diff options
Diffstat (limited to 'docs/yodldocs/smb.conf.5.yo')
| -rw-r--r-- | docs/yodldocs/smb.conf.5.yo | 7029 |
1 files changed, 0 insertions, 7029 deletions
diff --git a/docs/yodldocs/smb.conf.5.yo b/docs/yodldocs/smb.conf.5.yo deleted file mode 100644 index 70603d15ce8..00000000000 --- a/docs/yodldocs/smb.conf.5.yo +++ /dev/null @@ -1,7029 +0,0 @@ -mailto(samba@samba.org) - -manpage(smb.conf htmlcommand((5)))(5)(23 Oct 1998)(Samba)(SAMBA) - -label(NAME) -manpagename(smb.conf)(The configuration file for the Samba suite) - -label(SYNOPSIS) -manpagesynopsis() - -bf(smb.conf) The bf(smb.conf) file is a configuration file for the -Samba suite. bf(smb.conf) contains runtime configuration information -for the Samba programs. The bf(smb.conf) file is designed to be -configured and administered by the url(bf(swat (8)))(swat.8.html) -program. The complete description of the file format and possible -parameters held within are here for reference purposes. - -label(FILEFORMAT) -manpagesection(FILE FORMAT) - -The file consists of sections and parameters. A section begins with -the name of the section in square brackets and continues until the -next section begins. Sections contain parameters of the form - -tt('name = value') - -The file is line-based - that is, each newline-terminated line -represents either a comment, a section name or a parameter. - -Section and parameter names are not case sensitive. - -Only the first equals sign in a parameter is significant. Whitespace -before or after the first equals sign is discarded. Leading, trailing -and internal whitespace in section and parameter names is -irrelevant. Leading and trailing whitespace in a parameter value is -discarded. Internal whitespace within a parameter value is retained -verbatim. - -Any line beginning with a semicolon (';') or a hash ('#') character is -ignored, as are lines containing only whitespace. - -Any line ending in a tt('\') is "continued" on the next line in the -customary UNIX fashion. - -The values following the equals sign in parameters are all either a -string (no quotes needed) or a boolean, which may be given as yes/no, -0/1 or true/false. Case is not significant in boolean values, but is -preserved in string values. Some items such as create modes are -numeric. - -label(SECTIONDESCRIPTIONS) -manpagesection(SECTION DESCRIPTIONS) - -Each section in the configuration file (except for the -link(bf([global]))(global) section) describes a shared resource (known -as a em("share")). The section name is the name of the shared resource -and the parameters within the section define the shares attributes. - -There are three special sections, link(bf([global]))(global), -link(bf([homes]))(homes) and link(bf([printers]))(printers), which are -described under link(bf('special sections'))(SPECIALSECTIONS). The -following notes apply to ordinary section descriptions. - -A share consists of a directory to which access is being given plus -a description of the access rights which are granted to the user of -the service. Some housekeeping options are also specifiable. - -Sections are either filespace services (used by the client as an -extension of their native file systems) or printable services (used by -the client to access print services on the host running the server). - -Sections may be designated link(bf(guest))(guestok) services, in which -case no password is required to access them. A specified UNIX -link(bf(guest account))(guestaccount) is used to define access -privileges in this case. - -Sections other than guest services will require a password to access -them. The client provides the username. As older clients only provide -passwords and not usernames, you may specify a list of usernames to -check against the password using the link(bf("user="))(user) option in -the share definition. For modern clients such as Windows 95/98 and -Windows NT, this should not be necessary. - -Note that the access rights granted by the server are masked by the -access rights granted to the specified or guest UNIX user by the host -system. The server does not grant more access than the host system -grants. - -The following sample section defines a file space share. The user has -write access to the path tt(/home/bar). The share is accessed via -the share name "foo": - -verb( - - [foo] - path = /home/bar - writeable = true - -) - -The following sample section defines a printable share. The share -is readonly, but printable. That is, the only write access permitted -is via calls to open, write to and close a spool file. The -link(bf('guest ok'))(guestok) parameter means access will be permitted -as the default guest user (specified elsewhere): - -verb( - [aprinter] - path = /usr/spool/public - writeable = false - printable = true - guest ok = true -) - -label(SPECIALSECTIONS) -manpagesection(SPECIAL SECTIONS) - -startdit() - -label(global) -dit(bf(The [global] section)) - -Parameters in this section apply to the server as a whole, or are -defaults for sections which do not specifically define certain -items. See the notes under link(bf('PARAMETERS'))(PARAMETERS) for more -information. - -label(homes) -dit(bf(The [homes] section)) - -If a section called tt('homes') is included in the configuration file, -services connecting clients to their home directories can be created -on the fly by the server. - -When the connection request is made, the existing sections are -scanned. If a match is found, it is used. If no match is found, the -requested section name is treated as a user name and looked up in the -local password file. If the name exists and the correct password has -been given, a share is created by cloning the [homes] section. - -Some modifications are then made to the newly created share: - -startit() - -it() The share name is changed from tt('homes') to the located -username - -it() If no path was given, the path is set to the user's home -directory. - -endit() - -If you decide to use a link(bf(path=))(path) line in your [homes] -section then you may find it useful to use the link(bf(%S))(percentS) -macro. For example : - -tt(path=/data/pchome/%S) - -would be useful if you have different home directories for your PCs -than for UNIX access. - -This is a fast and simple way to give a large number of clients access -to their home directories with a minimum of fuss. - -A similar process occurs if the requested section name is tt("homes"), -except that the share name is not changed to that of the requesting -user. This method of using the [homes] section works well if different -users share a client PC. - -The [homes] section can specify all the parameters a normal service -section can specify, though some make more sense than others. The -following is a typical and suitable [homes] section: - -verb( - [homes] - writeable = yes -) - -An important point is that if guest access is specified in the [homes] -section, all home directories will be visible to all clients -bf(without a password). In the very unlikely event that this is -actually desirable, it would be wise to also specify link(bf(read only -access))(readonly). - -Note that the link(bf(browseable))(browseable) flag for auto home -directories will be inherited from the global browseable flag, not the -[homes] browseable flag. This is useful as it means setting -browseable=no in the [homes] section will hide the [homes] share but -make any auto home directories visible. - -label(printers) -dit(bf(The [printers] section)) - -This section works like link(bf([homes]))(homes), but for printers. - -If a bf([printers]) section occurs in the configuration file, users are -able to connect to any printer specified in the local host's printcap -file. - -When a connection request is made, the existing sections are -scanned. If a match is found, it is used. If no match is found, but a -link(bf([homes]))(homes) section exists, it is used as described -above. Otherwise, the requested section name is treated as a printer -name and the appropriate printcap file is scanned to see if the -requested section name is a valid printer share name. If a match is -found, a new printer share is created by cloning the bf([printers]) -section. - -A few modifications are then made to the newly created share: - -startit() - -it() The share name is set to the located printer name - -it() If no printer name was given, the printer name is set to the -located printer name - -it() If the share does not permit guest access and no username was -given, the username is set to the located printer name. - -endit() - -Note that the bf([printers]) service MUST be printable - if you specify -otherwise, the server will refuse to load the configuration file. - -Typically the path specified would be that of a world-writeable spool -directory with the sticky bit set on it. A typical bf([printers]) entry -would look like this: - -verb( - [printers] - path = /usr/spool/public - guest ok = yes - printable = yes -) - -All aliases given for a printer in the printcap file are legitimate -printer names as far as the server is concerned. If your printing -subsystem doesn't work like that, you will have to set up a -pseudo-printcap. This is a file consisting of one or more lines like -this: - -verb( alias|alias|alias|alias... ) - -Each alias should be an acceptable printer name for your printing -subsystem. In the link(bf([global]))(global) section, specify the new -file as your printcap. The server will then only recognize names -found in your pseudo-printcap, which of course can contain whatever -aliases you like. The same technique could be used simply to limit -access to a subset of your local printers. - -An alias, by the way, is defined as any component of the first entry -of a printcap record. Records are separated by newlines, components -(if there are more than one) are separated by vertical bar symbols -("|"). - -NOTE: On SYSV systems which use lpstat to determine what printers are -defined on the system you may be able to use link(bf("printcap name = -lpstat"))(printcapname) to automatically obtain a list of -printers. See the link(bf("printcap name"))(printcapname) option for -more details. - -enddit() - -label(PARAMETERS) -manpagesection(PARAMETERS) - -Parameters define the specific attributes of sections. - -Some parameters are specific to the link(bf([global]))(global) section -(e.g., link(bf(security))(security)). Some parameters are usable in -all sections (e.g., link(bf(create mode))(createmode)). All others are -permissible only in normal sections. For the purposes of the following -descriptions the link(bf([homes]))(homes) and -link(bf([printers]))(printers) sections will be considered normal. -The letter tt('G') in parentheses indicates that a parameter is -specific to the link(bf([global]))(global) section. The letter tt('S') -indicates that a parameter can be specified in a service specific -section. Note that all tt('S') parameters can also be specified in the -link(bf([global]))(global) section - in which case they will define -the default behavior for all services. - -Parameters are arranged here in alphabetical order - this may not -create best bedfellows, but at least you can find them! Where there -are synonyms, the preferred synonym is described, others refer to the -preferred synonym. - -label(VARIABLESUBSTITUTIONS) -manpagesection(VARIABLE SUBSTITUTIONS) - -Many of the strings that are settable in the config file can take -substitutions. For example the option link(bf(tt("path = -/tmp/%u")))(path) would be interpreted as tt("path = /tmp/john") if -the user connected with the username john. - -These substitutions are mostly noted in the descriptions below, but -there are some general substitutions which apply whenever they might -be relevant. These are: - -startit() - -label(percentS) -it() bf(%S) = the name of the current service, if any. - -label(percentP) -it() bf(%P) = the root directory of the current service, if any. - -label(percentu) -it() bf(%u) = user name of the current service, if any. - -label(percentg) -it() bf(%g) = primary group name of link(bf(%u))(percentu). - -label(percentU) -it() bf(%U) = session user name (the user name that -the client wanted, not necessarily the same as the one they got). - -label(percentG) -it() bf(%G) = primary group name of link(bf(%U))(percentU). - -label(percentH) -it() bf(%H) = the home directory of the user given by link(bf(%u))(percentu). - -label(percentv) -it() bf(%v) = the Samba version. - -label(percenth) -it() bf(%h) = the internet hostname that Samba is running on. - -label(percentm) -it() bf(%m) = the NetBIOS name of the client machine (very useful). - -label(percentL) -it() bf(%L) = the NetBIOS name of the server. This allows you to change your -config based on what the client calls you. Your server can have a "dual -personality". - -label(percentM) -it() bf(%M) = the internet name of the client machine. - -label(percentN) -it() bf(%N) = the name of your NIS home directory server. This is -obtained from your NIS auto.map entry. If you have not compiled Samba -with the bf(--with-automount) option then this value will be the same -as link(bf(%L))(percentL). - -label(percentp) -it() bf(%p) = the path of the service's home directory, obtained from your NIS -auto.map entry. The NIS auto.map entry is split up as "%N:%p". - -label(percentR) -it() bf(%R) = the selected protocol level after protocol -negotiation. It can be one of CORE, COREPLUS, LANMAN1, LANMAN2 or NT1. - -label(percentd) -it() bf(%d) = The process id of the current server process. - -label(percenta) -it() bf(%a) = the architecture of the remote -machine. Only some are recognized, and those may not be 100% -reliable. It currently recognizes Samba, WfWg, WinNT and -Win95. Anything else will be known as "UNKNOWN". If it gets it wrong -then sending a level 3 log to email(samba@samba.org) -should allow it to be fixed. - -label(percentI) -it() bf(%I) = The IP address of the client machine. - -label(percentT) -it() bf(%T) = the current date and time. - -label(percentDollar) -it() bf(%$(envvar)) = The value of the environment variable bf(envar). - -endit() - -There are some quite creative things that can be done with these -substitutions and other smb.conf options. - -label(NAMEMANGLING) -manpagesection(NAME MANGLING) - -Samba supports em("name mangling") so that DOS and Windows clients can -use files that don't conform to the 8.3 format. It can also be set to -adjust the case of 8.3 format filenames. - -There are several options that control the way mangling is performed, -and they are grouped here rather than listed separately. For the -defaults look at the output of the testparm program. - -All of these options can be set separately for each service (or -globally, of course). - -The options are: - -label(manglecaseoption) -bf("mangle case = yes/no") controls if names that have characters that -aren't of the "default" case are mangled. For example, if this is yes -then a name like tt("Mail") would be mangled. Default em(no). - -label(casesensitiveoption) -bf("case sensitive = yes/no") controls whether filenames are case -sensitive. If they aren't then Samba must do a filename search and -match on passed names. Default em(no). - -label(defaultcaseoption) -bf("default case = upper/lower") controls what the default case is for new -filenames. Default em(lower). - -label(preservecaseoption) -bf("preserve case = yes/no") controls if new files are created with the -case that the client passes, or if they are forced to be the tt("default") -case. Default em(Yes). - -label(shortpreservecaseoption) - -bf("short preserve case = yes/no") controls if new files which conform -to 8.3 syntax, that is all in upper case and of suitable length, are -created upper case, or if they are forced to be the tt("default") -case. This option can be use with link(bf("preserve case = -yes"))(preservecaseoption) to permit long filenames to retain their -case, while short names are lowered. Default em(Yes). - -By default, Samba 2.0 has the same semantics as a Windows NT -server, in that it is case insensitive but case preserving. - -label(NOTEABOUTUSERNAMEPASSWORDVALIDATION) -manpagesection(NOTE ABOUT USERNAME/PASSWORD VALIDATION) - -There are a number of ways in which a user can connect to a -service. The server follows the following steps in determining if it -will allow a connection to a specified service. If all the steps fail -then the connection request is rejected. If one of the steps pass then -the following steps are not checked. - -If the service is marked link(bf("guest only = yes"))(guestonly) then -steps 1 to 5 are skipped. - -starteit() - -eit() Step 1: If the client has passed a username/password pair and -that username/password pair is validated by the UNIX system's password -programs then the connection is made as that username. Note that this -includes the tt(\\server\service%username) method of passing a -username. - -eit() Step 2: If the client has previously registered a username with -the system and now supplies a correct password for that username then -the connection is allowed. - -eit() Step 3: The client's netbios name and any previously used user -names are checked against the supplied password, if they match then -the connection is allowed as the corresponding user. - -eit() Step 4: If the client has previously validated a -username/password pair with the server and the client has passed the -validation token then that username is used. - -eit() Step 5: If a link(bf("user = "))(user) field is given in the -smb.conf file for the service and the client has supplied a password, -and that password matches (according to the UNIX system's password -checking) with one of the usernames from the link(bf(user=))(user) -field then the connection is made as the username in the -link(bf("user="))(user) line. If one of the username in the -link(bf(user=))(user) list begins with a tt('@') then that name -expands to a list of names in the group of the same name. - -eit() Step 6: If the service is a guest service then a connection is -made as the username given in the link(bf("guest account -="))(guestaccount) for the service, irrespective of the supplied -password. - -endeit() - -label(COMPLETELISTOFGLOBALPARAMETERS) -manpagesection(COMPLETE LIST OF GLOBAL PARAMETERS) - -Here is a list of all global parameters. See the section of each -parameter for details. Note that some are synonyms. - -startit() - -it() link(bf(add user script))(adduserscript) - -it() link(bf(allow trusted domains))(allowtrusteddomains) - -it() link(bf(announce as))(announceas) - -it() link(bf(announce version))(announceversion) - -it() link(bf(auto services))(autoservices) - -it() link(bf(bind interfaces only))(bindinterfacesonly) - -it() link(bf(browse list))(browselist) - -it() link(bf(change notify timeout))(changenotifytimeout) - -it() link(bf(character set))(characterset) - -it() link(bf(client code page))(clientcodepage) - -it() link(bf(coding system))(codingsystem) - -it() link(bf(config file))(configfile) - -it() link(bf(deadtime))(deadtime) - -it() link(bf(debug hires timestamp))(debughirestimestamp) - -it() link(bf(debug pid))(debugpid) - -it() link(bf(debug timestamp))(debugtimestamp) - -it() link(bf(debug uid))(debuguid) - -it() link(bf(debug level))(debuglevel) - -it() link(bf(default))(default) - -it() link(bf(default service))(defaultservice) - -it() link(bf(delete user script))(deleteuserscript) - -it() link(bf(dfree command))(dfreecommand) - -it() link(bf(dns proxy))(dnsproxy) - -it() link(bf(domain admin group))(domainadmingroup) - -it() link(bf(domain admin users))(domainadminusers) - -it() link(bf(domain groups))(domaingroups) - -it() link(bf(domain guest group))(domainguestgroup) - -it() link(bf(domain guest users))(domainguestusers) - -it() link(bf(domain logons))(domainlogons) - -it() link(bf(domain master))(domainmaster) - -it() link(bf(encrypt passwords))(encryptpasswords) - -it() link(bf(enhanced browsing))(enhancedbrowsing) - -it() link(bf(getwd cache))(getwdcache) - -it() link(bf(hide local users))(hidelocalusers) - -it() link(bf(homedir map))(homedirmap) - -it() link(bf(hosts equiv))(hostsequiv) - -it() link(bf(interfaces))(interfaces) - -it() link(bf(keepalive))(keepalive) - -it() link(bf(kernel oplocks))(kerneloplocks) - -it() link(bf(ldap filter))(ldapfilter) - -it() link(bf(ldap port))(ldapport) - -it() link(bf(ldap root))(ldaproot) - -it() link(bf(ldap root passwd))(ldaprootpasswd) - -it() link(bf(ldap server))(ldapserver) - -it() link(bf(ldap suffix))(ldapsuffix) - -it() link(bf(lm announce))(lmannounce) - -it() link(bf(lm interval))(lminterval) - -it() link(bf(load printers))(loadprinters) - -it() link(bf(local master))(localmaster) - -it() link(bf(lock dir))(lockdir) - -it() link(bf(lock directory))(lockdirectory) - -it() link(bf(log file))(logfile) - -it() link(bf(log level))(loglevel) - -it() link(bf(logon drive))(logondrive) - -it() link(bf(logon home))(logonhome) - -it() link(bf(logon path))(logonpath) - -it() link(bf(logon script))(logonscript) - -it() link(bf(lpq cache time))(lpqcachetime) - -it() link(bf(machine password timeout))(machinepasswordtimeout) - -it() link(bf(mangled stack))(mangledstack) - -it() link(bf(map to guest))(maptoguest) - -it() link(bf(max disk size))(maxdisksize) - -it() link(bf(max log size))(maxlogsize) - -it() link(bf(max mux))(maxmux) - -it() link(bf(max open files))(maxopenfiles) - -it() link(bf(max packet))(maxpacket) - -it() link(bf(max ttl))(maxttl) - -it() link(bf(max wins ttl))(maxwinsttl) - -it() link(bf(max xmit))(maxxmit) - -it() link(bf(message command))(messagecommand) - -it() link(bf(min passwd length))(minpasswdlength) - -it() link(bf(min password length))(minpasswordlength) - -it() link(bf(min wins ttl))(minwinsttl) - -it() link(bf(name resolve order))(nameresolveorder) - -it() link(bf(netbios aliases))(netbiosaliases) - -it() link(bf(netbios name))(netbiosname) - -it() link(bf(netbios scope))(netbiosscope) - -it() link(bf(nis homedir))(nishomedir) - -it() link(bf(nt acl support))(ntaclsupport) - -it() link(bf(nt pipe support))(ntpipesupport) - -it() link(bf(nt smb support))(ntsmbsupport) - -it() link(bf(null passwords))(nullpasswords) - -it() link(bf(ole locking compatibility))(olelockingcompatibility) - -it() link(bf(oplock break wait time))(oplockbreakwaittime) - -it() link(bf(os level))(oslevel) - -it() link(bf(packet size))(packetsize) - -it() link(bf(panic action))(panicaction) - -it() link(bf(passwd chat))(passwdchat) - -it() link(bf(passwd chat debug))(passwdchatdebug) - -it() link(bf(passwd program))(passwdprogram) - -it() link(bf(password level))(passwordlevel) - -it() link(bf(password server))(passwordserver) - -it() link(bf(prefered master))(preferedmaster) - -it() link(bf(preferred master))(preferredmaster) - -it() link(bf(preload))(preload) - -it() link(bf(printcap))(printcap) - -it() link(bf(printcap name))(printcapname) - -it() link(bf(printer driver file))(printerdriverfile) - -it() link(bf(private dir))(privatedir) - -it() link(bf(protocol))(protocol) - -it() link(bf(read bmpx))(readbmpx) - -it() link(bf(read prediction))(readprediction) - -it() link(bf(read raw))(readraw) - -it() link(bf(read size))(readsize) - -it() link(bf(remote announce))(remoteannounce) - -it() link(bf(remote browse sync))(remotebrowsesync) - -it() link(bf(restrict anonymous))(restrictanonymous) - -it() link(bf(root))(root) - -it() link(bf(root dir))(rootdir) - -it() link(bf(root directory))(rootdirectory) - -it() link(bf(security))(security) - -it() link(bf(server string))(serverstring) - -it() link(bf(shared mem size))(sharedmemsize) - -it() link(bf(smb passwd file))(smbpasswdfile) - -it() link(bf(smbrun))(smbrun) - -it() link(bf(socket address))(socketaddress) - -it() link(bf(socket options))(socketoptions) - -it() link(bf(source environment))(sourceenvironment) - -it() link(bf(ssl))(ssl) - -it() link(bf(ssl CA certDir))(sslCAcertDir) - -it() link(bf(ssl CA certFile))(sslCAcertFile) - -it() link(bf(ssl ciphers))(sslciphers) - -it() link(bf(ssl client cert))(sslclientcert) - -it() link(bf(ssl client key))(sslclientkey) - -it() link(bf(ssl compatibility))(sslcompatibility) - -it() link(bf(ssl hosts))(sslhosts) - -it() link(bf(ssl hosts resign))(sslhostsresign) - -it() link(bf(ssl require clientcert))(sslrequireclientcert) - -it() link(bf(ssl require servercert))(sslrequireservercert) - -it() link(bf(ssl server cert))(sslservercert) - -it() link(bf(ssl server key))(sslserverkey) - -it() link(bf(ssl version))(sslversion) - -it() link(bf(stat cache))(statcache) - -it() link(bf(stat cache size))(statcachesize) - -it() link(bf(strip dot))(stripdot) - -it() link(bf(syslog))(syslog) - -it() link(bf(syslog only))(syslogonly) - -it() link(bf(template homedir))(templatehomedir) - -it() link(bf(template shell))(templateshell) - -it() link(bf(time offset))(timeoffset) - -it() link(bf(time server))(timeserver) - -it() link(bf(timestamp logs))(timestamplogs) - -it() link(bf(unix password sync))(unixpasswordsync) - -it() link(bf(unix realname))(unixrealname) - -it() link(bf(update encrypted))(updateencrypted) - -it() link(bf(use rhosts))(userhosts) - -it() link(bf(username level))(usernamelevel) - -it() link(bf(username map))(usernamemap) - -it() link(bf(utmp directory))(utmpdirectory) - -it() link(bf(valid chars))(validchars) - -it() link(bf(winbind cache time))(winbindcachetime) - -it() link(bf(winbind gid))(winbindgid) - -it() link(bf(winbind uid))(winbinduid) - -it() link(bf(wins hook))(winshook) - -it() link(bf(wins proxy))(winsproxy) - -it() link(bf(wins server))(winsserver) - -it() link(bf(wins support))(winssupport) - -it() link(bf(workgroup))(workgroup) - -it() link(bf(write raw))(writeraw) - -endit() - -label(COMPLETELISTOFSERVICEPARAMETERS) -manpagesection(COMPLETE LIST OF SERVICE PARAMETERS) - -Here is a list of all service parameters. See the section of each -parameter for details. Note that some are synonyms. - -startit() - -it() link(bf(admin users))(adminusers) - -it() link(bf(allow hosts))(allowhosts) - -it() link(bf(alternate permissions))(alternatepermissions) - -it() link(bf(available))(available) - -it() link(bf(blocking locks))(blockinglocks) - -it() link(bf(browsable))(browsable) - -it() link(bf(browseable))(browseable) - -it() link(bf(case sensitive))(casesensitive) - -it() link(bf(casesignames))(casesignames) - -it() link(bf(comment))(comment) - -it() link(bf(copy))(copy) - -it() link(bf(create mask))(createmask) - -it() link(bf(create mode))(createmode) - -it() link(bf(default case))(defaultcase) - -it() link(bf(delete readonly))(deletereadonly) - -it() link(bf(delete veto files))(deletevetofiles) - -it() link(bf(deny hosts))(denyhosts) - -it() link(bf(directory))(directory) - -it() link(bf(directory mask))(directorymask) - -it() link(bf(directory mode))(directorymode) - -it() link(bf(directory security mask))(directorysecuritymask) - -it() link(bf(dont descend))(dontdescend) - -it() link(bf(dos filetime resolution))(dosfiletimeresolution) - -it() link(bf(dos filetimes))(dosfiletimes) - -it() link(bf(exec))(exec) - -it() link(bf(fake directory create times))(fakedirectorycreatetimes) - -it() link(bf(fake oplocks))(fakeoplocks) - -it() link(bf(follow symlinks))(followsymlinks) - -it() link(bf(force create mode))(forcecreatemode) - -it() link(bf(force directory mode))(forcedirectorymode) - -it() link(bf(force directory security mode))(forcedirectorysecuritymode) - -it() link(bf(force group))(forcegroup) - -it() link(bf(force security mode))(forcesecuritymode) - -it() link(bf(force user))(forceuser) - -it() link(bf(fstype))(fstype) - -it() link(bf(group))(group) - -it() link(bf(guest account))(guestaccount) - -it() link(bf(guest ok))(guestok) - -it() link(bf(guest only))(guestonly) - -it() link(bf(hide dot files))(hidedotfiles) - -it() link(bf(hide files))(hidefiles) - -it() link(bf(hosts allow))(hostsallow) - -it() link(bf(hosts deny))(hostsdeny) - -it() link(bf(include))(include) - -it() link(bf(inherit permissions))(inheritpermissions) - -it() link(bf(invalid users))(invalidusers) - -it() link(bf(level2 oplocks))(level2oplocks) - -it() link(bf(locking))(locking) - -it() link(bf(lppause command))(lppausecommand) - -it() link(bf(lpq command))(lpqcommand) - -it() link(bf(lpresume command))(lpresumecommand) - -it() link(bf(lprm command))(lprmcommand) - -it() link(bf(magic output))(magicoutput) - -it() link(bf(magic script))(magicscript) - -it() link(bf(mangle case))(manglecase) - -it() link(bf(mangle locks))(manglelocks) - -it() link(bf(mangled map))(mangledmap) - -it() link(bf(mangled names))(manglednames) - -it() link(bf(mangling char))(manglingchar) - -it() link(bf(map archive))(maparchive) - -it() link(bf(map hidden))(maphidden) - -it() link(bf(map system))(mapsystem) - -it() link(bf(max connections))(maxconnections) - -it() link(bf(min print space))(minprintspace) - -it() link(bf(only guest))(onlyguest) - -it() link(bf(only user))(onlyuser) - -it() link(bf(oplock contention limit))(oplockcontentionlimit) - -it() link(bf(oplocks))(oplocks) - -it() link(bf(path))(path) - -it() link(bf(postexec))(postexec) - -it() link(bf(postscript))(postscript) - -it() link(bf(preexec))(preexec) - -it() link(bf(preexec close))(preexecclose) - -it() link(bf(preserve case))(preservecase) - -it() link(bf(print command))(printcommand) - -it() link(bf(print ok))(printok) - -it() link(bf(printable))(printable) - -it() link(bf(printer))(printer) - -it() link(bf(printer admin))(printer admin) - -it() link(bf(printer driver))(printerdriver) - -it() link(bf(printer driver location))(printerdriverlocation) - -it() link(bf(printer name))(printername) - -it() link(bf(printing))(printing) - -it() link(bf(public))(public) - -it() link(bf(queuepause command))(queuepausecommand) - -it() link(bf(queueresume command))(queueresumecommand) - -it() link(bf(read list))(readlist) - -it() link(bf(read only))(readonly) - -it() link(bf(root postexec))(rootpostexec) - -it() link(bf(root preexec))(rootpreexec) - -it() link(bf(root preexec close))(rootpreexecclose) - -it() link(bf(security mask))(securitymask) - -it() link(bf(set directory))(setdirectory) - -it() link(bf(share