Monday, August 2, 2010

Nagios


Nagios is a system for monitoring a network. Monitors hosts and services you specify, alerting when the network behavior is not desired, and again when it returns to its rightful state. Nagios is licensed under the GNU General Public License Version 2 as published by the Free Software Foundation.

Features:

Monitoring of network services (SMTP, POP3, HTTP, NTTP, ICMP, SNMP).
Monitoring of host resources (processor load, disk usage, system logs).
Simple design of plugins that allow users to develop their own service checks depending on your needs, using their favorite tools (Bash, C + +, Perl, Ruby, Python, PHP, C #, etc.)..
Ability to define the hierarchy of the network, allowing to differentiate between host and host fallen inaccessible.
Notifications to the contacts when problems occur in services or hosts, and when they are resolved (via email, pager (search), SMS, or any method defined by the user along with its corresponding complement).
Ability to define event handlers that run when an event occurs or host a service for proactive problem-solving.
Support for implementing redundant hosts monitors.

Installation Requirements:
Apache HTTP Server
GCC Compiler
GD Library

To install these units, run as root:

[Root @ golden ~] # yum-y install httpd gcc glibc-common glibc-devel gd gd

Create an account for Nagios:

[Root @ golden ~] # useradd nagios
[Root @ golden ~] # passwd nagios

Create the group nagcmd to allow external commands can be submitted via the web interface. Add nagios and apache users group.

[Root @ golden ~] # groupadd nagcmd
[Root @ golden ~] # usermod-G nagios nagcmd
[Root @ golden ~] # usermod-G apache nagcmd

Download Nagios and the Plugins:

[Franky @ golden ~] $ mkdir nagios
[Franky @ golden ~] $ cd nagios
[Franky @ golden nagios] $ wget http://ufpr.dl.sourceforge.net/sourceforge/nagios/nagios-3.0.1.tar.gz
[Franky @ golden nagios] $ tar zxf nagios-3.0.1.tar.gz
[Franky @ golden nagios] $ wget http://ufpr.dl.sourceforge.net/sourceforge/nagiosplug/nagios-plugins-1.4.11.tar.gz
[Franky @ golden nagios] $ tar zxf nagios-plugin-1.4.11.tar.gz

Building and Installing Nagios

Become root:

[Franky @ golden nagios] $ su
[Root @ golden nagios] # cd nagios-3.0.1

Configuring Nagios:

[Root @ golden nagios-3.0.1] #. / Configure - with-command-group = nagcmd - with-init-dir = / etc / init.d

Compiling Nagios:

[Root @ golden nagios-3.0.1] # make all

Installed binaries, init script (/ etc / init.d), configuration examples:
[Root @ golden nagios-3.0.1] # make install
[Root @ golden nagios-3.0.1] # make install-init
[Root @ golden nagios-3.0.1] # make install-config
[Root @ golden nagios-3.0.1] # make install-commandmode


Configuring the web interface:

Installing configuration files in the conf.d folder of Apache configuration:

[Root @ golden nagios-3.0.1] # make install-webconf
Nagiosadmin Create an account to access the web interface, which then needed for Web access to Nagios:

[Root @ golden nagios-3.0.1] # htpasswd-c / usr / local / nagios / etc / htpasswd.users nagiosadmin
New password:
Re-type new password:
Adding password for user nagiosadmin

Restart Apache for the new settings to take effect:

[Root @ golden nagios-3.0.1] # / etc / init.d / httpd restart


Compiling and installing plugins

[Root @ golden nagios] # tar zxvf nagios-plugins-1.4.11.tar.gz
[Root @ nagios-plugins-golden 04.01.1911] #. / Configure - with-nagios-user = nagios-with-nagios-group = nagios
[Root @ nagios-plugins-golden 04.01.1911] # make
[Root @ nagios-plugins-golden 04.01.1911] # make install

Configuration

Adding check_nrpe command (used below) in the file / usr / local / nagios / etc / commands.cfg:

define command (
command_name check_nrpe
command_line $ USER1 $ / HOSTADDRESS check_nrpe-H $ ARG1 $-c $ $
)

Add configuration files (will be published later) of the hosts, host groups, services and service groups in the file nagios.cfg:

cfg_file = / usr / local / nagios / etc / objects / hostgroups.cfg
cfg_file = / usr / local / nagios / etc / objects / hosts_fcld.cfg
cfg_file = / usr / local / nagios / etc / objects / services_fcld.cfg
cfg_file = / usr / local / nagios / etc / objects / servicegroups.cfg

Description of these files:

hostgroups.cfg: definition of groups of hosts.
hosts_fcld.cfg: defining the hosts of the Sun Open Source Foundation
services_fcld.cfg: service definition to monitors in the FCLD hosts.

servicegroups.cfg: definition of the service clusters of servers.

Defining the hosts in / usr / local / nagios / etc / hosts_fcld.cfg:
define host (
fcld name-server # Template Name
check_command check-host-alive # Command to see if the host is reachable
check_period 24x7 # Period of time for monitoring. 24 hours, 7 days a week.
max_check_attempts 3 # Maximum attempts to check
5 # Interval normal_check_interval normal monitoring
process_perf_data 0 # Process performance information
retain_nonstatus_information 0 # retain information from non-state travez the program restarts
sysadm contact_groups # Group to which notifications will be sent
30 # Forward notification_interval notifications every 60 minutes
24x7 # notification_period reporting period
notification_options d, u, r # Send notifications d = down, u = up r = recovery
register 0 # Do not register this host, only a template
)
define host (
fcld-server use
sanjuan.fcld.local host_name
San Juan alias
sanjuan.fcld.local address
)

