321week3 Samba 3y5a6g

INFO 321 Server Technologies II

1

What is Samba? ◊ Samba is essentially a T/IP file and print server for Microsoft Windows clients • It can any SMB/CIFS-enabled client

◊ SMB/CIFS? • SMB is Server (or Session) Message Block • Common Internet File System (CIFS) is Windows File Sharing

2

SMB ◊ SMB was originally developed to run over NetBIOS (Network Basic Input Output System) LANs in the mid-1980’s • SMB was originally for MS-DOS and PC-DOS • SMB is the file sharing protocol inside CIFS • The inventor of SMB was Dr. Barry Feigenbaum of IBM, who initially called it BAF • Notice the name Samba contains SaMBa

3

SMB ◊ As of Windows 2000, the connection to NetBIOS was removed, thankfully • There exists NBT (NetBIOS over T/IP) SMB over T/IP without NBT is "naked" When running naked, SMB defaults to using T port 445 instead of the NBT Session Service port (T/139)

◊ SMB should work over any transport protocol 4

CIFS ◊ CIFS is a network file system plus a set of auxiliary services ed by a bunch of underlying protocols • Most of which are not particularly well documented by Microsoft; you may faint now • CIFS is "Microsoft's way of doing network file sharing“ since about 1996

◊ There is no RFC number for SMB or CIFS • Microsoft's implementations are the de facto CIFS standards

5

So what? ◊ “One of Samba’s big strengths is that you can use it to blend your mix of Windows and Linux machines together without requiring a separate Windows server. Samba includes for Active Directory, Unicode, new authentication and filename mangling systems, printing , trust relationships, LDAP integration and loadable RPC modules.” • From The Unofficial Samba HOWTO 6

If that’s not enough ◊ “Samba is software that can be run on a platform other than Microsoft Windows, for example, UNIX, Linux, IBM System 390, OpenVMS, and other operating systems. Samba uses the T/IP protocol that is installed on the host server. When correctly configured, it allows that host to interact with a Microsoft Windows client or server as if it is a Windows file and print server.” • From What is Samba? 7

Samba Today ◊ Samba is on version 3.5.6 (as of January 19, 2011), and is available for the following platforms • UNIX - AIX (IBM UNIX), HP-UX (HP UNIX), Solaris (Sun UNIX) • Linux - Debian, Fedora, RedHat, SuSE • MVS (IBM mainframes) • Novell (NetWare) • VMS (was DEC, now HP OpenVMS) From http://us1.samba.org/samba/ftp/Binary_Packages/

8

SMB addressing - UNC ◊ A Universal Naming Convention (UNC) path might look something like this: • \\ubiqx\cifs\SMB.html

◊ ...and would parse out like this:

No!

• ubiqx = The name of the server • cifs = The directory path • SMB.html = The file name Much of this section adapted from Implementing CIFS

9

SMB addressing - UNC ◊ UNC doesn't provide a protocol specification • That's not because it always assumes SMB • The UNC format can all sorts of filesharing protocols, but it is up to the underlying OS or application to figure out which one to use

◊ Protocol and transport discovery are handled by trial-and-error, with each possibility tested until something works • You might imagine a system with AppleTalk, NetWare, and SMB all enabled has a lot of work to do

10

UNC ◊ The UNC format is handled natively by Microsoft & IBM's family of operating systems: DOS, OS/2, & Windows • Samba's smbclient utility can also parse UNC names, but it does so at the application level rather than within the OS and it only ever tries to deal with SMB • Even so, smbclient must handle both NBT and naked transport, which can be tricky

11

UNC ◊ SMB is the server identifier field because it will accept addresses in addition to names ◊ Recognized server names are: • NetBIOS names • DNS hostnames • IP addresses

◊ Going from an IP address to a NetBIOS name involves guesswork 12

Share names ◊ The directory path looks just like a directory path, but there is one small thing that makes it different; that thing is called the "share name“ • A given directory can have one or many share names

◊ The idea is similar to symbolic links (symlinks) in Unix, or shortcuts in Windows • The share is a named pointer--with its own set of attributes--to the object being made available

13

File name ◊ File names are straightforward, right? No. ◊ Windows is case insensitive • But UNIX and Linux are case sensitive

◊ Other problem areas include • filename lengths • valid characters • file access permissions • the end-of-line delimiter in text files 14