modes))(sharemodes) - -it() link(bf(short preserve case))(shortpreservecase) - -it() link(bf(status))(status) - -it() link(bf(strict locking))(strictlocking) - -it() link(bf(strict sync))(strictsync) - -it() link(bf(sync always))(syncalways) - -it() link(bf(user))(user) - -it() link(bf(username))(username) - -it() link(bf(users))(users) - -it() link(bf(utmp))(utmp) - -it() link(bf(valid users))(validusers) - -it() link(bf(veto files))(vetofiles) - -it() link(bf(veto oplock files))(vetooplockfiles) - -it() link(bf(volume))(volume) - -it() link(bf(wide links))(widelinks) - -it() link(bf(writable))(writable) - -it() link(bf(write cache size))(writecachesize) - -it() link(bf(write list))(writelist) - -it() link(bf(write ok))(writeok) - -it() link(bf(writeable))(writeable) - -endit() - -label(EXPLANATIONOFEACHPARAMETER) -manpagesection(EXPLANATION OF EACH PARAMETER) - -startdit() - -label(adduserscript) -dit(bf(add user script (G))) - -This is the full pathname to a script that will be run em(AS ROOT) by -url(bf(smbd (8)))(smbd.8.html) under special circumstances decribed -below. - -Normally, a Samba server requires that UNIX users are created for all -users accessing files on this server. For sites that use Windows NT -account databases as their primary user database creating these users -and keeping the user list in sync with the Windows NT PDC is an -onerous task. This option allows url(bf(smbd))(smbd.8.html) to create -the required UNIX users em(ON DEMAND) when a user accesses the Samba -server. - -In order to use this option, url(bf(smbd))(smbd.8.html) must be set to -link(bf(security=server))(securityequalserver) or -link(bf(security=domain))(securityequaldomain) and bf("add user script") -must be set to a full pathname for a script that will create a UNIX user -given one argument of bf(%u), which expands into the UNIX user name to -create. - -When the Windows user attempts to access the Samba server, at -em("login")(session setup in the SMB protocol) time, -url(bf(smbd))(smbd.8.html) contacts the link(bf(password -server))(passwordserver) and attempts to authenticate the given user -with the given password. If the authentication succeeds then -url(bf(smbd))(smbd.8.html) attempts to find a UNIX user in the UNIX -password database to map the Windows user into. If this lookup fails, -and bf("add user script") is set then url(bf(smbd))(smbd.8.html) will -call the specified script em(AS ROOT), expanding any bf(%u) argument -to be the user name to create. - -If this script successfully creates the user then -url(bf(smbd))(smbd.8.html) will continue on as though the UNIX user -already existed. In this way, UNIX users are dynamically created to -match existing Windows NT accounts. - -See also link(bf(security=server))(securityequalserver), -link(bf(security=domain))(securityequaldomain), link(bf(password -server))(passwordserver), link(bf(delete user -script))(deleteuserscript). - - bf(Default:) -tt( add user script = <empty string>) - - bf(Example:) -tt( add user script = /usr/local/samba/bin/add_user %u) - -label(adminusers) -dit(bf(admin users (S))) - -This is a list of users who will be granted administrative privileges -on the share. This means that they will do all file operations as the -super-user (root). - -You should use this option very carefully, as any user in this list -will be able to do anything they like on the share, irrespective of -file permissions. - - bf(Default:) nl() -tt( no admin users) - - bf(Example:) nl() -tt( admin users = jason) - -label(allow hosts) -dit(bf(allow hosts (S))) - -Synonym for link(bf(hosts allow))(hostsallow). - -label(allowtrusteddomains) -dit(bf(allow trusted domains (G))) - -This option only takes effect when the link(bf(security))(security) -option is set to bf(server) or bf(domain). If it is set to no, -then attempts to connect to a resource from a domain or workgroup other than -the one which smbd is running in will fail, even if that domain -is trusted by the remote server doing the authentication. - -This is useful if you only want your Samba server to serve resources -to users in the domain it is a member of. As an example, suppose that there are -two domains DOMA and DOMB. DOMB is trusted by DOMA, which contains -the Samba server. Under normal circumstances, a user with an account -in DOMB can then access the resources of a UNIX account with the same -account name on the Samba server even if they do not have an account -in DOMA. This can make implementing a security boundary difficult. - - bf(Default:) -tt( allow trusted domains = Yes) - - bf(Example:) -tt( allow trusted domains = No) - -label(alternatepermissions) -dit(bf(alternate permissions (S))) - -This is a deprecated parameter. It no longer has any effect in Samba2.0. -In previous versions of Samba it affected the way the DOS "read only" -attribute was mapped for a file. In Samba2.0 a file is marked "read only" -if the UNIX file does not have the 'w' bit set for the owner of the file, -regardless if the owner of the file is the currently logged on user or not. - -label(announceas) -dit(bf(announce as (G))) - -This specifies what type of server url(bf(nmbd))(nmbd.8.html) will -announce itself as, to a network neighborhood browse list. By default -this is set to Windows NT. The valid options are : "NT", which is a -synonym for "NT Server", "NT Server", "NT Workstation", "Win95" or -"WfW" meaning Windows NT Server, Windows NT Workstation, Windows 95 -and Windows for Workgroups respectively. Do not change this parameter -unless you have a specific need to stop Samba appearing as an NT server -as this may prevent Samba servers from participating as browser servers correctly. - - bf(Default:) -tt( announce as = NT Server) - - bf(Example) -tt( announce as = Win95) - -label(announceversion) -dit(bf(announce version (G))) - -This specifies the major and minor version numbers that nmbd will use -when announcing itself as a server. The default is 4.2. Do not change -this parameter unless you have a specific need to set a Samba server -to be a downlevel server. - - bf(Default:) -tt( announce version = 4.2) - - bf(Example:) -tt( announce version = 2.0) - - -label(autoservices) -dit(bf(auto services (G))) - -This is a list of services that you want to be automatically added to -the browse lists. This is most useful for homes and printers services -that would otherwise not be visible. - -Note that if you just want all printers in your printcap file loaded -then the link(bf("load printers"))(loadprinters) option is easier. - - bf(Default:) -tt( no auto services) - - bf(Example:) -tt( auto services = fred lp colorlp) - -label(available) -dit(bf(available (S))) - -This parameter lets you em('turn off') a service. If tt('available = no'), -then em(ALL) attempts to connect to the service will fail. Such failures -are logged. - - bf(Default:) -tt( available = yes) - - bf(Example:) -tt( available = no) - -label(bindinterfacesonly) -dit(bf(bind interfaces only (G))) - -This global parameter allows the Samba admin to limit what interfaces -on a machine will serve smb requests. If affects file service -url(bf(smbd))(smbd.8.html) and name service url(bf(nmbd))(nmbd.8.html) -in slightly different ways. - -For name service it causes url(bf(nmbd))(nmbd.8.html) to bind to ports -137 and 138 on the interfaces listed in the -link(bf('interfaces'))(interfaces) -parameter. url(bf(nmbd))(nmbd.8.html) also binds to the 'all -addresses' interface (0.0.0.0) on ports 137 and 138 for the purposes -of reading broadcast messages. If this option is not set then -url(bf(nmbd))(nmbd.8.html) will service name requests on all of these -sockets. If bf("bind interfaces only") is set then -url(bf(nmbd))(nmbd.8.html) will check the source address of any -packets coming in on the broadcast sockets and discard any that don't -match the broadcast addresses of the interfaces in the -link(bf('interfaces'))(interfaces) parameter list. As unicast packets -are received on the other sockets it allows url(bf(nmbd))(nmbd.8.html) -to refuse to serve names to machines that send packets that arrive -through any interfaces not listed in the -link(bf("interfaces"))(interfaces) list. IP Source address spoofing -does defeat this simple check, however so it must not be used -seriously as a security feature for url(bf(nmbd))(nmbd.8.html). - -For file service it causes url(bf(smbd))(smbd.8.html) to bind only to -the interface list given in the link(bf('interfaces'))(interfaces) -parameter. This restricts the networks that url(bf(smbd))(smbd.8.html) -will serve to packets coming in those interfaces. Note that you -should not use this parameter for machines that are serving PPP or -other intermittent or non-broadcast network interfaces as it will not -cope with non-permanent interfaces. - -If bf("bind interfaces only") is set then unless the network address -em(127.0.0.1) is added to the link(bf('interfaces'))(interfaces) parameter -list url(bf(smbpasswd))(smbpasswd.8.html) and -url(bf(swat))(swat.8.html) may not work as expected due to the -reasons covered below. - -To change a users SMB password, the url(bf(smbpasswd))(smbpasswd.8.html) -by default connects to the em("localhost" - 127.0.0.1) address as an SMB -client to issue the password change request. If bf("bind interfaces only") -is set then unless the network address em(127.0.0.1) is added to the -link(bf('interfaces'))(interfaces) parameter list then -url(bf(smbpasswd))(smbpasswd.8.html) will fail to connect in it's -default mode. url(bf(smbpasswd))(smbpasswd.8.html) can be forced to -use the primary IP interface of the local host by using its -url(bf("-r remote machine"))(smbpasswd.8.html#minusr) parameter, with -bf("remote machine") set to the IP name of the primary interface -of the local host. - -The url(bf(swat))(swat.8.html) status page tries to connect with -url(bf(smbd))(smbd.8.html) and url(bf(nmbd))(nmbd.8.html) at the address -em(127.0.0.1) to determine if they are running. Not adding em(127.0.0.1) will cause -url(bf(smbd))(smbd.8.html) and url(bf(nmbd))(nmbd.8.html) to always show -"not running" even if they really are. This can prevent -url(bf(swat))(swat.8.html) from starting/stopping/restarting -url(bf(smbd))(smbd.8.html) and url(bf(nmbd))(nmbd.8.html). - - bf(Default:) -tt( bind interfaces only = False) - - bf(Example:) -tt( bind interfaces only = True) - -label(blockinglocks) -dit(bf(blocking locks (S))) - -This parameter controls the behavior of url(bf(smbd))(smbd.8.html) when -given a request by a client to obtain a byte range lock on a region -of an open file, and the request has a time limit associated with it. - -If this parameter is set and the lock range requested cannot be -immediately satisfied, Samba 2.0 will internally queue the lock -request, and periodically attempt to obtain the lock until the -timeout period expires. - -If this parameter is set to "False", then Samba 2.0 will behave -as previous versions of Samba would and will fail the lock -request immediately if the lock range cannot be obtained. - -This parameter can be set per share. - - bf(Default:) -tt( blocking locks = True) - - bf(Example:) -tt( blocking locks = False) - -label(browsable) -dit(bf(browsable (S))) - -Synonym for link(bf(browseable))(browseable). - -label(browselist) -dit(bf(browse list(G))) - -This controls whether url(bf(smbd))(smbd.8.html) will serve a browse -list to a client doing a NetServerEnum call. Normally set to true. You -should never need to change this. - - bf(Default:) -tt( browse list = Yes) - -label(browseable) -dit(bf(browseable)) - -This controls whether this share is seen in the list of available -shares in a net view and in the browse list. - - bf(Default:) -tt( browseable = Yes) - - bf(Example:) -tt( browseable = No) - -label(casesensitive) -dit(bf(case sensitive (S))) - -See the discussion in the section link(bf(NAME MANGLING))(NAMEMANGLING). - -label(casesignames) -dit(bf(casesignames (S))) - -Synonym for link(bf("case sensitive"))(casesensitive). - -label(changenotifytimeout) -dit(bf(change notify timeout (G))) - -One of the new NT SMB requests that Samba 2.0 supports is the -"ChangeNotify" requests. This SMB allows a client to tell a server to -em("watch") a particular directory for any changes and only reply to -the SMB request when a change has occurred. Such constant scanning of -a directory is expensive under UNIX, hence an -url(bf(smbd))(smbd.8.html) daemon only performs such a scan on each -requested directory once every bf(change notify timeout) seconds. - -bf(change notify timeout) is specified in units of seconds. - - bf(Default:) -tt( change notify timeout = 60) - - bf(Example:) -tt( change notify timeout = 300) - -Would change the scan time to every 5 minutes. - -label(characterset) -dit(bf(character set (G))) - -This allows a smbd to map incoming filenames from a DOS Code page (see -the link(bf(client code page))(clientcodepage) parameter) to several -built in UNIX character sets. The built in code page translations are: - -startit() - -it() bf(ISO8859-1) Western European UNIX character set. The parameter -link(bf(client code page))(clientcodepage) em(MUST) be set to code -page 850 if the bf(character set) parameter is set to iso8859-1 -in order for the conversion to the UNIX character set to be done -correctly. - -it() bf(ISO8859-2) Eastern European UNIX character set. The parameter -link(bf(client code page))(clientcodepage) em(MUST) be set to code -page 852 if the bf(character set) parameter is set to ISO8859-2 -in order for the conversion to the UNIX character set to be done -correctly. - -it() bf(ISO8859-5) Russian Cyrillic UNIX character set. The parameter -link(bf(client code page))(clientcodepage) em(MUST) be set to code -page 866 if the bf(character set) parameter is set to ISO8859-5 -in order for the conversion to the UNIX character set to be done -correctly. - -it() bf(ISO8859-7) Greek UNIX character set. The parameter -link(bf(client code page))(clientcodepage) em(MUST) be set to code -page 737 if the bf(character set) parameter is set to ISO8859-7 -in order for the conversion to the UNIX character set to be done -correctly. - -it() bf(KOI8-R) Alternate mapping for Russian Cyrillic UNIX -character set. The parameter link(bf(client code -page))(clientcodepage) em(MUST) be set to code page 866 if the -bf(character set) parameter is set to KOI8-R in order for the -conversion to the UNIX character set to be done correctly. - -endit() - -em(BUG). These MSDOS code page to UNIX character set mappings should -be dynamic, like the loading of MS DOS code pages, not static. - -See also link(bf(client code page))(clientcodepage). Normally this -parameter is not set, meaning no filename translation is done. - - bf(Default:) -tt( character set = <empty string>) - - bf(Example:) -tt( character set = ISO8859-1) - -label(clientcodepage) -dit(bf(client code page (G))) - -This parameter specifies the DOS code page that the clients accessing -Samba are using. To determine what code page a Windows or DOS client -is using, open a DOS command prompt and type the command "chcp". This -will output the code page. The default for USA MS-DOS, Windows 95, and -Windows NT releases is code page 437. The default for western european -releases of the above operating systems is code page 850. - -This parameter tells url(bf(smbd))(smbd.8.html) which of the -tt(codepage.XXX) files to dynamically load on startup. These files, -described more fully in the manual page url(bf(make_smbcodepage -(1)))(make_smbcodepage.1.html), tell url(bf(smbd))(smbd.8.html) how -to map lower to upper case characters to provide the case insensitivity -of filenames that Windows clients expect. - -Samba currently ships with the following code page files : - -startit() - -it() bf(Code Page 437 - MS-DOS Latin US) - -it() bf(Code Page 737 - Windows '95 Greek) - -it() bf(Code Page 850 - MS-DOS Latin 1) - -it() bf(Code Page 852 - MS-DOS Latin 2) - -it() bf(Code Page 861 - MS-DOS Icelandic) - -it() bf(Code Page 866 - MS-DOS Cyrillic) - -it() bf(Code Page 932 - MS-DOS Japanese SJIS) - -it() bf(Code Page 936 - MS-DOS Simplified Chinese) - -it() bf(Code Page 949 - MS-DOS Korean Hangul) - -it() bf(Code Page 950 - MS-DOS Traditional Chinese) - -endit() - -Thus this parameter may have any of the values 437, 737, 850, 852, -861, 932, 936, 949, or 950. If you don't find the codepage you need, -read the comments in one of the other codepage files and the -url(bf(make_smbcodepage (1)))(make_smbcodepage.1.html) man page and -write one. Please remember to donate it back to the Samba user -community. - -This parameter co-operates with the link(bf("valid -chars"))(validchars) parameter in determining what characters are -valid in filenames and how capitalization is done. If you set both -this parameter and the link(bf("valid chars"))(validchars) parameter -the bf("client code page") parameter em(MUST) be set before the -link(bf("valid chars"))(validchars) parameter in the bf(smb.conf) -file. The link(bf("valid chars"))(validchars) string will then augment -the character settings in the "client code page" parameter. - -If not set, bf("client code page") defaults to 850. - -See also : link(bf("valid chars"))(validchars) - - bf(Default:) -tt( client code page = 850) - - bf(Example:) -tt( client code page = 936) - -label(codingsystem) -dit(bf(codingsystem (G))) - -This parameter is used to determine how incoming Shift-JIS Japanese -characters are mapped from the incoming link(bf("client code -page"))(clientcodepage) used by the client, into file names in the -UNIX filesystem. Only useful if link(bf("client code -page"))(clientcodepage) is set to 932 (Japanese Shift-JIS). - -The options are : - -startit() - -it() bf(SJIS) Shift-JIS. Does no conversion of the incoming filename. - -it() bf(JIS8, J8BB, J8BH, J8@B, J8@J, J8@H ) Convert from incoming -Shift-JIS to eight bit JIS code with different shift-in, shift out -codes. - -it() bf(JIS7, J7BB, J7BH, J7@B, J7@J, J7@H ) Convert from incoming -Shift-JIS to seven bit JIS code with different shift-in, shift out -codes. - -it() bf(JUNET, JUBB, JUBH, JU@B, JU@J, JU@H ) Convert from incoming -Shift-JIS to JUNET code with different shift-in, shift out codes. - -it() bf(EUC) Convert an incoming Shift-JIS character to EUC code. - -it() bf(HEX) Convert an incoming Shift-JIS character to a 3 byte hex -representation, i.e. tt(:AB). - -it() bf(CAP) Convert an incoming Shift-JIS character to the 3 byte hex -representation used by the Columbia AppleTalk Program (CAP), -i.e. tt(:AB). This is used for compatibility between Samba and CAP. - -endit() - -label(comment) -dit(bf(comment (S))) - -This is a text field that is seen next to a share when a client does a -queries the server, either via the network neighborhood or via "net -view" to list what shares are available. - -If you want to set the string that is displayed next to the machine -name then see the server string command. - - bf(Default:) -tt( No comment string) - - bf(Example:) -tt( comment = Fred's Files) - -label(configfile) -dit(bf(config file (G))) - -This allows you to override the config file to use, instead of the -default (usually bf(smb.conf)). There is a chicken and egg problem -here as this option is set in the config file! - -For this reason, if the name of the config file has changed when the -parameters are loaded then it will reload them from the new config -file. - -This option takes the usual substitutions, which can be very useful. - -If the config file doesn't exist then it won't be loaded (allowing you -to special case the config files of just a few clients). - - bf(Example:) -tt( config file = /usr/local/samba/lib/smb.conf.%m) - -label(copy) -dit(bf(copy (S))) - -This parameter allows you to em('clone') service entries. The specified -service is simply duplicated under the current service's name. Any -parameters specified in the current section will override those in the -section being copied. - -This feature lets you set up a 'template' service and create similar -services easily. Note that the service being copied must occur earlier -in the configuration file than the service doing the copying. - - bf(Default:) -tt( none) - - bf(Example:) -tt( copy = otherservice) - -label(createmask) -dit(bf(create mask (S))) - -A synonym for this parameter is link(bf('create mode'))(createmode). - -When a file is created, the necessary permissions are calculated -according to the mapping from DOS modes to UNIX permissions, and the -resulting UNIX mode is then bit-wise 'AND'ed with this parameter. -This parameter may be thought of as a bit-wise MASK for the UNIX modes -of a file. Any bit em(*not*) set here will be removed from the modes set -on a file when it is created. - -The default value of this parameter removes the 'group' and 'other' -write and execute bits from the UNIX modes. - -Following this Samba will bit-wise 'OR' the UNIX mode created from -this parameter with the value of the "force create mode" parameter -which is set to 000 by default. - -This parameter does not affect directory modes. See the parameter -link(bf('directory mode'))(directorymode) for details. - -See also the link(bf("force create mode"))(forcecreatemode) parameter -for forcing particular mode bits to be set on created files. See also -the link(bf("directory mode"))(directorymode) parameter for masking -mode bits on created directories. -See also the link(bf("inherit permissions"))(inheritpermissions) parameter. - - bf(Default:) -tt( create mask = 0744) - - bf(Example:) -tt( create mask = 0775) - -label(createmode) -dit(bf(create mode (S))) - -This is a synonym for link(bf(create mask))(createmask). - -label(deadtime) -dit(bf(deadtime (G))) - -The value of the parameter (a decimal integer) represents the number -of minutes of inactivity before a connection is considered dead, and -it is disconnected. The deadtime only takes effect if the number of -open files is zero. - -This is useful to stop a server's resources being exhausted by a large -number of inactive connections. - -Most clients have an auto-reconnect feature when a connection is -broken so in most cases this parameter should be transparent to users. - -Using this parameter with a timeout of a few minutes is recommended -for most systems. - -A deadtime of zero indicates that no auto-disconnection should be -performed. - - bf(Default:) -tt( deadtime = 0) - - bf(Example:) -tt( deadtime = 15) - -label(debughirestimestamp) -dit(bf(debug hires timestamp (G))) - -Sometimes the timestamps in the log messages are needed with a -resolution of higher that seconds, this boolean parameter adds -microsecond resolution to the timestamp message header when turned on. - -Note that the parameter link(bf(debug timestamp))(debugtimestamp) -must be on for this to have an effect. - - bf(Default:) -tt( debug hires timestamp = No) - - bf(Example:) -tt( debug hires timestamp = Yes) - -label(debugtimestamp) -dit(bf(debug timestamp (G))) - -Samba2.0 debug log messages are timestamped by default. If you are -running at a high link(bf("debug level"))(debuglevel) these timestamps -can be distracting. This boolean parameter allows timestamping to be turned -off. - - bf(Default:) -tt( debug timestamp = Yes) - - bf(Example:) -tt( debug timestamp = No) - -label(debugpid) -dit(bf(debug pid (G))) - -When using only one log file for more then one forked smbd-process -there may be hard to follow which process outputs which message. -This boolean parameter is adds the process-id to the timestamp message -headers in the logfile when turned on. - -Note that the parameter link(bf(debug timestamp))(debugtimestamp) -must be on for this to have an effect. - - bf(Default:) -tt( debug pid = No) - - bf(Example:) -tt( debug pid = Yes) - -label(debuguid) -dit(bf(debug uid (G))) - -Samba is sometimes run as root and sometime run as the connected -user, this boolean parameter inserts the current euid, egid, uid -and gid to the timestamp message headers in the log file if turned on. - -Note that the parameter link(bf(debug timestamp))(debugtimestamp) -must be on for this to have an effect. - - bf(Default:) -tt( debug uid = No) - - bf(Example:) -tt( debug uid = Yes) - -label(debuglevel) -dit(bf(debug level (G))) - -The value of the parameter (an integer) allows the debug level -(logging level) to be specified in the bf(smb.conf) file. This is to -give greater flexibility in the configuration of the system. - -The default will be the debug level specified on the command line -or level zero if none was specified. - - bf(Example:) -tt( debug level = 3) - -label(default) -dit(bf(default (G))) - -A synonym for link(bf(default service))(defaultservice). - -label(defaultcase) -dit(bf(default case (S))) - -See the section on link(bf("NAME MANGLING"))(NAMEMANGLING). Also note -the link(bf("short preserve case"))(shortpreservecase) parameter. - -label(defaultservice) -dit(bf(default service (G))) - -This parameter specifies the name of a service which will be connected -to if the service actually requested cannot be found. Note that the -square brackets are em(NOT) given in the parameter value (see example -below). - -There is no default value for this parameter. If this parameter is not -given, attempting to connect to a nonexistent service results in an -error. - -Typically the default service would be a link(bf(guest ok))(guestok), -link(bf(read-only))(readonly) service. - -Also note that the apparent service name will be changed to equal that -of the requested service, this is very useful as it allows you to use -macros like link(bf(%S))(percentS) to make a wildcard service. - -Note also that any tt('_') characters in the name of the service used -in the default service will get mapped to a tt('/'). This allows for -interesting things. - - - bf(Example:) -verb( - default service = pub - - [pub] - path = /%S -) - -label(deleteuserscript) -dit(bf(delete user script (G))) - -This is the full pathname to a script that will be run em(AS ROOT) by -url(bf(smbd (8)))(smbd.8.html) under special circumstances decribed -below. - -Normally, a Samba server requires that UNIX users are created for all -users accessing files on this server. For sites that use Windows NT -account databases as their primary user database creating these users -and keeping the user list in sync with the Windows NT PDC is an -onerous task. This option allows url(bf(smbd))(smbd.8.html) to delete -the required UNIX users em(ON DEMAND) when a user accesses the Samba -server and the Windows NT user no longer exists. - -In order to use this option, url(bf(smbd))(smbd.8.html) must be set to -link(bf(security=domain))(securityequaldomain) and bf("delete user -script") must be set to a full pathname for a script that will delete -a UNIX user given one argument of bf(%u), which expands into the UNIX -user name to delete. em(NOTE) that this is different to the -link(bf(add user script))(adduserscript) which will work with the -link(bf(security=server))(securityequalserver) option as well as -link(bf(security=domain))(securityequaldomain). The reason for this -is only when Samba is a domain member does it get the information -on an attempted user logon that a user no longer exists. In the -link(bf(security=server))(securityequalserver) mode a missing user -is treated the same as an invalid password logon attempt. Deleting -the user in this circumstance would not be a good idea. - -When the Windows user attempts to access the Samba server, at -em("login")(session setup in the SMB protocol) time, -url(bf(smbd))(smbd.8.html) contacts the link(bf(password -server))(passwordserver) and attempts to authenticate the given user -with the given password. If the authentication fails with the specific -Domain error code meaning that the user no longer exists then -url(bf(smbd))(smbd.8.html) attempts to find a UNIX user in the UNIX -password database that matches the Windows user account. If this lookup succeeds, -and bf("delete user script") is set then url(bf(smbd))(smbd.8.html) will -call the specified script em(AS ROOT), expanding any bf(%u) argument -to be the user name to delete. - -This script should delete the given UNIX username. In this way, UNIX -users are dynamically deleted to match existing Windows NT accounts. - -See also link(bf(security=domain))(securityequaldomain), -link(bf(password server))(passwordserver), link(bf(add user -script))(adduserscript). - - bf(Default:) -tt( delete user script = <empty string>) - - bf(Example:) -tt( delete user script = /usr/local/samba/bin/del_user %u) - -label(deletereadonly) -dit(bf(delete readonly (S))) - -This parameter allows readonly files to be deleted. This is not -normal DOS semantics, but is allowed by UNIX. - -This option may be useful for running applications such as rcs, where -UNIX file ownership prevents changing file permissions, and DOS -semantics prevent deletion of a read only file. - - bf(Default:) -tt( delete readonly = No) - - bf(Example:) -tt( delete readonly = Yes) - -label(deletevetofiles) -dit(bf(delete veto files (S))) - -This option is used when Samba is attempting to delete a directory -that contains one or more vetoed directories (see the link(bf('veto -files'))(vetofiles) option). If this option is set to False (the -default) then if a vetoed directory contains any non-vetoed files or -directories then the directory delete will fail. This is usually what -you want. - -If this option is set to True, then Samba will attempt to recursively -delete any files and directories within the vetoed directory. This can -be useful for integration with file serving systems such as bf(NetAtalk), -which create meta-files within directories you might normally veto -DOS/Windows users from seeing (e.g. tt(.AppleDouble)) - -Setting tt('delete veto files = True') allows these directories to be -transparently deleted when the parent directory is deleted (so long -as the user has permissions to do so). - -See also the link(bf(veto files))(vetofiles) parameter. - - bf(Default:) -tt( delete veto files = False) - - bf(Example:) -tt( delete veto files = True) - -label(denyhosts) -dit(bf(deny hosts (S))) - -Synonym for link(bf(hosts deny))(hostsdeny). - -label(dfreecommand) -dit(bf(dfree command (G))) - -The dfree command setting should only be used on systems where a -problem occurs with the internal disk space calculations. This has -been known to happen with Ultrix, but may occur with other operating -systems. The symptom that was seen was an error of "Abort Retry -Ignore" at the end of each directory listing. - -This setting allows the replacement of the internal routines to -calculate the total disk space and amount available with an external -routine. The example below gives a possible script that might fulfill -this function. - -The external program will be passed a single parameter indicating a -directory in the filesystem being queried. This will typically consist -of the string tt("./"). The script should return two integers in -ascii. The first should be the total disk space in blocks, and the -second should be the number of available blocks. An optional third -return value can give the block size in bytes. The default blocksize -is 1024 bytes. - -Note: Your script should em(NOT) be setuid or setgid and should be -owned by (and writeable only by) root! - - bf(Default:) -tt( By default internal routines for determining the disk capacity -and remaining space will be used.) - - bf(Example:) -tt( dfree command = /usr/local/samba/bin/dfree) - -Where the script dfree (which must be made executable) could be: - -verb( - #!