Defining the services in / usr / local / nagios / etc / services_fcld.cfg:

define service (
fcld-service # name Name of template
use generic-service # Template base
# check_period 24x7 monitoring period
max_check_attempts 3 # Maximos attempts to check
3 # Interval normal_check_interval normal checkups. 3 minutes
retry_check_interval 1 # Retry in 1 minute checking
sysadm contact_groups # Group of contacts to notify
notification_options w, u, c, r # Options for notifications:
w = warning, u = unknown, r = c = critical recovery
30 # Interval notification_interval re-notifications
24x7 # Period notification_period notifications. 24 hours a day, 7 days a week
register 0 # Do not register this service. It is only a template.
)

define service (
fcld-service use
sanjuan.fcld.local host_name
service_description Processes
check_command check_nrpe! check_total_procs
)
define service (
fcld-service use
sanjuan.fcld.local host_name
service_description zombie processes
check_command check_nrpe! check_zombie_procs
)
define service (
fcld-service use
sanjuan.fcld.local host_name
Swap service_description
check_command check_nrpe! check_swap
)
define service (
fcld-service use
sanjuan.fcld.local host_name
Users service_description
check_command check_nrpe! check_users
)
define service (
fcld-service use
sanjuan.fcld.local host_name
System head service_description
check_command check_nrpe! check_load
)
define service (
fcld-service use
sanjuan.fcld.local host_name
service_description Disc /
check_command check_nrpe! check_disk
)
define service (
fcld-service use
sanjuan.fcld.local host_name
service_description Disco / boot
check_command check_nrpe! check_disk_boot
)
define service (
fcld-service use
santodomingo.fcld.local host_name
HTTP service_description
check_http check_command
)
define service (
fcld-service use
sanjuan.fcld.local host_name
SSH service_description
check_ssh check_command
)

Defining the contacts in / usr / local / nagios / etc / objects / contacts.cfg:

define contact (
# use generic-contact template base
franky Contact_Name # Name of contact within Nagios
# Aliases alias Franky Almonte, detailed name
email suresh.sonu2@gmail.com # Contact E-Mail
24x7 # Period service_notification_period notifications for services
24x7 # Period host_notification_period notifications for hosts
service_notification_options w, u, c, r # Report the status of services: w = warning, u = unknown, r = c = critical recovery
host_notification_options d, u, r # Report the status of hosts: d = down, u = unreachable r = recovery (up states)
service_notification_commands notify-by-email # Nitifica using the command notify-by-email: send notifications by e-mail services
host_notification_commands host-notify-by-email # Send notifications by email hosts
)
define contact (
use generic-contact
Contact_Name cristhian
alias Cristhian Nunez
email suresh.sonu2@gmail.com
24x7 service_notification_period
24x7 host_notification_period
service_notification_options w, u, c, r
host_notification_options d, u, r
service_notification_commands notify-by-email
host_notification_commands host-notify-by-email
)

Defining groups of contacts in / usr / local / nagios / etc / contacts.cfg:

(define contactgroup
sysadm contactgroup_name # Name of group
# Aliases alias FCLD SYSADM group
Members franky, cristhian # Members of the group
)

Defining the group of hosts under / usr / local / nagios / etc / objects / hostgroups.cfg:

(define hostgroup
hostgroup_name Group # Name servers
Servers FCLD # Alias alias group
Members localhost, sanjuan.fcld.local, santodomingo.fcld.local # Members. The names are separated by commas.
)


Defining services group in / usr / local / nagios / etc / objetcs / servicegroups.cfg:

(define ServiceGroup
SSH servicegroup_name # Name Service Group
Secure Shell # Aliases alias group
Members sanjuan.fcld.local, SSH, santodomingo.fcld.local, SSH # Members. Format: host name, service name
)

Start Nagios

Nagios add to the list of system services that start automatically when the system boots:

[Root @ golden nagios] # chkconfig - add nagios
[Root @ golden nagios] # chkconfig nagios on

To verify the settings before you begin:
[Root @ golden ~] # / usr / local / nagios / bin / nagios-v / usr / local / nagios / etc / nagios.cfg


If no errors:

[Root @ golden ~] # / etc / init.d / nagios start

Starting with the command Nagios service:
[Root @ golden ~] # service nagios start


At this point we have installed Nagios! But only contains a basic configuration to monitor essential services of the computer running.

To access via web Nagios type the following URL into your browser:
http://nombre.o.ip.del.servidor/nagios

Use the following username and password:

Username: nagiosadmin
Key: nagiosadmin
Figure 1: Accessing Nagios


Figure 2: Home Nagios


Figure 3: Services installed by default for localhost

Monitoring equipment GNU / Linux

To monitor equipment GNU / Linux need to run remote commands on those machines remotely. This is possible thanks to the NRPE service. Through this service we can run Nagios command will give us the information we need on the CPU, memory, disks, etc.

The monitoring architecture using NRPE is:



Installing NRPE

Create a user for NRPE:

[Root @ golden ~] # useradd nagios
[Root @ golden ~] # passwd nagios

Installing plugins:

[Root @ sanjuan nagios] # wget http://ufpr.dl.sourceforge.net/sourceforge/nagiosplug/nagios-plugins-1.4.12.tar.g
[Root @ sanjuan nagios] # tar zxvf nagios-plugins-1.4.12.tar.gz
[Root @ sanjuan nagios] # cd nagios-plugins-01.04.1912 /
[Root @ nagios-plugins-sanjuan 01/04/1912] #. / Configure
[Root @ nagios-plugins-sanjuan 01/04/1912] # make
[Root @ nagios-plugins-sanjuan 01/04/1912] # make install
[Root @ nagios-plugins-sanjuan 01/04/1912] # chown nagios: nagios / usr / local / nagios /
[Root @ nagios-plugins-sanjuan 01/04/1912] # chown-R nagios: nagios / usr / local / nagios / libexec /

