From: Samuel Cabrero Date: Fri, 3 Jun 2022 12:12:01 +0000 (+0200) Subject: Revert "docs-xml: Update documentation for removal of NIS support" X-Git-Tag: tevent-0.13.0~467 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f74e284a9d7fa8dc45f22b70dcea27f1aa8bd232;p=thirdparty%2Fsamba.git Revert "docs-xml: Update documentation for removal of NIS support" This partly reverts commit a72bc3e15d3ed62e9ad2c0a97ce5d6d653abb048. Revert only the chunks related to netgroups and skip NIS related ones. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15087 Signed-off-by: Samuel Cabrero Reviewed-by: Jeremy Allison --- diff --git a/docs-xml/smbdotconf/security/hostsallow.xml b/docs-xml/smbdotconf/security/hostsallow.xml index a052e7f79cd..8b4b62268a3 100644 --- a/docs-xml/smbdotconf/security/hostsallow.xml +++ b/docs-xml/smbdotconf/security/hostsallow.xml @@ -41,6 +41,13 @@ hosts allow = lapland, arvidsjaur + Example 4: allow only hosts in NIS netgroup "foonet", but + deny access from one particular host + + hosts allow = @foonet + + hosts deny = pirate + Note that access still requires suitable user-level passwords. See testparm diff --git a/docs-xml/smbdotconf/security/invalidusers.xml b/docs-xml/smbdotconf/security/invalidusers.xml index 268cdfad560..b2fb2b9d293 100644 --- a/docs-xml/smbdotconf/security/invalidusers.xml +++ b/docs-xml/smbdotconf/security/invalidusers.xml @@ -7,8 +7,21 @@ to login to this service. This is really a paranoid check to absolutely ensure an improper setting does not breach your security. + + A name starting with a '@' is interpreted as an NIS + netgroup first (if your system supports NIS), and then as a UNIX + group if the name was not found in the NIS netgroup database. - A name starting with a '@' is interpreted UNIX group. + A name starting with '+' is interpreted only + by looking in the UNIX group database via the NSS getgrnam() interface. A name starting with + '&' is interpreted only by looking in the NIS netgroup database + (this requires NIS to be working on your system). The characters + '+' and '&' may be used at the start of the name in either order + so the value +&group means check the + UNIX group database, followed by the NIS netgroup database, and + the value &+group means check the NIS + netgroup database, followed by the UNIX group database (the + same as the '@' prefix). The current servicename is substituted for %S. This is useful in the [homes] section. diff --git a/docs-xml/smbdotconf/security/usernamemap.xml b/docs-xml/smbdotconf/security/usernamemap.xml index eab72bb8672..809a54c1e2f 100644 --- a/docs-xml/smbdotconf/security/usernamemap.xml +++ b/docs-xml/smbdotconf/security/usernamemap.xml @@ -58,6 +58,11 @@ + + If your system supports the NIS NETGROUP option then the netgroup database is checked before the /etc/group database for matching groups. + + You can map Windows usernames that have spaces in them by using double quotes around the name. For example: diff --git a/docs-xml/smbdotconf/security/validusers.xml b/docs-xml/smbdotconf/security/validusers.xml index 6b0bacfd78a..0b681a1fef5 100644 --- a/docs-xml/smbdotconf/security/validusers.xml +++ b/docs-xml/smbdotconf/security/validusers.xml @@ -4,10 +4,9 @@ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> - This is a list of users that should be allowed to login to this service. - Names starting with an '@' are interpreted using the same rules as - described in the - invalid users parameter. + This is a list of users that should be allowed to login to this service. Names starting with + '@', '+' and '&' are interpreted using the same rules as described in the + invalid users parameter. diff --git a/docs-xml/smbdotconf/winbind/winbindseparator.xml b/docs-xml/smbdotconf/winbind/winbindseparator.xml index 9be46109cd6..eda14f4e03a 100644 --- a/docs-xml/smbdotconf/winbind/winbindseparator.xml +++ b/docs-xml/smbdotconf/winbind/winbindseparator.xml @@ -10,9 +10,9 @@ and nss_winbind.so modules for UNIX services. - Please note that setting this parameter to + can cause problems + Please note that setting this parameter to + causes problems with group membership at least on glibc systems, as the character + - was used as a special character for NIS in /etc/group. + is used as a special character for NIS in /etc/group. \