Using FIPS

If you’re experimenting with Linux for the first time, you would like to be able to work with your existing operating system and set up and try Linux at the same time. In order to do this, you’ll need to create separate partitions for Linux–for which you need FIPS. FIPS expands to First non destructive Interactive Partition Splitting program. This utility allows you to create a new partition on your hard disk by using available free space, without destroying the data already present on it.First, you’ll need to create enough space on the hard disk. In addition to what space is required for the install, user and swap space could add an additional 100 MB. Typically, this is what you would need:Bare bones < 100 MB (customization required)
GNOME Workstation 607 MB (no customization required)
KDE Workstation 590 MB (no customization required)
Custom 100 MB to 1,092 MB (full install)

While it may seem that Linux is also becoming large and unwieldy, remember that apart from the OS, you are also installing major language support such as C, C++, Perl, python, etc, and many applications that are nearly always installed separately (Netscape, Xmms, Games, word processors, publishing tools, etc).

To start partitioning, you’ll need to copy FIPS onto your hard disk. You can copy the directory fips20. First, defragment the hard disk that you want to partition. Even if the percentage of fragmentation is low, run through the defragment process. This process will ensure that all the free space that the hard disk has is put together at the end.FIPS requires you to create a special bootup disk used for rescue purposes. Format a floppy and make it a bootable system disk. Copy the following files from the FIPS directory onto the floppy–restorrb.exe, fips.exe, and errors.txt. This floppy can be used to restore your partition status if errors occur. The floppy is also used to store a copy of the entire structure of the hard disk and should be safely stored.Boot from the floppy. Now run FIPS. FIPS will scan the hard disk and inform you if it detects any errors. This process will display the following messages.

Checking disk...
Checking FAT...
Searching for free space...
This may take some time, depending on the size of your hard disk. The next step is to save the status of the hard disk by storing the boot and root records of the current configuration.
After the status is saved, you are presented a screen where you can make the choice regarding the size of the new partition. Initially, all free defragmented space is allocated to the partition. If you have a very small size to start with, you need to remove your swap file or other irritants. Read the documentation for more details. You can control the size of the partition by using the left and right arrow keys. When you are set, press Enter to confirm. Press C to continue and commit the changes by selecting the option that writes the new partition to the disk.
At this point, you may get an error such as "Memory Allocation Error...". Ignore it, since this indicates that partitioning is complete. You can now proceed to install Linux in this new partition.

Interacting with NT

You might ask
yourself why adding Win NT or 2000 machines should be any different from
adding Win 9x machines. However, there are significant differences in the
SMB implementations between versions of Microsoft’s own operating systems.
Even the password algorithms used by the two operating systems are
different. Win 9x machines don’t actually participate in a Win NT domain
the way NT does. The domain controller in this case is used purely for
authentication.

If you want to use Win 2000
machines in a Samba domain, you’ll need to upgrade to Samba 2.0.7 (Zoot
ships with 2.0.6, so you’ll have to download the updated RPMs). There are
a few subtle changes in 2000, most of which have been addressed in this
release. There are a few outstanding bugs though, but no show-stoppers. Note
that Win 2000 is currently only supported in the backwards compatibility
(with NT PDC) mode, and not in its native domain controller mode.

Adding a Samba server to a
Win NT domain

To get a
Samba server to join a Win NT domain, you must first create a machine
account for the server in the PDC’s SAM (Security Accounting Manager)
database. You can do this using the "Server Manager for Domains"
utility on the PDC. The machine account is created using the netbios name of
the Samba server, which is usually, but not necessarily, its host name.

Once you’ve created the
machine account, you need to configure the smb.conf file. Apart from the
standard configuration, you need to make the following changes:

workgroup = NTDOM (Assume
that the domain name is NTDOM)

security = domain

password server = NTDOMPDC
NTDOMBDC1 NTDOMBDC2

where NTDOMPDC is the name of
the domain controller, NTDOMBDC<1,2> are the names of the backup domain
controllers, and SAMBA is the netbios name of the samba server.

Now, before restarting the
smbd daemons, give the command

# smbpasswd -j NTDOM -r
NTDOMPDC

This command will create a
file called SAMBA.NTDOM.mac in your /etc/ directory, containing the machine
account password for the Samba server.