Installing xinetd:

[Root @ sanjuan nagios] # yum-y install xinetd

Download and install NRPE:

[Root @ sanjuan nagios] # wget http://ufpr.dl.sourceforge.net/sourceforge/nagios/nrpe-2.12.tar.gz
[Root @ sanjuan nagios] # tar zxvf nrpe-2.12.tar.gz
[Root @ sanjuan nagios] # cd nrpe-2.12 /
[Root @ sanjuan nrpe-2.12] #. / Configure - disable-ssl
[Root @ sanjuan nrpe-2.12] # make all
[Root @ sanjuan nrpe-2.12] # make install-plugin
[Root @ sanjuan nrpe-2.12] # make install-daemon
[Root @ sanjuan nrpe-2.12] # make install-daemon-config
[Root @ sanjuan nrpe-2.12] # make install-xinetd


Adding NRPE service to the list of system services in / etc / services:

[Root @ sanjuan nrpe-2.12] # vim / etc / services

Add at end of file:
nrpe 5666/tcp # NRPE


We add the Nagios server IP address in the configuration of xinetd to allow access to the service team via NRPE:

[Root @ sanjuan nrpe-2.12] # vim / etc / xinetd.d / nrpe
service nrpe
(
flags = REUSE
socket_type = stream
port = 5666
wait = no
user = nagios
group = nagios
server = / usr / local / nagios / bin / nrpe
server_args =-c / usr / local / nagios / etc / nrpe.cfg - inetd
log_on_failure + = USERID
disable = no
only_from = 127.0.0.1 # IP 192.168.100.12 Nagios server
)

Xinetd service must start with system startup teams GNU / Linux remote for this run:

[Root @ santiago objects] # chkconfig - level 345 xinetd on

Check_nrpe command syntax is:
check_nrpe-H [-n] [-u] [-p ] [-t
By at
Labels:

Linux Samba


For complete information on Samba see the SMB HOWTO. Also refer to the the smb.conf(5), smbd(8), smbclient(1), smbpasswd(5), smbpasswd(8), and testparm(1) man pages. You may access the howtos from one of the weblinks listed in the Linux websites section. The Linux Documentation Project or Metalab's Index of Linux publications will have copies if these howtos.
You will want to perform the following steps according to the instructions below to set up samba services on your computer.
  1. Set up your Windows based computers for file and print sharing if you want to access your windows computers from Linux.
  2. Decide whether to run Samba through the inetd internet super daemon or through the startup scripts. Running using the startup scripts is recommended for better reliability.
  3. Edit the /etc/services file to be sure the port services are enabled.
  4. Edit the /etc/smb.conf file with encrypted passwords enabled to work with most modern Windows versions.
  5. Add any users as desired to the /etc/smbusers file
  6. Optionally add hostnames to /etc/lmhosts.
  7. Set up your samba users passwords with the "smbpasswd -a username" command.
  8. Start or restart Samba services. When running Sambaservices through the startup scripts it can be done in Redhat using the linuxconf program. On other systems it may be done with one or more of the following commands:
    • samba start - Starts samba.
    • /etc/re.d/init.d/smb start - Starts samba.
    • samba restart - Restarts samba.
    • /etc/re.d/init.d/smb restart - Restarts samba.
    If using inetd to run Samba services, restart/start sambawith the command "killall -HUP inetd".

Check your /usr/doc directory for a directory like "samba-2.0.5a". Enter this directory with the command "cd /usr/doc/samba-2.0.5a". There is a docs and a samples directory at this location. There is a sample smb.conf file in the samples directory called smb.conf.default. Use this file to start your /etc/smb.conf file if you don't have one. Modify it for your workgroup name, remove the comment from the line "encrypt passwords = yes" and set up your share definitions as you need.

Configuring Windows

Configuring windows 95 for sharing: (If you want to be able to browse your windows computer from Linux)
  1. Right click on "network neighborhood" and click "properties"
  2. Under configuration make sure you have "Client for Microsoft Networks", your ethernet card driver and TCP/IP
  3. Select "Client for Microsoft Networks"
  4. Select "File and Print Sharing" and turn on file and printer access, enter a password to use
  5. Select Add?

Setting up the service method

There are two ways to run samba services. You can run them as a deamon, using the system startup scripts or use the internet super daemon, "inetd". You must choose one way or the other, you cannot run the service both ways. I recommend using the startup scripts since the service seems less reliable through inetd.
  1. To run as a startup service, if you are using Redhat Linux, you may run "linuxconf" and go to "Control", then "Control panel", then "Control service activity", select "smb" and set it to enabled and running. You will also need to be sure the "/etc/services" file is set up for the named ports below, along with setting up the "/etc/smb.conf", "/etc/smbusers", and possibly the "/etc/lmhosts" files below.
  2. To run on request through inetd, Put these lines in /etc/inedt.conf:
    # Other services
    netbios-ssn stream tcp nowait root /usr/sbin/tcpd /usr/sbin/smbd
    netbios-ns dgram udp wait root /usr/sbin/tcpd  /usr/sbin/nmbd \
-a

Setting up the services

Configure ports for NetBIOS name, datagram, and session services by being sure of existence of (or adding) the following lines in the /etc/services file:
netbios-ns 137/tcp    # NETBIOS Name Service
 netbios-ns 137/udp
 netbios-dgm 138/tcp    # NETBIOS Datagram Service
 netbios-dgm 138/udp
 netbios-ssn 139/tcp    # NETBIOS session service

 netbios-ssn 139/udp

Setting up the Samba configuration file

Edit the Samba configuration file "/etc/smb.conf" to provide suitable services. You should be able to get a file to start with from /usr/doc/samba-x.x.x/examples/smb.conf.default, you can copy it to /etc/smb.conf and use an editor to modify it.