SMB URL ◊ Fortunately, there such a thing as an SMB URL • It fits into the general URI syntax and can be used to specify files, directories, and other SMB-shared stuff • It is intended as a more portable, and more complete way to specify SMB paths at the application level

15

Reach out ◊ … and touch an SMB server ◊ To do this we need two steps to identify who we’re talking to, and how • Server identifier interpretation • Transport discovery

16

Server identifier interpretation ◊ Try a URL like this • smb://server/ • Assuming the server’s name is ‘server’

◊ To resolve the name server, try ◊ It could be an IPv4 address • That’s easy; and IPv6 addresses should be in brackets, smb:// [fe80::240:f4ff:fe1f:8243]/ 17

Server identifier interpretation

◊ It could be a NetBIOS Name

• Look for un-escaped dots in the NetBIOS name • smb://my%2Enode.scope/ has a NetBIOS Name of ‘my.node’ and Scope ID of ‘scope’ • Use a NBT Name Query to get the server’s IP address

◊ It could be a DNS name • Try DNS to get the IP address

18

Port number please? ◊ Now we need to divine the port number • Port 139 is for NBT • Port 445 is for raw T • Which one applies?

◊ And if other security protocols are being used, higher port numbers could apply ◊ So this is another mess to figure out, if you weren’t given it

19

Transport discovery ◊ Try running naked • Open a T connection to port 445 on the server, but do not send an NBT SESSION REQUEST--just start sending SMB messages and see if that works

◊ Try NBT transport ◊ Try reverse-mapping a NetBIOS Name 20

Can we do something? ◊ All that was just to establish a connection to an SMB server ◊ Now we can look at SMB commands ◊ They may contain a header, parameters, and data

Image from http://www.ubiqx.org/cifs/figures/smb03.html 21

SMB Header ◊ The SMB header typically has eight 4Byte lines • SMB_HEADER { • PROTOCOL = "\xffSMB" (4B) • COMMAND = <SMB Command code (1 B)> The CIFS Technical Reference lists these

• STATUS = <Status code> (4B) • FLAGS = (1 B) 22

SMB Header • FLAGS2 = (2 B) • EXTRA = <Sometimes used for additional data> (12 B) The PidHigh subfield is used to accommodate systems that have 32-bit Process IDs The 8-byte Signature subfield is for SMB message g, as in a digital signature When not in use, these fields must be filled with zeros

23

SMB Header • TID = (2B) The SMB used to open a share is called a "Tree Connect“; the TID field is used to identify connections to shares once they have been established

• PID = (2B) The "Process ID" is set by the client, and is intended as an identifier for the process sending the SMB request The most important thing to note regarding the PID is that file locking and access modes are maintained relative to the value in this field

24

SMB Header • UID = < ID> (2B) The " ID" is also known as a VUID (Virtual ID) It is assigned by the server after the logs in, and is valid until the logs off It does not need to be the 's actual ID on the server system

25

SMB Header • MID = <Multiplex ID> (2B) } The "Multiplex ID“ is used by the client to keep track of multiple outstanding requests The server must echo back the MID and the PID provided in the client request The client can use those values to make sure that the reply is matched up to the correct request

26

SMB Message Parameters ◊ SMB_PARAMETERS { ◊ WordCount = (1 B) ◊ Words[WordCount] = <SMB parameters; varies with SMB command> (2*WordCount B) } • The SMB_PARAMETERS.Words block is limited in length to 510 bytes 27

SMB Message Parameters ◊ Each SMB message type (species?) has a different record structure that is carried in the Words block ◊ Think of that structure as representing the parameters ed to a function (the function identified by the SMB command code listed in the header) 28

SMB Message Data ◊ SMB_DATA { ◊ ByteCount = (2 B) ◊ Bytes[ByteCount] = (ByteCount B) } • SMB_DATA.Bytes may be as much as 65,535 bytes in length 29

Parameters vs Data blocks ◊ So if the Parameters block and the Data block look alike, it’s not just you • “…any functional distinction that may have separated the Parameter and Data blocks has been blurred” - Implementing CIFS

30

AndX messages ◊ SMB can form a linked list of related messages using a format called AndX messages ◊ The AndX message has two fields in a 4-Byte line • AndXCommand (1 B) • (reserved) (1 B) • AndXOffset (2 B) 31

