path: root/packaging/Caldera/OpenServer/man/cat.5/smb.conf.5

     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



     NNNNAAAAMMMMEEEE
          smb.conf - The configuration file for the Samba suite

     SSSSYYYYNNNNOOOOPPPPSSSSIIIISSSS
          The _s_m_b._c_o_n_f file is a configuration file for the Samba
          suite. _s_m_b._c_o_n_f contains runtime configuration information
          for the Samba programs. The _s_m_b._c_o_n_f file is designed to be
          configured and administered by the sssswwwwaaaatttt((((8888))))
           program. The complete description of the file format and
          possible parameters held within are here for reference
          purposes.

     FFFFIIIILLLLEEEE FFFFOOOORRRRMMMMAAAATTTT
          The file consists of sections and parameters. A section
          begins with the name of the section in square brackets and
          continues until the next section begins. Sections contain
          parameters of the form

          _n_a_m_e = _v_a_l_u_e

          The file is line-based - that is, each newline-terminated
          line represents either a comment, a section name or a
          parameter.

          Section and parameter names are not case sensitive.

          Only the first equals sign in a parameter is significant.
          Whitespace before or after the first equals sign is
          discarded.  Leading, trailing and internal whitespace in
          section and parameter names is irrelevant. Leading and
          trailing whitespace in a parameter value is discarded.
          Internal whitespace within a parameter value is retained
          verbatim.

          Any line beginning with a semicolon (';') or a hash ('#')
          character is ignored, as are lines containing only
          whitespace.

          Any line ending in a '\' is continued on the next line in
          the customary UNIX fashion.

          The values following the equals sign in parameters are all
          either a string (no quotes needed) or a boolean, which may
          be given as yes/no, 0/1 or true/false. Case is not
          significant in boolean values, but is preserved in string
          values. Some items such as create modes are numeric.

     SSSSEEEECCCCTTTTIIIIOOOONNNN DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNNSSSS
          Each section in the configuration file (except for the
          [global] section) describes a shared resource (known as a
          "share"). The section name is the name of the shared
          resource and the parameters within the section define the



     Page 1                                          (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          shares attributes.

          There are three special sections, [global], [homes] and
          [printers], which are described under ssssppppeeeecccciiiiaaaallll sssseeeeccccttttiiiioooonnnnssss. The
          following notes apply to ordinary section descriptions.

          A share consists of a directory to which access is being
          given plus a description of the access rights which are
          granted to the user of the service. Some housekeeping
          options are also specifiable.

          Sections are either file share services (used by the client
          as an extension of their native file systems) or printable
          services (used by the client to access print services on the
          host running the server).

          Sections may be designated gggguuuueeeesssstttt services, in which case no
          password is required to access them. A specified UNIX gggguuuueeeesssstttt
          aaaaccccccccoooouuuunnnntttt is used to define access privileges in this case.

          Sections other than guest services will require a password
          to access them. The client provides the username. As older
          clients only provide passwords and not usernames, you may
          specify a list of usernames to check against the password
          using the "user =" option in the share definition. For
          modern clients such as Windows 95/98/ME/NT/2000, this should
          not be necessary.

          Note that the access rights granted by the server are masked
          by the access rights granted to the specified or guest UNIX
          user by the host system. The server does not grant more
          access than the host system grants.

          The following sample section defines a file space share. The
          user has write access to the path /_h_o_m_e/_b_a_r. The share is
          accessed via the share name "foo":

                    [foo]
                    path = /home/bar
                    read only = no




          The following sample section defines a printable share. The
          share is readonly, but printable. That is, the only write
          access permitted is via calls to open, write to and close a
          spool file. The gggguuuueeeesssstttt ooookkkk parameter means access will be
          permitted as the default guest user (specified elsewhere):

                    [aprinter]
                    path = /usr/spool/public



     Page 2                                          (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



                    read only = yes
                    printable = yes
                    guest ok = yes




     SSSSPPPPEEEECCCCIIIIAAAALLLL SSSSEEEECCCCTTTTIIIIOOOONNNNSSSS
        TTTTHHHHEEEE  GGGGLLLLOOOOBBBBAAAALLLL  SSSSEEEECCCCTTTTIIIIOOOONNNN
          parameters in this section apply to the server as a whole,
          or are defaults for sections which do not specifically
          define certain items. See the notes under PARAMETERS for
          more information.