This is the samba file I use: Note: you can use swat (described below) to configure this file.
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options (perhaps too

# many!) most of which are not shown in this example
#
# Any line which starts with a ; (semi-colon) or a # (hash) 
# is a comment and is ignored. In this example we will use a #
# for commentry and a ; for parts of the config file that you

# may wish to enable
#
# NOTE: Whenever you modify this file you should run the command "testparm"
# to check that you have not many any basic syntactic errors. 
#
#======================= Global Settings =====================================

[global]

# workgroup = NT-Domain-Name or Workgroup-Name
   workgroup = mygroup
# This allows you to get around a problem in WIN95, it is also needed
# for OS/2 clients.  You should definitely have this line enabled if

# you want to be able to just drop your GNU/Linux machine into an existing
# WIN95-only network.
   lm announce = yes  #important for WIN95 and OS/2 machines
# server string is the equivalent of the NT Description field

   server string = Samba Server
# This option is important for security. It allows you to restrict
# connections to machines which are on your local network. The
# following example restricts access to two C class networks and

# the "loopback" interface. For more examples of the syntax see
# the smb.conf man page
#   hosts deny = ALL
#   hosts allow = 10.1.3.16 10.1.0.100 

# if you want to automatically load your printer list rather
# than setting them up individually then you'll need this
   printcap name = /etc/printcap
   load printers = yes
# It should not be necessary to spell out the print system type unless

# yours is non-standard. Currently supported print systems include:
# bsd, sysv, plp, lprng, aix, hpux, qnx
;   printing = bsd
# Uncomment this if you want a guest account, you must add this to /etc/passwd
# otherwise the user "nobody" is used

;  guest account = pcguest
# this tells Samba to use a separate log file for each machine
# that connects
   log file = /var/log/samba/log.%m
# Put a capping on the size of the log files (in Kb).
   max log size = 50

# Security mode. Most people will want user level security. See
# security_level.txt for details.
   security = user
# Use password server option only with security = server
;   password server = &#60NT-Server-Name&#62

# Password Level allows matching of _n_ characters of the password for
# all combinations of upper and lower case.
;  password level = 8
# You may wish to use password encryption. Please read
# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.

# Do not enable this option unless you have read those documents
encrypt passwords = yes
smb passwd file = /etc/smbpasswd
# The following are needed to allow password changing from Windows to
# update the Linux sytsem password also.

# NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above.
# NOTE2: You do NOT need these to allow workstations to change only
#        the encrypted SMB passwords. They allow the Unix password

#        to be kept in sync with the SMB password.
unix password sync = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n
 *passwd:*all*authentication*tokens*updated*successfully*

# Unix users can map to different SMB User names
  username map = /etc/smbusers
# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name

# of the machine that is connecting
;   include = /etc/smb.conf.%m
# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
   socket options = TCP_NODELAY

# Configure Samba to use multiple interfaces
# If you have multiple network interfaces then you must list them
# here. See the man page for details.
interfaces = 192.168.199.1/24 10.1.0.100/16 

# Configure remote browse list synchronisation here
#  request announcement to, or browse list sync from:
# a specific host or from / to a whole subnet (see below)
;   remote browse sync = 192.168.3.25 192.168.5.255

# Cause this host to announce itself to local subnets here
; remote announce = 10.1.255.255 192.168.199.2 192.168.2.44

# Browser Control Options:
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
;   local master = no
# OS Level determines the precedence of this server in master browser

# elections. The default value should be reasonable
;   os level = 33
# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this

# if you already have a Windows NT domain controller doing this job
;   domain master = yes 
# Preferred Master causes Samba to force a local browser election on startup
# and gives it a slightly higher chance of winning the election

;   preferred master = yes
# Use only if you have an NT server on your network that has been
# configured at install time to be a primary domain controller.
;   domain controller = &#60NT-Domain-Controller-SMBName&#62

# Enable this if you want Samba to be a domain logon server for 
# Windows95 workstations. 
;   domain logons = yes
# if you enable domain logons then you may want a per-machine or
# per user logon script
# run a specific logon batch file per workstation (machine)

;   logon script = %m.bat
# run a specific logon batch file per username
;   logon script = %U.bat
# Where to store roving profiles (only for Win95 and WinNT)
#        %L substitutes for this servers netbios name, %U is username

#        You must uncomment the [Profiles] share below
;   logon path = \\%L\Profiles\%U
# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server

   wins support = yes
# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
;   wins server = w.x.y.z
# WINS Proxy - Tells Samba to answer name resolution queries on

# behalf of a non WINS capable client, for this to work there must be
# at least one WINS Server on the network. The default is NO.
;   wins proxy = yes
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names

# via DNS nslookups. The built-in default for versions 1.9.17 is yes,
# this has been changed in version 1.9.18 to no.
   dns proxy = no 
# Case Preservation can be handy - system default is _no_
# NOTE: These can be set on a per share basis

;  preserve case = no
;  short preserve case = no
# Default case is normally upper case for all DOS files
;  default case = lower
# Be very careful with case sensitivity - it can break things!
;  case sensitive = no

  admin users = root
  dead time=15
  hide dot files = yes
  max connections = 10
  share modes = yes
  guest account = nobody
  browseable = yes
;  invalid users = root
#============================ Share Definitions ==============================

[homes]
   comment = Home Directories
   browseable = no
   writeable = yes
   path=/home/%S
   public = no
# Un-comment the following and create the netlogon directory for Domain Logons
; [netlogon]

;   comment = Network Logon Service
;   path = /home/netlogon
;   guest ok = yes
;   writable = no
;   share modes = no