Figure from http://www.ubiqx.org/cifs/figures/smb05.html

AndX messages

◊ The AndXCommand field provides the SMB command code for the next AndX block in the list (not the current one) • The AndXOffset value in each AndX parameter block gives the offset (relative to the start of the SMB) of the next AndX block; AndXOffset of the last AndX block has a value of zero (0) 32

AndX messages ◊ The AndXOffset contains the byte index, relative to the start of the SMB header, of that next AndX block--think of it as a pointer • Since the AndXOffset value is independent of the SMB_PARAMETERS.WordCount and SMB_DATA.ByteCount values, it is possible to provide padding between the AndX blocks

33

Start the conversation ◊ After establishing the transport protocol, the SMB client and server can exchange messages ◊ The first one is always NEGOTIATE PROTOCOL REQUEST/RESPONSE, which does just that ◊ It’s followed by SESSION SETUP REQUEST • Didn’t we already do that? 34

Transport vs sessions ◊ No, we established the transport layer session; now it’s time to establish a logon session ◊ In the second message in the handout, we have • Name

= "GUEST“

◊ This is to log on as the GUEST

35

Find a tree ◊ Once a logon is done, often the next command is to find the shared directory tree • TREE CONNECT does this

◊ Recall the tree concept identifies shared folders

36

SMB Connection ◊ After transport disconnect, all resources are released, not too surprisingly

Figure from http://www.ubiqx.org/cifs/figures/smb06.html

37

Ok, enough SMB! ◊ Aren’t you glad someone wrote Samba to do all this stuff for you? Who, you ask? • Aussie Andrew Tridgell reverse engineered SMB and started Samba in 1992

◊ Samba exists only on the non-Windows side; a Windows system only needs to be configured for ‘Microsoft networking’ Much of this section is from (Nemeth, 2007) and the Samba3HOWTO

38

Samba = Unix CIFS server ◊ Samba can provide these services • File sharing • Network printing • Authentication and authorization • Name resolution • Service announcement Browse file servers or printers

39

Samba services ◊ Samba can also • Do basic Windows primary domain controller functions • With LDAP, serve as a backup domain controller • some other Windows functions such as domain s, roaming profiles, and CIFS print spooling

40

Samba processes ◊ Samba is implemented in Linux mostly via two processes (daemons, to be precise): • The daemon smbd provides file sharing, network printing, authentication and authorization • The daemon nmbd provides name resolution and service announcement

◊ Samba runs as a normal process, binding to the CIFS sockets 41

Installing Samba ◊ Most Linux distributions include Samba, but you can the latest from samba.org, and install it • root# rpm -Uvh samba-3.0.20-1.i386.rpm

◊ Create a mount point for shared files • root# mkdir /plans • root# chmod 755 /plans

From Samba ByExample 42

Installing Samba ◊ Then install the smb.conf file (which we’ll get to soon) ◊ that the /etc/hosts file contains the following entry: • 192.168.1.1 server

◊ Start samba • root# chkconfig smb on • root# /etc/rc.d/init.d/smb restart 43

Simple smb.conf file • # Global Parameters • [global] • workgroup = MIDEARTH • security = SHARE • [Plans] • path = /plans • read only = Yes • guest ok = Yes 44

From the PC side ◊ Make sure the PC is in the workgroup (e.g. MIDEARTH) ◊ Make sure its IP address is in the same range as the Samba system (192.168.1.x), and they have the same netmask (255.255.255.0) ◊ Find the samba server in the Network Neighborhood 45

Is Samba alive? ◊ Check samba status with • root# smbclient -L localhost -U% • The -U% option gives no name and

◊ And prove it can handle a • root# smbclient -L server -Uroot%

◊ That should establish basic file sharing

46

Samba configuration file ◊ Like most Unix-y apps, it has a ‘.conf’ file which governs how it runs • /etc/smb.conf or /etc/samba/smb.conf or maybe /usr/local/samba/lib/smb.conf

◊ When Samba is running, it checks the conf file every few seconds, so changes will take effect quite quickly (no reboot needed) 47

Config file sections ◊ Each section in the smb.conf file (“stanza”) represents either a share or a meta-service on the Samba server • The [global] stanza contains settings that apply to the whole Samba server