/bin/sh - df $1 | tail -1 | awk '{print $2" "$4}' -) - -or perhaps (on Sys V based systems): - -verb( - #!/bin/sh - /usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}' -) - - Note that you may have to replace the command names with full -path names on some systems. - -label(directory) -dit(bf(directory (S))) - -Synonym for link(bf(path))(path). - -label(directorymask) -dit(bf(directory mask (S))) - -This parameter is the octal modes which are used when converting DOS -modes to UNIX modes when creating UNIX directories. - -When a directory is created, the necessary permissions are calculated -according to the mapping from DOS modes to UNIX permissions, and the -resulting UNIX mode is then bit-wise 'AND'ed with this parameter. -This parameter may be thought of as a bit-wise MASK for the UNIX modes -of a directory. Any bit em(*not*) set here will be removed from the -modes set on a directory when it is created. - -The default value of this parameter removes the 'group' and 'other' -write bits from the UNIX mode, allowing only the user who owns the -directory to modify it. - -Following this Samba will bit-wise 'OR' the UNIX mode created from -this parameter with the value of the "force directory mode" -parameter. This parameter is set to 000 by default (i.e. no extra mode -bits are added). - -See the link(bf("force directory mode"))(forcedirectorymode) parameter -to cause particular mode bits to always be set on created directories. - -See also the link(bf("create mode"))(createmode) parameter for masking -mode bits on created files, and the link(bf("directory security mask"))(directorysecuritymask) -parameter. - -See also the link(bf("inherit permissions"))(inheritpermissions) parameter. - - bf(Default:) -tt( directory mask = 0755) - - bf(Example:) -tt( directory mask = 0775) - -label(directorymode) -dit(bf(directory mode (S))) - -Synonym for link(bf(directory mask))(directorymask). - -label(directorysecuritymask) -dit(bf(directory security mask (S))) - -This parameter controls what UNIX permission bits can be modified -when a Windows NT client is manipulating the UNIX permission on a -directory using the native NT security dialog box. - -This parameter is applied as a mask (AND'ed with) to the changed -permission bits, thus preventing any bits not in this mask from -being modified. Essentially, zero bits in this mask may be treated -as a set of bits the user is not allowed to change. - -If not set explicitly this parameter is set to the same value as the -link(bf(directory mask))(directorymask) parameter. To allow a user to -modify all the user/group/world permissions on a directory, set this -parameter to 0777. - -em(Note) that users who can access the Samba server through other -means can easily bypass this restriction, so it is primarily -useful for standalone "appliance" systems. Administrators of -most normal systems will probably want to set it to 0777. - -See also the link(bf(force directory security -mode))(forcedirectorysecuritymode), link(bf(security -mask))(securitymask), link(bf(force security mode))(forcesecuritymode) -parameters. - - bf(Default:) -tt( directory security mask = <same as directory mask>) - - bf(Example:) -tt( directory security mask = 0777) - -label(dnsproxy) -dit(bf(dns proxy (G))) - -Specifies that url(bf(nmbd))(nmbd.8.html) when acting as a WINS -server and finding that a NetBIOS name has not been registered, should -treat the NetBIOS name word-for-word as a DNS name and do a lookup -with the DNS server for that name on behalf of the name-querying -client. - -Note that the maximum length for a NetBIOS name is 15 characters, so -the DNS name (or DNS alias) can likewise only be 15 characters, -maximum. - -url(bf(nmbd))(nmbd.8.html) spawns a second copy of itself to do the -DNS name lookup requests, as doing a name lookup is a blocking action. - -See also the parameter link(bf(wins support))(winssupport). - - bf(Default:) -tt( dns proxy = yes) - -label(domainadmingroup) -bf(domain admin group (G)) - -This is an bf(EXPERIMENTAL) parameter that is part of the unfinished -Samba NT Domain Controller Code. It may be removed in a later release. -To work with the latest code builds that may have more support for -Samba NT Domain Controller functionality please subscribe to the -mailing list bf(Samba-ntdom) available by visiting the web page at -url(http://lists.samba.org/)(http://lists.samba.org/) - -label(domainadminusers) -dit(bf(domain admin users (G))) - -This is an bf(EXPERIMENTAL) parameter that is part of the unfinished -Samba NT Domain Controller Code. It may be removed in a later release. -To work with the latest code builds that may have more support for -Samba NT Domain Controller functionality please subscribe to the -mailing list bf(Samba-ntdom) available by visiting the web page at -url(http://lists.samba.org/)(http://lists.samba.org/) - -label(domaingroups) -dit(bf(domain groups (G))) - -This is an bf(EXPERIMENTAL) parameter that is part of the unfinished -Samba NT Domain Controller Code. It may be removed in a later release. -To work with the latest code builds that may have more support for -Samba NT Domain Controller functionality please subscribe to the -mailing list bf(Samba-ntdom) available by visiting the web page at -url(http://lists.samba.org/)(http://lists.samba.org/) - -label(domainguestgroup) -dit(bf(domain guest group (G))) - -This is an bf(EXPERIMENTAL) parameter that is part of the unfinished -Samba NT Domain Controller Code. It may be removed in a later release. -To work with the latest code builds that may have more support for -Samba NT Domain Controller functionality please subscribe to the -mailing list bf(Samba-ntdom) available by visiting the web page at -url(http://lists.samba.org/)(http://lists.samba.org/) - -label(domainguestusers) -dit(bf(domain guest users (G))) - -This is an bf(EXPERIMENTAL) parameter that is part of the unfinished -Samba NT Domain Controller Code. It may be removed in a later release. -To work with the latest code builds that may have more support for -Samba NT Domain Controller functionality please subscribe to the -mailing list bf(Samba-ntdom) available by visiting the web page at -url(http://lists.samba.org/)(http://lists.samba.org/) - -label(domainlogons) -dit(bf(domain logons (G))) - -If set to true, the Samba server will serve Windows 95/98 Domain -logons for the link(bf(workgroup))(workgroup) it is in. For more -details on setting up this feature see the file DOMAINS.txt in the -Samba documentation directory tt(docs/) shipped with the source code. - -Note that Win95/98 Domain logons are em(NOT) the same as Windows -NT Domain logons. NT Domain logons require a Primary Domain Controller -(PDC) for the Domain. It is intended that in a future release Samba -will be able to provide this functionality for Windows NT clients -also. - - bf(Default:) -tt( domain logons = no) - -label(domainmaster) -dit(bf(domain master (G))) - -Tell url(bf(nmbd))(nmbd.8.html) to enable WAN-wide browse list -collation. Setting this option causes url(bf(nmbd))(nmbd.8.html) to -claim a special domain specific NetBIOS name that identifies it as a -domain master browser for its given -link(bf(workgroup))(workgroup). Local master browsers in the same -link(bf(workgroup))(workgroup) on broadcast-isolated subnets will give -this url(bf(nmbd))(nmbd.8.html) their local browse lists, and then -ask url(bf(smbd))(smbd.8.html) for a complete copy of the browse list -for the whole wide area network. Browser clients will then contact -their local master browser, and will receive the domain-wide browse -list, instead of just the list for their broadcast-isolated subnet. - -Note that Windows NT Primary Domain Controllers expect to be able to -claim this link(bf(workgroup))(workgroup) specific special NetBIOS -name that identifies them as domain master browsers for that -link(bf(workgroup))(workgroup) by default (i.e. there is no way to -prevent a Windows NT PDC from attempting to do this). This means that -if this parameter is set and url(bf(nmbd))(nmbd.8.html) claims the -special name for a link(bf(workgroup))(workgroup) before a Windows NT -PDC is able to do so then cross subnet browsing will behave strangely -and may fail. - - bf(Default:) -tt( domain master = no) - -label(dont descend) -dit(bf(dont descend (S))) - -There are certain directories on some systems (e.g., the tt(/proc) tree -under Linux) that are either not of interest to clients or are -infinitely deep (recursive). This parameter allows you to specify a -comma-delimited list of directories that the server should always show -as empty. - -Note that Samba can be very fussy about the exact format of the "dont -descend" entries. For example you may need tt("./proc") instead of -just tt("/proc"). Experimentation is the best policy :-) - - bf(Default:) -tt( none (i.e., all directories are OK to descend)) - - bf(Example:) -tt( dont descend = /proc,/dev) - -label(dosfiletimeresolution) -dit(bf(dos filetime resolution (S))) - -Under the DOS and Windows FAT filesystem, the finest granularity on -time resolution is two seconds. Setting this parameter for a share -causes Samba to round the reported time down to the nearest two second -boundary when a query call that requires one second resolution is made -to url(bf(smbd))(smbd.8.html). - -This option is mainly used as a compatibility option for Visual C++ -when used against Samba shares. If oplocks are enabled on a share, -Visual C++ uses two different time reading calls to check if a file -has changed since it was last read. One of these calls uses a -one-second granularity, the other uses a two second granularity. As -the two second call rounds any odd second down, then if the file has a -timestamp of an odd number of seconds then the two timestamps will not -match and Visual C++ will keep reporting the file has changed. Setting -this option causes the two timestamps to match, and Visual C++ is -happy. - - bf(Default:) -tt( dos filetime resolution = False) - - bf(Example:) -tt( dos filetime resolution = True) - -label(dos filetimes) -dit(bf(dos filetimes (S))) - -Under DOS and Windows, if a user can write to a file they can change -the timestamp on it. Under POSIX semantics, only the owner of the file -or root may change the timestamp. By default, Samba runs with POSIX -semantics and refuses to change the timestamp on a file if the user -smbd is acting on behalf of is not the file owner. Setting this option -to True allows DOS semantics and smbd will change the file timestamp as -DOS requires. - - bf(Default:) -tt( dos filetimes = False) - - bf(Example:) -tt( dos filetimes = True) - -label(encryptpasswords) -dit(bf(encrypt passwords (G))) - -This boolean controls whether encrypted passwords will be negotiated -with the client. Note that Windows NT 4.0 SP3 and above and also -Windows 98 will by default expect encrypted passwords unless a -registry entry is changed. To use encrypted passwords in Samba see the -file ENCRYPTION.txt in the Samba documentation directory tt(docs/) -shipped with the source code. - -In order for encrypted passwords to work correctly -url(bf(smbd))(smbd.8.html) must either have access to a local -url(bf(smbpasswd (5)))(smbpasswd.5.html) file (see the -url(bf(smbpasswd (8)))(smbpasswd.8.html) program for information on -how to set up and maintain this file), or set the -link(bf(security=))(security) parameter to either -link(bf("server"))(securityequalserver) or -link(bf("domain"))(securityequaldomain) which causes -url(bf(smbd))(smbd.8.html) to authenticate against another server. - -label(enhancedbrowsing) -dit(bf(enhanced browsing (G))) - -This option enables a couple of enhancements to cross-subnet browse -propogation that have been added in Samba but which are not standard -in Microsoft implementations. Enhanced browsing is enabled by -default, and can be diabled using "enhanced browsing = No". - -The first enhancement to browse propogation consists of a regular -wildcard query to a Samba WINS server for all Domain Master Browsers, -followed by a browse synchronisation with each of the returned -DMBs. The second enhancement consists of a regular randomised browse -synchronisation with all currently known DMBs. - -You may wish to disable this option if you have a problem with empty -workgroups not disappearing from browse lists. Due to the restrictions -of the browse protocols these enhancements can cause a empty workgroup -to stay around forever which can be annoying. - -In general you should leave this option enabled as it makes -cross-subnet browse propogation much more reliable. - -label(exec) -dit(bf(exec (S))) - -This is a synonym for link(bf(preexec))(preexec). - -label(fake directory create times) -dit(bf(fake directory create times (S))) - -NTFS and Windows VFAT file systems keep a create time for all files -and directories. This is not the same as the ctime - status change -time - that Unix keeps, so Samba by default reports the earliest of -the various times Unix does keep. Setting this parameter for a share -causes Samba to always report midnight 1-1-1980 as the create time for -directories. - -This option is mainly used as a compatibility option for Visual C++ -when used against Samba shares. Visual C++ generated makefiles have -the object directory as a dependency for each object file, and a make -rule to create the directory. Also, when NMAKE compares timestamps it -uses the creation time when examining a directory. Thus the object -directory will be created if it does not exist, but once it does exist -it will always have an earlier timestamp than the object files it -contains. - -However, Unix time semantics mean that the create time reported by -Samba will be updated whenever a file is created or deleted in the -directory. NMAKE therefore finds all object files in the object -directory bar the last one built are out of date compared to the -directory and rebuilds them. Enabling this option ensures directories -always predate their contents and an NMAKE build will proceed as -expected. - - bf(Default:) -tt( fake directory create times = False) - - bf(Example:) -tt( fake directory create times = True) - -label(fakeoplocks) -dit(bf(fake oplocks (S))) - -Oplocks are the way that SMB clients get permission from a server to -locally cache file operations. If a server grants an oplock -(opportunistic lock) then the client is free to assume that it is the -only one accessing the file and it will aggressively cache file -data. With some oplock types the client may even cache file open/close -operations. This can give enormous performance benefits. - -When you set tt("fake oplocks = yes") url(bf(smbd))(smbd.8.html) will -always grant oplock requests no matter how many clients are using the -file. - -It is generally much better to use the real link(bf(oplocks))(oplocks) -support rather than this parameter. - -If you enable this option on all read-only shares or shares that you -know will only be accessed from one client at a time such as -physically read-only media like CDROMs, you will see a big performance -improvement on many operations. If you enable this option on shares -where multiple clients may be accessing the files read-write at the -same time you can get data corruption. Use this option carefully! - -This option is disabled by default. - -label(followsymlinks) -dit(bf(follow symlinks (S))) - -This parameter allows the Samba administrator to stop -url(bf(smbd))(smbd.8.html) from following symbolic links in a -particular share. Setting this parameter to em("No") prevents any file -or directory that is a symbolic link from being followed (the user -will get an error). This option is very useful to stop users from -adding a symbolic link to tt(/etc/passwd) in their home directory for -instance. However it will slow filename lookups down slightly. - -This option is enabled (i.e. url(bf(smbd))(smbd.8.html) will follow -symbolic links) by default. - -label(forcecreatemode) -dit(bf(force create mode (S))) - -This parameter specifies a set of UNIX mode bit permissions that will -em(*always*) be set on a file by Samba. This is done by bitwise -'OR'ing these bits onto the mode bits of a file that is being created -or having its permissions changed. The default for this parameter is -(in octal) 000. The modes in this parameter are bitwise 'OR'ed onto -the file mode after the mask set in the link(bf("create -mask"))(createmask) parameter is applied. - -See also the parameter link(bf("create mask"))(createmask) for details -on masking mode bits on files. - -See also the link(bf("inherit permissions"))(inheritpermissions) parameter. - - bf(Default:) -tt( force create mode = 000) - - bf(Example:) -tt( force create mode = 0755) - -would force all created files to have read and execute permissions set -for 'group' and 'other' as well as the read/write/execute bits set for -the 'user'. - -label(forcedirectorymode) -dit(bf(force directory mode (S))) - -This parameter specifies a set of UNIX mode bit permissions that will -em(*always*) be set on a directory created by Samba. This is done by -bitwise 'OR'ing these bits onto the mode bits of a directory that is -being created. The default for this parameter is (in octal) 0000 which -will not add any extra permission bits to a created directory. This -operation is done after the mode mask in the parameter -link(bf("directory mask"))(directorymask) is applied. - -See also the parameter link(bf("directory mask"))(directorymask) for -details on masking mode bits on created directories. - -See also the link(bf("inherit permissions"))(inheritpermissions) parameter. - - bf(Default:) -tt( force directory mode = 000) - - bf(Example:) -tt( force directory mode = 0755) - -would force all created directories to have read and execute -permissions set for 'group' and 'other' as well as the -read/write/execute bits set for the 'user'. - -label(forcedirectorysecuritymode) -dit(bf(force directory security mode (S))) - -This parameter controls what UNIX permission bits can be modified when -a Windows NT client is manipulating the UNIX permission on a directory -using the native NT security dialog box. - -This parameter is applied as a mask (OR'ed with) to the changed -permission bits, thus forcing any bits in this mask that the user may -have modified to be on. Essentially, one bits in this mask may be -treated as a set of bits that, when modifying security on a directory, -the user has always set to be 'on'. - -If not set explicitly this parameter is set to the same value as the -link(bf(force directory mode))(forcedirectorymode) parameter. To allow -a user to modify all the user/group/world permissions on a directory, -with restrictions set this parameter to 000. - -em(Note) that users who can access the Samba server through other -means can easily bypass this restriction, so it is primarily -useful for standalone "appliance" systems. Administrators of -most normal systems will probably want to set it to 0000. - -See also the link(bf(directory security mask))(directorysecuritymask), -link(bf(security mask))(securitymask), link(bf(force security -mode))(forcesecuritymode) parameters. - - bf(Default:) -tt( force directory security mode = <same as force directory mode>) - - bf(Example:) -tt( force directory security mode = 0) - -label(forcegroup) -dit(bf(force group (S))) - -This specifies a UNIX group name that will be assigned as the default -primary group for all users connecting to this service. This is useful -for sharing files by ensuring that all access to files on service will -use the named group for their permissions checking. Thus, by assigning -permissions for this group to the files and directories within this -service the Samba administrator can restrict or allow sharing of these -files. - -In Samba 2.0.5 and above this parameter has extended functionality in the following -way. If the group name listed here has a '+' character prepended to it -then the current user accessing the share only has the primary group -default assigned to this group if they are already assigned as a member -of that group. This allows an administrator to decide that only users -who are already in a particular group will create files with group -ownership set to that group. This gives a finer granularity of ownership -assignment. For example, the setting tt(force group = +sys) means -that only users who are already in group sys will have their default -primary group assigned to sys when accessing this Samba share. All -other users will retain their ordinary primary group. - -If the link(bf("force user"))(forceuser) parameter is also set the -group specified in bf(force group) will override the primary group -set in link(bf("force user"))(forceuser). - -See also link(bf("force user"))(forceuser) - - bf(Default:) -tt( no forced group) - - bf(Example:) -tt( force group = agroup) - -label(forcesecuritymode) -dit(bf(force security mode (S))) - -This parameter controls what UNIX permission bits can be modified when -a Windows NT client is manipulating the UNIX permission on a file -using the native NT security dialog box. - -This parameter is applied as a mask (OR'ed with) to the changed -permission bits, thus forcing any bits in this mask that the user may -have modified to be on. Essentially, one bits in this mask may be -treated as a set of bits that, when modifying security on a file, the -user has always set to be 'on'. - -If not set explicitly this parameter is set to the same value as the -link(bf(force create mode))(forcecreatemode) parameter. To allow -a user to modify all the user/group/world permissions on a file, -with no restrictions set this parameter to 000. - -em(Note) that users who can access the Samba server through other -means can easily bypass this restriction, so it is primarily -useful for standalone "appliance" systems. Administrators of -most normal systems will probably want to set it to 0000. - -See also the link(bf(force directory security -mode))(forcedirectorysecuritymode), link(bf(directory security -mask))(directorysecuritymask), link(bf(security mask))(securitymask) -parameters. - - bf(Default:) -tt( force security mode = <same as force create mode>) - - bf(Example:) -tt( force security mode = 0) - -label(forceuser) -dit(bf(force user (S))) - -This specifies a UNIX user name that will be assigned as the default -user for all users connecting to this service. This is useful for -sharing files. You should also use it carefully as using it -incorrectly can cause security problems. - -This user name only gets used once a connection is established. Thus -clients still need to connect as a valid user and supply a valid -password. Once connected, all file operations will be performed as the -tt("forced user"), no matter what username the client connected as. - -This can be very useful. - -In Samba 2.0.5 and above this parameter also causes the primary -group of the forced user to be used as the primary group for all -file activity. Prior to 2.0.5 the primary group was left as the -primary group of the connecting user (this was a bug). - -See also link(bf("force group"))(forcegroup) - - bf(Default:) -tt( no forced user) - - bf(Example:) -tt( force user = auser) - -label(fstype) -dit(bf(fstype (S))) - -This parameter allows the administrator to configure the string that -specifies the type of filesystem a share is using that is reported by -url(bf(smbd))(smbd.8.html) when a client queries the filesystem type -for a share. The default type is bf("NTFS") for compatibility with -Windows NT but this can be changed to other strings such as "Samba" or -"FAT" if required. - - bf(Default:) -tt( fstype = NTFS) - - bf(Example:) -tt( fstype = Samba) - -label(getwdcache) -dit(bf(getwd cache (G))) - -This is a tuning option. When this is enabled a caching algorithm -will be used to reduce the time taken for getwd() calls. This can have -a significant impact on performance, especially when the -link(bf(widelinks))(widelinks) parameter is set to False. - - bf(Default:) -tt( getwd cache = No) - - bf(Example:) -tt( getwd cache = Yes) - -label(group) -dit(bf(group (S))) - -Synonym for link(bf("force group"))(forcegroup). - -label(guestaccount) -dit(bf(guest account (S))) - -This is a username which will be used for access to services which are -specified as link(bf('guest ok'))(guestok) (see below). Whatever -privileges this user has will be available to any client connecting to -the guest service. Typically this user will exist in the password -file, but will not have a valid login. The user account bf("ftp") is -often a good choice for this parameter. If a username is specified in -a given service, the specified username overrides this one. - -One some systems the default guest account "nobody" may not be able to -print. Use another account in this case. You should test this by -trying to log in as your guest user (perhaps by using the tt("su -") -command) and trying to print using the system print command such as -bf(lpr (1)) or bf(lp (1)). - - bf(Default:) -tt( specified at compile time, usually "nobody") - - bf(Example:) -tt( guest account = ftp) - -label(guestok) -dit(bf(guest ok (S))) - -If this parameter is em('yes') for a service, then no password is -required to connect to the service. Privileges will be those of the -link(bf(guest account))(guestaccount). - -See the section below on link(bf(security))(security) for more -information about this option. - - bf(Default:) -tt( guest ok = no) - - bf(Example:) -tt( guest ok = yes) - -label(guestonly) -dit(bf(guest only (S))) - -If this parameter is em('yes') for a service, then only guest -connections to the service are permitted. This parameter will have no -affect if link(bf("guest ok"))(guestok) or link(bf("public"))(public) -is not set for the service. - -See the section below on link(bf(security))(security) for more -information about this option. - - bf(Default:) -tt( guest only = no) - - bf(Example:) -tt( guest only = yes) - -label(hidedotfiles) -dit(bf(hide dot files (S))) - -This is a boolean parameter that controls whether files starting with -a dot appear as hidden files. - - bf(Default:) -tt( hide dot files = yes) - - bf(Example:) -tt( hide dot files = no) - - -label(hidefiles) -dit(bf(hide files(S))) - -This is a list of files or directories that are not visible but are -accessible. The DOS 'hidden' attribute is applied to any files or -directories that match. - -Each entry in the list must be separated by a tt('/'), which allows -spaces to be included in the entry. tt('*') and tt('?') can be used -to specify multiple files or directories as in DOS wildcards. - -Each entry must be a Unix path, not a DOS path and must not include the -Unix directory separator tt('/'). - -Note that the case sensitivity option is applicable in hiding files. - -Setting this parameter will affect the performance of Samba, as it -will be forced to check all files and directories for a match as they -are scanned. - -See also link(bf("hide dot files"))(hidedotfiles), link(bf("veto -files"))(vetofiles) and link(bf("case sensitive"))(casesensitive). - - bf(Default) -verb( - No files or directories are hidden by this option (dot files are - hidden by default because of the "hide dot files" option). -) - - bf(Example) -tt( hide files = /.*/DesktopFolderDB/TrashFor%m/resource.frk/) - -The above example is based on files that the Macintosh SMB client -(DAVE) available from url(bf(Thursby))(http://www.thursby.com) creates for -internal use, and also still hides all files beginning with a dot. - -label(hidelocalusers) -dit(bf(hide local users(G))) - -This parameter toggles the hiding of local UNIX users (root, wheel, floppy, etc) -from remote clients. - - bf(Default:) -tt( hide local users = No) - - bf(Example:) -tt( hide local users = Yes) - -label(homedirmap) -dit(bf(homedir map (G))) - -If link(bf("nis homedir"))(nishomedir) is true, and -url(bf(smbd))(smbd.8.html) is also acting as a Win95/98 link(bf(logon -server))(domainlogons) then this parameter specifies the NIS (or YP) -map from which the server for the user's home directory should be -extracted. At present, only the Sun auto.home map format is -understood. The form of the map is: - -tt(username server:/some/file/system) - -and the program will extract the servername from before the first -tt(':'). There should probably be a better parsing system that copes -with different map formats and also Amd (another automounter) maps. - -NB: A working NIS is required on the system for this option to work. - -See also link(bf("nis homedir"))(nishomedir), link(bf(domain -logons))(domainlogons). - - bf(Default:) -tt( homedir map = auto.home) - - bf(Example:) -tt( homedir map = amd.homedir) - -label(hostsallow) -dit(bf(hosts allow (S))) - -A synonym for this parameter is link(bf('allow hosts'))(allowhosts) - -This parameter is a comma, space, or tab delimited set of hosts which -are permitted to access a service. - -If specified in the link(bf([global]))(global) section then it will -apply to all services, regardless of whether the individual service -has a different setting. - -You can specify the hosts by name or IP number. For example, you could -restrict access to only the hosts on a Class C subnet with something -like tt("allow hosts = 150.203.5."). The full syntax of the list is -described in the man page bf(hosts_access (5)). Note that this man -page may not be present on your system, so a brief description will -be given here also. - -Note that the localhost address 127.0.0.1 will always be allowed -access unless specifically denied by a "hosts deny" option. - -You can also specify hosts by network/netmask pairs and by netgroup -names if your system supports netgroups. The em(EXCEPT) keyword can also -be used to limit a wildcard list. The following examples may provide -some help: - -bf(Example 1): allow all IPs in 150.203.