Samba V4.10-16D for VSI OpenVMS

VMS Software Inc. (VSI) is pleased to provide you with a new version of Samba for VSI OpenVMS. This release of Samba for VSI OpenVMS Alpha, Integrity, and x86-64 servers is based on Samba 4.10.16 and represents a significant update from the previous 4.6-5x versions of Samba for VSI OpenVMS. This is primarily a bug-fix release which addresses various issues identified in the previous 4.10-16C kit.

For a more detailed description of new features, enhancements, and known issues, please refer to the release notes found at the following links. Please be aware that some product features may be platform-specific.

For the latest information about Samba, see https://www.samba.org/samba/docs/. Please be aware that some features may be specific to Samba on OpenVMS and therefore are described only in this document.

This release of Samba for VSI OpenVMS is based on Samba 4.10.16. Since V4.6-5D, a number of changes in operation and configuration of Samba for OpenVMS needed to be made according to the changes that were introduced in Samba 4.10.16. See the list of changes below:

A list of significant issues from the previous release of Samba for VSI OpenVMS that were fixed in this release, is provided in Section 15, “Specific Issues Fixed Since the V4.10-16C Release”.

Operating system and layered product software versions requirements for Samba V4.10-16D for VSI OpenVMS servers are listed below.

The user should be familiar with the installation, configuration, and use of open-source products such as Samba in the VSI OpenVMS environment.

Make sure your system meets the following requirements before you install Samba for VSI OpenVMS.

Samba requires the SYSGEN parameters listed in the table below to be set at least to the specified minimum value, otherwise the installation will fail. Note that each time you change the values of these SYSGEN parameters, you must run AUTOGEN for the changes to take effect and then reboot your system.

If you are upgrading or migrating from the old CIFS for OpenVMS to Samba for VSI OpenVMS, VSI strongly recommends that you backup the existing CIFS SAMBA$ROOT directory tree prior to installing Samba.

Make sure enough space is allocated to process dynamic memory. For details, see Section 13, “Memory Requirements”.

The Samba kit is provided as a compressed VSI OpenVMS PCSI kit, named VSI-AXPVMS-SAMBA-V0410-16D-1.PCSI$COMPRESSED for Alpha, VSI-I64VMS-SAMBA-V0410-16D-1.PCSI$COMPRESSED for Integrity, and VSI-X86VMS-SAMBA-V0410-16D-1.PCSI$COMPRESSED for x86-64 servers. It can be installed by a suitably privileged user via the following command:

$ PRODUCT INSTALL SAMBA

By default, Samba will be installed to SYS$SYSDEVICE:[VMS$COMMON.SAMBA]. The /DESTINATION qualifier may be used to install the software into an alternative location.

If multiple cluster members will share the same SAMBA$ROOT: directory tree, Samba must be installed onto a device that is mounted by all cluster members.

To allow mixed-architecture cluster nodes to be members of the same Samba instance, install Samba on a node of each architecture type but specify the same installation location using the /DESTINATION qualifier.

If you plan to run Samba on multiple cluster members of the same architecture which do not have a common system disk, install Samba on one cluster member only. Then, follow the post-installation instructions described in Section 7, “Post-Installation Steps” to complete the installation on other cluster members.

The installation directory of Samba for VSI OpenVMS is associated with the SAMBA$ROOT logical name. SAMBA$ROOT is a rooted logical name that defines the root location for the Samba configuration files, logs, and other product files. Samba configuration files are stored in SAMBA$ROOT:[LIB] and, by default, logs are stored in SAMBA$ROOT:[VAR]. The SAMBA$ROOT logical name is defined in SYS$STARTUP:SAMBA$DEFINE_ROOT.COM (which is executed from the Samba start up procedure, SYS$STARTUP:SAMBA$STARTUP.COM).

Below you can see a sample installation log. Note that your output may differ slightly from that shown below, depending on the platform and other factors.

Performing product kit validation of signed kits ...

The following product has been selected:

VSI I64VMS SAMBA V4.10-16D                  Layered Product


The following product has been selected:

VSI I64VMS SAMBA V4.10-16D                  Layered Product

Do you want to continue?  [YES]

Configuration phase starting ...

You will be asked to choose options, if any, for each selected product and for
any products that may be installed to satisfy software dependency requirements.