◊ Samba s a number of metaservices, each of which serves its own purpose From (Samba3-HOWTO) 48

Config file meta-services • The [homes] stanza is a meta-service that causes Samba to provide a personal home share for each • The [printers] stanza is a meta-service that establishes print queue , and species the location of the intermediate spool directory into which print jobs are received from Windows clients prior to being dispatched to the UNIX/Linux print spooler 49

Really minimal smb.conf file [global] workgroup = WKG netbios name = MYNAME

[share1] path = /tmp

[share2] path = /my shared folder comment = Some random files 50

Security issues ◊ File sharing is naturally a security hole ◊ To control which clients can access Samba shared resources, look for the hosts allow clause in the smb.conf file • It should contain only the IP addresses or IP address ranges you trust to have access

◊ Turn on encryption • encrypt s = true 51

Security issues ◊ encryption makes Samba keep a hash of the for each • Recall Unix and Windows keep different information

◊ To set this , use smbwd • sudo smbwd –a name

◊ s can then change their • smbwd –r smbservername –U name 52

Security issues ◊ Block the Samba server from outside your organization • Samba uses encryption only for authentication, not for data transport!

◊ Hence might want to use firewall to block • UDP ports 137-139 • T ports 137, 139, and 445 53

What are my settings? ◊ To find the current Samba settings use the command • testparm –v

◊ This will include all your smb.conf settings, and other defaults • Only override defaults for a reason – otherwise leave them out of smb.conf

54

Encoding compatibility ◊ Try echo $LANG ◊ Samba uses UTF-8 character set ◊ If you’re using anything else, set the character sets in Samba to be the same as your system using, e.g. • unix charset = ISO8859-15 • display charset = ISO8859-15

55

Removing NetBIOS ◊ If all Windows clients are at least Win2k, have DNS provided outside of Samba, and you don’t need Network Neighborhood browsing in Samba, you can remove NetBIOS [global] disable netbios = yes name resolve order = host 56

Removing NetBIOS ◊ Without NetBIOS , you don’t need to run nmbd; so remove it from Samba startup in /etc/init.d ◊ To connect to a Samba server without NetBIOS , use the full DNS name of the host • \\server.example.com.\myshare • The extra dot tells Windows to use DNS 57

Authentication ◊ Windows uses a challenge/response approach to respond to an authentication request • If you have the same Samba name and as in Windows, then this will be invisible in the background

◊ For larger scale systems, can use NIS, LDAP or Windows authen. services 58

Authentication ◊ To merge authentication services between Linux and Windows, make Samba act as a Primary Domain Controller ◊ Or can use Nate Yocom’s open source pGina (GINA = Graphical Identification aNd Authentication) to handle almost any authentication method 59

Basic file sharing in smb.conf ◊ If everyone has a home directory, the [homes] stanza can share them • [homes] • comment = Home directories • browseable = no • valid s = %S • writeable = yes • guest ok = no 60

Basic file sharing ◊ This will allow any to access their home Linux directory from any Windows system ◊ Can you see another ’s home directory? • Samba uses Linux file permissions through CIFS, so usually the answer would be yes • The valid s line prevents it though 61

Group shares ◊ A group can be defined by access control lists (ACLs), but that’s a bit messy ◊ Easier to define a pseudo , and have Samba pretend people are in that group • E.g. create a Linux ‘eng’ group, and matching Samba and group of the same name • The pseudo is the owner of the directory

62

Group shares • [eng] • valid s = @eng • force = eng • force group = eng • path = /home/eng • nt acl = no • create mask = 0660 • force create mask = 0660

63

Group shares • security mask = 0000 • directory mask = 2770 • force directory mask = 2770 • directory security mask = 0000 More info on these masks circa p. 324 of HOWTO

• browseable = no • writeable = yes • guest ok = no 64

Sources ◊ The Unofficial Samba HOWTO from oregontech.com ◊ Vernooij, Terpstra, Carter. (May 27, 2009) Samba3-HOWTO from samba.org ◊ Samba3-ByExample from samba.org ◊ What is Samba? from samba.org ◊ Implementing CIFS, by Christopher R. Hertel

65

Sources ◊ CIFS Technical Reference by SNIA (2002) ◊ Nemeth, Snyder, Hein. (2007) Linux istration Handbook. Prentice Hall, ISBN 0131480049

66