# Un-comment the following to provide a specific roving profile share
# the default is to use the user's home directory

;[Profiles]
;    path = /home/profiles
;    browseable = no
;    guest ok = yes
# NOTE: If you have a BSD-style print system there is no need to 
# specifically define each individual printer
[printers]

   comment = All Printers
   path = /var/spool/samba
   browseable = no
# Set public = yes to allow user 'guest account' to print
   guest ok = no
   writable = no
   printable = yes
# This one is useful for people to share files

[tmp]
   comment = Temporary file space
   path = /tmp
   read only = no
   public = yes
# A publicly accessible directory, but read only, except for people in
# the "staff" group
[public]

   comment = Public Stuff
   path = /home/public
   public = yes
   writable = yes
   printable = no
;   write list = @staff
# Other examples. 
#
# A private printer, usable only by fred. Spool data will be placed in fred's

# home directory. Note that fred must have write access to the spool directory,
# wherever it is.
;[fredsprn]
;   comment = Fred's Printer
;   valid users = fred
;   path = /homes/fred
;   printer = freds_printer

;   public = no
;   writable = no
;   printable = yes
# A private directory, usable only by fred. Note that fred requires write
# access to the directory.
;[fredsdir]
;   comment = Fred's Service

;   path = /usr/somewhere/private
;   valid users = fred
;   public = no
;   writable = yes
;   printable = no
# a service which has a different directory for each machine that connects
# this allows you to tailor configurations to incoming machines. You could

# also use the %u option to tailor it by user name.
# The %m gets replaced with the machine name that is connecting.
;[pchome]
;  comment = PC Directories
;  path = /usr/pc/%m
;  public = no
;  writable = yes

# A publicly accessible directory, read/write to all users. Note that all files
# created in the directory by users will be owned by the default user, so
# any user with access can delete any other user's files. Obviously this

# directory must be writable by the default user. Another user could of course
# be specified, in which case all files would be owned by that user instead.
;[public]
;   path = /usr/somewhere/else/public
;   public = yes

;   only guest = yes
;   writable = yes
;   printable = no
# The following two entries show how to share a directory so that two 
# users can put files there that will be owned by specific users. In this
# setup, the directory should be writable by both users & have the sticky

# bit set on it to prevent abuse. Obviously this could be extended to
# as many users as required.
;[myshare]
;   comment = Mary's and Fred's stuff
;   path = /usr/somewhere/shared
;   valid users = mary fred

;   public = no
;   writable = yes
;   printable = no
;   create mask = 0765

[cdrom]
  comment = Samba server's CD-ROM
  writable = no
  locking = no
  path = mnt/cdrom
  public = no

  root preexec = /bin/mount /mnt/cdrom
  root postexec = /bin/umount /mnt/cdrom

[etc]
  comment = Linux setup files in /etc
  public = no
  writeable = yes
  path = /etc
  read only = yes
  valid users = george mark


[floppy]
  comment = [Samba server's Floppy Drive
  browseable = yes
  writeable = yes
  path = /mnt/floppy
  public = no
  root preexec = /bin/mount /dev/fd0 /mnt/floppy
  root postexec = /bin/umount /mnt/floppy
Notes:
  • The section that allows unix passwords to be synced withsamba passwords does not seem to work. This may be because I use shadow passwords.
  • To customize samba setups from various machines use the "include = /etc/smb.conf.%m" line.
  • To make passwords be sent over the network in encrypted form:
    1. In the /etc/smb.conf file add or uncomment the lines:
      encrypt passwords = yes
  smb password file = /etc/smbpasswd
    2. Type "smbpasswd -a user" then enter the desired passwords
    Note: If you are not using shadow passwords, there is a way to convert to secure passwords without users knowing it. The command "cat /etc/passwd |mksmbpasswd.sh > /etc/smbpasswd" will create a smbpasswd file. However if you are using shadow passwords (which you should be), the /etc/passwd file does not contain the required information to setup the password file and you must still have each user modify their passwords or do it from root with the "smbpasswd -a username" command. Read the documentation in /usr/doc/samba-x.x.x/docs/textdocs/ENCRYPTION.txt. Be sure your smbpasswd file is only readable and writable by the root user.
  • Note: Be sure alias is off so hosts can't fool your machine by aliasing their names.
    To deny all hosts access except those you specify use the following example under [global]:
    hosts deny = ALL
  hosts allow = 10.1.3.16 10.1.0.100
If you deny hosts, be sure you know what you are doing! The way Microsoft networking works is that a master browser is picked based on an election process from all computers that are running Windows networking. If you deny access to the master browser, you may be unable to browse the network for your computer. Therefore, unless you know what computer will be the master browser and backup browser that you will use for browsing, it may be unwise to use this feature.

The smbusers file

Edit the /etc/smbusers file to map your machine names to unix users names:
The following file is an example I use:
# Unix_name = SMB_name1 SMB_name2 ...
root = windoze1 windoze2
nobody = guest pcguest smbguest
mark = windoze3
In this case anyone logging in from machines windoze1 or 2 will be mapped as user "root".

The lmhosts file

You may want to edit the /etc/lmhosts file depending on how you are providing your samba name services, Below is an example:
127.0.0.1 localhost
10.1.0.100 mymachine
10.1.3.16 george
This file may be used by the system to get IP addresses from host names. It may not be necessary for you to configure this file. You may need it if you do not have a DNS server available or your DNS server is not configured properly. If you get a message like "Resource is unavailable" you should try creating this file.