        TTTTHHHHEEEE  HHHHOOOOMMMMEEEESSSS  SSSSEEEECCCCTTTTIIIIOOOONNNN
          If a section called homes is included in the configuration
          file, services connecting clients to their home directories
          can be created on the fly by the server.

          When the connection request is made, the existing sections
          are scanned. If a match is found, it is used. If no match is
          found, the requested section name is treated as a user name
          and looked up in the local password file. If the name exists
          and the correct password has been given, a share is created
          by cloning the [homes] section.

          Some modifications are then made to the newly created share:

          o+ The share name is changed from homes to the located
            username.

          o+ If no path was given, the path is set to the user's home
            directory.

          If you decide to use a ppppaaaatttthhhh ==== line in your [homes] section
          then you may find it useful to use the %S macro. For example
          :

          ppppaaaatttthhhh ==== ////ddddaaaattttaaaa////ppppcccchhhhoooommmmeeee////%%%%SSSS

          would be useful if you have different home directories for
          your PCs than for UNIX access.

          This is a fast and simple way to give a large number of
          clients access to their home directories with a minimum of
          fuss.

          A similar process occurs if the requested section name is
          "homes", except that the share name is not changed to that
          of the requesting user. This method of using the [homes]
          section works well if different users share a client PC.




     Page 3                                          (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          The [homes] section can specify all the parameters a normal
          service section can specify, though some make more sense
          than others. The following is a typical and suitable [homes]
          section:

                              [homes]
                         read only = no




          An important point is that if guest access is specified in
          the [homes] section, all home directories will be visible to
          all clients wwwwiiiitttthhhhoooouuuutttt aaaa ppppaaaasssssssswwwwoooorrrrdddd. In the very unlikely event
          that this is actually desirable, it would be wise to also
          specify rrrreeeeaaaadddd oooonnnnllllyyyy aaaacccccccceeeessssssss.

          Note that the bbbbrrrroooowwwwsssseeeeaaaabbbblllleeee flag for auto home directories will
          be inherited from the global browseable flag, not the
          [homes] browseable flag. This is useful as it means setting
          bbbbrrrroooowwwwsssseeeeaaaabbbblllleeee ==== nnnnoooo in the [homes] section will hide the [homes]
          share but make any auto home directories visible.

        TTTTHHHHEEEE  PPPPRRRRIIIINNNNTTTTEEEERRRRSSSS  SSSSEEEECCCCTTTTIIIIOOOONNNN
          This section works like [homes], but for printers.

          If a [printers] section occurs in the configuration file,
          users are able to connect to any printer specified in the
          local host's printcap file.

          When a connection request is made, the existing sections are
          scanned. If a match is found, it is used. If no match is
          found, but a [homes] section exists, it is used as described
          above. Otherwise, the requested section name is treated as a
          printer name and the appropriate printcap file is scanned to
          see if the requested section name is a valid printer share
          name. If a match is found, a new printer share is created by
          cloning the [printers] section.

          A few modifications are then made to the newly created
          share:

          o+ The share name is set to the located printer name

          o+ If no printer name was given, the printer name is set to
            the located printer name

          o+ If the share does not permit guest access and no username
            was given, the username is set to the located printer
            name.

          Note that the [printers] service MUST be printable - if you



     Page 4                                          (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          specify otherwise, the server will refuse to load the
          configuration file.

          Typically the path specified would be that of a world-
          writeable spool directory with the sticky bit set on it. A
          typical [printers] entry would look like this:

                    [printers]
                         path = /usr/spool/public
                         guest ok = yes
                         printable = yes



          All aliases given for a printer in the printcap file are
          legitimate printer names as far as the server is concerned.
          If your printing subsystem doesn't work like that, you will
          have to set up a pseudo-printcap. This is a file consisting
          of one or more lines like this:

                                 alias|alias|alias|alias...




          Each alias should be an acceptable printer name for your
          printing subsystem. In the [global] section, specify the new
          file as your printcap. The server will then only recognize
          names found in your pseudo-printcap, which of course can
          contain whatever aliases you like. The same technique could
          be used simply to limit access to a subset of your local
          printers.

          An alias, by the way, is defined as any component of the
          first entry of a printcap record. Records are separated by
          newlines, components (if there are more than one) are
          separated by vertical bar symbols ('|').

