HP CIFS Server Administrator's Guide Version A.03.01.01 (5900-1282, May 2011)

Configuring HP CIFS Server to enable SSL
Configure the following smb.conf parameters to enable SSL:
• For HP CIFS Server A.02.* as well as A.03.01.01 versions, set the following parameter in
the [Global] section of the smb.conf file:
passwd backend = ldapsam:ldaps://<directory server name>
Where <directory server name> is the fully qualified name of the target directory server.
• HP CIFS Server A.02.03 or later supports the start_tls option to the ldap_ssl parameter.
To enable SSL connections to the directory server, set the following parameters one of the two
ways shown below in the [Global] section of the smb.conf file:
To use the SSL port 636 set:
ldap ssl = yes
If you choose to use the Start TLS option with port 389 set:
ldap ssl = start_tls
For detailed information on how to enable SSL on the HP CIFS Server, see “LDAP Configuration
Parameters” (page 92).
Extending the Samba Subschema into Your Directory Server
You now need to extend the Directory Server schema with the Samba subschema from the HP CIFS
Server into your Directory Server. Ensure that you have configured your LDAP directory and LDAP-UX
Client Services before extending the schema.
Set the passwd backend parameter to ldapsam:ldap://<ldap server name>.
Samba Subschema Differences Between HP CIFS Server Versions
New HP CIFS Server releases sometimes extend the attributes for use but update are backwards
compatible with older versions of LDAP schemas.
Procedures to Extend the Samba Subschema into Your Directory
Use the following steps to extend the Samba subschema
/opt/samba/LDAP3/98samba–3.4.3.ldif in HP CIFS Server A.02.* into the Directory
Server:
1. Run the ftp commands to get the /opt/samba/LDAP3/98samba-3.4.3.ldif file from
the HP CIFS Server and place it in the Directory Server:
For example, the following commands copy /opt/samba/LDAP3/98samba-3.4.3.ldif
file from the HP CIFS Server to the /var/opt/netscape/servers/
sldapd-hostA.hp.com/config/schema/98samba-3.4.3.ldif file in the Directory
Server, hostA.hp.com:
cd /opt/samba/LDAP3
ftp hostA.org.hp.com
user root
root passwd
cd /var/opt/netscape/servers/sldapd-hostA.hp.com/config/schema
put 98samba-3.4.3.ldif
quit
2. Login to your Directory Server and restart the daemon, slapd. This is to ensure that the
sambaSamAccount subschema is recognized by the LDAP directory.
$ /var/opt/netscape/servers/slapd-<server name>/restart-slapd
For example:
$ /var/opt/netscape/servers/slapd-hostA.hp.com/restart-slapd
88 LDAP Integration Support