From 8daa83a594a2e98f39d764422bfbdbc62c9efd44 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 19:20:00 +0200 Subject: Adding upstream version 2:4.20.0+dfsg. Signed-off-by: Daniel Baumann --- docs-xml/smbdotconf/winbind/applygrouppolicies.xml | 19 ++++ docs-xml/smbdotconf/winbind/createkrb5conf.xml | 23 ++++ docs-xml/smbdotconf/winbind/idmapbackend.xml | 22 ++++ docs-xml/smbdotconf/winbind/idmapcachetime.xml | 13 +++ docs-xml/smbdotconf/winbind/idmapconfig.xml | 122 +++++++++++++++++++++ docs-xml/smbdotconf/winbind/idmapgid.xml | 21 ++++ .../smbdotconf/winbind/idmapnegativecachetime.xml | 12 ++ docs-xml/smbdotconf/winbind/idmapuid.xml | 21 ++++ .../smbdotconf/winbind/includesystemkrb5conf.xml | 15 +++ .../smbdotconf/winbind/netutralizent4emulation.xml | 18 +++ docs-xml/smbdotconf/winbind/rejectmd5servers.xml | 25 +++++ docs-xml/smbdotconf/winbind/requirestrongkey.xml | 26 +++++ docs-xml/smbdotconf/winbind/templatehomedir.xml | 17 +++ docs-xml/smbdotconf/winbind/templateshell.xml | 13 +++ docs-xml/smbdotconf/winbind/winbindcachetime.xml | 20 ++++ .../smbdotconf/winbind/winbinddsocketdirectory.xml | 15 +++ docs-xml/smbdotconf/winbind/winbindenumgroups.xml | 19 ++++ docs-xml/smbdotconf/winbind/winbindenumusers.xml | 23 ++++ .../smbdotconf/winbind/winbindexpandgroups.xml | 35 ++++++ .../smbdotconf/winbind/winbindignoredomains.xml | 14 +++ docs-xml/smbdotconf/winbind/winbindmaxclients.xml | 19 ++++ .../winbind/winbindmaxdomainconnections.xml | 25 +++++ .../smbdotconf/winbind/winbindnestedgroups.xml | 16 +++ .../smbdotconf/winbind/winbindnormalizenames.xml | 30 +++++ docs-xml/smbdotconf/winbind/winbindnssinfo.xml | 38 +++++++ .../smbdotconf/winbind/winbindofflinelogon.xml | 17 +++ .../smbdotconf/winbind/winbindreconnectdelay.xml | 14 +++ .../smbdotconf/winbind/winbindrefreshtickets.xml | 15 +++ .../smbdotconf/winbind/winbindrequesttimeout.xml | 15 +++ docs-xml/smbdotconf/winbind/winbindrpconly.xml | 15 +++ .../winbind/winbindscantrusteddomains.xml | 29 +++++ docs-xml/smbdotconf/winbind/winbindsealedpipes.xml | 15 +++ docs-xml/smbdotconf/winbind/winbindseparator.xml | 20 ++++ .../smbdotconf/winbind/winbindusedefaultdomain.xml | 22 ++++ .../winbind/winbindusekrb5enterpriseprincipals.xml | 34 ++++++ 35 files changed, 817 insertions(+) create mode 100644 docs-xml/smbdotconf/winbind/applygrouppolicies.xml create mode 100644 docs-xml/smbdotconf/winbind/createkrb5conf.xml create mode 100644 docs-xml/smbdotconf/winbind/idmapbackend.xml create mode 100644 docs-xml/smbdotconf/winbind/idmapcachetime.xml create mode 100644 docs-xml/smbdotconf/winbind/idmapconfig.xml create mode 100644 docs-xml/smbdotconf/winbind/idmapgid.xml create mode 100644 docs-xml/smbdotconf/winbind/idmapnegativecachetime.xml create mode 100644 docs-xml/smbdotconf/winbind/idmapuid.xml create mode 100644 docs-xml/smbdotconf/winbind/includesystemkrb5conf.xml create mode 100644 docs-xml/smbdotconf/winbind/netutralizent4emulation.xml create mode 100644 docs-xml/smbdotconf/winbind/rejectmd5servers.xml create mode 100644 docs-xml/smbdotconf/winbind/requirestrongkey.xml create mode 100644 docs-xml/smbdotconf/winbind/templatehomedir.xml create mode 100644 docs-xml/smbdotconf/winbind/templateshell.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindcachetime.xml create mode 100644 docs-xml/smbdotconf/winbind/winbinddsocketdirectory.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindenumgroups.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindenumusers.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindexpandgroups.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindignoredomains.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindmaxclients.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindmaxdomainconnections.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindnestedgroups.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindnormalizenames.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindnssinfo.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindofflinelogon.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindreconnectdelay.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindrefreshtickets.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindrequesttimeout.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindrpconly.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindscantrusteddomains.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindsealedpipes.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindseparator.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindusedefaultdomain.xml create mode 100644 docs-xml/smbdotconf/winbind/winbindusekrb5enterpriseprincipals.xml (limited to 'docs-xml/smbdotconf/winbind') diff --git a/docs-xml/smbdotconf/winbind/applygrouppolicies.xml b/docs-xml/smbdotconf/winbind/applygrouppolicies.xml new file mode 100644 index 0000000..67baa0d --- /dev/null +++ b/docs-xml/smbdotconf/winbind/applygrouppolicies.xml @@ -0,0 +1,19 @@ + + + + This option controls whether winbind will execute the gpupdate + command defined in on the + Group Policy update interval. The Group Policy update interval is + defined as every 90 minutes, plus a random offset between 0 and 30 + minutes. This applies Group Policy Machine polices to the client or + KDC and machine policies to a server. + + + + +no +yes + diff --git a/docs-xml/smbdotconf/winbind/createkrb5conf.xml b/docs-xml/smbdotconf/winbind/createkrb5conf.xml new file mode 100644 index 0000000..4054034 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/createkrb5conf.xml @@ -0,0 +1,23 @@ + + + + + Setting this parameter to no prevents + winbind from creating custom krb5.conf files. Winbind normally does + this because the krb5 libraries are not AD-site-aware and thus would + pick any domain controller out of potentially very many. Winbind + is site-aware and makes the krb5 libraries use a local DC by + creating its own krb5.conf files. + + + Preventing winbind from doing this might become necessary if you + have to add special options into your system-krb5.conf that winbind + does not see. + + + +yes + diff --git a/docs-xml/smbdotconf/winbind/idmapbackend.xml b/docs-xml/smbdotconf/winbind/idmapbackend.xml new file mode 100644 index 0000000..864a975 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/idmapbackend.xml @@ -0,0 +1,22 @@ + + + + The idmap backend provides a plugin interface for Winbind to use + varying backends to store SID/uid/gid mapping tables. + + + + This option specifies the default backend that is used when no special + configuration set, but it is now deprecated in favour of the new + spelling . + + + +tdb + diff --git a/docs-xml/smbdotconf/winbind/idmapcachetime.xml b/docs-xml/smbdotconf/winbind/idmapcachetime.xml new file mode 100644 index 0000000..87c6c56 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/idmapcachetime.xml @@ -0,0 +1,13 @@ + + + This parameter specifies the number of seconds that Winbind's + idmap interface will cache positive SID/uid/gid query results. By + default, Samba will cache these results for one week. + + + +604800 + diff --git a/docs-xml/smbdotconf/winbind/idmapconfig.xml b/docs-xml/smbdotconf/winbind/idmapconfig.xml new file mode 100644 index 0000000..f70f11d --- /dev/null +++ b/docs-xml/smbdotconf/winbind/idmapconfig.xml @@ -0,0 +1,122 @@ + + + + + ID mapping in Samba is the mapping between Windows SIDs and Unix user + and group IDs. This is performed by Winbindd with a configurable plugin + interface. Samba's ID mapping is configured by options starting with the + prefix. + An idmap option consists of the + prefix, followed by a domain name or the asterisk character (*), + a colon, and the name of an idmap setting for the chosen domain. + + + + The idmap configuration is hence divided into groups, one group + for each domain to be configured, and one group with the + asterisk instead of a proper domain name, which specifies the + default configuration that is used to catch all domains that do + not have an explicit idmap configuration of their own. + + + + There are three general options available: + + + + + backend = backend_name + + This specifies the name of the idmap plugin to use as the + SID/uid/gid backend for this domain. The standard backends are + tdb + (idmap_tdb 8 ), + tdb2 + (idmap_tdb2 8), + ldap + (idmap_ldap 8), + rid + (idmap_rid 8), + hash + (idmap_hash 8), + autorid + (idmap_autorid 8), + ad + (idmap_ad 8) + and nss + (idmap_nss 8). + The corresponding manual pages contain the details, but + here is a summary. + + + The first three of these create mappings of their own using + internal unixid counters and store the mappings in a database. + These are suitable for use in the default idmap configuration. + The rid and hash backends use a pure algorithmic calculation + to determine the unixid for a SID. The autorid module is a + mixture of the tdb and rid backend. It creates ranges for + each domain encountered and then uses the rid algorithm for each + of these automatically configured domains individually. + The ad backend uses