          NOTE: On SYSV systems which use lpstat to determine what
          printers are defined on the system you may be able to use
          "printcap name = lpstat" to automatically obtain a list of
          printers. See the "printcap name" option for more details.

     PPPPAAAARRRRAAAAMMMMEEEETTTTEEEERRRRSSSS
          parameters define the specific attributes of sections.

          Some parameters are specific to the [global] section (e.g.,
          sssseeeeccccuuuurrrriiiittttyyyy). Some parameters are usable in all sections (e.g.,
          ccccrrrreeeeaaaatttteeee mmmmooooddddeeee). All others are permissible only in normal
          sections. For the purposes of the following descriptions the
          [homes] and [printers] sections will be considered normal.
          The letter GGGG in parentheses indicates that a parameter is



     Page 5                                          (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          specific to the [global] section. The letter SSSS indicates
          that a parameter can be specified in a service specific
          section. Note that all SSSS parameters can also be specified in
          the [global] section - in which case they will define the
          default behavior for all services.

          parameters are arranged here in alphabetical order - this
          may not create best bedfellows, but at least you can find
          them! Where there are synonyms, the preferred synonym is
          described, others refer to the preferred synonym.

     VVVVAAAARRRRIIIIAAAABBBBLLLLEEEE SSSSUUUUBBBBSSSSTTTTIIIITTTTUUUUTTTTIIIIOOOONNNNSSSS
          Many of the strings that are settable in the config file can
          take substitutions. For example the option "path = /tmp/%u"
          would be interpreted as "path = /tmp/john" if the user
          connected with the username john.

          These substitutions are mostly noted in the descriptions
          below, but there are some general substitutions which apply
          whenever they might be relevant. These are:

          %%%%SSSS   the name of the current service, if any.

          %%%%PPPP   the root directory of the current service, if any.

          %%%%uuuu   user name of the current service, if any.

          %%%%gggg   primary group name of %u.

          %%%%UUUU   session user name (the user name that the client
               wanted, not necessarily the same as the one they got).

          %%%%GGGG   primary group name of %U.

          %%%%HHHH   the home directory of the user given by %u.

          %%%%vvvv   the Samba version.

          %%%%hhhh   the Internet hostname that Samba is running on.

          %%%%mmmm   the NetBIOS name of the client machine (very useful).

          %%%%LLLL   the NetBIOS name of the server. This allows you to
               change your config based on what the client calls you.
               Your server can have a "dual personality".

               Note that this paramater is not available when Samba
               listens on port 445, as clients no longer send this
               information

          %%%%MMMM   the Internet name of the client machine.




     Page 6                                          (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          %%%%NNNN   the name of your NIS home directory server. This is
               obtained from your NIS auto.map entry. If you have not
               compiled Samba with the --------wwwwiiiitttthhhh----aaaauuuuttttoooommmmoooouuuunnnntttt option then
               this value will be the same as %L.

          %%%%pppp   the path of the service's home directory, obtained from
               your NIS auto.map entry. The NIS auto.map entry is
               split up as "%N:%p".

          %%%%RRRR   the selected protocol level after protocol negotiation.
               It can be one of CORE, COREPLUS, LANMAN1, LANMAN2 or
               NT1.

          %%%%dddd   The process id of the current server process.

          %%%%aaaa   the architecture of the remote machine. Only some are
               recognized, and those may not be 100% reliable. It
               currently recognizes Samba, WfWg, Win95, WinNT and
               Win2k. Anything else will be known as "UNKNOWN". If it
               gets it wrong then sending a level 3 log to
               samba@samba.org
                <URL:mailto:samba@samba.org> should allow it to be
               fixed.

          %%%%IIII   The IP address of the client machine.

          %%%%TTTT   the current date and time.

          %%%%$$$$((((_e_n_v_v_a_r))))
               The value of the environment variable _e_n_v_a_r.

          There are some quite creative things that can be done with
          these substitutions and other smb.conf options.

     NNNNAAAAMMMMEEEE MMMMAAAANNNNGGGGLLLLIIIINNNNGGGG
          Samba supports "name mangling" so that DOS and Windows
          clients can use files that don't conform to the 8.3 format.
          It can also be set to adjust the case of 8.3 format
          filenames.

          There are several options that control the way mangling is
          performed, and they are grouped here rather than listed
          separately. For the defaults look at the output of the
          testparm program.

          All of these options can be set separately for each service
          (or globally, of course).