*.* except one - -tt( hosts allow = 150.203. EXCEPT 150.203.6.66) - -bf(Example 2): allow hosts that match the given network/netmask - -tt( hosts allow = 150.203.15.0/255.255.255.0) - -bf(Example 3): allow a couple of hosts - -tt( hosts allow = lapland, arvidsjaur) - -bf(Example 4): allow only hosts in NIS netgroup "foonet", but -deny access from one particular host - -tt( hosts allow = @foonet) - -tt( hosts deny = pirate) - -Note that access still requires suitable user-level passwords. - -See url(bf(testparm (1)))(testparm.1.html) for a way of testing your -host access to see if it does what you expect. - - bf(Default:) -tt( none (i.e., all hosts permitted access)) - - bf(Example:) -tt( allow hosts = 150.203.5. myhost.mynet.edu.au) - - -label(hostsdeny) -dit(bf(hosts deny (S))) - -The opposite of link(bf('hosts allow'))(hostsallow) - hosts listed -here are em(NOT) permitted access to services unless the specific -services have their own lists to override this one. Where the lists -conflict, the link(bf('allow'))(hostsallow) list takes precedence. - - bf(Default:) -tt( none (i.e., no hosts specifically excluded)) - - bf(Example:) -tt( hosts deny = 150.203.4. badhost.mynet.edu.au) - -label(hostsequiv) -dit(bf(hosts equiv (G))) - -If this global parameter is a non-null string, it specifies the name -of a file to read for the names of hosts and users who will be allowed -access without specifying a password. - -This is not be confused with link(bf(hosts allow))(hostsallow) which -is about hosts access to services and is more useful for guest -services. bf(hosts equiv) may be useful for NT clients which will not -supply passwords to samba. - -NOTE: The use of bf(hosts equiv) can be a major security hole. This is -because you are trusting the PC to supply the correct username. It is -very easy to get a PC to supply a false username. I recommend that the -bf(hosts equiv) option be only used if you really know what you are -doing, or perhaps on a home network where you trust your spouse and -kids. And only if you em(really) trust them :-). - - bf(Default) -tt( No host equivalences) - - bf(Example) -tt( hosts equiv = /etc/hosts.equiv) - -label(include) -dit(bf(include (G))) - -This allows you to include one config file inside another. The file -is included literally, as though typed in place. - -It takes the standard substitutions, except link(bf(%u))(percentu), -link(bf(%P))(percentP) and link(bf(%S))(percentS). - -label(inheritpermissions) -dit(bf(inherit permissions (S))) - -The permissions on new files and directories are normally governed by -link(bf("create mask"))(createmask), -link(bf("directory mask"))(directorymask), -link(bf("force create mode"))(forcecreatemode) and -link(bf("force directory mode"))(forcedirectorymode) -but the boolean inherit permissions parameter overrides this. - -New directories inherit the mode of the parent directory, -including bits such as setgid. - -New files inherit their read/write bits from the parent directory. -Their execute bits continue to be determined by -link(bf("map archive"))(maparchive), -link(bf("map hidden"))(maphidden) and -link(bf("map system"))(mapsystem) as usual. - -Note that the setuid bit is *never* set via inheritance -(the code explicitly prohibits this). - -This can be particularly useful on large systems with many users, -perhaps several thousand, -to allow a single bf([homes]) share to be used flexibly by each user. - -See also link(bf("create mask"))(createmask), link(bf("directory mask"))(directorymask), -link(bf("force create mode"))(forcecreatemode) and -link(bf("force directory mode"))(forcedirectorymode). - - bf(Default) -tt( inherit permissions = no) - - bf(Example) -tt( inherit permissions = yes) - -label(interfaces) -dit(bf(interfaces (G))) - -This option allows you to override the default network interfaces list -that Samba will use for browsing, name registration and other NBT -traffic. By default Samba will query the kernel for the list of all -active interfaces and use any interfaces except 127.0.0.1 that are -broadcast capable. - -The option takes a list of interface strings. Each string can be in -any of the following forms: - -startit() -it() a network interface name (such as eth0). This may include - shell-like wildcards so eth* will match any interface starting - with the substring "eth" -it() an IP address. In this case the netmask is determined - from the list of interfaces obtained from the kernel -it() an IP/mask pair. -it() a broadcast/mask pair. -endit() - -The "mask" parameters can either be a bit length (such as 24 for a C -class network) or a full netmask in dotted decmal form. - -The "IP" parameters above can either be a full dotted decimal IP -address or a hostname which will be looked up via the OSes normal -hostname resolution mechanisms. - -For example, the following line: - -tt(interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0) - -would configure three network interfaces corresponding to the eth0 -device and IP addresses 192.168.2.10 and 192.168.3.10. The netmasks of -the latter two interfaces would be set to 255.255.255.0. - -See also link(bf("bind interfaces only"))(bindinterfacesonly). - -label(invalidusers) -dit(bf(invalid users (S))) - -This is a list of users that should not be allowed to login to this -service. This is really a em("paranoid") check to absolutely ensure an -improper setting does not breach your security. - -A name starting with a tt('@') is interpreted as an NIS netgroup first -(if your system supports NIS), and then as a UNIX group if the name -was not found in the NIS netgroup database. - -A name starting with tt('+') is interpreted only by looking in the -UNIX group database. A name starting with tt('&') is interpreted only -by looking in the NIS netgroup database (this requires NIS to be -working on your system). The characters tt('+') and tt('&') may be -used at the start of the name in either order so the value -tt("+&group") means check the UNIX group database, followed by the NIS -netgroup database, and the value tt("&+group") means check the NIS -netgroup database, followed by the UNIX group database (the same as -the tt('@') prefix). - -The current servicename is substituted for -link(bf(%S))(percentS). This is useful in the link(bf([homes]))(homes) -section. - -See also link(bf("valid users"))(validusers). - - bf(Default:) -tt( No invalid users) - - bf(Example:) -tt( invalid users = root fred admin @wheel) - -label(keepalive) -dit(bf(keepalive (G))) - -The value of the parameter (an integer) represents the number of -seconds between bf('keepalive') packets. If this parameter is zero, no -keepalive packets will be sent. Keepalive packets, if sent, allow the -server to tell whether a client is still present and responding. - -Keepalives should, in general, not be needed if the socket being used -has the SO_KEEPALIVE attribute set on it (see link(bf("socket -options"))(socketoptions)). Basically you should only use this option -if you strike difficulties. - - bf(Default:) -tt( keepalive = 0) - - bf(Example:) -tt( keepalive = 60) - -label(kerneloplocks) -dit(bf(kernel oplocks (G))) - -For UNIXs that support kernel based link(bf(oplocks))(oplocks) -(currently only IRIX but hopefully also Linux and FreeBSD soon) this -parameter allows the use of them to be turned on or off. - -Kernel oplocks support allows Samba link(bf(oplocks))(oplocks) to be -broken whenever a local UNIX process or NFS operation accesses a file -that url(bf(smbd))(smbd.8.html) has oplocked. This allows complete -data consistency between SMB/CIFS, NFS and local file access (and is a -em(very) cool feature :-). - -This parameter defaults to em("On") on systems that have the support, -and em("off") on systems that don't. You should never need to touch -this parameter. - -See also the link(bf("oplocks"))(oplocks) and link(bf("level2 oplocks"))(level2oplocks) -parameters. - -label(ldapfilter) -dit(bf(ldap filter (G))) - -This parameter is part of the em(EXPERIMENTAL) Samba support for a -password database stored on an LDAP server back-end. These options -are only available if your version of Samba was configured with -the bf(--with-ldap) option. - -This parameter specifies an LDAP search filter used to search for a -user name in the LDAP database. It must contain the string -link(bf(%u))(percentU) which will be replaced with the user being -searched for. - - bf(Default:) -tt( empty string.) - -label(ldapport) -dit(bf(ldap port (G))) - -This parameter is part of the em(EXPERIMENTAL) Samba support for a -password database stored on an LDAP server back-end. These options -are only available if your version of Samba was configured with -the bf(--with-ldap) option. - -This parameter specifies the TCP port number to use to contact -the LDAP server on. - - bf(Default:) -tt( ldap port = 389.) - -label(ldaproot) -dit(bf(ldap root (G))) - -This parameter is part of the em(EXPERIMENTAL) Samba support for a -password database stored on an LDAP server back-end. These options -are only available if your version of Samba was configured with -the bf(--with-ldap) option. - -This parameter specifies the entity to bind to the LDAP server -as (essentially the LDAP username) in order to be able to perform -queries and modifications on the LDAP database. - -See also link(bf(ldap root passwd))(ldaprootpasswd). - - bf(Default:) -tt( empty string (no user defined)) - -label(ldaprootpasswd) -dit(bf(ldap root passwd (G))) - -This parameter is part of the em(EXPERIMENTAL) Samba support for a -password database stored on an LDAP server back-end. These options -are only available if your version of Samba was configured with -the bf(--with-ldap) option. - -This parameter specifies the password for the entity to bind to the -LDAP server as (the password for this LDAP username) in order to be -able to perform queries and modifications on the LDAP database. - -em(BUGS:) This parameter should em(NOT) be a readable parameter -in the bf(smb.conf) file and will be removed once a correct -storage place is found. - -See also link(bf(ldap root))(ldaproot). - - bf(Default:) -tt( empty string.) - -label(ldapserver) -dit(bf(ldap server (G))) - -This parameter is part of the em(EXPERIMENTAL) Samba support for a -password database stored on an LDAP server back-end. These options -are only available if your version of Samba was configured with -the bf(--with-ldap) option. - -This parameter specifies the DNS name of the LDAP server to use -for SMB/CIFS authentication purposes. - - bf(Default:) -tt( ldap server = localhost) - -label(ldapsuffix) -dit(bf(ldap suffix (G))) - -This parameter is part of the em(EXPERIMENTAL) Samba support for a -password database stored on an LDAP server back-end. These options -are only available if your version of Samba was configured with -the bf(--with-ldap) option. - -This parameter specifies the tt("dn") or LDAP em("distinguished name") -that tells url(bf(smbd))(smbd.8.html) to start from when searching -for an entry in the LDAP password database. - - bf(Default:) -tt( empty string.) - -label(level2oplocks) -dit(bf(level2 oplocks (S))) - -This parameter (new in Samba 2.0.5) controls whether Samba supports -level2 (read-only) oplocks on a share. In Samba 2.0.5 this parameter -defaults to "False" as the code is new, but will default to "True" -in a later release. - -Level2, or read-only oplocks allow Windows NT clients that have an -oplock on a file to downgrade from a read-write oplock to a read-only -oplock once a second client opens the file (instead of releasing all -oplocks on a second open, as in traditional, exclusive oplocks). This -allows all openers of the file that support level2 oplocks to cache -the file for read-ahead only (ie. they may not cache writes or lock -requests) and increases performance for many acesses of files that -are not commonly written (such as application .EXE files). - -Once one of the clients which have a read-only oplock writes to -the file all clients are notified (no reply is needed or waited -for) and told to break their oplocks to "none" and delete any -read-ahead caches. - -It is recommended that this parameter be turned on to speed access -to shared executables (and also to test the code :-). - -For more discussions on level2 oplocks see the CIFS spec. - -Currently, if link(bf("kernel oplocks"))(kerneloplocks) are supported -then level2 oplocks are not granted (even if this parameter is set -to tt("true")). Note also, the link(bf("oplocks"))(oplocks) parameter must -be set to "true" on this share in order for this parameter to have any -effect. - -See also the link(bf("oplocks"))(oplocks) and link(bf("kernel oplocks"))(kerneloplocks) parameters. - - bf(Default:) -tt( level2 oplocks = False) - - bf(Example:) -tt( level2 oplocks = True) - -label(lmannounce) -dit(bf(lm announce (G))) - -This parameter determines if url(bf(nmbd))(nmbd.8.html) will produce -Lanman announce broadcasts that are needed by bf(OS/2) clients in order -for them to see the Samba server in their browse list. This parameter -can have three values, tt("true"), tt("false"), or tt("auto"). The -default is tt("auto"). If set to tt("false") Samba will never produce -these broadcasts. If set to tt("true") Samba will produce Lanman -announce broadcasts at a frequency set by the parameter link(bf("lm -interval"))(lminterval). If set to tt("auto") Samba will not send Lanman -announce broadcasts by default but will listen for them. If it hears -such a broadcast on the wire it will then start sending them at a -frequency set by the parameter link(bf("lm interval"))(lminterval). - -See also link(bf("lm interval"))(lminterval). - - bf(Default:) -tt( lm announce = auto) - - bf(Example:) -tt( lm announce = true) - -label(lminterval) -dit(bf(lm interval (G))) - -If Samba is set to produce Lanman announce broadcasts needed by -bf(OS/2) clients (see the link(bf("lm announce"))(lmannounce) -parameter) then this parameter defines the frequency in seconds with -which they will be made. If this is set to zero then no Lanman -announcements will be made despite the setting of the link(bf("lm -announce"))(lmannounce) parameter. - -See also link(bf("lm announce"))(lmannounce). - - bf(Default:) -tt( lm interval = 60) - - bf(Example:) -tt( lm interval = 120) - -label(loadprinters) -dit(bf(load printers (G))) - -A boolean variable that controls whether all printers in the printcap -will be loaded for browsing by default. See the -link(bf("printers"))(printers) section for more details. - - bf(Default:) -tt( load printers = yes) - - bf(Example:) -tt( load printers = no) - -label(localmaster) -dit(bf(local master (G))) - -This option allows url(bf(nmbd))(nmbd.8.html) to try and become a -local master browser on a subnet. If set to False then -url(bf(nmbd))(nmbd.8.html) will not attempt to become a local master -browser on a subnet and will also lose in all browsing elections. By -default this value is set to true. Setting this value to true doesn't -mean that Samba will em(become) the local master browser on a subnet, -just that url(bf(nmbd))(nmbd.8.html) will em(participate) in -elections for local master browser. - -Setting this value to False will cause url(bf(nmbd))(nmbd.8.html) -em(never) to become a local master browser. - - bf(Default:) -tt( local master = yes) - -label(lock dir) -dit(bf(lock dir (G))) - -Synonym for link(bf("lock directory"))(lockdirectory). - -label(lockdirectory) -dit(bf(lock directory (G))) - -This option specifies the directory where lock files will be placed. -The lock files are used to implement the link(bf("max -connections"))(maxconnections) option. - - bf(Default:) -tt( lock directory = /tmp/samba) - - bf(Example:) -tt( lock directory = /usr/local/samba/var/locks) - -label(locking) -dit(bf(locking (S))) - -This controls whether or not locking will be performed by the server -in response to lock requests from the client. - -If tt("locking = no"), all lock and unlock requests will appear to -succeed and all lock queries will indicate that the queried lock is -clear. - -If tt("locking = yes"), real locking will be performed by the server. - -This option em(may) be useful for read-only filesystems which em(may) -not need locking (such as cdrom drives), although setting this -parameter of tt("no") is not really recommended even in this case. - -Be careful about disabling locking either globally or in a specific -service, as lack of locking may result in data corruption. You should -never need to set this parameter. - - bf(Default:) -tt( locking = yes) - - bf(Example:) -tt( locking = no) - -label(logfile) -dit(bf(log file (G))) - -This options allows you to override the name of the Samba log file -(also known as the debug file). - -This option takes the standard substitutions, allowing you to have -separate log files for each user or machine. - - bf(Example:) -tt( log file = /usr/local/samba/var/log.%m) - -label(loglevel) -dit(bf(log level (G))) - -Synonym for link(bf("debug level"))(debuglevel). - -label(logondrive) -dit(bf(logon drive (G))) - -This parameter specifies the local path to which the home directory -will be connected (see link(bf("logon home"))(logonhome)) and is only -used by NT Workstations. - -Note that this option is only useful if Samba is set up as a -link(bf(logon server))(domainlogons). - - bf(Example:) -tt( logon drive = h:) - -label(logonhome) -dit(bf(logon home (G))) - -This parameter specifies the home directory location when a Win95/98 or -NT Workstation logs into a Samba PDC. It allows you to do - -tt("NET USE H: /HOME") - -from a command prompt, for example. - -This option takes the standard substitutions, allowing you to have -separate logon scripts for each user or machine. - -This parameter can be used with Win9X workstations to ensure that -roaming profiles are stored in a subdirectory of the user's home -directory. This is done in the following way: - -tt(" logon home = \\%L\%U\profile") - -This tells Samba to return the above string, with substitutions made -when a client requests the info, generally in a NetUserGetInfo request. -Win9X clients truncate the info to \\server\share when a user does tt("net use /home"), -but use the whole string when dealing with profiles. - -Note that in prior versions of Samba, the tt("logon path") was returned rather than -tt("logon home"). This broke tt("net use /home") but allowed profiles outside the -home directory. The current implementation is correct, and can be used for profiles -if you use the above trick. - -Note that this option is only useful if Samba is set up as a -link(bf(logon server))(domainlogons). - - bf(Example:) -tt( logon home = "\\remote_smb_server\%U") - - bf(Default:) -tt( logon home = "\\%N\%U") - -label(logonpath) -dit(bf(logon path (G))) - -This parameter specifies the home directory where roaming profiles -(NTuser.dat etc files for Windows NT) are stored. Contrary to previous -versions of these manual pages, it has nothing to do with Win 9X roaming -profiles. To find out how to handle roaming profiles for Win 9X system, see -the tt("logon home") parameter. - -This option takes the standard substitutions, allowing you to have -separate logon scripts for each user or machine. It also specifies -the directory from which the tt("application data"), (tt("desktop"), tt("start menu"), -tt("network neighborhood"), tt("programs") and other folders, and their -contents, are loaded and displayed on your Windows NT client. - -The share and the path must be readable by the user for the -preferences and directories to be loaded onto the Windows NT -client. The share must be writeable when the logs in for the first -time, in order that the Windows NT client can create the NTuser.dat -and other directories. - -Thereafter, the directories and any of the contents can, if required, be -made read-only. It is not advisable that the NTuser.dat file be made -read-only - rename it to NTuser.man to achieve the desired effect (a -em(MAN)datory profile). - -Windows clients can sometimes maintain a connection to the [homes] -share, even though there is no user logged in. Therefore, it is vital -that the logon path does not include a reference to the homes share -(i.e. setting this parameter to tt(\\%N\HOMES\profile_path) will cause -problems). - -This option takes the standard substitutions, allowing you to have -separate logon scripts for each user or machine. - -Note that this option is only useful if Samba is set up as a -link(bf(logon server))(domainlogons). - - bf(Default:) -tt( logon path = \\%N\%U\profile) - - bf(Example:) -tt( logon path = \\PROFILESERVER\HOME_DIR\%U\PROFILE) - -label(logonscript) -dit(bf(logon script (G))) - -This parameter specifies the batch file (.bat) or NT command file -(.cmd) to be downloaded and run on a machine when a user successfully -logs in. The file must contain the DOS style cr/lf line endings. -Using a DOS-style editor to create the file is recommended. - -The script must be a relative path to the tt([netlogon]) service. If -the tt([netlogon]) service specifies a link(bf(path))(path) of -/usr/local/samba/netlogon, and logon script = STARTUP.BAT, then the -file that will be downloaded is: - -tt(/usr/local/samba/netlogon/STARTUP.BAT) - -The contents of the batch file is entirely your choice. A suggested -command would be to add tt(NET TIME \\SERVER /SET /YES), to force every -machine to synchronize clocks with the same time server. Another use -would be to add tt(NET USE U: \\SERVER\UTILS) for commonly used -utilities, or tt(NET USE Q: \\SERVER\ISO9001_QA) for example. - -Note that it is particularly important not to allow write access to -the tt([netlogon]) share, or to grant users write permission on the -batch files in a secure environment, as this would allow the batch -files to be arbitrarily modified and security to be breached. - -This option takes the standard substitutions, allowing you to have -separate logon scripts for each user or machine. - -Note that this option is only useful if Samba is set up as a -link(bf(logon server))(domainlogons). - - bf(Example:) -tt( logon script = scripts\%U.bat) - -label(lppausecommand) -dit(bf(lppause command (S))) - -This parameter specifies the command to be executed on the server host -in order to stop printing or spooling a specific print job. - -This command should be a program or script which takes a printer name -and job number to pause the print job. One way of implementing this is -by using job priorities, where jobs having a too low priority won't be -sent to the printer. - -If a tt("%p") is given then the printername is put in its place. A -tt("%j") is replaced with the job number (an integer). On HPUX (see -link(bf(printing=hpux))(printing)), if the tt("-p%p") option is added -to the lpq command, the job will show up with the correct status, -i.e. if the job priority is lower than the set fence priority it will -have the PAUSED status, whereas if the priority is equal or higher it -will have the SPOOLED or PRINTING status. - -Note that it is good practice to include the absolute path in the -lppause command as the PATH may not be available to the server. - -See also the link(bf("printing"))(printing) parameter. - - bf(Default:) - Currently no default value is given to this string, unless the -value of the link(bf("printing"))(printing) parameter is tt(SYSV), in -which case the default is : - -tt( lp -i %p-%j -H hold) - -or if the value of the link(bf("printing"))(printing) parameter is tt(softq), -then the default is: - -tt( qstat -s -j%j -h) - - bf(Example for HPUX:) - lppause command = /usr/bin/lpalt %p-%j -p0 - -label(lpqcachetime) -dit(bf(lpq cache time (G))) - -This controls how long lpq info will be cached for to prevent the -bf(lpq) command being called too often. A separate cache is kept for -each variation of the bf(lpq) command used by the system, so if you -use different bf(lpq) commands for different users then they won't -share cache information. - -The cache files are stored in tt(/tmp/lpq.xxxx) where xxxx is a hash of -the bf(lpq) command in use. - -The default is 10 seconds, meaning that the cached results of a -previous identical bf(lpq) command will be used if the cached data is -less than 10 seconds old. A large value may be advisable if your -bf(lpq) command is very slow. - -A value of 0 will disable caching completely. - -See also the link(bf("printing"))(printing) parameter. - - bf(Default:) -tt( lpq cache time = 10) - - bf(Example:) -tt( lpq cache time = 30) - -label(lpqcommand) -dit(bf(lpq command (S))) - -This parameter specifies the command to be executed on the server host -in order to obtain tt("lpq")-style printer status information. - -This command should be a program or script which takes a printer name -as its only parameter and outputs printer status information. - -Currently eight styles of printer status information are supported; -BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX and SOFTQ. This covers most UNIX -systems. You control which type is expected using the -link(bf("printing ="))(printing) option. - -Some clients (notably Windows for Workgroups) may not correctly send -the connection number for the printer they are requesting status -information about. To get around this, the server reports on the first -printer service connected to by the client. This only happens if the -connection number sent is invalid. - -If a tt(%p) is given then the printername is put in its place. Otherwise -it is placed at the end of the command. - -Note that it is good practice to include the absolute path in the bf(lpq -command) as the PATH may not be available to the server. - -See also the link(bf("printing"))(printing) parameter. - - bf(Default:) -tt( depends on the setting of printing =) - - bf(Example:) -tt( lpq command = /usr/bin/lpq %p) - -label(lpresumecommand) -dit(bf(lpresume command (S))) - -This parameter specifies the command to be executed on the server host -in order to restart or continue printing or spooling a specific print -job. - -This command should be a program or script which takes a printer name -and job number to resume the print job. See also the link(bf("lppause -command"))(lppausecommand) parameter. - -If a tt(%p) is given then the printername is put in its place. A -tt(%j) is replaced with the job number (an integer). - -Note that it is good practice to include the absolute path in the bf(lpresume -command) as the PATH may not be available to the server. - -See also the link(bf("printing"))(printing) parameter. - - bf(Default:) - - Currently no default value is given to this string, unless the -value of the link(bf("printing"))(printing) parameter is tt(SYSV), in -which case the default is : - -tt( lp -i %p-%j -H resume) - -or if the value of the link(bf("printing"))(printing) parameter is tt(softq), -then the default is: - -tt( qstat -s -j%j -r) - - bf(Example for HPUX:) -tt( lpresume command = /usr/bin/lpalt %p-%j -p2) - -label(lprmcommand) -dit(bf(lprm command (S))) - -This parameter specifies the command to be executed on the server host -in order to delete a print job. - -This command should be a program or script which takes a printer name -and job number, and deletes the print job. - -If a tt(%p) is given then the printername is put in its place. A -tt(%j) is replaced with the job number (an integer). - -Note that it is good practice to include the absolute path in the -bf(lprm command) as the PATH may not be available to the server. - -See also the link(bf("printing"))(printing) parameter. - - bf(Default:) -tt( depends on the setting of "printing =") - - bf(Example 1:) -tt( lprm command = /usr/bin/lprm -P%p %j) - - bf(Example 2:) -tt( lprm command = /usr/bin/cancel %p-%j) - -label(machinepasswordtimeout) -dit(bf(machine password timeout (G))) - -If a Samba server is a member of an Windows NT Domain (see the -link(bf("security=domain"))(securityequaldomain)) parameter) then -periodically a running url(bf(smbd))(smbd.8.html) process will try and -change the bf(MACHINE ACCOUNT PASWORD) stored in the file called -tt(<Domain>.