unix ids stored in Active Directory via + the standard schema extensions. The nss backend reverses + the standard winbindd setup and gets the unix ids via names + from nsswitch which can be useful in an ldap setup. + + + + + range = low - high + + Defines the available matching uid and gid range for which the + backend is authoritative. For allocating backends, this also + defines the start and the end of the range for allocating + new unique IDs. + + + winbind uses this parameter to find the backend that is + authoritative for a unix ID to SID mapping, so it must be set + for each individually configured domain and for the default + configuration. The configured ranges must be mutually disjoint. + + + Note that the low value interacts with the option! + + + + + read only = yes|no + + This option can be used to turn the writing backends + tdb, tdb2, and ldap into read only mode. This can be useful + e.g. in cases where a pre-filled database exists that should + not be extended automatically. + + + + + + The following example illustrates how to configure the + idmap_ad 8 + backend for the CORP domain and the + idmap_tdb + 8 backend for all other + domains. This configuration assumes that the admin of CORP assigns + unix ids below 1000000 via the SFU extensions, and winbind is supposed + to use the next million entries for its own mappings from trusted + domains and for local groups for example. + + + + idmap config * : backend = tdb + idmap config * : range = 1000000-1999999 + + idmap config CORP : backend = ad + idmap config CORP : range = 1000-999999 + + + +min domain uid + diff --git a/docs-xml/smbdotconf/winbind/idmapgid.xml b/docs-xml/smbdotconf/winbind/idmapgid.xml new file mode 100644 index 0000000..1b576b2 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/idmapgid.xml @@ -0,0 +1,21 @@ + +winbind gid + + + The idmap gid parameter specifies the range of group ids + for the default idmap configuration. It is now deprecated + in favour of . + + + See the option. + + + +10000-20000 + diff --git a/docs-xml/smbdotconf/winbind/idmapnegativecachetime.xml b/docs-xml/smbdotconf/winbind/idmapnegativecachetime.xml new file mode 100644 index 0000000..32c4e1f --- /dev/null +++ b/docs-xml/smbdotconf/winbind/idmapnegativecachetime.xml @@ -0,0 +1,12 @@ + + + This parameter specifies the number of seconds that Winbind's + idmap interface will cache negative SID/uid/gid query results. + + + +120 + diff --git a/docs-xml/smbdotconf/winbind/idmapuid.xml b/docs-xml/smbdotconf/winbind/idmapuid.xml new file mode 100644 index 0000000..f666f61 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/idmapuid.xml @@ -0,0 +1,21 @@ + +winbind uid + + + The idmap uid parameter specifies the range of user ids for + the default idmap configuration. It is now deprecated in favour + of . + + + See the option. + + + +10000-20000 + diff --git a/docs-xml/smbdotconf/winbind/includesystemkrb5conf.xml b/docs-xml/smbdotconf/winbind/includesystemkrb5conf.xml new file mode 100644 index 0000000..3e53292 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/includesystemkrb5conf.xml @@ -0,0 +1,15 @@ + + + + Setting this parameter to no will prevent + winbind to include the system /etc/krb5.conf file into the krb5.conf file + it creates. See also . This option + only applies to Samba built with MIT Kerberos. + + + +yes + diff --git a/docs-xml/smbdotconf/winbind/netutralizent4emulation.xml b/docs-xml/smbdotconf/winbind/netutralizent4emulation.xml new file mode 100644 index 0000000..247822e --- /dev/null +++ b/docs-xml/smbdotconf/winbind/netutralizent4emulation.xml @@ -0,0 +1,18 @@ + + + This option controls whether winbindd sends + the NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION flag in order to bypass + the NT4 emulation of a domain controller. + + Typically you should not need set this. + It can be useful for upgrades from NT4 to AD domains. + + The behavior can be controlled per netbios domain + by using 'neutralize nt4 emulation:NETBIOSDOMAIN = yes' as option. + + +no + diff --git a/docs-xml/smbdotconf/winbind/rejectmd5servers.xml b/docs-xml/smbdotconf/winbind/rejectmd5servers.xml new file mode 100644 index 0000000..3bc4eaf --- /dev/null +++ b/docs-xml/smbdotconf/winbind/rejectmd5servers.xml @@ -0,0 +1,25 @@ + + + This option controls whether winbindd requires support + for aes support for the netlogon secure channel. + + The following flags will be required NETLOGON_NEG_ARCFOUR, + NETLOGON_NEG_SUPPORTS_AES, NETLOGON_NEG_PASSWORD_SET2 and NETLOGON_NEG_AUTHENTICATED_RPC. + + You