Configuring VSI I64VMS SAMBA V4.10-16D: VSI OpenVMS SAMBA
    © (c) Copyright 2023 VMS Software, Inc.
    OpenVMS SAMBA is released under the terms of GNU Public License.
    This installation procedure requires that all the following
    conditions are satisfied:

    1. This procedure is running on an Itanium processor.
    2. The system is running OpenVMS V8.4-2L1 or later.
    3. SSL3 IA64 installed version V3.0.8 or later.
    4. LDAP IA64 installed version V2.6.3 or later.
    5. All required privileges are currently enabled.
    6. No CIFS or SAMBA images are running on this node or anywhere in
       the cluster that make use of common samba$root installation
       directory.
    7. ODS5 filesystem only.
    8. SYSGEN Parameter values:

    Parameter       Minimum Required
    ---------       ----------------
    CHANNELCNT      2560
    PROCSECTCNT     512
    PQL_DPGFLQUOTA  256000

Do you want to continue? [Please, type N or NO if you don't want to continue, any other answer means YES]

* This product does not have any configuration options.

Execution phase starting ...

The following product will be installed to destination:

    VSI I64VMS SAMBA V4.10-16D DISK$I64V841H1SYS:[VMS$COMMON.]

Portion done: 0%...10%...20%...30%...40%...50%...60%...70%...80%...90%

    User Accounts and User Identification Codes (UICs)
    --------------------------------------------------
    The OpenVMS SAMBA installation creates five OpenVMS
    accounts: SAMBA$SMBD, SAMBA$NMBD, SAMBA$GUEST, SAMBA$TMPLT
    and SMBADMIN. The default UIC group number for these new
    accounts depends on the following:

    o If you are installing the server for the first time, the
    default is the first unused UIC group number, starting
    with 360.
    
    o If any of these accounts already exists, then the default
    UIC group number will not be used to change the UIC of
    any existing accounts.
    
  For more information about UIC group numbers, see the
  OpenVMS System Manager's Manual.

Enter default UIC group number for SAMBA accounts

Group: [360]

Creating OpenVMS accounts required by SAMBA

Created account SAMBA$SMBD
Created account SAMBA$NMBD
Created account SAMBA$GUEST
Created account SAMBA$TMPLT
Created account SMBADMIN

SAMBA$ROOT is defined as "DSA102:[SYS0.SYSCOMMON.SAMBA.]"

Setting file protections...

    File protections are set

Creating Samba for OpenVMS root definition file SYS$COMMON:[SYS$STARTUP]SAMBA$DEFINE_ROOT.COM...
File created
Save startup files
Setup SAMBA logical environment
Successfully finished

    In a cluster, on all the nodes that are going to use common
    samba$root installation directory as the current node, copy
    the following files to SYS$STARTUP directory of each node:

        SYS$STARTUP:SAMBA$STARTUP.COM
        SYS$STARTUP:SAMBA$SHUTDOWN.COM
        SYS$STARTUP:SAMBA$DEFINE_ROOT.COM

    To automatically start OpenVMS SAMBA during system startup
    add the following line to the file SYS$MANAGER:SYSTARTUP_VMS.COM
    after the TCPIP startup command procedure:

        $ @SYS$STARTUP:SAMBA$STARTUP.COM

    To shut down OpenVMS SAMBA during system shutdown
    add the following line to the file SYS$MANAGER:SYSHUTDWN.COM:

        $ @SYS$STARTUP:SAMBA$SHUTDOWN.COM

Press Enter to continue:

    To configure OpenVMS SAMBA on any of the nodes in OpenVMS
    cluster that will share the common samba$root installation
    directory as the current node, execute:

        $ @SYS$STARTUP:SAMBA$DEFINE_ROOT.COM
        $ @SAMBA$ROOT:[BIN]SAMBA$CONFIG.COM

    Define symbols for all Samba utilities:
. ..100% $ @SAMBA$ROOT:[BIN]SAMBA$DEFINE_COMMANDS.COM

The following product has been installed:
    VSI I64VMS SAMBA V4.10-16D Layered Product

After you have successfully installed Samba for VSI OpenVMS, follow these steps to configure it:

Run SAMBA$CONFIG.COM after installation to migrate an existing CIFS for OpenVMS configuration to Samba for OpenVMS. SAMBA$CONFIG.COM runs SAMBA$MIGRATION.COM, which renames the appropriate CIFS users/groups and their associated OpenVMS account and identifier names (changing CIFS to SAMBA) and updates references in .CONF and USERNAME.MAP files. SAMBA$CONFIG.COM also has routines to migrate obsolete, deprecated, and modified parameters from CIFS for OpenVMS to their equivalents in Samba for OpenVMS.