<Machine>.mac) where tt(<Domain>) is the name of the -Domain we are a member of and tt(<Machine>) is the primary -link(bf("NetBIOS name"))(netbiosname) of the machine -url(bf(smbd))(smbd.8.html) is running on. This parameter specifies how -often this password will be changed, in seconds. The default is one -week (expressed in seconds), the same as a Windows NT Domain member -server. - -See also url(bf(smbpasswd (8)))(smbpasswd.8.html), and the -link(bf("security=domain"))(securityequaldomain)) parameter. - - bf(Default:) -tt( machine password timeout = 604800) - -label(magicoutput) -dit(bf(magic output (S))) - -This parameter specifies the name of a file which will contain output -created by a magic script (see the link(bf("magic -script"))(magicscript) parameter below). - -Warning: If two clients use the same link(bf("magic -script"))(magicscript) in the same directory the output file content -is undefined. - - bf(Default:) -tt( magic output = <magic script name>.out) - - bf(Example:) -tt( magic output = myfile.txt) - -label(magicscript) -dit(bf(magic script (S))) - -This parameter specifies the name of a file which, if opened, will be -executed by the server when the file is closed. This allows a UNIX -script to be sent to the Samba host and executed on behalf of the -connected user. - -Scripts executed in this way will be deleted upon completion, -permissions permitting. - -If the script generates output, output will be sent to the file -specified by the link(bf("magic output"))(magicoutput) parameter (see -above). - -Note that some shells are unable to interpret scripts containing -carriage-return-linefeed instead of linefeed as the end-of-line -marker. Magic scripts must be executable em("as is") on the host, -which for some hosts and some shells will require filtering at the DOS -end. - -Magic scripts are em(EXPERIMENTAL) and should em(NOT) be relied upon. - - bf(Default:) -tt( None. Magic scripts disabled.) - - bf(Example:) -tt( magic script = user.csh) - -label(manglecase) -dit(bf(mangle case (S))) - -See the section on link(bf("NAME MANGLING"))(NAMEMANGLING). - -label(manglelocks) -dit(bf(mangle locks (S))) - -This option is was introduced with Samba 2.0.4 and above and has been -removed in Samba 2.0.6 as Samba now dynamically configures such things -on 32 bit systems. - -label(mangledmap) -dit(bf(mangled map (S))) - -This is for those who want to directly map UNIX file names which can -not be represented on Windows/DOS. The mangling of names is not always -what is needed. In particular you may have documents with file -extensions that differ between DOS and UNIX. For example, under UNIX -it is common to use tt(".html") for HTML files, whereas under -Windows/DOS tt(".htm") is more commonly used. - -So to map tt("html") to tt("htm") you would use: - -tt( mangled map = (*.html *.htm)) - -One very useful case is to remove the annoying tt(";1") off the ends -of filenames on some CDROMS (only visible under some UNIXs). To do -this use a map of (*;1 *). - - bf(default:) -tt( no mangled map) - - bf(Example:) -tt( mangled map = (*;1 *)) - -label(manglednames) -dit(bf(mangled names (S))) - -This controls whether non-DOS names under UNIX should be mapped to -DOS-compatible names ("mangled") and made visible, or whether non-DOS -names should simply be ignored. - -See the section on link(bf("NAME MANGLING"))(NAMEMANGLING) for details -on how to control the mangling process. - -If mangling is used then the mangling algorithm is as follows: - -startit() - -it() The first (up to) five alphanumeric characters before the -rightmost dot of the filename are preserved, forced to upper case, and -appear as the first (up to) five characters of the mangled name. - -it() A tilde tt("~") is appended to the first part of the mangled -name, followed by a two-character unique sequence, based on the -original root name (i.e., the original filename minus its final -extension). The final extension is included in the hash calculation -only if it contains any upper case characters or is longer than three -characters. - -Note that the character to use may be specified using the -link(bf("mangling char"))(manglingchar) option, if you don't like -tt('~'). - -it() The first three alphanumeric characters of the final extension -are preserved, forced to upper case and appear as the extension of the -mangled name. The final extension is defined as that part of the -original filename after the rightmost dot. If there are no dots in the -filename, the mangled name will have no extension (except in the case -of link(bf("hidden files"))(hidefiles) - see below). - -it() Files whose UNIX name begins with a dot will be presented as DOS -hidden files. The mangled name will be created as for other filenames, -but with the leading dot removed and tt("___") as its extension regardless -of actual original extension (that's three underscores). - -endit() - -The two-digit hash value consists of upper case alphanumeric -characters. - -This algorithm can cause name collisions only if files in a directory -share the same first five alphanumeric characters. The probability of -such a clash is 1/1300. - -The name mangling (if enabled) allows a file to be copied between UNIX -directories from Windows/DOS while retaining the long UNIX -filename. UNIX files can be renamed to a new extension from -Windows/DOS and will retain the same basename. Mangled names do not -change between sessions. - - bf(Default:) -tt( mangled names = yes) - - bf(Example:) -tt( mangled names = no) - -label(manglingchar) -dit(bf(mangling char (S))) - -This controls what character is used as the em("magic") character in -link(bf(name mangling))(manglednames). The default is a tt('~') but -this may interfere with some software. Use this option to set it to -whatever you prefer. - - bf(Default:) -tt( mangling char = ~) - - bf(Example:) -tt( mangling char = ^) - -label(mangledstack) -dit(bf(mangled stack (G))) - -This parameter controls the number of mangled names that should be -cached in the Samba server url(bf(smbd))(smbd.8.html). - -This stack is a list of recently mangled base names (extensions are -only maintained if they are longer than 3 characters or contains upper -case characters). - -The larger this value, the more likely it is that mangled names can be -successfully converted to correct long UNIX names. However, large -stack sizes will slow most directory access. Smaller stacks save -memory in the server (each stack element costs 256 bytes). - -It is not possible to absolutely guarantee correct long file names, so -be prepared for some surprises! - - bf(Default:) -tt( mangled stack = 50) - - bf(Example:) -tt( mangled stack = 100) - -label(maparchive) -dit(bf(map archive (S))) - -This controls whether the DOS archive attribute should be mapped to -the UNIX owner execute bit. The DOS archive bit is set when a file -has been modified since its last backup. One motivation for this -option it to keep Samba/your PC from making any file it touches from -becoming executable under UNIX. This can be quite annoying for shared -source code, documents, etc... - -Note that this requires the link(bf("create mask"))(createmask) -parameter to be set such that owner execute bit is not masked out -(i.e. it must include 100). See the parameter link(bf("create -mask"))(createmask) for details. - - bf(Default:) -tt( map archive = yes) - - bf(Example:) -tt( map archive = no) - -label(maphidden) -dit(bf(map hidden (S))) - -This controls whether DOS style hidden files should be mapped to the -UNIX world execute bit. - -Note that this requires the link(bf("create mask"))(createmask) to be -set such that the world execute bit is not masked out (i.e. it must -include 001). See the parameter link(bf("create mask"))(createmask) -for details. - - bf(Default:) -tt( map hidden = no) - - bf(Example:) -tt( map hidden = yes) - -label(mapsystem) -dit(bf(map system (S))) - -This controls whether DOS style system files should be mapped to the -UNIX group execute bit. - -Note that this requires the link(bf("create mask"))(createmask) to be -set such that the group execute bit is not masked out (i.e. it must -include 010). See the parameter link(bf("create mask"))(createmask) -for details. - - bf(Default:) -tt( map system = no) - - bf(Example:) -tt( map system = yes) - -label(maptoguest) -dit(bf(map to guest (G))) - -This parameter is only useful in link(bf(security))(security) modes -other than link(bf("security=share"))(securityequalshare) - i.e. user, -server, and domain. - -This parameter can take three different values, which tell -url(bf(smbd))(smbd.8.html) what to do with user login requests that -don't match a valid UNIX user in some way. - -The three settings are : - -startit() - -it() bf("Never") - Means user login requests with an invalid password -are rejected. This is the default. - -it() bf("Bad User") - Means user logins with an invalid password are -rejected, unless the username does not exist, in which case it is -treated as a guest login and mapped into the link(bf("guest -account"))(guestaccount). - -it() bf("Bad Password") - Means user logins with an invalid -password are treated as a guest login and mapped into the -link(bf("guest account"))(guestaccount). Note that this can -cause problems as it means that any user incorrectly typing their -password will be silently logged on a bf("guest") - and -will not know the reason they cannot access files they think -they should - there will have been no message given to them -that they got their password wrong. Helpdesk services will -em(*hate*) you if you set the bf("map to guest") parameter -this way :-). - -endit() - -Note that this parameter is needed to set up bf("Guest") share -services when using link(bf(security))(security) modes other than -share. This is because in these modes the name of the resource being -requested is em(*not*) sent to the server until after the server has -successfully authenticated the client so the server cannot make -authentication decisions at the correct time (connection to the -share) for bf("Guest") shares. - -For people familiar with the older Samba releases, this parameter -maps to the old compile-time setting of the GUEST_SESSSETUP value -in local.h. - - bf(Default:) -tt( map to guest = Never) - bf(Example): -tt( map to guest = Bad User) - -label(maxconnections) -dit(bf(max connections (S))) - -This option allows the number of simultaneous connections to a service -to be limited. If bf("max connections") is greater than 0 then -connections will be refused if this number of connections to the -service are already open. A value of zero mean an unlimited number of -connections may be made. - -Record lock files are used to implement this feature. The lock files -will be stored in the directory specified by the link(bf("lock -directory"))(lockdirectory) option. - - bf(Default:) -tt( max connections = 0) - - bf(Example:) -tt( max connections = 10) - -label(maxdisksize) -dit(bf(max disk size (G))) - -This option allows you to put an upper limit on the apparent size of -disks. If you set this option to 100 then all shares will appear to be -not larger than 100 MB in size. - -Note that this option does not limit the amount of data you can put on -the disk. In the above case you could still store much more than 100 -MB on the disk, but if a client ever asks for the amount of free disk -space or the total disk size then the result will be bounded by the -amount specified in bf("max disk size"). - -This option is primarily useful to work around bugs in some pieces of -software that can't handle very large disks, particularly disks over -1GB in size. - -A bf("max disk size") of 0 means no limit. - - bf(Default:) -tt( max disk size = 0) - - bf(Example:) -tt( max disk size = 1000) - -label(maxlogsize) -dit(bf(max log size (G))) - -This option (an integer in kilobytes) specifies the max size the log -file should grow to. Samba periodically checks the size and if it is -exceeded it will rename the file, adding a tt(".old") extension. - -A size of 0 means no limit. - - bf(Default:) -tt( max log size = 5000) - - bf(Example:) -tt( max log size = 1000) - -label(maxmux) -dit(bf(max mux (G))) - -This option controls the maximum number of outstanding simultaneous -SMB operations that samba tells the client it will allow. You should -never need to set this parameter. - - bf(Default:) -tt( max mux = 50) - -label(maxopenfiles) -dit(bf(max open files (G))) - -This parameter limits the maximum number of open files that one -url(bf(smbd))(smbd.8.html) file serving process may have open for -a client at any one time. The default for this parameter is set -very high (10,000) as Samba uses only one bit per unopened file. - -The limit of the number of open files is usually set by the -UNIX per-process file descriptor limit rather than this parameter -so you should never need to touch this parameter. - - bf(Default:) -tt( max open files = 10000) - -label(maxpacket) -dit(bf(max packet (G))) - -Synonym for link(bf("packet size"))(packetsize). - -label(maxttl) -dit(bf(max ttl (G))) - -This option tells url(bf(nmbd))(nmbd.8.html) what the default 'time -to live' of NetBIOS names should be (in seconds) when -url(bf(nmbd))(nmbd.8.html) is requesting a name using either a -broadcast packet or from a WINS server. You should never need to -change this parameter. The default is 3 days. - - bf(Default:) -tt( max ttl = 259200) - -label(maxwinsttl) -dit(bf(max wins ttl (G))) - -This option tells url(bf(nmbd))(nmbd.8.html) when acting as a WINS -server link(bf((wins support =true)))(winssupport) what the maximum -'time to live' of NetBIOS names that url(bf(nmbd))(nmbd.8.html) will -grant will be (in seconds). You should never need to change this -parameter. The default is 6 days (518400 seconds). - -See also the link(bf("min wins ttl"))(minwinsttl) parameter. - - bf(Default:) -tt( max wins ttl = 518400) - -label(maxxmit) -dit(bf(max xmit (G))) - -This option controls the maximum packet size that will be negotiated -by Samba. The default is 65535, which is the maximum. In some cases -you may find you get better performance with a smaller value. A value -below 2048 is likely to cause problems. - - bf(Default:) -tt( max xmit = 65535) - - bf(Example:) -tt( max xmit = 8192) - -label(messagecommand) -dit(bf(message command (G))) - -This specifies what command to run when the server receives a WinPopup -style message. - -This would normally be a command that would deliver the message -somehow. How this is to be done is up to your imagination. - -An example is: - -tt( message command = csh -c 'xedit %s;rm %s' &) - -This delivers the message using bf(xedit), then removes it -afterwards. em(NOTE THAT IT IS VERY IMPORTANT THAT THIS COMMAND RETURN -IMMEDIATELY). That's why I have the tt('&') on the end. If it doesn't -return immediately then your PCs may freeze when sending messages -(they should recover after 30secs, hopefully). - -All messages are delivered as the global guest user. The command takes -the standard substitutions, although link(bf(%u))(percentu) won't work -(link(bf(%U))(percentU) may be better in this case). - -Apart from the standard substitutions, some additional ones apply. In -particular: - -startit() - -it() tt("%s") = the filename containing the message. - -it() tt("%t") = the destination that the message was sent to (probably the server -name). - -it() tt("%f") = who the message is from. - -endit() - -You could make this command send mail, or whatever else takes your -fancy. Please let us know of any really interesting ideas you have. - -Here's a way of sending the messages as mail to root: - -tt(message command = /bin/mail -s 'message from %f on %m' root < %s; rm %s) - -If you don't have a message command then the message won't be -delivered and Samba will tell the sender there was an -error. Unfortunately WfWg totally ignores the error code and carries -on regardless, saying that the message was delivered. - -If you want to silently delete it then try: - -tt("message command = rm %s"). - - bf(Default:) -tt( no message command) - - bf(Example:) -tt( message command = csh -c 'xedit %s;rm %s' &) - -label(minprintspace) -dit(bf(min print space (S))) - -This sets the minimum amount of free disk space that must be available -before a user will be able to spool a print job. It is specified in -kilobytes. The default is 0, which means a user can always spool a print -job. - -See also the link(bf(printing))(printing) parameter. - - bf(Default:) -tt( min print space = 0) - - bf(Example:) -tt( min print space = 2000) - -label(minpasswdlength) -dit(bf(min passwd length (G))) - -Synonym for link(bf("min password length"))(minpasswordlength). - -label(minpasswordlength) -dit(bf(min password length (G))) - -This option sets the minimum length in characters of a plaintext password -than smbd will accept when performing UNIX password changing. - -See also link(bf("unix password sync"))(unixpasswordsync), -link(bf("passwd program"))(passwdprogram) and link(bf("passwd chat -debug"))(passwdchatdebug). - - bf(Default:) -tt( min password length = 5) - - -label(minwinsttl) -dit(bf(min wins ttl (G))) - -This option tells url(bf(nmbd))(nmbd.8.html) when acting as a WINS -server link(bf((wins support = true)))(winssupport) what the minimum -'time to live' of NetBIOS names that url(bf(nmbd))(nmbd.8.html) will -grant will be (in seconds). You should never need to change this -parameter. The default is 6 hours (21600 seconds). - - bf(Default:) -tt( min wins ttl = 21600) - - -label(nameresolveorder) -dit(bf(name resolve order (G))) - -This option is used by the programs in the Samba suite to determine -what naming services and in what order to resolve host names to IP -addresses. The option takes a space separated string of different name -resolution options. - -The options are :"lmhosts", "host", "wins" and "bcast". They cause -names to be resolved as follows : - -startit() - -it() bf(lmhosts) : Lookup an IP address in the Samba lmhosts file. -If the line in lmhosts has no name type attached to the NetBIOS -name (see the url(bf(lmhosts (5)))(lmhosts.5.html) for details) then -any name type matches for lookup. - -it() bf(host) : Do a standard host name to IP address resolution, -using the system /etc/hosts, NIS, or DNS lookups. This method of name -resolution is operating system depended for instance on IRIX or -Solaris this may be controlled by the em(/etc/nsswitch.conf) file). -Note that this method is only used if the NetBIOS name type being -queried is the 0x20 (server) name type, otherwise it is ignored. - -it() bf(wins) : Query a name with the IP address listed in the -link(bf(wins server))(winsserver) parameter. If no WINS server has -been specified this method will be ignored. - -it() bf(bcast) : Do a broadcast on each of the known local interfaces -listed in the link(bf(interfaces))(interfaces) parameter. This is the -least reliable of the name resolution methods as it depends on the -target host being on a locally connected subnet. - -endit() - - bf(Default:) -tt( name resolve order = lmhosts host wins bcast) - - bf(Example:) -tt( name resolve order = lmhosts bcast host) - -This will cause the local lmhosts file to be examined first, followed -by a broadcast attempt, followed by a normal system hostname lookup. - -label(netbiosaliases) -dit(bf(netbios aliases (G))) - -This is a list of NetBIOS names that url(bf(nmbd))(nmbd.8.html) will -advertise as additional names by which the Samba server is known. This -allows one machine to appear in browse lists under multiple names. If -a machine is acting as a link(bf(browse server))(localmaster) or -link(bf(logon server))(domainlogons) none of these names will be -advertised as either browse server or logon servers, only the primary -name of the machine will be advertised with these capabilities. - -See also link(bf("netbios name"))(netbiosname). - - bf(Default:) -tt( empty string (no additional names)) - - bf(Example:) -tt( netbios aliases = TEST TEST1 TEST2) - -label(netbiosname) -dit(bf(netbios name (G))) - -This sets the NetBIOS name by which a Samba server is known. By -default it is the same as the first component of the host's DNS name. -If a machine is a link(bf(browse server))(localmaster) or -link(bf(logon server))(domainlogons) this name (or the first component -of the hosts DNS name) will be the name that these services are -advertised under. - -See also link(bf("netbios aliases"))(netbiosaliases). - - bf(Default:) -tt( Machine DNS name.) - - bf(Example:) -tt( netbios name = MYNAME) - -label(netbiosscope) -dit(bf(netbios scope (G))) - -This sets the NetBIOS scope that Samba will operate under. This should -not be set unless every machine on your LAN also sets this value. - -label(nishomedir) -dit(bf(nis homedir (G))) - -Get the home share server from a NIS map. For UNIX systems that use an -automounter, the user's home directory will often be mounted on a -workstation on demand from a remote server. - -When the Samba logon server is not the actual home directory server, -but is mounting the home directories via NFS then two network hops -would be required to access the users home directory if the logon -server told the client to use itself as the SMB server for home -directories (one over SMB and one over NFS). This can be very -slow. - -This option allows Samba to return the home share as being on a -different server to the logon server and as long as a Samba daemon is -running on the home directory server, it will be mounted on the Samba -client directly from the directory server. When Samba is returning the -home share to the client, it will consult the NIS map specified in -link(bf("homedir map"))(homedirmap) and return the server listed -there. - -Note that for this option to work there must be a working NIS -system and the Samba server with this option must also be a -link(bf(logon server))(domainlogons). - - bf(Default:) -tt( nis homedir = false) - - bf(Example:) -tt( nis homedir = true) - -label(ntaclsupport) -dit(bf(nt acl support (G))) - -This boolean parameter controls whether url(bf(smbd))(smbd.8.html) -will attempt to map UNIX permissions into Windows NT access control lists. - - bf(Default:) -tt( nt acl support = yes) - - bf(Example:) -tt( nt acl support = no) - -label(ntpipesupport) -dit(bf(nt pipe support (G))) - -This boolean parameter controls whether url(bf(smbd))(smbd.8.html) -will allow Windows NT clients to connect to the NT SMB specific -tt(IPC$) pipes. This is a developer debugging option and can be left -alone. - - bf(Default:) -tt( nt pipe support = yes) - -label(ntsmbsupport) -dit(bf(nt smb support (G))) - -This boolean parameter controls whether url(bf(smbd))(smbd.8.html) -will negotiate NT specific SMB support with Windows NT -clients. Although this is a developer debugging option and should be -left alone, benchmarking has discovered that Windows NT clients give -faster performance with this option set to tt("no"). This is still -being investigated. If this option is set to tt("no") then Samba -offers exactly the same SMB calls that versions prior to Samba2.0 -offered. This information may be of use if any users are having -problems with NT SMB support. - - bf(Default:) -tt( nt support = yes) - -label(nullpasswords) -dit(bf(null passwords (G))) - -Allow or disallow client access to accounts that have null passwords. - -See also url(bf(smbpasswd (5)))(smbpasswd.5.html). - - bf(Default:) -tt( null passwords = no) - - bf(Example:) -tt( null passwords = yes) - -label(olelockingcompatibility) -dit(bf(ole locking compatibility (G))) - -This parameter allows an administrator to turn off the byte range lock -manipulation that is done within Samba to give compatibility for OLE -applications. Windows OLE applications use byte range locking as a -form of inter-process communication, by locking ranges of bytes around -the 2^32 region of a file range. This can cause certain UNIX lock -managers to crash or otherwise cause problems. Setting this parameter -to tt("no") means you trust your UNIX lock manager to handle such cases -correctly. - - bf(Default:) -tt( ole locking compatibility = yes) - - bf(Example:) -tt( ole locking compatibility = no) - -label(onlyguest) -dit(bf(only guest (S))) - -A synonym for link(bf("guest only"))(guestonly). - -label(onlyuser) -dit(bf(only user (S))) - -This is a boolean option that controls whether connections with -usernames not in the link(bf(user=))(user) list will be allowed. By -default this option is disabled so a client can supply a username to -be used by the server. - -Note that this also means Samba won't try to deduce usernames from the -service name. This can be annoying for the link(bf([homes]))(homes) -section. To get around this you could use "link(bf(user))(user) = -link(bf(%S))(percentS)" which means your link(bf("user"))(user) list -will be just the service name, which for home directories is the name -of the user. - -See also the link(bf(user))(user) parameter. - - bf(Default:) -tt( only user = False) - - bf(Example:) -tt( only user = True) - -label(oplocks) -dit(bf(oplocks (S))) - -This boolean option tells smbd whether to issue oplocks (opportunistic -locks) to file open requests on this share. The oplock code can -dramatically (approx. 30% or more) improve the speed of access to files -on Samba servers. It allows the clients to aggressively cache files -locally and you may want to disable this option for unreliable network -environments (it is turned on by default in Windows NT Servers). For -more information see the file Speed.txt in the Samba docs/ directory. - -Oplocks may be selectively turned off on certain files on a per share basis. -See the 'veto oplock files' parameter. On some systems oplocks are recognized -by the underlying operating system. This allows data synchronization between -all access to oplocked files, whether it be via Samba or NFS or a local -UNIX process. See the link(bf(kernel oplocks))(kerneloplocks) parameter -for details. - -See also the link(bf("kernel oplocks"))(kerneloplocks) and -link(bf("level2 oplocks"))(level2oplocks) parameters. - - bf(Default:) -tt( oplocks = True) - - bf(Example:) -tt( oplocks = False) - -label(oplockbreakwaittime) -dit(bf(oplock break wait time (G))) - -This is a tuning parameter added due to bugs in both Windows 9x and WinNT. -If Samba responds to a client too quickly when that client issues an SMB that -can cause an oplock break request, then the client redirector can fail and -not respond to the break request. This tuning parameter (which is set in -milliseconds) is the amount of time Samba will wait before sending an -oplock break request to such (broken) clients. - -em(DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA -OPLOCK CODE). - - bf(Default:) -tt( oplock break wait time = 10) - -label(oplockcontentionlimit) -dit(bf(oplock contention limit (S))) - -This is a em(very) advanced url(bf(smbd))(smbd.8.html) tuning option to improve -the efficiency of the granting of oplocks under multiple client contention for the same file. - -In brief it specifies a number, which causes smbd not to grant an oplock even -when requested if the approximate number of clients contending for an oplock on -the same file goes over this limit. This causes url(bf(smbd))(smbd.8.html) to -behave in a similar way to Windows NT. - -em(DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA -OPLOCK CODE). - - bf(Default:) -tt( oplock contention limit = 2) - -label(oslevel) -dit(bf(os level (G))) - -This integer value controls what level Samba advertises itself as for -browse elections. The value of this parameter determines whether -url(bf(nmbd))(nmbd.8.html) has a chance of becoming a local master -browser for the link(bf(WORKGROUP))(workgroup) in the local broadcast -area. The default is zero, which means url(bf(nmbd))(nmbd.8.html) will -lose elections to Windows machines. See BROWSING.txt in the Samba -docs/ directory for details. - - bf(Default:) -tt( os level = 20) - - bf(Example:) -tt( os level = 65 ; This will win against any NT Server) - -label(packetsize) -dit(bf(packet size (G))) - -This is a deprecated parameter that has no effect on the current -Samba code. It is left in the parameter list to prevent breaking -old bf(smb.conf) files. - -label(panicaction) -dit(bf(panic action (G))) - -This is a Samba developer option that allows a system command to be -called when either url(bf(smbd))(smbd.8.html) or -url(bf(nmbd))(nmbd.8.html) crashes. This is usually used to draw -attention to the fact that a problem occurred. - - bf(Default:) -tt( panic action = <empty string>) - -label(passwdchat) -dit(bf(passwd chat (G))) - -This string controls the em("chat") conversation that takes places -between url(bf(smbd))(smbd.8.html) and the local password changing -program to change the users password. The string describes a sequence -of response-receive pairs that url(bf(smbd))(smbd.8.html) uses to -determine what to send to the link(bf(passwd))(passwdprogram) program -and what to expect back. If the expected output is not received then -the password is not changed. - -This chat sequence is often quite site specific, depending on what -local methods are used for password control (such as NIS etc). - -The string can contain the macros tt("%o") and tt("%n") which are -substituted for the old and new passwords respectively. It can also -contain the standard macros tt("\n"), tt("\r"), tt("\t") and tt("\s") -to give line-feed, carriage-return, tab and space. - -The string can also contain a tt('*') which matches any sequence of -characters. - -Double quotes can be used to collect strings with spaces in them into -a single string. - -If the send string in any part of the chat sequence is a fullstop -tt(".") then no string is sent. Similarly, is the expect string is a -fullstop then no string is expected. - -Note that if the link(bf("unix password sync"))(unixpasswordsync) -parameter is set to true, then this sequence is called em(*AS ROOT*) -when the SMB password in the smbpasswd file is being changed, without -access to the old password cleartext. In this case the old password -cleartext is set to tt("") (the empty string). - -See also link(bf("unix password sync"))(unixpasswordsync), -link(bf("passwd program"))(passwdprogram) and link(bf("passwd chat -debug"))(passwdchatdebug). - - bf(Example:) -verb( passwd chat = "*Enter OLD password*" %o\n "*Enter NEW password*" %n\n \ - "*Reenter NEW password*" %n\n "*Password changed*" -) - - bf(Default:) -verb( passwd chat = *old*password* %o\n *new*password* %n\n *new*password* %n\n *changed*) - -label(passwdchatdebug) -dit(bf(passwd chat debug (G))) - -This boolean specifies if the passwd chat script parameter is run in -tt("debug") mode. In this mode the strings passed to and received from -the passwd chat are printed in the url(bf(smbd))(smbd.8.html) log with -a link(bf("debug level"))(debuglevel) of 100. This is a dangerous -option as it will allow plaintext passwords to be seen in the -url(bf(smbd))(smbd.8.html) log. It