can set this to yes if all domain controllers support aes. + This will prevent downgrade attacks. + + The behavior can be controlled per netbios domain + by using 'reject md5 servers:NETBIOSDOMAIN = no' as option. + + The default changed from 'no' to 'yes, with the patches for CVE-2022-38023, + see https://bugzilla.samba.org/show_bug.cgi?id=15240 + + This option overrides the option. + + +yes + diff --git a/docs-xml/smbdotconf/winbind/requirestrongkey.xml b/docs-xml/smbdotconf/winbind/requirestrongkey.xml new file mode 100644 index 0000000..9c1c1d7 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/requirestrongkey.xml @@ -0,0 +1,26 @@ + + + This option controls whether winbindd requires support + for md5 strong key support for the netlogon secure channel. + + The following flags will be required NETLOGON_NEG_STRONG_KEYS, + NETLOGON_NEG_ARCFOUR and NETLOGON_NEG_AUTHENTICATED_RPC. + + You can set this to no if some domain controllers only support des. + This might allows weak crypto to be negotiated, may via downgrade attacks. + + The behavior can be controlled per netbios domain + by using 'require strong key:NETBIOSDOMAIN = no' as option. + + Note for active directory domain this option is hardcoded to 'yes' + + This option is over-ridden by the option. + + This option overrides the option. + + +yes + diff --git a/docs-xml/smbdotconf/winbind/templatehomedir.xml b/docs-xml/smbdotconf/winbind/templatehomedir.xml new file mode 100644 index 0000000..2801edf --- /dev/null +++ b/docs-xml/smbdotconf/winbind/templatehomedir.xml @@ -0,0 +1,17 @@ + + + When filling out the user information for a Windows NT + user, the winbindd + 8 daemon uses this + parameter to fill in the home directory for that user. If the + string %D is present it + is substituted with the user's Windows NT domain name. If the + string %U is present it + is substituted with the user's Windows NT user name. + + +/home/%D/%U + diff --git a/docs-xml/smbdotconf/winbind/templateshell.xml b/docs-xml/smbdotconf/winbind/templateshell.xml new file mode 100644 index 0000000..891c424 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/templateshell.xml @@ -0,0 +1,13 @@ + + + When filling out the user information for a Windows NT + user, the winbindd + 8 daemon uses this + parameter to fill in the login shell for that user. + + +/bin/false + diff --git a/docs-xml/smbdotconf/winbind/winbindcachetime.xml b/docs-xml/smbdotconf/winbind/winbindcachetime.xml new file mode 100644 index 0000000..2f69de3 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindcachetime.xml @@ -0,0 +1,20 @@ + + + This parameter specifies the number of + seconds the winbindd + 8 daemon will cache + user and group information before querying a Windows NT server + again. + + + This does not apply to authentication requests, these are always + evaluated in real time unless the option has been enabled. + + + +300 + diff --git a/docs-xml/smbdotconf/winbind/winbinddsocketdirectory.xml b/docs-xml/smbdotconf/winbind/winbinddsocketdirectory.xml new file mode 100644 index 0000000..7827d36 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbinddsocketdirectory.xml @@ -0,0 +1,15 @@ + + + This setting controls the location of the winbind daemon's socket. + Except within automated test scripts, this should not be + altered, as the client tools (nss_winbind etc) do not honour + this parameter. Client tools must then be advised of the + altered path with the WINBINDD_SOCKET_DIR environment + variable. + + +&pathconfig.WINBINDD_SOCKET_DIR; + diff --git a/docs-xml/smbdotconf/winbind/winbindenumgroups.xml b/docs-xml/smbdotconf/winbind/winbindenumgroups.xml new file mode 100644 index 0000000..c3339e1 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindenumgroups.xml @@ -0,0 +1,19 @@ + + + On large installations using winbindd + 8 it may be necessary to suppress + the enumeration of groups through the setgrent(), + getgrent() and + endgrent() group of system calls. If + the winbind enum groups parameter is + no, calls to the getgrent() system + call will not return any data. + +Turning off group enumeration may cause some programs to behave oddly. + + +no + diff --git a/docs-xml/smbdotconf/winbind/winbindenumusers.xml b/docs-xml/smbdotconf/winbind/winbindenumusers.xml new file mode 100644 index 0000000..5ce53d6 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindenumusers.xml @@ -0,0 +1,23 @@ + + + On large installations using winbindd + 8 it may be + necessary to suppress the enumeration of users through the setpwent(), + getpwent() and + endpwent() group of system calls. If + the winbind enum users parameter is + no, calls to the getpwent system call + will not return any data. + +Turning off user + enumeration may cause some programs to behave oddly. For + example, the finger program relies on having access to the + full user list when searching for matching + usernames. + + +no + diff --git a/docs-xml/smbdotconf/winbind/winbindexpandgroups.xml b/docs-xml/smbdotconf/winbind/winbindexpandgroups.xml new file mode 100644 index 0000000..5a05ecf --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindexpandgroups.xml @@ -0,0 +1,35 @@ + + + This option controls the maximum depth that winbindd + will traverse when flattening nested group memberships + of Windows domain groups. This is different from the + option + which implements the Windows NT4 model of local group + nesting. The "winbind expand groups" + parameter specifically applies to the membership of + domain groups. + + This option also affects the return of non nested + group memberships of Windows domain users. With the + new default "winbind expand groups = 0" winbind does + not query group memberships at all. + + Be aware that a high value for this parameter can + result in system slowdown as the main parent winbindd daemon + must perform the group unrolling and will be unable to answer + incoming NSS or authentication requests during this time. + + The default value was changed from 1 to 0 with Samba 4.2. + Some broken applications (including some implementations of + newgrp and sg) calculate the group memberships of + users by traversing groups, such applications will require + "winbind expand groups = 1". But the new default makes winbindd + more reliable as it doesn't require SAMR access to domain + controllers of trusted domains. + + +0 + diff --git a/docs-xml/smbdotconf/winbind/winbindignoredomains.xml b/docs-xml/smbdotconf/winbind/winbindignoredomains.xml new file mode 100644 index 0000000..af99222 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindignoredomains.xml @@ -0,0 +1,14 @@ + + + Allows one to enter a list of trusted domains winbind should + ignore (untrust). This can avoid the overhead of resources from + attempting to login to DCs that should not be communicated with. + + + + +DOMAIN1, DOMAIN2 + diff --git a/docs-xml/smbdotconf/winbind/winbindmaxclients.xml b/docs-xml/smbdotconf/winbind/winbindmaxclients.xml new file mode 100644 index 0000000..847a588 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindmaxclients.xml @@ -0,0 +1,19 @@ + + + This parameter specifies the maximum number of clients + the winbindd + 8 daemon can connect with. + The parameter is not a hard limit. + The winbindd + 8 daemon configures + itself to be able to accept at least that many connections, + and if the limit is reached, an attempt is made to disconnect + idle clients. + + + +200 + diff --git a/docs-xml/smbdotconf/winbind/winbindmaxdomainconnections.xml b/docs-xml/smbdotconf/winbind/winbindmaxdomainconnections.xml new file mode 100644 index 0000000..5cd846e --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindmaxdomainconnections.xml @@ -0,0 +1,25 @@ + + + This parameter specifies the maximum number of simultaneous + connections that the winbindd + 8 daemon should open to the + domain controller of one domain. + Setting this parameter to a value greater than 1 can improve + scalability with many simultaneous winbind requests, + some of which might be slow. + Changing this value requires a restart of winbindd. + + + Note that if is set to + Yes, then only one + DC connection is allowed per domain, regardless of this setting. + + + +1 +10 + diff --git a/docs-xml/smbdotconf/winbind/winbindnestedgroups.xml b/docs-xml/smbdotconf/winbind/winbindnestedgroups.xml new file mode 100644 index 0000000..a4a03eb --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindnestedgroups.xml @@ -0,0 +1,16 @@ + + + If set to yes, this parameter activates the support for nested + groups. Nested groups are also called local groups or + aliases. They work like their counterparts in Windows: Nested + groups are defined locally on any machine (they are shared + between DC's through their SAM) and can contain users and + global groups from any trusted SAM. To be able to use nested + groups, you need to run nss_winbind. + + +yes + diff --git a/docs-xml/smbdotconf/winbind/winbindnormalizenames.xml b/docs-xml/smbdotconf/winbind/winbindnormalizenames.xml new file mode 100644 index 0000000..362f488 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindnormalizenames.xml @@ -0,0 +1,30 @@ + + + This parameter controls whether winbindd will replace + whitespace in user and group names with an underscore (_) character. + For example, whether the name "Space Kadet" should be + replaced with the string "space_kadet". + Frequently Unix shell scripts will have difficulty with usernames + contains whitespace due to the default field separator in the shell. + If your domain possesses names containing the underscore character, + this option may cause problems unless the name aliasing feature + is supported by your nss_info plugin. + + + This feature also enables the name aliasing API which can + be used to make domain user and group names to a non-qualified + version. Please refer to the manpage for the configured + idmap and nss_info plugin for the specifics on how to configure + name aliasing for a specific configuration. Name aliasing takes + precedence (and is mutually exclusive) over the whitespace + replacement mechanism discussed previously. + + + + +no +yes + diff --git a/docs-xml/smbdotconf/winbind/winbindnssinfo.xml b/docs-xml/smbdotconf/winbind/winbindnssinfo.xml new file mode 100644 index 0000000..e6d17c2 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindnssinfo.xml @@ -0,0 +1,38 @@ + + + + This parameter is designed to control how Winbind retrieves Name + Service Information to construct a user's home directory and login shell. + Currently the following settings are available: + + + + template + - The default, using the parameters of template + shell and template homedir) + + + + + <sfu | sfu20 | rfc2307 > + - When Samba is running in security = ads and your Active Directory + Domain Controller does support the Microsoft "Services for Unix" (SFU) + LDAP schema, winbind can retrieve the login shell and the home + directory attributes directly from your Directory Server. For SFU 3.0 or 3.5 simply choose + "sfu", if you use SFU 2.0 please choose "sfu20". + Note that for the idmap backend idmap_ad + you need to configure those settings in the idmap configuration section. + Make sure to consult the documentation of the idmap backend that you are using. + + + + + + + +template +sfu + diff --git a/docs-xml/smbdotconf/winbind/winbindofflinelogon.xml b/docs-xml/smbdotconf/winbind/winbindofflinelogon.xml new file mode 100644 index 0000000..9cf1249 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindofflinelogon.xml @@ -0,0 +1,17 @@ + + + + This parameter is designed to control whether Winbind should + allow one to login with the pam_winbind + module using Cached Credentials. If enabled, winbindd will store user credentials + from successful logins encrypted in a local cache. + + + + +no +yes + diff --git a/docs-xml/smbdotconf/winbind/winbindreconnectdelay.xml b/docs-xml/smbdotconf/winbind/winbindreconnectdelay.xml new file mode 100644 index 0000000..f26fd5e --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindreconnectdelay.xml @@ -0,0 +1,14 @@ + + + This parameter specifies the number of + seconds the winbindd + 8 daemon will wait between + attempts to contact a Domain controller for a domain that is + determined to be down or not contactable. + + +30 + diff --git a/docs-xml/smbdotconf/winbind/winbindrefreshtickets.xml b/docs-xml/smbdotconf/winbind/winbindrefreshtickets.xml new file mode 100644 index 0000000..f6bb738 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindrefreshtickets.xml @@ -0,0 +1,15 @@ + + + + This parameter is designed to control whether Winbind should refresh Kerberos Tickets + retrieved using the pam_winbind module. + + + + +no +yes + diff --git a/docs-xml/smbdotconf/winbind/winbindrequesttimeout.xml b/docs-xml/smbdotconf/winbind/winbindrequesttimeout.xml new file mode 100644 index 0000000..8c7ec56 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindrequesttimeout.xml @@ -0,0 +1,15 @@ + + + This parameter specifies the number of + seconds the winbindd + 8 daemon will wait before + disconnecting either a client connection with no outstanding + requests (idle) or a client connection with a request that has + remained outstanding (hung) for longer than this number of seconds. + + +60 + diff --git a/docs-xml/smbdotconf/winbind/winbindrpconly.xml b/docs-xml/smbdotconf/winbind/winbindrpconly.xml new file mode 100644 index 0000000..50795ac --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindrpconly.xml @@ -0,0 +1,15 @@ + + + + + Setting this parameter to yes forces + winbindd to use RPC instead of LDAP to retrieve information from Domain + Controllers. + + + +no + diff --git a/docs-xml/smbdotconf/winbind/winbindscantrusteddomains.xml b/docs-xml/smbdotconf/winbind/winbindscantrusteddomains.xml new file mode 100644 index 0000000..12e94cb --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindscantrusteddomains.xml @@ -0,0 +1,29 @@ + + + + This option only takes effect when the option is set to + domain or ads. + If it is set to yes, winbindd periodically tries to scan for new + trusted domains and adds them to a global list inside of winbindd. + The list can be extracted with wbinfo --trusted-domains --verbose. + Setting it to yes matches the behaviour of Samba 4.7 and older. + + The construction of that global list is not reliable and often + incomplete in complex trust setups. In most situations the list is + not needed any more for winbindd to operate correctly. + E.g. for plain file serving via SMB using a simple idmap setup + with autorid, tdb or ad. + However some more complex setups require the list, e.g. + if you specify idmap backends for specific domains. + Some pam_winbind setups may also require the global list. + + If you have a setup that doesn't require the global list, you should set + no. + + + +no + diff --git a/docs-xml/smbdotconf/winbind/winbindsealedpipes.xml b/docs-xml/smbdotconf/winbind/winbindsealedpipes.xml new file mode 100644 index 0000000..016ac9b --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindsealedpipes.xml @@ -0,0 +1,15 @@ + + + This option controls whether any requests from winbindd to domain controllers + pipe will be sealed. Disabling sealing can be useful for debugging + purposes. + + The behavior can be controlled per netbios domain + by using 'winbind sealed pipes:NETBIOSDOMAIN = no' as option. + + +yes + diff --git a/docs-xml/smbdotconf/winbind/winbindseparator.xml b/docs-xml/smbdotconf/winbind/winbindseparator.xml new file mode 100644 index 0000000..eda14f4 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindseparator.xml @@ -0,0 +1,20 @@ + + + This parameter allows an admin to define the character + used when listing a username of the form of DOMAIN + \user. This parameter + is only applicable when using the pam_winbind.so + and nss_winbind.so modules for UNIX services. + + + Please note that setting this parameter to + causes problems + with group membership at least on glibc systems, as the character + + is used as a special character for NIS in /etc/group. + + +\ ++ + diff --git a/docs-xml/smbdotconf/winbind/winbindusedefaultdomain.xml b/docs-xml/smbdotconf/winbind/winbindusedefaultdomain.xml new file mode 100644 index 0000000..186398e --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindusedefaultdomain.xml @@ -0,0 +1,22 @@ + + + This parameter specifies whether the + winbindd + 8 daemon should operate on users + without domain component in their username. Users without a domain + component are treated as is part of the winbindd server's own + domain. While this does not benefit Windows users, it makes SSH, FTP and + e-mail function in a way much closer to the way they + would in a native unix system. + This option should be avoided if possible. It can cause confusion + about responsibilities for a user or group. In many situations it is + not clear whether winbind or /etc/passwd should be seen as authoritative + for a user, likewise for groups. + + +no +yes + diff --git a/docs-xml/smbdotconf/winbind/winbindusekrb5enterpriseprincipals.xml b/docs-xml/smbdotconf/winbind/winbindusekrb5enterpriseprincipals.xml new file mode 100644 index 0000000..d30b7f3 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindusekrb5enterpriseprincipals.xml @@ -0,0 +1,34 @@ + + + winbindd is able to get kerberos tickets for + pam_winbind with krb5_auth or wbinfo -K/--krb5auth=. + + + winbindd (at least on a domain member) is never be able + to have a complete picture of the trust topology (which is managed by the DCs). + There might be uPNSuffixes and msDS-SPNSuffixes values, + which don't belong to any AD domain at all. + + + With no + winbindd doesn't even get a complete picture of the topology. + + + It is not really required to know about the trust topology. + We can just rely on the [K]DCs of our primary domain (e.g. PRIMARY.A.EXAMPLE.COM) + and use enterprise principals e.g. upnfromB@B.EXAMPLE.COM@PRIMARY.A.EXAMPLE.COM + and follow the WRONG_REALM referrals in order to find the correct DC. + The final principal might be userfromB@INTERNALB.EXAMPLE.PRIVATE. + + + With yes + winbindd enterprise principals will be used. + + + +yes +no + -- cgit v1.2.3