This section discusses the following topics:
The instructions in this section assume that you have already prepared your workstation for accessing the DSfW server by completing the instructions in these prior sections:
One of the primary benefits of DSfW is that users can access files on OES servers without having any Client for Open Enterprise Server software installed. This is accomplished through Samba software that is installed on every DSfW server.
Samba lets Linux and other non-Windows servers provide file and print services to clients that support the Microsoft SMB (Server Message Block) and CIFS (Common Internet File System) protocols.
OES customers have the DSfW configuration of Samba
The Section 21.1.3, Samba in the DSfW Environment explains the Samba configuration that is included with DSfW.
When you install a DSfW server, Samba software is automatically installed on that server. This is configured as outlined in Table 21-1.
Table 21-1 Samba in DSfW
|
Item |
Samba in DSfW |
|---|---|
|
Authentication |
No Samba-compatible Password Policy is required for DSfW users because the domain is set up as a trusted environment. DSfW uses Active Directory/Kerberos authentication to ensure that only authorized users can log in to the domain. |
|
File system support |
It is recommended (but not required) that you create Samba shares on NSS data volumes. NSS is fully integrated with eDirectory for easier management, and using an NSS volume allows you to take advantage of the rich data security model in NSS. You can use either iManager or the nssmu utility to create an NSS volume on an OES server. |
|
Samba enablement |
eDirectory users in the domain (eDirectory partition) are automatically Samba users and are enabled to access Samba shares. See Section 14.0, Creating Users. Domain users are set up with the necessary UID and default group (DomainUsers) membership. Every additional eDirectory group created within the domain is automatically Linux-enabled. |
|
Username and password |
eDirectory users in the domain (eDirectory partition) can log into any workstation that has joined the domain. There is no need for a corresponding user object on the workstation. |
To manage Samba shares, iManager must be configured with the necessary plug-ins and role-based services. For information on how to configure iManager, see the iManager Documentation
To create a Samba share in iManager:
Open a browser and point to http://ip_address_of_server/nps/iManager.html.
Provide the username, password, and tree information as requested and click Login.
In the Roles and Tasks view, select File Protocols > Samba.
Specify the IP address of the server you want to manage, or use the Object Selector to browse to and select the server.
The NCP Server objects for DSfW servers are located in OESSystemObjects.domain_name.com.
The General page displays Samba-related information about the selected server.
NOTE:The LDAP Suffix setting does not apply to DSfW servers.
Click the Shares tab.
Click New and enter the share name, path, and comment (optional). Click OK.
The path you enter must already exist on the OES server’s file system. By default, NSS volumes are located in /media/nss/volume_name.
The example shown above creates a Samba share called Projects for the NSS volume named PROJECTS. The share name and volume name do not need to be the same, but making them identical can make share management easier. If you want, you can enter a more complete description of the share in the Comment field.
The new share is added to the list of shares for this Samba server.
Continue with Section 21.1.6, Assigning Rights to Samba Shares to assign users rights to access the new share.
If you prefer, you can create Samba shares by editing the /etc/samba/smb.conf file.
For example, to create a Samba share on an NSS volume named PROJECTS, you would create a share to the /media/nss/PROJECTS directory as follows:
Open the /etc/samba/smb.conf file in an editor.
Create a [projects] share in the smb.conf file by inserting the following lines:
[projects]
comment = Project folders
path = /media/nss/PROJECTS
browseable = Yes
read only = No
inherit acls = Yes
Save the file and restart Samba.
Continue with Section 21.1.6, Assigning Rights to Samba Shares to assign users rights to access the new share.
For domain users to access the Samba shares you have created, you must assign the appropriate rights. You can assign rights to individual users or to groups. If you want all users in the domain to have the same rights to the share, you can assign the rights to the DomainUsers group.
Table 21-2 lists the management tools available for assigning rights to Samba shares created on various file systems.
Table 21-2 Tools for Managing File System Rights
|
File System |
Rights Management Tools |
Notes |
|---|---|---|
|
OES Storage Services (NSS) |
iManager > Files and Folders > Properties > Rights rights command |
The rights command available at the terminal prompt is for working with NSS volumes only. For online help, enter rights with no options. |
|
NCP Volume on Linux POSIX file systems (no NSS) |
iManager > Flies and Folders > Properties > Rights ncpcon > rights |
The rights command in the ncpcon utility is for working with any NCP volume, including NSS volumes and NCP volumes defined on Linux POSIX file systems. For online help, run ncpcon and enter help rights. |
|
Linux POSIX file systems (no NSS or NCP) |
chmod chown chgrp |
For information on assigning POSIX rights, see the SLES 12 Administration Guide. |
The example below continues the steps described in Section 21.1.4, Creating Samba Shares in iManager and Section 21.1.5, Creating Samba Shares in the smb.conf File.