Upon completion

You will need to issue the following commands to complete the setup of Samba services:
  1. Enter the users' passwords with the command "smbpasswd -a user". This command is used to enter passwords for your users and is required for each user if you are using encrypted passwords which should be the case.
  2. If running the startup daemons, use one of the following choices of "samba restart", "samba start", "/etc/rc.d/init.d/smb restart", or "/etc/rc.d/init.d/smb start". Don't forget to set your startup services in Redhat's linuxconf program to run Samba services the next time you boot your system.
  3. If running Samba from inetd, start it with "killall -HUP inetd".
Examples of commands you may need or want to use
testparm |more
To see the results of your changes. May have to restart inetd (below)
smbpasswd -a user
To set samba passwords. See the smbpasswd(8) man page for more information.
samba restart
To restart the Samba services when running through the startup scripts. This allows changes to take effect. You can use the command start, stop, or status to start, stop, or see the status of the service, respectively.
/etc/rc.d/init.d/smb restart
The same as the Samba restart command, but this command directly invokes the Samba startup script.
smbclient -L mymachine
To tell what services are running under samba
smbmount
Used to mount volumes from windows machines
killall -HUP inetd
To restart the inetd daemon and therefore allow new settings for this daemon or any subdaemon to be implemented. You will use this command, only if you run Sambausing the inetd daemon.

Common Pitfalls

Many times those setting up Samba services will either have trouble browsing for their computer on the network or logging in. Below I have listed some possible reasons for these problems and what you should check:
  • Unable to browse:
    1. Check to be sure the name of your workgroup is correct in the /etc/smb.conf file with the statement "workgroup = mygroup".
    2. Check to be sure the line "browseable = yes" is included in the [global] section of /etc/smb.conf.
    3. You may need to set up the lmhosts file if you do not have a DNS server or your DNS server is not configured with your samba server IP address and name.
    4. Type "ps -ax |grep smb" and you should see a line like "784 ? S 0:00 smbd -D". If you don't your services are not running and you should start them.
    5. If you are attempting to run Samba services from inetd using the inetd.conf file, run Sambaas a startup service and see if that fixes the problem.
  • Unable to login with the system producing a message saying the password is incorrect.
    1. Check the log files in the /var/log/sambadirectory. First look for a file "log.machinename" where machinename is the name of the machine you are logging in from. You can "cat log.machinename" or use less or more to see the file.
    2. Be sure your user mapping is correct.
      1. Be sure the line "username map = /etc/smbusers" is included in the /etc/smb.conf file. Also check the log.smb file
      2. Be sure the file /etc/smbusers file contain line(s) like "unixuser = windozemachine1 windozemachine2 winuser1 winuser2 ...". The unix user is normally the name of the equivalent user you want to log in as such as root. I always put the machine name and all windows users names in the file to be sure that if the login is by machine name or Windows user name, it will be translated to a unix user name. Normally it is Windows user name. You will find out by examining the file "log.machinename".
    3. Be sure you are logging in using encrypted passwords from both the Linux and windows sides.
      1. Be sure the lines "encrypt passwords = yes" and "smb passwd file = /etc/smbpasswd" are in the /etc/smb.conf file and are not commented out with a ';' or '#' character in front of the line.
      2. Be sure you have added the users you are trying to log in as with the "smbpasswd -a user" command where user is the name of the Linux user you want to log in as. For instance the command is "smbpasswd -a root" to set the password up for the root user.
      3. Be sure Windows 95 is sending encrypted passwords. There is an upgrade patch for Windows 95 from Microsoft to make this change. This is only necessary for old versions of Windows 95. Windows 98, NT, 2K all send encrypted passwords by default. Therefore unless you are using one of the first versions of Windows 95 that came out, you should not have this problem.
Be sure you restart Samba every time you make a change to the /etc/smb.conf file to put your changes into effect.

Mounting and getting windows files from Linux aftersamba is installed

There are two programs supporting file services from windows:
  1. smbmount - Allows a shared directory on a windows machine to be mounted on the Linux machine.
  2. smbclient - Works similar to an ftp client enabling the user to transfer files
smbmount //winhost/windows /mnt/name_windows -c mylinuxmachine
This command mounts the directory "windows" on the windows computer "winhost" on the machine named "mylinuxmachine". The directory "windows" must have sharing enabled for this to work. To unmount:
smbumount /mnt/name_windows
The smbclient program works with the following syntax:
smbclient //winmachine/dirsharename -s /etc/smb.conf
The winmachine is the NetBIOS name of the serving machine with the shared resource on it.
The dirsharename is the share name of the directory
The "-s /etc/smb.conf" indicates the path of the sambaconfiguration file.
After entering the above command you will get a password prompt. If no password is required, press "return", otherwise enter the required password. Upon successful login you can look at the directory with the "dir" command. Below are some available commands:
  • dir - directory
  • get remotefile localfile
  • cd - Change directory
  • exit, q, or quit - To exit the program
  • help - for help information
  • mkdir - make directory
See the man page on smbclient for a full set of commands. Note: I've had trouble getting this program to work with windozeNT.