is available to help Samba admins -debug their link(bf("passwd chat"))(passwdchat) scripts when calling -the link(bf("passwd program"))(passwdprogram) and should be turned off -after this has been done. This parameter is off by default. - -See also link(bf("passwd chat"))(passwdchat), link(bf("passwd -program"))(passwdprogram). - - bf(Example:) -tt( passwd chat debug = True) - - bf(Default:) -tt( passwd chat debug = False) - -label(passwdprogram) -dit(bf(passwd program (G))) - -The name of a program that can be used to set UNIX user passwords. -Any occurrences of link(bf(%u))(percentu) will be replaced with the -user name. The user name is checked for existence before calling the -password changing program. - -Also note that many passwd programs insist in em("reasonable") -passwords, such as a minimum length, or the inclusion of mixed case -chars and digits. This can pose a problem as some clients (such as -Windows for Workgroups) uppercase the password before sending it. - -em(Note) that if the link(bf("unix password sync"))(unixpasswordsync) -parameter is set to tt("True") then this program is called em(*AS -ROOT*) before the SMB password in the -url(bf(smbpasswd))(smbpasswd.5.html) file is changed. If this UNIX -password change fails, then url(bf(smbd))(smbd.8.html) will fail to -change the SMB password also (this is by design). - -If the link(bf("unix password sync"))(unixpasswordsync) parameter is -set this parameter em(MUST USE ABSOLUTE PATHS) for em(ALL) programs -called, and must be examined for security implications. Note that by -default link(bf("unix password sync"))(unixpasswordsync) is set to -tt("False"). - -See also link(bf("unix password sync"))(unixpasswordsync). - - bf(Default:) -tt( passwd program = /bin/passwd) - - bf(Example:) -tt( passwd program = /sbin/passwd %u) - -label(passwordlevel) -dit(bf(password level (G))) - -Some client/server combinations have difficulty with mixed-case -passwords. One offending client is Windows for Workgroups, which for -some reason forces passwords to upper case when using the LANMAN1 -protocol, but leaves them alone when using COREPLUS! - -This parameter defines the maximum number of characters that may be -upper case in passwords. - -For example, say the password given was tt("FRED"). If bf(password -level) is set to 1, the following combinations would be tried if -tt("FRED") failed: - -tt("Fred"), tt("fred"), tt("fRed"), tt("frEd"), tt("freD") - -If bf(password level) was set to 2, the following combinations would -also be tried: - -tt("FRed"), tt("FrEd"), tt("FreD"), tt("fREd"), tt("fReD"), -tt("frED"), tt(..) - -And so on. - -The higher value this parameter is set to the more likely it is that a -mixed case password will be matched against a single case -password. However, you should be aware that use of this parameter -reduces security and increases the time taken to process a new -connection. - -A value of zero will cause only two attempts to be made - the password -as is and the password in all-lower case. - - bf(Default:) -tt( password level = 0) - - bf(Example:) -tt( password level = 4) - -label(passwordserver) -dit(bf(password server (G))) - -By specifying the name of another SMB server (such as a WinNT box) -with this option, and using link(bf("security = domain"))(security) or -link(bf("security = server"))(security) you can get Samba to do all -its username/password validation via a remote server. - -This options sets the name of the password server to use. It must be a -NetBIOS name, so if the machine's NetBIOS name is different from its -internet name then you may have to add its NetBIOS name to the lmhosts -file which is stored in the same directory as the bf(smb.conf) file. - -The name of the password server is looked up using the parameter -link(bf("name resolve order="))(nameresolveorder) and so may resolved -by any method and order described in that parameter. - -The password server much be a machine capable of using the "LM1.2X002" -or the "LM NT 0.12" protocol, and it must be in user level security -mode. - -NOTE: Using a password server means your UNIX box (running Samba) is -only as secure as your password server. em(DO NOT CHOOSE A PASSWORD -SERVER THAT YOU DON'T COMPLETELY TRUST). - -Never point a Samba server at itself for password serving. This will -cause a loop and could lock up your Samba server! - -The name of the password server takes the standard substitutions, but -probably the only useful one is link(bf(%m))(percentm), which means -the Samba server will use the incoming client as the password -server. If you use this then you better trust your clients, and you -better restrict them with hosts allow! - -If the link(bf("security"))(security) parameter is set to -bf("domain"), then the list of machines in this option must be a list -of Primary or Backup Domain controllers for the -link(bf(Domain))(workgroup) or the character tt(*), as the Samba server is cryptographicly -in that domain, and will use cryptographicly authenticated RPC calls -to authenticate the user logging on. The advantage of using -link(bf("security=domain"))(securityequaldomain) is that if you list -several hosts in the bf("password server") option then -url(bf(smbd))(smbd.8.html) will try each in turn till it finds one -that responds. This is useful in case your primary server goes down. - -If the bf("password server") option is set to the character tt(*), -then Samba will attempt to auto-locate the Primary or Backup Domain controllers -to authenticate against by doing a query for the name tt(WORKGROUP<1C>) -and then contacting each server returned in the list of IP addresses -from the link(bf(name resolution))(nameresolveorder) source. - -If the link(bf("security"))(security) parameter is set to -link(bf("server"))(securityequalserver), then there are different -restrictions that link(bf("security=domain"))(securityequaldomain) -doesn't suffer from: - -startit() - -it() You may list several password servers in the bf("password server") -parameter, however if an url(bf(smbd))(smbd.8.html) makes a connection -to a password server, and then the password server fails, no more -users will be able to be authenticated from this -url(bf(smbd))(smbd.8.html). This is a restriction of the SMB/CIFS -protocol when in link(bf("security=server"))(securityequalserver) mode -and cannot be fixed in Samba. - -it() If you are using a Windows NT server as your password server then -you will have to ensure that your users are able to login from the -Samba server, as when in -link(bf("security=server"))(securityequalserver) mode the network -logon will appear to come from there rather than from the users -workstation. - -endit() - -See also the link(bf("security"))(security) parameter. - - bf(Default:) -tt( password server = <empty string>) - - bf(Example:) -tt( password server = NT-PDC, NT-BDC1, NT-BDC2) - - bf(Example:) -tt( password server = *) - -label(path) -dit(bf(path (S))) - -This parameter specifies a directory to which the user of the service -is to be given access. In the case of printable services, this is -where print data will spool prior to being submitted to the host for -printing. - -For a printable service offering guest access, the service should be -readonly and the path should be world-writeable and have the sticky bit -set. This is not mandatory of course, but you probably won't get the -results you expect if you do otherwise. - -Any occurrences of link(bf(%u))(percentu) in the path will be replaced -with the UNIX username that the client is using on this -connection. Any occurrences of link(bf(%m))(percentm) will be replaced -by the NetBIOS name of the machine they are connecting from. These -replacements are very useful for setting up pseudo home directories -for users. - -Note that this path will be based on link(bf("root dir"))(rootdir) if -one was specified. - - bf(Default:) -tt( none) - - bf(Example:) -tt( path = /home/fred) - -label(postexec) -dit(bf(postexec (S))) - -This option specifies a command to be run whenever the service is -disconnected. It takes the usual substitutions. The command may be run -as the root on some systems. - -An interesting example may be do unmount server resources: - -tt(postexec = /etc/umount /cdrom) - -See also link(bf(preexec))(preexec). - - bf(Default:) -tt( none (no command executed)) - - bf(Example:) -tt( postexec = echo "%u disconnected from %S from %m (%I)" >> /tmp/log) - -label(postscript) -dit(bf(postscript (S))) - -This parameter forces a printer to interpret the print files as -postscript. This is done by adding a tt(%!) to the start of print output. - -This is most useful when you have lots of PCs that persist in putting -a control-D at the start of print jobs, which then confuses your -printer. - - bf(Default:) -tt( postscript = False) - - bf(Example:) -tt( postscript = True) - -label(preexec) -dit(bf(preexec (S))) - -This option specifies a command to be run whenever the service is -connected to. It takes the usual substitutions. - -An interesting example is to send the users a welcome message every -time they log in. Maybe a message of the day? Here is an example: - -verb( - preexec = csh -c 'echo \"Welcome to %S!\" | \ - /usr/local/samba/bin/smbclient -M %m -I %I' & -) - -Of course, this could get annoying after a while :-) - -See also link(bf(preexec close))(preexecclose) and link(bf(postexec))(postexec). - - bf(Default:) -tt( none (no command executed)) - - bf(Example:) -tt( preexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log) - -label(preexecclose) -dit(bf(preexec close (S))) - -This boolean option controls whether a non-zero return code from -link(bf("preexec"))(preexec) should close the service being connected to. - - bf(Default:) -tt( preexec close = no) - - bf(Example:) -tt( preexec close = yes) - -label(preferredmaster) -dit(bf(preferred master (G))) - -This boolean parameter controls if url(bf(nmbd))(nmbd.8.html) is a -preferred master browser for its workgroup. - -If this is set to true, on startup, url(bf(nmbd))(nmbd.8.html) will -force an election, and it will have a slight advantage in winning the -election. It is recommended that this parameter is used in -conjunction with link(bf("domain master = yes"))(domainmaster), so -that url(bf(nmbd))(nmbd.8.html) can guarantee becoming a domain -master. - -Use this option with caution, because if there are several hosts -(whether Samba servers, Windows 95 or NT) that are preferred master -browsers on the same subnet, they will each periodically and -continuously attempt to become the local master browser. This will -result in unnecessary broadcast traffic and reduced browsing -capabilities. - -See also link(bf(os level))(oslevel). - - bf(Default:) -tt( preferred master = no) - - bf(Example:) -tt( preferred master = yes) - -label(preferedmaster) -dit(bf(prefered master (G))) - -Synonym for link(bf("preferred master"))(preferredmaster) for people -who cannot spell :-). - -label(preload) -dit(bf(preload)) -Synonym for link(bf("auto services"))(autoservices). - -label(preservecase) -dit(bf(preserve case (S))) - -This controls if new filenames are created with the case that the -client passes, or if they are forced to be the tt("default") case. - - bf(Default:) -tt( preserve case = yes) - -See the section on link(bf("NAME MANGLING"))(NAMEMANGLING) for a -fuller discussion. - -label(printcommand) -dit(bf(print command (S))) - -After a print job has finished spooling to a service, this command -will be used via a tt(system()) call to process the spool -file. Typically the command specified will submit the spool file to -the host's printing subsystem, but there is no requirement that this -be the case. The server will not remove the spool file, so whatever -command you specify should remove the spool file when it has been -processed, otherwise you will need to manually remove old spool files. - -The print command is simply a text string. It will be used verbatim, -with two exceptions: All occurrences of tt("%s") and tt("%f") will be -replaced by the appropriate spool file name, and all occurrences of -tt("%p") will be replaced by the appropriate printer name. The spool -file name is generated automatically by the server, the printer name -is discussed below. - -The print command em(MUST) contain at least one occurrence of tt("%s") -or tt("%f") - the tt("%p") is optional. At the time a job is -submitted, if no printer name is supplied the tt("%p") will be -silently removed from the printer command. - -If specified in the link(bf("[global]"))(global) section, the print -command given will be used for any printable service that does not -have its own print command specified. - -If there is neither a specified print command for a printable service -nor a global print command, spool files will be created but not -processed and (most importantly) not removed. - -Note that printing may fail on some UNIXs from the tt("nobody") -account. If this happens then create an alternative guest account that -can print and set the link(bf("guest account"))(guestaccount) in the -link(bf("[global]"))(global) section. - -You can form quite complex print commands by realizing that they are -just passed to a shell. For example the following will log a print -job, print the file, then remove it. Note that tt(';') is the usual -separator for command in shell scripts. - -tt(print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s) - -You may have to vary this command considerably depending on how you -normally print files on your system. The default for the parameter -varies depending on the setting of the link(bf("printing="))(printing) -parameter. - - bf(Default:) - For link(bf("printing="))(printing) BSD, AIX, QNX, LPRNG or PLP : -tt( print command = lpr -r -P%p %s) - - For link(bf("printing="))(printing) SYS or HPUX : -tt( print command = lp -c -d%p %s; rm %s) - - For link(bf("printing="))(printing) SOFTQ : -tt( print command = lp -d%p -s %s; rm %s) - - bf(Example:) -tt( print command = /usr/local/samba/bin/myprintscript %p %s) - -label(printok) -dit(bf(print ok (S))) - -Synonym for link(bf(printable))(printable). - -label(printable) -dit(bf(printable (S))) - -If this parameter is tt("yes"), then clients may open, write to and -submit spool files on the directory specified for the service. - -Note that a printable service will ALWAYS allow writing to the service -path (user privileges permitting) via the spooling of print data. The -link(bf("writeable"))(writeable) parameter controls only non-printing -access to the resource. - - bf(Default:) -tt( printable = no) - - bf(Example:) -tt( printable = yes) - -label(printcap) -dit(bf(printcap (G))) - -Synonym for link(bf(printcapname))(printcapname). - -label(printer admin) -dit(bf(printer admin (S))) - -This is a list of users that can do anything to printers via the -remote administration interfaces offered by MSRPC (usually using a NT -workstation). Note that the root user always has admin rights. - - bf(Default:) -tt( printer admin = <empty string>) - - bf(Example:) -tt( printer admin = admin, @staff) - -label(printcapname) -dit(bf(printcap name (G))) - -This parameter may be used to override the compiled-in default -printcap name used by the server (usually /etc/printcap). See the -discussion of the link(bf([printers]))(printers) section above for -reasons why you might want to do this. - -On System V systems that use bf(lpstat) to list available printers you -can use tt("printcap name = lpstat") to automatically obtain lists of -available printers. This is the default for systems that define SYSV -at configure time in Samba (this includes most System V based -systems). If bf("printcap name") is set to bf(lpstat) on these systems -then Samba will launch tt("lpstat -v") and attempt to parse the output -to obtain a printer list. - -A minimal printcap file would look something like this: - -verb( - print1|My Printer 1 - print2|My Printer 2 - print3|My Printer 3 - print4|My Printer 4 - print5|My Printer 5 -) - -where the tt('|') separates aliases of a printer. The fact that the -second alias has a space in it gives a hint to Samba that it's a -comment. - -em(NOTE): Under AIX the default printcap name is -tt("/etc/qconfig"). Samba will assume the file is in AIX tt("qconfig") -format if the string tt("/qconfig") appears in the printcap filename. - - bf(Default:) -tt( printcap name = /etc/printcap) - - bf(Example:) -tt( printcap name = /etc/myprintcap) - -label(printer) -dit(bf(printer (S))) - -This parameter specifies the name of the printer to which print jobs -spooled through a printable service will be sent. - -If specified in the link(bf([global]))(global) section, the printer -name given will be used for any printable service that does not have -its own printer name specified. - - bf(Default:) - none (but may be tt("lp") on many systems) - - bf(Example:) - printer name = laserwriter - -label(printerdriver) -dit(bf(printer driver (S))) - -This option allows you to control the string that clients receive when -they ask the server for the printer driver associated with a -printer. If you are using Windows95 or WindowsNT then you can use this -to automate the setup of printers on your system. - -You need to set this parameter to the exact string (case sensitive) -that describes the appropriate printer driver for your system. If you -don't know the exact string to use then you should first try with no -bf("printer driver") option set and the client will give you a list of -printer drivers. The appropriate strings are shown in a scrollbox -after you have chosen the printer manufacturer. - -See also link(bf("printer driver file"))(printerdriverfile). - - bf(Example:) - printer driver = HP LaserJet 4L - -label(printerdriverfile) -dit(bf(printer driver file (G))) - -This parameter tells Samba where the printer driver definition file, -used when serving drivers to Windows 95 clients, is to be found. If -this is not set, the default is : - -tt(SAMBA_INSTALL_DIRECTORY/lib/printers.def) - -This file is created from Windows 95 tt("msprint.inf") files found on -the Windows 95 client system. For more details on setting up serving -of printer drivers to Windows 95 clients, see the documentation file -in the docs/ directory, PRINTER_DRIVER.txt. - - bf(Default:) -tt( None (set in compile).) - - bf(Example:) -tt( printer driver file = /usr/local/samba/printers/drivers.def) - -See also link(bf("printer driver location"))(printerdriverlocation). - -label(printerdriverlocation) -dit(bf(printer driver location (S))) - -This parameter tells clients of a particular printer share where to -find the printer driver files for the automatic installation of -drivers for Windows 95 machines. If Samba is set up to serve printer -drivers to Windows 95 machines, this should be set to - -tt(\\MACHINE\PRINTER$) - -Where MACHINE is the NetBIOS name of your Samba server, and PRINTER$ -is a share you set up for serving printer driver files. For more -details on setting this up see the documentation file in the docs/ -directory, PRINTER_DRIVER.txt. - - bf(Default:) -tt( None) - - bf(Example:) -tt( printer driver location = \\MACHINE\PRINTER$) - -See also link(bf("printer driver file"))(printerdriverfile). - -label(printername) -dit(bf(printer name (S))) - -Synonym for link(bf(printer))(printer). - -label(printing) -dit(bf(printing (S))) - -This parameters controls how printer status information is interpreted -on your system. It also affects the default values for the -link(bf("print command"))(printcommand), link(bf("lpq -command"))(lpqcommand) link(bf("lppause command"))(lppausecommand), -link(bf("lpresume command"))(lpresumecommand), and link(bf("lprm -command"))(lprmcommand) if specified in the link(bf([global]))(global) -section. - -Currently eight printing styles are supported. They are -bf("printing=BSD"), bf("printing=AIX"), -bf("printing=LPRNG"), bf("printing=PLP"), bf("printing=SYSV"), -bf("printing="HPUX"), bf("printing=QNX"), bf("printing=SOFTQ"), -and bf("printing=CUPS"). - -To see what the defaults are for the other print commands when using -the various options use the url(bf("testparm"))(testparm.1.html) program. - -This option can be set on a per printer basis - -See also the discussion in the link(bf([printers]))(printers) section. - -label(privatedir) -dit(bf(private dir(G))) - -The bf(private dir) parameter allows an administator to define a -directory path used to hold the various databases Samba will use -to store things like a the machine trust account information -when acting as a domain member (i.e. where the secrets.tdb file will -be located), where the passdb.tbd file will stored in the case -of using the experiemental tdbsam support, etc... - - bf(Default:) -tt( private dir = <compile time location of smbpasswd>) - - bf(Example:) -tt( private dir = /etc/smbprivate) - -label(protocol) -dit(bf(protocol (G))) - -The value of the parameter (a string) is the highest protocol level -that will be supported by the server. - -Possible values are : - -startit() - -it() CORE: Earliest version. No concept of user names. - -it() COREPLUS: Slight improvements on CORE for efficiency. - -it() LANMAN1: First em("modern") version of the protocol. Long -filename support. - -it() LANMAN2: Updates to Lanman1 protocol. - -it() NT1: Current up to date version of the protocol. Used by Windows -NT. Known as CIFS. - -endit() - -Normally this option should not be set as the automatic negotiation -phase in the SMB protocol takes care of choosing the appropriate -protocol. - - bf(Default:) -tt( protocol = NT1) - - bf(Example:) -tt( protocol = LANMAN1) - -label(public) -dit(bf(public (S))) - -Synonym for link(bf("guest ok"))(guestok). - -label(queuepausecommand) -dit(bf(queuepause command (S))) - -This parameter specifies the command to be executed on the server host -in order to pause the printerqueue. - -This command should be a program or script which takes a printer name -as its only parameter and stops the printerqueue, such that no longer -jobs are submitted to the printer. - -This command is not supported by Windows for Workgroups, but can be -issued from the Printer's window under Windows 95 & NT. - -If a tt("%p") is given then the printername is put in its -place. Otherwise it is placed at the end of the command. - -Note that it is good practice to include the absolute path in the -command as the PATH may not be available to the server. - - bf(Default:) -tt( depends on the setting of "printing =") - - bf(Example:) -tt( queuepause command = disable %p) - -label(queueresumecommand) -dit(bf(queueresume command (S))) - -This parameter specifies the command to be executed on the server host -in order to resume the printerqueue. It is the command to undo the -behavior that is caused by the previous parameter -(link(bf("queuepause command))(queuepausecommand)). - -This command should be a program or script which takes a printer name -as its only parameter and resumes the printerqueue, such that queued -jobs are resubmitted to the printer. - -This command is not supported by Windows for Workgroups, but can be -issued from the Printer's window under Windows 95 & NT. - -If a tt("%p") is given then the printername is put in its -place. Otherwise it is placed at the end of the command. - -Note that it is good practice to include the absolute path in the -command as the PATH may not be available to the server. - - bf(Default:) -tt( depends on the setting of "printing =") - - bf(Example:) -tt( queuepause command = enable %p) - -label(read bmpx) -dit(bf(read bmpx (G))) - -This boolean parameter controls whether url(bf(smbd))(smbd.8.html) -will support the "Read Block Multiplex" SMB. This is now rarely used -and defaults to off. You should never need to set this parameter. - - bf(Default:) - read bmpx = No - -label(readlist) -dit(bf(read list (S))) - -This is a list of users that are given read-only access to a -service. If the connecting user is in this list then they will not be -given write access, no matter what the link(bf("writeable"))(writeable) -option is set to. The list can include group names using the syntax -described in the link(bf("invalid users"))(invalidusers) parameter. - -See also the link(bf("write list"))(writelist) parameter and -the link(bf("invalid users"))(invalidusers) parameter. - - bf(Default:) -tt( read list = <empty string>) - - bf(Example:) -tt( read list = mary, @students) - -label(readonly) -dit(bf(read only (S))) - -Note that this is an inverted synonym for -link(bf("writeable"))(writeable). - -label(readprediction) -dit(bf(read prediction (G))) - -em(NOTE): This code is currently disabled in Samba2.0 and -may be removed at a later date. Hence this parameter has -no effect. - -This options enables or disables the read prediction code used to -speed up reads from the server. When enabled the server will try to -pre-read data from the last accessed file that was opened read-only -while waiting for packets. - - bf(Default:) -tt( read prediction = False) - -label(readraw) -dit(bf(read raw (G))) - -This parameter controls whether or not the server will support the raw -read SMB requests when transferring data to clients. - -If enabled, raw reads allow reads of 65535 bytes in one packet. This -typically provides a major performance benefit. - -However, some clients either negotiate the allowable block size -incorrectly or are incapable of supporting larger block sizes, and for -these clients you may need to disable raw reads. - -In general this parameter should be viewed as a system tuning tool and left -severely alone. See also link(bf("write raw"))(writeraw). - - bf(Default:) -tt( read raw = yes) - -label(readsize) -dit(bf(read size (G))) - -The option bf("read size") affects the overlap of disk reads/writes -with network reads/writes. If the amount of data being transferred in -several of the SMB commands (currently SMBwrite, SMBwriteX and -SMBreadbraw) is larger than this value then the server begins writing -the data before it has received the whole packet from the network, or -in the case of SMBreadbraw, it begins writing to the network before -all the data has been read from disk. - -This overlapping works best when the speeds of disk and network access -are similar, having very little effect when the speed of one is much -greater than the other. - -The default value is 16384, but very little experimentation has been -done yet to determine the optimal value, and it is likely that the -best value will vary greatly between systems anyway. A value over -65536 is pointless and will cause you to allocate memory -unnecessarily. - - bf(Default:) -tt( read size = 16384) - - bf(Example:) -tt( read size = 8192) - -label(remoteannounce) -dit(bf(remote announce (G))) - -This option allows you to setup url(bf(nmbd))(nmbd.8.html) to -periodically announce itself to arbitrary IP addresses with an -arbitrary workgroup name. - -This is useful if you want your Samba server to appear in a remote -workgroup for which the normal browse propagation rules don't -work. The remote workgroup can be anywhere that you can send IP -packets to. - -For example: - -tt( remote announce = 192.168.2.255/SERVERS 192.168.4.255/STAFF) - -the above line would cause nmbd to announce itself to the two given IP -addresses using the given workgroup names. If you leave out the -workgroup name then the one given in the -link(bf("workgroup"))(workgroup) parameter is used instead. - -The IP addresses you choose would normally be the broadcast addresses -of the remote networks, but can also be the IP addresses of known -browse masters if your network config is that stable. - -See the documentation file BROWSING.txt in the docs/ directory. - - bf(Default:) -tt( remote announce = <empty string>) - - bf(Example:) -tt( remote announce = 192.168.2.255/SERVERS 192.168.4.255/STAFF) - -label(remotebrowsesync) -dit(bf(remote browse sync (G))) - -This option allows you to setup url(bf(nmbd))(nmbd.8.html) to -periodically request synchronization of browse lists with the master -browser of a samba server that is on a remote segment. This option -will allow you to gain browse lists for multiple workgroups across -routed networks. This is done in a manner that does not work with any -non-samba servers. - -This is useful if you want your Samba server and all local clients to -appear in a remote workgroup for which the normal browse propagation -rules don't work. The remote workgroup can be anywhere that you can -send IP packets to. - -For example: - -tt( remote browse sync = 192.168.2.255 192.168.4.255) - -the above line would cause url(bf(nmbd))(nmbd.8.html) to request the -master browser on the specified subnets or addresses to synchronize -their browse lists with the local server. - -The IP addresses you choose would normally be the broadcast addresses -of the remote networks, but can also be the IP addresses of known -browse masters if your network config is that stable. If a machine IP -address is given Samba makes NO attempt to validate that the remote -machine is available, is listening, nor that it is in fact the browse -master on it's segment. - - bf(Default:) -tt( remote browse sync = <empty string>) - - bf(Example:) -tt( remote browse sync = 192.168.2.255 192.168.4.255) - - -label(restrict anonymous) -dit(bf(restrict anonymous (G))) - -This is a boolean parameter. If it is true, then anonymous access -to the server will be restricted, namely in the case where the server -is expecting the client to send a username, but it doesn't. Setting -it to true will force these anonymous connections to be denied, and -the client will be required to always supply a username and password -when connecting. Use of this parameter is only recommened for homogenous -NT client environments. - -This parameter makes the use of macro expansions that rely -on the username (%U, %G, etc) consistant. NT 4.0 likes to use -anonymous connections when refreshing the share list, and this -is a way to work around that. - -When restrict anonymous is true, all anonymous connections are denied -no matter what they are for. This can effect the ability of a machine -to access the samba Primary Domain Controller to revalidate it's machine -account after someone else has logged on the client interactively. The -NT client will display a message saying that the machine's account in -the domain doesn't exist or the password is bad. The best way to deal -with this is to reboot NT client machines between interactive logons, -using "Shutdown and Restart", rather than "Close all programs and logon -as a different user". - - bf(Default:) -tt( restrict anonymous = false) - - bf(Example:) -tt( restrict anonymous = true) - -label(root) -dit(bf(root (G))) - -Synonym for link(bf("root directory"))(rootdirectory). - -label(rootdir) -dit(bf(root dir (G))) - -Synonym for link(bf("root directory"))(rootdirectory). - -label(rootdirectory) -dit(bf(root directory (G))) - -The server will tt("chroot()") (i.e. Change it's root directory) to -this directory on startup. This is not strictly necessary for secure -operation. Even without it the server will deny access to files not in -one of the service entries. It may also check for, and deny access to, -soft links to other parts of the filesystem, or attempts to use -tt("..") in file names to access other directories (depending on the -setting of the link(bf("wide links"))(widelinks) parameter). - -Adding a bf("root directory") entry other than tt("/") adds an extra -level of security, but at a price. It absolutely ensures that no -access is given to files not in the sub-tree specified in the bf("root -directory") option, em(*including*) some files needed for complete -operation of the server. To maintain full operability of the server -you will need to mirror some system files into the bf("root -directory") tree. In particular you will need to mirror /etc/passwd -(or a subset of it), and any binaries or configuration files needed -for printing (if required). The set of files that must be mirrored is -operating system dependent. - - bf(Default:) -tt( root directory = /) - -bf(Example:) -tt( root directory = /homes/smb) - -label(rootpostexec) -dit(bf(root postexec (S))) - -This is the same as the link(bf("postexec"))(postexec) parameter -except that the command is run as root. This is useful for unmounting -filesystems (such as cdroms) after a connection is closed. - -See also link(bf("postexec"))(postexec). - -label(rootpreexec) -dit(bf(root preexec (S))) - -This is the same as the link(bf("preexec"))(preexec) parameter except -that the command is run as root. This is useful for mounting -filesystems (such as cdroms) before a connection is finalized. - -See also link(bf("preexec"))(preexec) -and link(bf("root preexec close"))(rootpreexecclose). - -label(rootpreexecclose) -dit(bf(root preexec close (S))) - -This is the same as the link(bf("preexec close"))(preexecclose) parameter -except that the command is run as root. - -See also link(bf("preexec"))(preexec), link(bf("preexec close"))(preexecclose). - -label(security) -dit(bf(security (G))) - -This option affects how clients respond to Samba and is one of the most -important settings in the bf(smb.conf) file. - -The option sets the tt("security mode bit") in replies to protocol -negotiations with url(bf(smbd))(smbd.8.html) to turn share level -security on or off. Clients decide based on this bit whether (and how) -to transfer user and password information to the server. - -The default is link("security=user")(securityequaluser), as this is -the most common setting needed when talking to Windows 98 and Windows -NT. - -The alternatives are link(bf("security = share"))(securityequalshare), -link(bf("security = server"))(securityequalserver) or -link(bf("security=domain"))(securityequaldomain). - -em(*****NOTE THAT THIS DEFAULT IS DIFFERENT IN SAMBA2.0 THAN FOR -PREVIOUS VERSIONS OF SAMBA *******). - -In previous versions of Samba the default was -link(bf("security=share"))(securityequalshare) mainly because that was -the only option at one stage. - -There is a bug in WfWg that has relevance to this setting. When in -user or server level security a WfWg client will totally ignore the -password you type in the "connect drive" dialog box. This makes it -very difficult (if not impossible) to connect to a Samba service as -anyone except the user that you are logged into WfWg as. - -If your PCs use usernames that are the same as their usernames on the -UNIX machine then you will want to use bf("security = user"). If you -mostly use usernames that don't exist on the UNIX box then use -bf("security = share"). - -You should also use link(bf(security=share))(securityequalshare) if -you want to mainly setup shares without a password (guest -shares). This is commonly used for a shared printer server. It is more -difficult to setup guest shares with -link(bf(security=user))(securityequaluser), see the link(bf("map to -guest"))(maptoguest)parameter for details. - -It is possible to use url(bf(smbd))(smbd.8.html) in a em("hybrid -mode") where it is offers both user and share level security under -different link(bf(NetBIOS aliases))(netbiosaliases). See the -link(bf(NetBIOS aliases))(netbiosaliases) and the -link(bf(include))(include) parameters for more information. - -The different settings will now be explained. - -startdit() - -label(securityequalshare) -dit(bf("security=share")) When clients connect to a share level -security server then need not log onto the server with a valid -username and password before attempting to connect to a shared -resource (although modern clients such as Windows 95/98 and Windows NT -will send a logon request with a username but no password when talking -to a bf(security=share) server). Instead, the clients send -authentication information (passwords) on a per-share basis, at the -time they attempt to connect to that share. - -Note that url(bf(smbd))(smbd.8.html) em(*ALWAYS*) uses a valid UNIX -user to act on behalf of the client, even in bf("security=share") -level security. - -As clients are not required to send a username to the server -in share level security, url(bf(smbd))(smbd.8.html) uses several -techniques to determine the correct UNIX user to use on behalf -of the client. - -A list of possible UNIX usernames to match with the given -client password is constructed using the following methods : - -startit() - -it() If the link(bf("guest only"))(guestonly) parameter is set, then -all the other stages are missed and only the link(bf("guest -account"))(guestaccount) username is checked. - -it() Is a username is sent with the share connection request, then -this username (after mapping - see link(bf("username -map"))(usernamemap)), is added as a potential username. - -it() If the client did a previous em("logon") request (the -SessionSetup SMB call) then the username sent in this SMB -will be added as a potential username. - -it() The name of the service the client requested is added -as a potential username. - -it() The NetBIOS name of the client is added to the list as a -potential username. - -it() Any users on the link(bf("user"))(user) list are added -as potential usernames. - -endit() - -If the link(bf("guest only"))(guestonly) parameter is not set, then -this list is then tried with the supplied password. The first user for -whom the password matches will be used as the UNIX user. - -If the link(bf("guest only"))(guestonly) parameter is set, or no -username can be determined then if the share is marked as available to -the link(bf("guest account"))(guestaccount), then this guest user will -be used, otherwise access is denied. - -Note that it can be em(*very*) confusing in share-level security as to -which UNIX username will eventually be used in granting access. - -See also the section link(bf("NOTE ABOUT USERNAME/PASSWORD -VALIDATION"))(NOTEABOUTUSERNAMEPASSWORDVALIDATION). - -label(securityequaluser) -dit(bf("security=user")) - -This is the default security setting in Samba2.0. With user-level -security a client must first tt("log-on") with a valid username and -password (which can be mapped using the link(bf("username -map"))(usernamemap) parameter). Encrypted passwords (see the -link(bf("encrypted passwords"))(encryptpasswords) parameter) can also -be used in this security mode. Parameters such as -link(bf("user"))(user) and link(bf("guest only"))(guestonly), if set -are then applied and may change the UNIX user to use on this -connection, but only after the user has been successfully -authenticated. - -em(Note) that the name of the resource being requested is -em(*not*) sent to the server until after the server has successfully -authenticated the client. This is why guest shares don't work in user -level security without allowing the server to automatically map unknown -users into the link(bf("guest account"))(guestaccount). See the -link(bf("map to guest"))(maptoguest) parameter for details on -doing this. - -See also the section link(bf("NOTE ABOUT USERNAME/PASSWORD -VALIDATION"))(NOTEABOUTUSERNAMEPASSWORDVALIDATION). - -label(securityequalserver) -dit(bf("security=server")) - -In this mode Samba will try to validate the username/password by -passing it to another SMB server, such as an NT box. If this fails it -will revert to bf("security = user"), but note that if encrypted -passwords have been negotiated then Samba cannot revert back to -checking the UNIX password file, it must have a valid smbpasswd file -to check users against. See the documentation file in the docs/ -directory ENCRYPTION.txt for details on how to set this up. - -em(Note) that from the clients point of view bf("security=server") is -the same as link(bf("security=user"))(securityequaluser). It only -affects how the server deals with the authentication, it does not in -any way affect what the client sees. - -em(Note) that the name of the resource being requested is -em(*not*) sent to the server until after the server has successfully -authenticated the client. This is why guest shares don't work in server -level security without allowing the server to automatically map unknown -users into the link(bf("guest account"))(guestaccount). See the -link(bf("map to guest"))(maptoguest) parameter for details on -doing this. - -See also the section link(bf("NOTE ABOUT USERNAME/PASSWORD -VALIDATION"))(NOTEABOUTUSERNAMEPASSWORDVALIDATION). - -See also the link(bf("password server"))(passwordserver) parameter. -and the link(bf("encrypted passwords"))(encryptpasswords) parameter. - -label(securityequaldomain) -dit(bf("security=domain")) - -This mode will only work correctly if -url(bf(smbpasswd))(smbpasswd.8.html) has been used to add this machine -into a Windows NT Domain. It expects the link(bf("encrypted -passwords"))(encryptpasswords) parameter to be set to tt("true"). In -this mode Samba will try to validate the username/password by passing -it to a Windows NT Primary or Backup Domain Controller, in exactly the -same way that a Windows NT Server would do. - -em(Note) that a valid UNIX user must still exist as well as the -account on the Domain Controller to allow Samba to have a valid -UNIX account to map file access to. - -em(Note) that from the clients point of view bf("security=domain") is -the same as link(bf("security=user"))(securityequaluser). It only -affects how the server deals with the authentication, it does not in -any way affect what the client sees. - -em(Note) that the name of the resource being requested is -em(*not*) sent to the server until after the server has successfully -authenticated the client. This is why guest shares don't work in domain -level security without allowing the server to automatically map unknown -users into the link(bf("guest account"))(guestaccount). See the -link(bf("map to guest"))(maptoguest) parameter for details on -doing this. - -em(BUG:) There is currently a bug in the implementation of -bf("security=domain) with respect to multi-byte character -set usernames. The communication with a Domain Controller -must be done in UNICODE and Samba currently does not widen -multi-byte user names to UNICODE correctly, thus a multi-byte -username will not be recognized correctly at the Domain Controller. -This issue will be addressed in a future release. - -See also the section link(bf("NOTE ABOUT USERNAME/PASSWORD -VALIDATION"))(NOTEABOUTUSERNAMEPASSWORDVALIDATION). - -See also the link(bf("password server"))(passwordserver) parameter. -and the link(bf("encrypted passwords"))(encryptpasswords) parameter. - -enddit() - - bf(Default:) -tt( security = USER) - - bf(Example:) -tt( security = DOMAIN) - -label(securitymask) -dit(bf(security mask (S))) - -This parameter controls what UNIX permission bits can be modified -when a Windows NT client is manipulating the UNIX permission on a -file using the native NT security dialog box. - -This parameter is applied as a mask (AND'ed with) to the changed -permission bits, thus preventing any bits not in this mask from -being modified. Essentially, zero bits in this mask may be treated -as a set of bits the user is not allowed to change. - -If not set explicitly this parameter is set to the same value as the -link(bf(create mask))(createmask) parameter. To allow a user to -modify all the user/group/world permissions on a file, set this -parameter to 0777. - -em(Note) that users who can access the Samba server through other -means can easily bypass this restriction, so it is primarily -useful for standalone "appliance" systems. Administrators of -most normal systems will probably want to set it to 0777. - -See also the link(bf(force directory security -mode))(forcedirectorysecuritymode), link(bf(directory security -mask))(directorysecuritymask), link(bf(force security -mode))(forcesecuritymode) parameters. - - bf(Default:) -tt( security mask = <same as create mask>) - - bf(Example:) -tt( security mask = 0777) - - -label(serverstring) -dit(bf(server string (G))) - -This controls what string will show up in the printer comment box in -print manager and next to the IPC connection in tt("net view"). It can be -any string that you wish to show to your users. - -It also sets what will appear in browse lists next to the machine -name. - -A tt("%v") will be replaced with the Samba version number. - -A tt("%h") will be replaced with the hostname. - - bf(Default:) -tt( server string = Samba %v) - - bf(Example:) -tt( server string = University of GNUs Samba Server) - -label(setdirectory) -dit(bf(set directory (S))) - -If tt("set directory = no"), then users of the service may not use the -setdir command to change directory. - -The setdir command is only implemented in the Digital Pathworks -client. See the Pathworks documentation for details. - - bf(Default:) -tt( set directory = no) - - bf(Example:) -tt( set directory = yes) - -label(sharemodes) -dit(bf(share modes (S))) - -This enables or disables the honoring of the tt("share modes") during a -file open. These modes are used by clients to gain exclusive read or -write access to a file. - -These open modes are not directly supported by UNIX, so they are -simulated using shared memory, or lock files if your UNIX doesn't -support shared memory (almost all do). - -The share modes that are enabled by this option are DENY_DOS, -DENY_ALL, DENY_READ, DENY_WRITE, DENY_NONE and DENY_FCB. - -This option gives full share compatibility and enabled by default. - -You should em(*NEVER*) turn this parameter off as many Windows -applications will break if you do so. - - bf(Default:) -tt( share modes = yes) - -label(sharedmemsize) -dit(bf(shared mem size (G))) - -It specifies the size of the shared memory (in bytes) to use between -url(bf(smbd))(smbd.8.html) processes. This parameter defaults to one -megabyte of shared memory. It is possible that if you have a large -server with many files open simultaneously that you may need to -increase this parameter. Signs that this parameter is set too low are -users reporting strange problems trying to save files (locking errors) -and error messages in the smbd log looking like tt("ERROR -smb_shm_alloc : alloc of XX bytes failed"). - -If your OS refuses the size that Samba asks for then Samba will try a -smaller size, reducing by a factor of 0.8 until the OS accepts it. - - bf(Default:) -tt( shared mem size = 1048576) - - bf(Example:) -tt( shared mem size = 5242880 ; Set to 5mb for a large number of files.) - -label(shortpreservecase) -dit(bf(short preserve case (S))) - -This boolean parameter controls if new files which conform to 8.3 -syntax, that is all in upper case and of suitable length, are created -upper case, or if they are forced to be the tt("default") case. This -option can be use with link(bf("preserve case -=yes"))(preservecaseoption) to permit long filenames to retain their -case, while short names are lowered. Default em(Yes). - -See the section on link(bf(NAME MANGLING))(NAMEMANGLING). - - bf(Default:) -tt( short preserve case = yes) - -label(smbpasswdfile) -dit(bf(smb passwd file (G))) - -This option sets the path to the encrypted smbpasswd file. By default -the path to the smbpasswd file is compiled into Samba. - - bf(Default:) -tt( smb passwd file= <compiled default>) - - bf(Example:) -tt( smb passwd file = /usr/samba/private/smbpasswd) - -label(smbrun) -dit(bf(smbrun (G))) - -This sets the full path to the bf(smbrun) binary. This defaults to the -value in the Makefile. - -You must get this path right for many services to work correctly. - -You should not need to change this parameter so long as Samba -is installed correctly. - - bf(Default:) -tt( smbrun=<compiled default>) - - bf(Example:) -tt( smbrun = /usr/local/samba/bin/smbrun) - -label(socketaddress) -dit(bf(socket address (G))) - -This option allows you to control what address Samba will listen for -connections on. This is used to support multiple virtual interfaces on -the one server, each with a different configuration. - -By default samba will accept connections on any address. - - bf(Example:) -tt( socket address = 192.168.2.20) - -label(socketoptions) -dit(bf(socket options (G))) - -This option allows you to set socket options to be used when talking -with the client. - -Socket options are controls on the networking layer of the operating -systems which allow the connection to be tuned. - -This option will typically be used to tune your Samba server for -optimal performance for your local network. There is no way that Samba -can know what the optimal parameters are for your net, so you must -experiment and choose them yourself. We strongly suggest you read the -appropriate documentation for your operating system first (perhaps -bf("man setsockopt") will help). - -You may find that on some systems Samba will say "Unknown socket -option" when you supply an option. This means you either incorrectly -typed it or you need to add an include file to includes.h for your OS. -If the latter is the case please send the patch to -email(samba@samba.org). - -Any of the supported socket options may be combined in any way you -like, as long as your OS allows it. - -This is the list of socket options currently settable using this -option: - -startit() - -it() SO_KEEPALIVE - -it() SO_REUSEADDR - -it() SO_BROADCAST - -it() TCP_NODELAY - -it() IPTOS_LOWDELAY - -it() IPTOS_THROUGHPUT - -it() SO_SNDBUF * - -it() SO_RCVBUF * - -it() SO_SNDLOWAT * - -it() SO_RCVLOWAT * - -endit() - -Those marked with a tt(*) take an integer argument. The others can -optionally take a 1 or 0 argument to enable or disable the option, by -default they will be enabled if you don't specify 1 or 0. - -To specify an argument use the syntax SOME_OPTION=VALUE for example -tt(SO_SNDBUF=8192). Note that you must not have any spaces before or after -the = sign. - -If you are on a local network then a sensible option might be - -tt(socket options = IPTOS_LOWDELAY) - -If you have a local network then you could try: - -tt(socket options = IPTOS_LOWDELAY TCP_NODELAY) - -If you are on a wide area network then perhaps try setting -IPTOS_THROUGHPUT. - -Note that several of the options may cause your Samba server to fail -completely. Use these options with caution! - - bf(Default:) -tt( socket options = TCP_NODELAY) - - bf(Example:) -tt( socket options = IPTOS_LOWDELAY) - -label(sourceenvironment) -dit(bf(source environment (G))) - -This parameter causes Samba to set environment variables as per the -content of the file named. - -If the value of this parameter starts with a "|" character then Samba will -treat that value as a pipe command to open and will set the environment -variables from the output of the pipe. - -The contents of the file or the output of the pipe should be formatted -as the output of the standard Unix env(1) command. This is of the form : - -Example environment entry: -tt( SAMBA_NETBIOS_NAME=myhostname ) - - bf(Default:) -tt(No default value) - - bf(Examples:) - -tt( source environment = |/etc/smb.conf.sh) - -tt( source environment = /usr/local/smb_env_vars) - -label(ssl) -dit(bf(ssl (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -This variable enables or disables the entire SSL mode. If it is set to -"no", the SSL enabled samba behaves exactly like the non-SSL samba. If -set to "yes", it depends on the variables link(bf("ssl -hosts"))(sslhosts) and link(bf("ssl hosts resign"))(sslhostsresign) -whether an SSL connection will be required. - - bf(Default:) -tt( ssl=no) - bf(Example:) -tt( ssl=yes) - -label(sslCAcertDir) -dit(bf(ssl CA certDir (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -This variable defines where to look up the Certification -Authorities. The given directory should contain one file for each CA -that samba will trust. The file name must be the hash value over the -"Distinguished Name" of the CA. How this directory is set up is -explained later in this document. All files within the directory that -don't fit into this naming scheme are ignored. You don't need this -variable if you don't verify client certificates. - - bf(Default:) -tt( ssl CA certDir = /usr/local/ssl/certs) - -label(sslCAcertFile) -dit(bf(ssl CA certFile (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -This variable is a second way to define the trusted CAs. The -certificates of the trusted CAs are collected in one big file and this -variable points to the file. You will probably only use one of the two -ways to define your CAs. The first choice is preferable if you have -many CAs or want to be flexible, the second is preferable if you only -have one CA and want to keep things simple (you won't need to create -the hashed file names). You don't need this variable if you don't -verify client certificates. - - bf(Default:) -tt( ssl CA certFile = /usr/local/ssl/certs/trustedCAs.pem) - -label(sslciphers) -dit(bf(ssl ciphers (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -This variable defines the ciphers that should be offered during SSL -negotiation. You should not set this variable unless you know what you -are doing. - -label(sslclientcert) -dit(bf(ssl client cert (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -The certificate in this file is used by -url(bf(smbclient))(smbclient.1.html) if it exists. It's needed if the -server requires a client certificate. - - bf(Default:) -tt( ssl client cert = /usr/local/ssl/certs/smbclient.pem) - -label(sslclientkey) -dit(bf(ssl client key (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -This is the private key for url(bf(smbclient))(smbclient.1.html). It's -only needed if the client should have a certificate. - - bf(Default:) -tt( ssl client key = /usr/local/ssl/private/smbclient.pem) - -label(sslcompatibility) -dit(bf(ssl compatibility (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -This variable defines whether SSLeay should be configured for bug -compatibility with other SSL implementations. This is probably not -desirable because currently no clients with SSL implementations other -than SSLeay exist. - - bf(Default:) -tt( ssl compatibility = no) - -label(sslhosts) -dit(bf(ssl hosts (G))) - -See link(bf("ssl hosts resign"))(sslhostsresign). - -label(sslhostsresign) -dit(bf(ssl hosts resign (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -These two variables define whether samba will go into SSL mode or -not. If none of them is defined, samba will allow only SSL -connections. If the link(bf("ssl hosts"))(sslhosts) variable lists -hosts (by IP-address, IP-address range, net group or name), only these -hosts will be forced into SSL mode. If the bf("ssl hosts resign") -variable lists hosts, only these hosts will NOT be forced into SSL -mode. The syntax for these two variables is the same as for the -link(bf("hosts allow"))(hostsallow) and link(bf("hosts -deny"))(hostsdeny) pair of variables, only that the subject of the -decision is different: It's not the access right but whether SSL is -used or not. See the link(bf("allow hosts"))(allowhosts) parameter for -details. The example below requires SSL connections from all hosts -outside the local net (which is 192.168.*.*). - - bf(Default:) -tt( ssl hosts = <empty string>) -tt( ssl hosts resign = <empty string>) - - bf(Example:) -tt( ssl hosts resign = 192.168.) - -label(sslrequireclientcert) -dit(bf(ssl require clientcert (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -If this variable is set to tt("yes"), the server will not tolerate -connections from clients that don't have a valid certificate. The -directory/file given in link(bf("ssl CA certDir"))(sslCAcertDir) and -link(bf("ssl CA certFile"))(sslCAcertFile) will be used to look up the -CAs that issued the client's certificate. If the certificate can't be -verified positively, the connection will be terminated. If this -variable is set to tt("no"), clients don't need certificates. Contrary -to web applications you really em(*should*) require client -certificates. In the web environment the client's data is sensitive -(credit card numbers) and the server must prove to be trustworthy. In -a file server environment the server's data will be sensitive and the -clients must prove to be trustworthy. - - bf(Default:) -tt( ssl require clientcert = no) - -label(sslrequireservercert) -dit(bf(ssl require servercert (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -If this variable is set to tt("yes"), the -url(bf(smbclient))(smbclient.1.html) will request a certificate from -the server. Same as link(bf("ssl require -clientcert"))(sslrequireclientcert) for the server. - - bf(Default:) -tt( ssl require servercert = no) - -label(sslservercert) -dit(bf(ssl server cert (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -This is the file containing the server's certificate. The server _must_ -have a certificate. The file may also contain the server's private key. -See later for how certificates and private keys are created. - - bf(Default:) -tt( ssl server cert = <empty string>) - -label(sslserverkey) -dit(bf(ssl server key (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -This file contains the private key of the server. If this variable is -not defined, the key is looked up in the certificate file (it may be -appended to the certificate). The server em(*must*) have a private key -and the certificate em(*must*) match this private key. - - bf(Default:) -tt( ssl server key = <empty string>) - -label(sslversion) -dit(bf(ssl version (G))) - -This variable is part of SSL-enabled Samba. This is only available if -the SSL libraries have been compiled on your system and the configure -option tt("--with-ssl") was given at configure time. - -em(Note) that for export control reasons this code is em(**NOT**) -enabled by default in any current binary version of Samba. - -This enumeration variable defines the versions of the SSL protocol -that will be used. tt("ssl2or3") allows dynamic negotiation of SSL v2 -or v3, tt("ssl2") results in SSL v2, tt("ssl3") results in SSL v3 and -"tls1" results in TLS v1. TLS (Transport Layer Security) is the -(proposed?) new standard for SSL. - - bf(Default:) -tt( ssl version = "ssl2or3") - -label(statcache) -dit(bf(stat cache (G))) - -This parameter determines if url(bf(smbd))(smbd.8.html) will use a -cache in order to speed up case insensitive name mappings. You should -never need to change this parameter. - - bf(Default:) -tt( stat cache = yes) - -label(statcachesize) -dit(bf(stat cache size (G))) - -This parameter determines the number of entries in the link(bf(stat -cache))(statcache). You should never need to change this parameter. - - bf(Default:) -tt( stat cache size = 50) - -label(status) -dit(bf(status (G))) - -This enables or disables logging of connections to a status file that -url(bf(smbstatus))(smbstatus.1.html) can read. - -With this disabled url(bf(smbstatus))(smbstatus.1.html) won't be able -to tell you what connections are active. You should never need to -change this parameter. - - bf(Default:) - status = yes - -label(strictlocking) -dit(bf(strict locking (S))) - -This is a boolean that controls the handling of file locking in the -server. When this is set to tt("yes") the server will check every read and -write access for file locks, and deny access if locks exist. This can -be slow on some systems. - -When strict locking is tt("no") the server does file lock checks only -when the client explicitly asks for them. - -Well behaved clients always ask for lock checks when it is important, -so in the vast majority of cases bf("strict locking = no") is -preferable. - - bf(Default:) -tt( strict locking = no) - - bf(Example:) -tt( strict locking = yes) - -label(strictsync) -dit(bf(strict sync (S))) - -Many Windows applications (including the Windows 98 explorer shell) -seem to confuse flushing buffer contents to disk with doing a sync to -disk. Under UNIX, a sync call forces the process to be suspended until -the kernel has ensured that all outstanding data in kernel disk -buffers has been safely stored onto stable storage. This is very slow -and should only be done rarely. Setting this parameter to "no" (the -default) means that smbd ignores the Windows applications requests for -a sync call. There is only a possibility of losing data if the -operating system itself that Samba is running on crashes, so there is -little danger in this default setting. In addition, this