The Samba migration process saves the old CIFS for OpenVMS configuration files to a subdirectory in SAMBA$ROOT:[BACKUP_MIGRATION] and produces a log file named according to the following format: SAMBA$ROOT:[VAR]SAMBA$MIGRATION_date_time.LOG.

To undo or roll back the migration if problems occur, proceed as follows:

WINBIND is a component of Samba that provides user and group identity mapping. In Samba for OpenVMS, WINBIND is a separate daemon process with one to four subprocesses.

When deciding whether to enable or disable WINBIND, consider the following:

4. Enable WINBIND:

4. Enable WINBIND: yes
    4A. UIC number range: 10000-10001
    4B. Allow Samba to create OpenVMS accounts on-the-fly: yes

idmap range not specified for domain '*'
ERROR: Invalid idmap range for domain *!

This release of Samba for OpenVMS does not include the following functionality:

The following list identifies currently known problems and restrictions with this release of Samba for VSI OpenVMS.

A Samba member server requires a proper DNS configuration to avoid long delays or timeouts when attempting to locate domain controllers.

If an OpenVMS host is configured to use the same DNS domain as the domain Samba will join, no changes are required.

However, if Samba is connected to a domain which is not the same DNS domain configured on the OpenVMS host, the OpenVMS host should be configured as a cache-only BIND server and use a stub zone or conditional forwarding for the domain that Samba will connect to. Additionally, the DNS name resolver on the OpenVMS host should be configured to use localhost as its DNS server.

Prior to connecting the Samba server to a domain, customers should verify the OpenVMS host is capable of resolving DNS SRV record types for the domain. For example, use the following command to verify that Samba will connect to a domain named example.com:

$ dig SRV _kerberos._tcp.example.com +noall +answer +additional

The response should be a list of domain controllers.

Since Samba defines many OpenVMS process logical names and dynamically activates image libraries, systems running Samba may require increased amounts of process dynamic memory space. The process dynamic memory size is controlled by the SYSGEN CTLPAGES parameter. Samba may consume the following amount of process dynamic memory:

On IA-64 and x86-64 hosts, the default value of CTLPAGES is 1056 pagelets (528KB), which is typically sufficient to support Samba requirements. On Alpha, however, the default is just 288 pagelets (144KB), which may be insufficient.

When the process dynamic memory space is insufficient, Samba administrators may encounter errors similar to the following:

To determine the amount of process dynamic memory in use, execute the SHOW PROCESS/MEMORY command. If "Free Space" is depleted, increase the value of the CTLPAGES SYSGEN parameter by the following minimum amounts (pagelets):

The value of CTLPAGES is used in AUTOGEN calculations, so to change the value, VSI recommends adding the appropriate line to SYS$SYSTEM:MODPARAMS.DAT (for example, ADD_CTLPAGES=230), running AUTOGEN, and rebooting the system.

For systems running the TCPware TCP/IP stack, Samba is not able to auto-detect the active TCPware IP interface addresses. Therefore, the list of interfaces available for use by Samba must be manually configured. To do so, use SMB$CONFIG to configure Samba as a standalone server first, then edit SAMBA$ROOT:[LIB]SMB.CONF and add the appropriate parameters (explained below) to the [global] section. If desired, run SAMBA$CONFIG to reconfigure Samba as a member server.

To make all active interface addresses available to Samba, list those addresses and their subnet masks separating them with a comma or a space as values for the “interfaces” global parameter. Be sure to always include the localhost address (127.0.0.1) in the list of allowed interfaces.

For example, you may add an entry similar to the following to SMB.CONF (setting address details as appropriate to your environment and making sure to include localhost):

interfaces = 10.100.10.1/24, 127.0.0.1

To make only a subset of active interface addresses available to Samba, include just the addresses and the subnet masks of the allowed interfaces in the interfaces list and also specify “bind interfaces only = yes”.

For example, if the host has three interfaces: 10.10.1.1/24, 192.168.0.10/16, and 44.4.1.1/10 and Samba is to use only the 10.10.1.1/24 and 192.168.0.10/16 interfaces, then you would specify the following in SMB.CONF:

interfaces = 10.10.1.1/24, 192.168.0.10, 127.0.0.1
bind interfaces only = yes