Some notes on the smb.conf file format

Variables as found in the smb.conf file are as follows:
  • %a - The architecture of the client machine such asSamba, WfWg, WinNT, Win95
  • %d - The PID of the server process.
  • %g - The group ID of the service's username (The name the client got)
  • %G - The group ID of the session requested username
  • %h - The internet (DNS) samba server host name.
  • %H - The user's home directory.
  • %I - The client machine's IP address.
  • %L - The NetBIOS server name
  • %m - The NetBIOS client name
  • %M - The internet (DNS) client host name.
  • %n - .
  • %N - NIS home directory server name.
  • %p - The path of the service's home directory from NIS auto.map.
  • %P - The current services' root directory.
  • %R - The protocol level. CORE, COREPLUS, LANMAN1, LANMAN2, or NT1.
  • %S - The name of the current service.
  • %T - The current data and time.
  • %u - The client's username
  • %U - The username the client wanted.
  • %v - Samba version number.
There are many global and service parameters defined in the smb.conf file. Read the man page on smb.conf for a complete list. Here is a list of a few global parameters:
  • auto services - Directories automatically visible to all users browsing the network.
  • bind interfaces only - Limits the interfaces to serve sambarequests.
  • deadtime - The timeout for inactive connections
  • debug level - The level of messages for logging.
  • default service - The service to be connected if the service requested cannot be found. EX:
    default service = docs
[docs]  path= /%S
  • directory mask - Octal file settings used to convert DOS modes to UNIX modes when creating directories.
  • directory security mask - Controls file permissions that can be modified by windows clients.
  • dns proxy - Specifies that the nmbd daemon if running as WINS server, should should treat unknown names as DNS names and do a DNS lookup.
  • lock directory - The path of the directory where lock files are stored.
  • message command - Samba's command to run in response to WinPopup messages.
  • name resolve order - The query order for resolution of name to IP addresses. Values are bcast, hosts, wins and lmhosts.
  • netbios aliases - Other names the samba server is called and will answer to.
  • netbios name - The samba server's netbios name.
  • smb passwd file - The path for the encrypted Sambapassword file.
  • smbrun - The path of the smbrun program used to execute shell commands for the samba daemon.
  • socket address - Controls the address on which Sambawill listen for connections.
  • syslog - Sets the threshold for sending messages to syslog
  • syslog only - Use syslog rather than samba log files

SWAT configuration

SWAT allows an administrator to configure the smb.conf file using a web browser. To use it you need to do the following:
  1. Add the following line to your /etc/services file:
    swat 901/tcp  # Swat Samba configuration services
  2. Add the following line to your /etc/inted.conf file
    swat      stream  tcp     nowait.400      root /usr/sbin/swat swat
  3. Type "killall -HUP inetd" to reload the inetd.conf file.
  4. On your local machine, address your web browser tohttp://localhost:901/
  5. If you connect over the network through a remote machine you should know that your password will be sent in the clear.
  6. SWAT will rewrite your smb.conf file and remove comments. Back up your smb.conf file before using SWAT.
For more information on NetBIOS, WINS, SMB, and NBNS (NetBIOS Name Server) read "The CTDP Networking Guide".
By at
Labels:

Quick and dirty Samba setup working Tested


Samba is an open source project that allows Windows users to connect to a Linux server from which to share data. If you are looking for a simple, affordable home file server, or need more disk space on your office network, a Linux server with Samba is the way to go. Linux along with Samba offers a stable, secure environment that is available at no cost, along with features such as remote administration, immunity to Windows viruses, and the ability to run on low-end machines. Here's how you can set up a simple Sambaserver on Slackware for SOHO use.
Most current Linux distributions, including Slackware 11, haveSamba already installed and running after the system boots. This article assumes that Samba has been installed. The commands work for Slackware version 11 and 10.2, and likely many other Linux distros.
The first step is to create a share folder on your hard drive; for instance, /disk2/data. After that, you need to edit the smb.conf file, found in /etc/samba, and make it look something like this:
# Global parameters
[global]
workgroup = HOME
netbios name = SAMBA
server string = Samba Server %v
map to guest = Bad User
log file = /var/log/samba/log.%m
max log size = 50
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
preferred master = No
local master = No
dns proxy = No
security = User
# Share
[Data]
path = /disk2/data
valid users = joel
read only = No
create mask = 0777
directory mask = 0777
You can copy and paste this into your conf file or make changes to your existing one.
The workgroup name needs to be the workgroup of your Windows computers, or your domain name. The netbios name is what will appear when you access the Linux computer from Windows. I am currently running a Windows domain with this setup, so I have the preferred master and local master set to no to avoid both servers from attempting to be the master browser. This will eliminate network conflicts on your Windows computers that can cause network-related outages.
For the share details, specify the valid users, or set them up later. In that section you can allow users to create their own folder and files for all to access.
The next step is to add users by the following command:

# useradd -c "Joel Nahrgang" joel
# smbpasswd -a joel
New SMB password: secret
Reenter SMB password: secret
Added user joel
Next, run the testparm command to ensure that the conf file is valid. If it returns no errors, restart Samba with the command /etc/rc.d/rc.samba restart. You should also make Samba executable when the server is rebooted with the command chmod 755 /etc/rc.d/rc.samba.
If you would like to tidy up your smb.conf file, the following commands will back up the file, then remove all the comments for easier reading:
# cd /etc/samba
# cp -a smb.conf smb.conf.master
# testparm -s smb.conf.master > smb.conf
Now you're ready to test Samba. On a Windows computer, you can either map a drive to the Samba server or access the drive using the Start-Run command and typing \\Samba\data, "Samba" being the server name and "data" being the shared folder.
One disclaimer: this setup serves a small network or a home network. For a larger user base and more complex network configuration, you may want to use the documentation provided on the Samba Web site.
By at
Labels:

Samba Server


Introduction

Sometimes having shares available via Samba is useful. This configuration basically provide access to the same data exported via NFS, except user home directories are read/write while the media share is read-only.

Samba Server

aptitude install samba samba-common
Answer the following questions:
Please specify the workgroup you want this server to appear to be in when queried by clients. Note that this parameter also controls the domain name used with the security=domain setting.
  • Workgroup/Domain Name:
    • Home
If your computer gets IP address information from a DHCP server on the network, the DHCP server may also provide information about WINS servers ("NetBIOS name servers") present on the network. This requires a change to your smb.conf file so that DHCP-provided WINS settings will automatically be read from /etc/samba/dhcp.conf.
The dhcp3-client package must be installed to take advantage of this feature.
  • Modify smb.conf to use WINS settings from DHCP?
    • no

Configuring Samba

Edit the smb.conf file:
nano /etc/samba/smb.conf

Enable User security

In the global section, remove the ";" at the front of the line 'security = user' and edit it like so.
security = share