fixes many -performance problems that people have reported with the new Windows98 -explorer shell file copies. - -See also the link(bf("sync always"))(syncalways) parameter. - - bf(Default:) -tt( strict sync = no) - - bf(Example:) -tt( strict sync = yes) - -label(stripdot) -dit(bf(strip dot (G))) - -This is a boolean that controls whether to strip trailing dots off -UNIX filenames. This helps with some CDROMs that have filenames ending -in a single dot. - - bf(Default:) -tt( strip dot = no) - - bf(Example:) -tt( strip dot = yes) - -label(syncalways) -dit(bf(sync always (S))) - -This is a boolean parameter that controls whether writes will always -be written to stable storage before the write call returns. If this is -false then the server will be guided by the client's request in each -write call (clients can set a bit indicating that a particular write -should be synchronous). If this is true then every write will be -followed by a fsync() call to ensure the data is written to disk. -Note that the link(bf("strict sync"))(strictsync) parameter must be -set to tt("yes") in order for this parameter to have any affect. - -See also the link(bf("strict sync"))(strictsync) parameter. - - bf(Default:) -tt( sync always = no) - - bf(Example:) -tt( sync always = yes) - -label(syslog) -dit(bf(syslog (G))) - -This parameter maps how Samba debug messages are logged onto the -system syslog logging levels. Samba debug level zero maps onto syslog -LOG_ERR, debug level one maps onto LOG_WARNING, debug level two maps -onto LOG_NOTICE, debug level three maps onto LOG_INFO. All higher -levels are mapped to LOG_DEBUG. - -This paramter sets the threshold for sending messages to syslog. -Only messages with debug level less than this value will be sent -to syslog. - - bf(Default:) -tt( syslog = 1) - -label(syslogonly) -dit(bf(syslog only (G))) - -If this parameter is set then Samba debug messages are logged into the -system syslog only, and not to the debug log files. - - bf(Default:) -tt( syslog only = no) - -label(templatehomedir) -dit(bf(template homedir (G))) - -NOTE: this parameter is only available in Samba 3.0. - -When filling out the user information for a Windows NT user, the -url(bf(winbindd))(winbindd.8.html) daemon uses this parameter to fill in -the home directory for that user. If the string tt(%D) is present it is -substituted with the user's Windows NT domain name. If the string tt(%U) -is present it is substituted with the user's Windows NT user name. - - bf(Default:) -tt( template homedir = /home/%D/%U) - -label(templateshell) -dit(bf(template shell (G))) - -NOTE: this parameter is only available in Samba 3.0. - -When filling out the user information for a Windows NT user, the -url(bf(winbindd))(winbindd.8.html) daemon uses this parameter to fill in -the login shell for that user. - - bf(Default:) -tt( template shell = /bin/false) - -label(timeoffset) -dit(bf(time offset (G))) - -This parameter is a setting in minutes to add to the normal GMT to -local time conversion. This is useful if you are serving a lot of PCs -that have incorrect daylight saving time handling. - - bf(Default:) -tt( time offset = 0) - - bf(Example:) -tt( time offset = 60) - -label(timeserver) - -dit(bf(time server (G))) - -This parameter determines if url(bf(nmbd))(nmbd.8.html) advertises -itself as a time server to Windows clients. The default is False. - - bf(Default:) -tt( time server = False) - - bf(Example:) -tt( time server = True) - -label(timestamplogs) -dit(bf(timestamp logs (G))) - -Synonym for url(bf("debug timestamp"))(debugtimestamp). - -label(unixpasswordsync) -dit(bf(unix password sync (G))) - -This boolean parameter controls whether Samba attempts to synchronize -the UNIX password with the SMB password when the encrypted SMB -password in the smbpasswd file is changed. If this is set to true the -program specified in the link(bf("passwd program"))(passwdprogram) -parameter is called em(*AS ROOT*) - to allow the new UNIX password to be -set without access to the old UNIX password (as the SMB password has -change code has no access to the old password cleartext, only the -new). By default this is set to tt("false"). - -See also link(bf("passwd program"))(passwdprogram), link(bf("passwd -chat"))(passwdchat). - - bf(Default:) -tt( unix password sync = False) - - bf(Example:) -tt( unix password sync = True) - -label(unixrealname) -dit(bf(unix realname (G))) - -This boolean parameter when set causes samba to supply the real name -field from the unix password file to the client. This is useful for -setting up mail clients and WWW browsers on systems used by more than -one person. - - bf(Default:) -tt( unix realname = no) - - bf(Example:) -tt( unix realname = yes) - -label(updateencrypted) -dit(bf(update encrypted (G))) - -This boolean parameter allows a user logging on with a plaintext -password to have their encrypted (hashed) password in the smbpasswd -file to be updated automatically as they log on. This option allows a -site to migrate from plaintext password authentication (users -authenticate with plaintext password over the wire, and are checked -against a UNIX account database) to encrypted password authentication -(the SMB challenge/response authentication mechanism) without forcing -all users to re-enter their passwords via smbpasswd at the time the -change is made. This is a convenience option to allow the change over -to encrypted passwords to be made over a longer period. Once all users -have encrypted representations of their passwords in the smbpasswd -file this parameter should be set to tt("off"). - -In order for this parameter to work correctly the link(bf("encrypt -passwords"))(encryptpasswords) parameter must be set to tt("no") when -this parameter is set to tt("yes"). - -Note that even when this parameter is set a user authenticating to -smbd must still enter a valid password in order to connect correctly, -and to update their hashed (smbpasswd) passwords. - - bf(Default:) -tt( update encrypted = no) - - bf(Example:) -tt( update encrypted = yes) - -label(userhosts) -dit(bf(use rhosts (G))) - -If this global parameter is a true, it specifies that the UNIX users -tt(".rhosts") file in their home directory will be read to find the -names of hosts and users who will be allowed access without specifying -a password. - -NOTE: The use of bf(use rhosts) can be a major security hole. This is -because you are trusting the PC to supply the correct username. It is -very easy to get a PC to supply a false username. I recommend that the -bf(use rhosts) option be only used if you really know what you are -doing. - - bf(Default:) -tt( use rhosts = no) - - bf(Example:) -tt( use rhosts = yes) - -label(user) -dit(bf(user (S))) - -Synonym for link(bf("username"))(username). - -label(users) -dit(bf(users (S))) - -Synonym for link(bf("username"))(username). - -label(username) -dit(bf(username (S))) - -Multiple users may be specified in a comma-delimited list, in which -case the supplied password will be tested against each username in -turn (left to right). - -The bf(username=) line is needed only when the PC is unable to supply -its own username. This is the case for the COREPLUS protocol or where -your users have different WfWg usernames to UNIX usernames. In both -these cases you may also be better using the tt(\\server\share%user) -syntax instead. - -The bf(username=) line is not a great solution in many cases as it -means Samba will try to validate the supplied password against each of -the usernames in the username= line in turn. This is slow and a bad -idea for lots of users in case of duplicate passwords. You may get -timeouts or security breaches using this parameter unwisely. - -Samba relies on the underlying UNIX security. This parameter does not -restrict who can login, it just offers hints to the Samba server as to -what usernames might correspond to the supplied password. Users can -login as whoever they please and they will be able to do no more -damage than if they started a telnet session. The daemon runs as the -user that they log in as, so they cannot do anything that user cannot -do. - -To restrict a service to a particular set of users you can use the -link(bf("valid users="))(validusers) parameter. - -If any of the usernames begin with a tt('@') then the name will be -looked up first in the yp netgroups list (if Samba is compiled with -netgroup support), followed by a lookup in the UNIX groups database -and will expand to a list of all users in the group of that name. - -If any of the usernames begin with a tt('+') then the name will be -looked up only in the UNIX groups database and will expand to a list -of all users in the group of that name. - -If any of the usernames begin with a tt('&') then the name will be -looked up only in the yp netgroups database (if Samba is compiled with -netgroup support) and will expand to a list of all users in the -netgroup group of that name. - -Note that searching though a groups database can take quite some time, -and some clients may time out during the search. - -See the section link(bf("NOTE ABOUT USERNAME/PASSWORD -VALIDATION"))(NOTEABOUTUSERNAMEPASSWORDVALIDATION) for more -information on how this parameter determines access to the services. - - bf(Default:) -tt( The guest account if a guest service, else the name of the service.) - - bf(Examples:) -verb( - username = fred - username = fred, mary, jack, jane, @users, @pcgroup -) - -label(usernamelevel) -dit(bf(username level (G))) - -This option helps Samba to try and 'guess' at the real UNIX username, -as many DOS clients send an all-uppercase username. By default Samba -tries all lowercase, followed by the username with the first letter -capitalized, and fails if the username is not found on the UNIX -machine. - -If this parameter is set to non-zero the behavior changes. This -parameter is a number that specifies the number of uppercase -combinations to try whilst trying to determine the UNIX user name. The -higher the number the more combinations will be tried, but the slower -the discovery of usernames will be. Use this parameter when you have -strange usernames on your UNIX machine, such as tt("AstrangeUser"). - - bf(Default:) -tt( username level = 0) - - bf(Example:) -tt( username level = 5) - -label(usernamemap) -dit(bf(username map (G))) - -This option allows you to specify a file containing a mapping of -usernames from the clients to the server. This can be used for several -purposes. The most common is to map usernames that users use on DOS or -Windows machines to those that the UNIX box uses. The other is to map -multiple users to a single username so that they can more easily share -files. - -The map file is parsed line by line. Each line should contain a single -UNIX username on the left then a tt('=') followed by a list of -usernames on the right. The list of usernames on the right may contain -names of the form @group in which case they will match any UNIX -username in that group. The special client name tt('*') is a wildcard -and matches any name. Each line of the map file may be up to 1023 -characters long. - -The file is processed on each line by taking the supplied username and -comparing it with each username on the right hand side of the tt('=') -signs. If the supplied name matches any of the names on the right hand -side then it is replaced with the name on the left. Processing then -continues with the next line. - -If any line begins with a tt('#') or a tt(';') then it is ignored - -If any line begins with an tt('!') then the processing will stop after -that line if a mapping was done by the line. Otherwise mapping -continues with every line being processed. Using tt('!') is most -useful when you have a wildcard mapping line later in the file. - -For example to map from the name tt("admin") or tt("administrator") to -the UNIX name tt("root") you would use: - - -tt( root = admin administrator) - -Or to map anyone in the UNIX group tt("system") to the UNIX name -tt("sys") you would use: - -tt( sys = @system) - -You can have as many mappings as you like in a username map file. - -If your system supports the NIS NETGROUP option then the netgroup -database is checked before the tt(/etc/group) database for matching -groups. - -You can map Windows usernames that have spaces in them by using double -quotes around the name. For example: - -tt( tridge = "Andrew Tridgell") - -would map the windows username tt("Andrew Tridgell") to the unix -username tridge. - -The following example would map mary and fred to the unix user sys, -and map the rest to guest. Note the use of the tt('!') to tell Samba -to stop processing if it gets a match on that line. - -verb( - !sys = mary fred - guest = * -) - -Note that the remapping is applied to all occurrences of -usernames. Thus if you connect to tt("\\server\fred") and tt("fred") -is remapped to tt("mary") then you will actually be connecting to -tt("\\server\mary") and will need to supply a password suitable for -tt("mary") not tt("fred"). The only exception to this is the username -passed to the link(bf("password server"))(passwordserver) (if you have -one). The password server will receive whatever username the client -supplies without modification. - -Also note that no reverse mapping is done. The main effect this has is -with printing. Users who have been mapped may have trouble deleting -print jobs as PrintManager under WfWg will think they don't own the -print job. - - bf(Default:) -tt( no username map) - - bf(Example:) -tt( username map = /usr/local/samba/lib/users.map) - -label(utmp) -dit(bf(utmp (S))) - -This boolean parameter is only available if Samba has been configured and compiled -with the option tt(--with-utmp). If set to True then Samba will attempt -to add utmp or utmpx records (depending on the UNIX system) whenever a -connection is made to a Samba server. Sites may use this to record the -user connecting to a Samba share. - -See also the link(bf("utmp directory"))(utmpdirectory) parameter. - - bf(Default:) -tt(utmp = False) - - bf(Example:) -tt(utmp = True) - -label(utmpdirectory) -dit(bf(utmp directory(G))) - -This parameter is only available if Samba has been configured and compiled -with the option tt(--with-utmp). It specifies a directory pathname that is -used to store the utmp or utmpx files (depending on the UNIX system) that -record user connections to a Samba server. See also the link(bf("utmp"))(utmp) -parameter. By default this is not set, meaning the system will use whatever -utmp file the native system is set to use (usually /var/run/utmp on Linux). - - bf(Default:) -tt(no utmp directory) - - bf(Example:) -tt(utmp directory = /var/adm/) - -label(winbindcachetime) -dit(winbind cache time) - -NOTE: this parameter is only available in Samba 3.0. - -This parameter specifies the number of seconds the -url(bf(winbindd))(winbindd.8.html) daemon will cache user and group -information before querying a Windows NT server again. - - bf(Default:) -tt( winbind cache type = 15) - -label(winbindgid) -dit(winbind gid) - -NOTE: this parameter is only available in Samba 3.0. - -The winbind gid parameter specifies the range of group ids that are -allocated by the url(bf(winbindd))(winbindd.8.html) daemon. This range of -group ids should have no existing local or nis groups within it as strange -conflicts can occur otherwise. - - bf(Default:) -tt( winbind gid = <empty string>) - - bf(Example:) -tt( winbind gid = 10000-20000) - -label(winbinduid) -dit(winbind uid) - -NOTE: this parameter is only available in Samba 3.0. - -The winbind uid parameter specifies the range of user ids that are -allocated by the url(bf(winbindd))(winbindd.8.html) daemon. This range of -ids should have no existing local or nis users within it as strange -conflicts can occur otherwise. - - bf(Default:) -tt( winbind uid = <empty string>) - - bf(Example:) -tt( winbind uid = 10000-20000) - -label(validchars) -dit(bf(valid chars (G))) - -The option allows you to specify additional characters that should be -considered valid by the server in filenames. This is particularly -useful for national character sets, such as adding u-umlaut or a-ring. - -The option takes a list of characters in either integer or character -form with spaces between them. If you give two characters with a colon -between them then it will be taken as an lowercase:uppercase pair. - -If you have an editor capable of entering the characters into the -config file then it is probably easiest to use this method. Otherwise -you can specify the characters in octal, decimal or hexadecimal form -using the usual C notation. - -For example to add the single character tt('Z') to the charset (which -is a pointless thing to do as it's already there) you could do one of -the following - -verb( - valid chars = Z - valid chars = z:Z - valid chars = 0132:0172 -) - -The last two examples above actually add two characters, and alter the -uppercase and lowercase mappings appropriately. - -Note that you MUST specify this parameter after the link(bf("client -code page"))(clientcodepage) parameter if you have both set. If -link(bf("client code page"))(clientcodepage) is set after the -bf("valid chars") parameter the bf("valid chars") settings will be -overwritten. - -See also the link(bf("client code page"))(clientcodepage) parameter. - - bf(Default:) -verb( - Samba defaults to using a reasonable set of valid characters - for English systems -) - - bf(Example) -tt( valid chars = 0345:0305 0366:0326 0344:0304) - -The above example allows filenames to have the Swedish characters in -them. - -NOTE: It is actually quite difficult to correctly produce a bf("valid -chars") line for a particular system. To automate the process -email(tino@augsburg.net) has written a package called bf("validchars") -which will automatically produce a complete bf("valid chars") line for -a given client system. Look in the examples/validchars/ subdirectory -of your Samba source code distribution for this package. - -label(validusers) -dit(bf(valid users (S))) - -This is a list of users that should be allowed to login to this -service. Names starting with tt('@'), tt('+') and tt('&') are -interpreted using the same rules as described in the link(bf("invalid -users"))(invalidusers) parameter. - -If this is empty (the default) then any user can login. If a username -is in both this list and the link(bf("invalid users"))(invalidusers) -list then access is denied for that user. - -The current servicename is substituted for -link(bf("%S"))(percentS). This is useful in the -link(bf([homes]))(homes) section. - -See also link(bf("invalid users"))(invalidusers). - - bf(Default:) -tt( No valid users list. (anyone can login)) - - bf(Example:) -tt( valid users = greg, @pcusers) - -label(vetofiles) -dit(bf(veto files(S))) - -This is a list of files and directories that are neither visible nor -accessible. Each entry in the list must be separated by a tt('/'), -which allows spaces to be included in the entry. tt('*') and tt('?') -can be used to specify multiple files or directories as in DOS -wildcards. - -Each entry must be a unix path, not a DOS path and must em(*not*) include the -unix directory separator tt('/'). - -Note that the link(bf("case sensitive"))(casesensitive) option is -applicable in vetoing files. - -One feature of the veto files parameter that it is important to be -aware of, is that if a directory contains nothing but files that match -the veto files parameter (which means that Windows/DOS clients cannot -ever see them) is deleted, the veto files within that directory *are -automatically deleted* along with it, if the user has UNIX permissions -to do so. - -Setting this parameter will affect the performance of Samba, as it -will be forced to check all files and directories for a match as they -are scanned. - -See also link(bf("hide files"))(hidefiles) and link(bf("case -sensitive"))(casesensitive). - - bf(Default:) -tt( No files or directories are vetoed.) - - bf(Examples:) - - Example 1. - -verb( - - Veto any files containing the word Security, - any ending in .tmp, and any directory containing the - word root. - - veto files = /*Security*/*.tmp/*root*/ -) - - Example 2. - -verb( - Veto the Apple specific files that a NetAtalk server - creates. - - veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ -) - -label(vetooplockfiles) -dit(bf(veto oplock files (S))) - -This parameter is only valid when the link(bf("oplocks"))(oplocks) -parameter is turned on for a share. It allows the Samba administrator -to selectively turn off the granting of oplocks on selected files that -match a wildcarded list, similar to the wildcarded list used in the -link(bf("veto files"))(vetofiles) parameter. - - bf(Default:) -tt( No files are vetoed for oplock grants.) - - bf(Examples:) - -You might want to do this on files that you know will be heavily -contended for by clients. A good example of this is in the NetBench -SMB benchmark program, which causes heavy client contention for files -ending in tt(".SEM"). To cause Samba not to grant oplocks on these -files you would use the line (either in the link(bf([global]))(global) -section or in the section for the particular NetBench share : - -tt( veto oplock files = /*.SEM/) - -label(volume) -dit(bf(volume (S))) - -This allows you to override the volume label returned for a -share. Useful for CDROMs with installation programs that insist on a -particular volume label. - -The default is the name of the share. - -label(widelinks) -dit(bf(wide links (S))) - -This parameter controls whether or not links in the UNIX file system -may be followed by the server. Links that point to areas within the -directory tree exported by the server are always allowed; this -parameter controls access only to areas that are outside the directory -tree being exported. - -Note that setting this parameter can have a negative effect on your -server performance due to the extra system calls that Samba has to -do in order to perform the link checks. - - bf(Default:) -tt( wide links = yes) - - bf(Example:) -tt( wide links = no) - -label(winsproxy) -dit(bf(wins proxy (G))) - -This is a boolean that controls if url(bf(nmbd))(nmbd.8.html) will -respond to broadcast name queries on behalf of other hosts. You may -need to set this to tt("yes") for some older clients. - - bf(Default:) -tt( wins proxy = no) - -label(winsserver) -dit(bf(wins server (G))) - -This specifies the IP address (or DNS name: IP address for preference) -of the WINS server that url(bf(nmbd))(nmbd.8.html) should register with. -If you have a WINS server on your network then you should set this to -the WINS server's IP. - -You should point this at your WINS server if you have a -multi-subnetted network. - -em(NOTE). You need to set up Samba to point to a WINS server if you -have multiple subnets and wish cross-subnet browsing to work correctly. - -See the documentation file BROWSING.txt in the docs/ directory of your -Samba source distribution. - - bf(Default:) -tt( wins server = ) - - bf(Example:) -tt( wins server = 192.9.200.1) - -label(winshook) -dit(bf(wins hook (G))) - -When Samba is running as a WINS server this allows you to call an -external program for all changes to the WINS database. The primary use -for this option is to allow the dynamic update of external name -resolution databases such as dynamic DNS. - -The wins hook parameter specifies the name of a script or executable -that will be called as follows: - - wins_hook operation name nametype ttl IP_list - -The first argument is the operation and is one of "add", "delete", -or "refresh". In most cases the operation can be ignored as the rest -of the parameters provide sufficient information. Note that "refresh" -may sometimes be called when the name has not previously been added, -in that case it should be treated as an add. - -The second argument is the netbios name. If the name is not a legal -name then the wins hook is not called. Legal names contain only -letters, digits, hyphens, underscores and periods. - -The third argument is the netbios name type as a 2 digit hexadecimal -number. - -The fourth argument is the TTL (time to live) for the name in seconds. - -The fifth and subsequent arguments are the IP addresses currently -registered for that name. If this list is empty then the name should -be deleted. - -An example script that calls the BIND dynamic DNS update program -"nsupdate" is provided in the examples directory of the Samba source -code. - -label(winssupport) -dit(bf(wins support (G))) - -This boolean controls if the url(bf(nmbd))(nmbd.8.html) process in -Samba will act as a WINS server. You should not set this to true -unless you have a multi-subnetted network and you wish a particular -url(bf(nmbd))(nmbd.8.html) to be your WINS server. Note that you -should em(*NEVER*) set this to true on more than one machine in your -network. - - bf(Default:) -tt( wins support = no) - -label(workgroup) -dit(bf(workgroup (G))) - -This controls what workgroup your server will appear to be in when -queried by clients. Note that this parameter also controls the Domain -name used with the link(bf("security=domain"))(securityequaldomain) -setting. - - bf(Default:) -tt( set at compile time to WORKGROUP) - - bf(Example:) - workgroup = MYGROUP - -label(writable) -dit(bf(writable (S))) - -Synonym for link(bf("writeable"))(writeable) for people who can't spell :-). - -label(writelist) -dit(bf(write list (S))) - -This is a list of users that are given read-write access to a -service. If the connecting user is in this list then they will be -given write access, no matter what the link(bf("writeable"))(writeable) -option is set to. The list can include group names using the @group -syntax. - -Note that if a user is in both the read list and the write list then -they will be given write access. - -See also the link(bf("read list"))(readlist) option. - - bf(Default:) -tt( write list = <empty string>) - - bf(Example:) -tt( write list = admin, root, @staff) - -label(writecachesize) -dit(bf(write cache size (S))) - -This integer parameter (new with Samba 2.0.7) if set to non-zero causes Samba to create an in-memory -cache for each oplocked file (it does bf(not) do this for non-oplocked files). All -writes that the client does not request to be flushed directly to disk will be -stored in this cache if possible. The cache is flushed onto disk when a write -comes in whose offset would not fit into the cache or when the file is closed -by the client. Reads for the file are also served from this cache if the data -is stored within it. - -This cache allows Samba to batch client writes into a more efficient write -size for RAID disks (ie. writes may be tuned to be the RAID stripe size) and -can improve performance on systems where the disk subsystem is a bottleneck -but there is free memory for userspace programs. - -The integer parameter specifies the size of this cache (per oplocked file) -in bytes. - - bf(Default:) -tt( write cache size = 0) - - bf(Example:) -tt( write cache size = 262144) -for a 256k cache size per file. - -label(writeok) -dit(bf(write ok (S))) - -Synonym for link(bf(writeable))(writeable). - -label(writeraw) -dit(bf(write raw (G))) - -This parameter controls whether or not the server will support raw -writes SMB's when transferring data from clients. You should never -need to change this parameter. - - bf(Default:) -tt( write raw = yes) - -label(writeable) -dit(bf(writeable)) - -An inverted synonym is link(bf("read only"))(readonly). - -If this parameter is tt("no"), then users of a service may not create -or modify files in the service's directory. - -Note that a printable service link(bf(("printable = yes")))(printable) -will em(*ALWAYS*) allow writing to the directory (user privileges -permitting), but only via spooling operations. - - bf(Default:) -tt( writeable = no) - - bf(Examples:) -verb( - read only = no - writeable = yes - write ok = yes -) - -endit() - -label(WARNINGS) -manpagesection(WARNINGS) - -Although the configuration file permits service names to contain -spaces, your client software may not. Spaces will be ignored in -comparisons anyway, so it shouldn't be a problem - but be aware of the -possibility. - -On a similar note, many clients - especially DOS clients - limit -service names to eight characters. url(bf(Smbd))(smbd.8.html) has no -such limitation, but attempts to connect from such clients will fail -if they truncate the service names. For this reason you should -probably keep your service names down to eight characters in length. - -Use of the link(bf([homes]))(homes) and link(bf([printers]))(printers) -special sections make life for an administrator easy, but the various -combinations of default attributes can be tricky. Take extreme care -when designing these sections. In particular, ensure that the -permissions on spool directories are correct. - -label(VERSION) -manpagesection(VERSION) - -This man page is correct for version 2.0 of the Samba suite. - -label(SEEALSO) -manpagesection(SEE ALSO) - -url(bf(smbd (8)))(smbd.8.html), url(bf(smbclient (1)))(smbclient.1.html), -url(bf(nmbd (8)))(nmbd.8.html), url(bf(testparm (1)))(testparm.1.html), -url(bf(testprns (1)))(testprns.1.html), url(bf(Samba))(samba.7.html), -url(bf(nmblookup (1)))(nmblookup.1.html), url(bf(smbpasswd (5)))(smbpasswd.5.html), -url(bf(smbpasswd (8)))(smbpasswd.8.html). - -label(AUTHOR) -manpageauthor() - -The original Samba software and related utilities were created by -Andrew Tridgell email(samba@samba.org). Samba is now developed -by the Samba Team as an Open Source project similar to the way the -Linux kernel is developed. - -The original Samba man pages were written by Karl Auer. The man page -sources were converted to YODL format (another excellent piece of Open -Source software, available at -url(bf(ftp://ftp.icce.rug.nl/pub/unix/))(ftp://ftp.icce.rug.nl/pub/unix/)) -and updated for the Samba2.0 release by Jeremy Allison. -email(samba@samba.org). - -See url(bf(samba (7)))(samba.7.html) to find out how to get a full -list of contributors and details on how to submit bug reports, -comments etc. |