Beneath the /media/nss/PROJECTS folder, create subfolders for each project.
For example, you could create folders named doc and code.
Assign trustees to the project folders, using either iManager or the rights command at a terminal prompt.
For example, suppose you want user1 to have full rights to doc but only read and filescan rights to code, and you want user2 to have full rights to code but only read and filescan to doc. You could assign the rights by using the following commands:
rights -f /projects/doc -r rwemafc trustee user1.full_edir_context
rights -f /projects/code -r rf trustee user1.full_edir_context
rights -f /projects/code -r rwemafc trustee user2.full_edir_context
rights -f /projects/doc -r rf trustee user2.full_edir_context
Because Samba access to NSS volumes is controlled by OES trustee rights, user1 and user2 can now work in their respective project folders, and they can see but not change the contents of the project folder belonging to their coworker. Adjusting POSIX permissions is not required.
From a Windows 2000 or XP workstation, you can add a Network Place (also known as a Web folder) that points to a share on the DSfW server.
IMPORTANT:The directory you are linking to must already exist on the DSfW server and fall within the scope of a defined share.
Share names and the server directories they point to are defined by using the Samba Management plug-in for iManager or by editing the /etc/samba/smb.conf file on the OES server. For more information and setting up shares, see Section 21.1.4, Creating Samba Shares in iManager and Section 21.1.5, Creating Samba Shares in the smb.conf File.
Log in to your Windows workstation.
From your desktop, access My Network Places.
For example, click Start My > Computer > My Network Places.
Click Add Network Place.
On Windows XP, do the following:
In the Add Network Wizard dialog box, click Next.
Select Choose another network location, then click Next.
Click Browse.
Click Entire Network > Microsoft Windows Network.
Click the domain, then click the DSfW server.
Click the share you want to add.
Share names and the server directories they point to are defined in the /etc/samba/smb.conf file on the OES server. For more information and for instructions on setting up shares, see Section 21.1.4, Creating Samba Shares in iManager.
Click OK > Next.
(Optional) modify the name of the Network Place to a more intuitive name, such as My Home Directory.
Click Next.
Click Finish.
The folder opens, ready for access.
On Windows 2000, do the following:
Click Browse.
Double-click Entire Network > Microsoft Windows Network.
Double-click your domain name > your DSfW server.
Click the share you want to add.
Share names and the server directories they point to are defined in the /etc/samba/smb.conf file on the OES server. For more information and for instructions on setting up shares, see Section 21.1.4, Creating Samba Shares in iManager.
Click OK > Next.
(Optional) modify the name of the Network Place to a more intuitive name, such as My Home Directory.
Click Finish.
The folder opens, ready for access.
Network Places are persistent and are automatically made available in Network Neighborhood each time the user logs in.
You can use the Internet Explorer browser to add a Web folder that points to a share on the DSfW server.
IMPORTANT:The directory you are linking to must already exist on the DSfW server and fall within the scope of a defined share.
Share names and the server directories they point to are defined by using the Samba Management plug-in for iManager or by editing the /etc/samba/smb.conf file on the OES server. For more information and setting up shares, see Section 21.1.4, Creating Samba Shares in iManager and Section 21.1.5, Creating Samba Shares in the smb.conf File.
Log in to your Windows workstation.
Open Internet Explorer.
Click File > Open.
Click Open as Web Folder.
In the Open field, type the DSfW server name and share name as follows:
DNS_Name_or_IP\share_name
where DNS_Name_or_IP is the IP address or DNS name of the Samba server and share_name is a share name specified in the /etc/samba/smb.conf file (the most common share name is homes
).
For example, to access the homes share on a server with the host name myserver, you would type \\myserver.full.dns.name\homes in the Location field.
Click OK.
To make the folder automatically available, click Favorites > Add to Favorites > OK.
From a Windows 2000 or XP workstation, you can map a network drive letter that points to a share on the DSfW server.
IMPORTANT:The directory you are linking to must already exist on the DSfW server.
Log in to your Windows workstation.
From your desktop, access My Computer > Tools > Map Network Drive.
From the Drive drop-down menu, select an unused drive letter.
Click Browse and browse to Entire Network > Microsoft Windows Network.
Browse to your domain > the DSfW server > the share you want to map the drive to.
Click OK.
Click Finish.
The folder opens, ready for access.