Assuming all goes well, you
should get a message saying

smbpasswd :
Joined domain NTDOM

Adding an NT server to a

To add
a Win NT machine to a Samba domain, you need to create a user entry
for it in the password file. This is the Samba equivalent of creating a
machine account in the SAM database. The username should be the name of the
machine, appended with a "$". Set no password, and set the home
directory to /dev/null, and shell to /bin/false. (You might have to escape
the "$" on the command line with a "\", if required)

# useradd ntserver$ -s /bin/false -d /dev/null

The next step
is to go to the NT machine, and set the domain name to SAMBADOM (where
SAMBADOM is the domain name). Take care not to check the "create a
machine account" check box. This feature is not yet supported. You
should get a message saying "Welcome
to the SAMBADOM domain".

Understanding server
configuration options

If you look
at the man page for the smb.conf file (man 5 smb.conf), you’ll find a
number of configuration options that you can use to tweak the performance
and customize your Samba configuration further. Due to the lack of space
here, I’ll take a look at only a few configuration options.

One of the more misunderstood
configuration parameters is the "security=" option. We’ll take a
brief look at what the various options mean.

security=share

This is the conventional, and
most brain-dead option available. Shares exported will be available to any
machine in the workgroup without further authentication. This is commonly
used for machines sharing public shares, CD-ROMs, etc. Use this only when
you have no security concerns whatsoever.

security=server

Server level security is used
when you want the Samba server to authenticate users against another Samba
or Windows NT machine acting as a domain controller. This is a good idea
when you have a number of machines on your network, with users needing to
logon to the domain to be able to access the shares. In this case, you’ll
have to configure the "password server" parameter to specify the
names of the authentication servers (normally the PDC and BDC).

security=user

In this scheme, the Samba
server actually acts as a workgroup controller, authenticating Windows NT
and Win 9x clients. A separate user list has to be maintained, and users are
added using the "smbpasswd" command. In this case, the Samba
server maintains its equivalent of an NT SAM database.

security=domain

Domain level security is used
in the case described above, when adding a Samba server to a Win NT domain.
Here too, you’ll need to specify the "password server"
parameter. So how’s this different to the "security=server"
configuration? For one, when using server level security, the Samba server
will open and maintain a network connection to the domain controller during
the entire session. This can be a significant drain on network resources. In
domain level security, a connection is established for exchanging
authentication information only.

There are some new parameters
in Samba 2.0.7 as well. Most of these deal with the new utmp and wtmp
support (experimental, I might add) included in this version. This will
enable users logged in via Samba to be seen using the "who"
command, and all login information to be recorded in the system logs, not
just the samba logs. You’ll need to specifically compile support for this
using the

"–with-utmp" flag to "configure".

Samba development

Samba
development is progressing at an extremely hectic pace. There are currently
four trees under active development (For those new to the open source style
of development, a "tree" consists of all the latest source code of
the software, to which developers have access. Developers "check
in" portions of code they are working on, and then "check
out" the new code for others to test and debug when they have
finished).

There is the SAMBA_STABLE
branch, which has the regularly released "stable code", for you
and me to use. New features are not introduced into this tree until they’ve
been thoroughly tested in unstable versions. The stable Samba tree at this
time doesn’t have the ability to be a domain controller for Win NT
machines.

The second branch is the
SAMBA_TNG branch, which is where the main thrust of development is going on
at the moment. TNG stands for "The Next Generation", and includes
all the "cool code", such as domain controller for NT and Win 2000
machines, support for NT- specific administrative tools such as "User
Manager for Domains", and trust relationships, etc.

The Third branch is the
SAMBA_HEAD branch, which is the successor to the current 2.0.x series. It
contains improved file and print sharing services and NT file permissions
support. However, it contains no NT PDC support.

The last and final branch is
the HEAD_WITH_TNG branch, which is exactly what you might imagine from its
name.

The most interesting of these
branches is the SAMBA_TNG branch, which focuses on Win NT PDC controller
code. It currently suffers from poor file serving ability, but code mergers
with the SAMBA_HEAD branch will take care of this problem in the near
future.

So if you’re a hacker, or
kid with a network and time to spare, download the TNG or HEAD branch and
play with the code. Finding bugs or contributing documentation is the
easiest way to help the development effort, if you’re not a developer
yourself.

Babu Kalakrishnan, a Director at Sankya System & Objects, Bangalore www://www.sankya.com