled by default because it is more secure. If encrypted passwords are not used, plain text passwords are used, which can be intercepted by someone using a network packet sniffer. It is recommended that encrypted passwords be used.

The Microsoft SMB Protocol originally used plaintext passwords. However, Windows NT 4.0 with Service Pack 3 or higher, Windows 98, Windows 2000, Windows ME, and Windows XP require encrypted Samba passwords. To use Samba between a Linux system and a system running one of these Windows operating systems, you can either edit your Windows registry to use plaintext passwords or configure Samba on your Linux system to use encrypted passwords. If you choose to modify your registry, you must do so for all your Windows machines — this is risky and may cause further conflicts. It is recommended that you use encrypted passwords for better security.

To configure Samba to use encrypted passwords, follow these steps:

1. Create a separate password file for Samba. To create one based on your existing /etc/passwd file, at a shell prompt, type the following command:
   

   cat /etc/passwd | mksmbpasswd.sh > /etc/samba/smbpasswd

   If the system uses NIS, type the following command:

   ypcat passwd | mksmbpasswd.sh > /etc/samba/smbpasswd

   The mksmbpasswd.sh script is installed in your /usr/bin directory with the samba package.

2. Change the permissions of the Samba password file so that only root has read and write permissions:
   

   chmod 600 /etc/samba/smbpasswd

3. The script does not copy user passwords to the new file, and a Samba user account is not active until a password is set for it. For higher security, it is recommended that the user’s Samba password be different from the user’s system password. To set each Samba user’s password, use the following command (replace username with each user’s username):
   

   smbpasswd username

4. Encrypted passwords must be enabled. Since they are enabled by default, they do not have to be specifically enabled in the configuration file. However, they can not be disabled in the configuration file either. In the file /etc/samba/smb.conf, verify that the following line does not exist:
   

   encrypt passwords = no

   If it does exist but is commented out with a semi-colon (;) at the beginning of the line, then the line is ignored, and encrypted passwords are enabled. If this line exist but is not commented out, either remove it or comment it out.

   To specifically enable encrypted passwords in the configuration file, add the following lines to etc/samba/smb.conf:

   encrypt passwords = yes smb passwd file = /etc/samba/smbpasswd

5. Make sure the smb service is started by typing the command service smb restart at a shell prompt.
6. If you want the smb service to start automatically, use ntsysv, chkconfig, or the Services Configuration Tool to enable it at runtime. Refer to Chapter 21 Controlling Access to Servicesfor details.

The pam_smbpass PAM module can be used to sync users’ Samba passwords with their system passwords when the passwd command is used. If a user invokes the passwd command, the password he uses to log in to the Red Hat Enterprise Linux system as well as the password he must provide to connect to a Samba share are changed.

To enable this feature, add the following line to /etc/pam.d/system-auth below the pam_cracklib.so invocation:

password required /lib/security/pam_smbpass.so nullok use_authtok try_first_pass

Starting and Stopping the Server

On the server that is sharing directories via Samba, the smb service must be running.

View the status of the Samba daemon with the following command:

/sbin/service smb status

Start the daemon with the following command:

/sbin/service smb start

Stop the daemon with the following command:

/sbin/service smb stop

To start the smb service at boot time, use the command:

/sbin/chkconfig --level 345 smb on

You can also use chkconfig, ntsysv or the Services Configuration Tool to configure which services start at boot time.

	Tip
	To view active connections to the system, execute the command smbstatus.