Disable printer support

I don't have any printers attached to my Samba server, so I comment out all the printer configurations by placing a ';' in front of all the relevant lines.
Then find the 'load printers' section and set it to 'no'.
# If you want to automatically load your printer list rather
 # than setting them up individually then you'll need this
    load printers = no

Configure Home directory access

Make home directories browsable and writable
# Un-comment the following (and tweak the other settings below to suit)
 # to enable the default home directory shares.  This will share each
 # user's home directory as \\server\username
 [homes]
    comment = Home Directories
    browseable = no
 
 # By default, \\server\username shares can be connected to by anyone
 # with access to the samba server.  Un-comment the following parameter
 # to make sure that only "username" can connect to \\server\username
 # This might need tweaking when using external authentication schemes
    valid users = %S

 # By default, the home directories are exported read-only. Change next
 # parameter to 'yes' if you want to be able to write to them.
    writable = yes

 # File creation mask is set to 0700 for security reasons. If you want to
 # create files with group=rw permissions, set next parameter to 0775.
    create mask = 0775

 # Directory creation mask is set to 0700 for security reasons. If you want to
 # create dirs. with group=rw permissions, set next parameter to 0775.
    directory mask = 0775

Configure Media directory access

If you have already created the 'media' directory (as part of the NFSServer howto), do so now.
mkdir -p /srv/media
 chown -R nobody:nogroup /srv/media
 chmod 2775 /srv/media
Continue editing '/etc/smb.conf'
[Media]
   comment = Media
   path = /srv/Media
   writable = yes
   force user = nobody
   force group = nogroup
   public = yes
   printable = no
   create mask = 0775
   directory mode = 0775
   force create mode = 0775
   force directory mode = 0775

Adding And Managing Users

Adding a new user

In this example, I will add a user named louise. You can add as many users as you need in the same way, just replace the username louise with the desired username in the commands.
useradd louise -m -G users
Now add the user to the Samba user database.
smbpasswd -a louise
Now you should be able to log in from your Windows workstation with the file explorer using the username louise and the chosen password and store files on the Linux server either in louise's home directory or in the public shared directory.

Adding an existing user to the users group

In the command below, we are adding the existing system user account 'martin' to the 'users' group.
addgroup martin user
Now add the user to the Samba user database.
smbpasswd -a martin

Reloading Samba Configuration

Check configuration file for errors
testparm
Reload Samba to pick up the new configurations
sudo /etc/init.d/samba reload

Samba Firewall Rules

If you run a firewall on your Samba server these are the ports you need to allow.
  • netbios-ns 137/udp # NetBIOS Name Service
  • netbios-dgm 138/udp # NetBIOS Datagram Service
  • netbios-ssn 139/tcp # NetBIOS Session Service
  • microsoft-ds 445/tcp # Microsoft Directory Service
References
By at
Labels:

Swat in Samba


SCENARIO: Configure a SAMBA Server on RHEL5 with a NETBIOS name STATION2-NIX. Create a SHARE in it having name STATION2-RHEL5-VM and mapped to the directory /network-places/station2. Windows Machine workgroup being WORKGROUP. The share should be writeable to the user "root"
STEPS
Before you configure SAMBA SERVER make sure following packages are installed:
system-config-samba-
samba-common-
samba-
samba-swat-
samba-client-

The easiest way to configure SAMBA server is to use samba-swat utility. By default it is turned off. First check whether it has been bind to port 901 or not using:
#cat /etc/services | grep swat

After this you need to start the swat service. Use #system-config-services and check mark "swat". Save the changes and closed the window.

Open a web-browser and type the link given below:
http://localhost:901/

It will ask for username and password. It's always advisable to login with root credentials. You will presented with a Web Based GUI.

Configuring a SAMBA server is just a 3 step process:
STEP 1: Go to "GLOBAL" section. Change the workgroup to the workgroup being used by Windows Machine. It can be anything like MSHOME, MYWORKGROUP,MYGROUP etc. But both Windows and Linux should use the same workgroup name. In my case workgroup="WORKGROUP". Change the netbios name to "STATION2-NIX". Change the security to "USER". Commit the changes.
STEP 2: Go to "SHARES" tab. Create a new share having the name "STATION2-RHEL5-VM". Set the path to "/network-places/station2". Make sure this directory path exits. Also make sure "browsable" and "available" options are set to yes. Add the user "root" to "write list". Commit the changes.
STEP 3: Go to the "PASSWORD" section. For the user "root" set the password and click "Add New User". You can now verify that a new entry must have been added to /etc/samba/smbpasswd. Start the smb service.
#service smb start

You all set to access the Linux Machine from Windows. Just go to Windows Box and your share would be browsable in "My Network Places"(XP) or "Network"(VISTA). Just double click the icon having you netbios name and login using "root" credentials.
By at
Labels:

RHCE study notes: Samba configure in RHEL 5


Step by step for configuring Samba server in server side and test.
a：# yum install samba*                              //install samba from yum database
b:  # vim /etc/samba/samba.conf          //configuring the samba.conf
[global]
workgroup=MYGROUP                              //setting for user group
server string=Samba Server Version  //describe samba server
hosts allow = 127. 192.168.0.0/24
[myshare]
comment=myshare
path= /folder
guest ok=yes
writable=yes
public=no
browserable=yes                     //allow all use access
[printers]
printerable=yes                    //printer setting
c: # service smb restart      // restart services
# chkconfig smb on
d:# smbclient -L 192.168.0.11         //test smb
# smbpasswd -a user1                //user1 must already been setup in system
# smbclient -U user1 //station11.example.com/myshare
e: Selinux setting up
—-SElinux deny—-
# ls -LZ
# chcon -R -t samba_share_t /folder
f: mount smb
# mount -t cifs //192.168.0.11/myshare /mnt/smb -o user=user1
By at
Labels:
Subscribe to: Posts (Atom)