          The options are:

          mmmmaaaannnngggglllliiiinnnngggg mmmmeeeetttthhhhoooodddd
               controls the algorithm used for the generating the



     Page 7                                          (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               mangled names. Can take two different values, "hash"
               and "hash2". "hash" is the default and is the algorithm
               that has been used in Samba for many years. "hash2" is
               a newer and considered a better algorithm (generates
               less collisions) in the names.  However, many Win32
               applications store the mangled names and so changing to
               the new algorithm must not be done lightly as these
               applications may break unless reinstalled.  New
               installations of Samba may set the default to hash2.
               Default hhhhaaaasssshhhh.

          mmmmaaaannnngggglllleeee ccccaaaasssseeee ==== yyyyeeeessss////nnnnoooo
               controls if names that have characters that aren't of
               the "default" case are mangled. For example, if this is
               yes then a name like "Mail" would be mangled. Default
               nnnnoooo.

          ccccaaaasssseeee sssseeeennnnssssiiiittttiiiivvvveeee ==== yyyyeeeessss////nnnnoooo
               controls whether filenames are case sensitive. If they
               aren't then Samba must do a filename search and match
               on passed names. Default nnnnoooo.

          ddddeeeeffffaaaauuuulllltttt ccccaaaasssseeee ==== uuuuppppppppeeeerrrr////lllloooowwwweeeerrrr
               controls what the default case is for new filenames.
               Default lllloooowwwweeeerrrr.

          pppprrrreeeesssseeeerrrrvvvveeee ccccaaaasssseeee ==== yyyyeeeessss////nnnnoooo
               controls if new files are created with the case that
               the client passes, or if they are forced to be the
               "default" case. Default yyyyeeeessss.

          sssshhhhoooorrrrtttt pppprrrreeeesssseeeerrrrvvvveeee ccccaaaasssseeee ==== yyyyeeeessss////nnnnoooo
               controls if new files which conform to 8.3 syntax, that
               is all in upper case and of suitable length, are
               created upper case, or if they are forced to be the
               "default" case. This option can be use with "preserve
               case = yes" to permit long filenames to retain their
               case, while short names are lowercased. Default yyyyeeeessss.

          By default, Samba 2.2 has the same semantics as a Windows NT
          server, in that it is case insensitive but case preserving.

     NNNNOOOOTTTTEEEE AAAABBBBOOOOUUUUTTTT UUUUSSSSEEEERRRRNNNNAAAAMMMMEEEE////PPPPAAAASSSSSSSSWWWWOOOORRRRDDDD VVVVAAAALLLLIIIIDDDDAAAATTTTIIIIOOOONNNN
          There are a number of ways in which a user can connect to a
          service. The server uses the following steps in determining
          if it will allow a connection to a specified service. If all
          the steps fail, then the connection request is rejected.
          However, if one of the steps succeeds, then the following
          steps are not checked.

          If the service is marked "guest only = yes" and the server
          is running with share-level security ("security = share")



     Page 8                                          (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          then steps 1 to 5 are skipped.

          1.   If the client has passed a username/password pair and
               that username/password pair is validated by the UNIX
               system's password programs then the connection is made
               as that username. Note that this includes the
               \\server\service%_u_s_e_r_n_a_m_e method of passing a username.

          2.   If the client has previously registered a username with
               the system and now supplies a correct password for that
               username then the connection is allowed.

          3.   The client's NetBIOS name and any previously used user
               names are checked against the supplied password, if
               they match then the connection is allowed as the
               corresponding user.

          4.   If the client has previously validated a
               username/password pair with the server and the client
               has passed the validation token then that username is
               used.

          5.   If a "user = " field is given in the _s_m_b._c_o_n_f file for
               the service and the client has supplied a password, and
               that password matches (according to the UNIX system's
               password checking) with one of the usernames from the
               "user =" field then the connection is made as the
               username in the "user =" line. If one of the username
               in the "user =" list begins with a '@' then that name
               expands to a list of names in the group of the same
               name.

          6.   If the service is a guest service then a connection is
               made as the username given in the "guest account =" for
               the service, irrespective of the supplied password.

     CCCCOOOOMMMMPPPPLLLLEEEETTTTEEEE LLLLIIIISSSSTTTT OOOOFFFF GGGGLLLLOOOOBBBBAAAALLLL PPPPAAAARRRRAAAAMMMMEEEETTTTEEEERRRRSSSS
          Here is a list of all global parameters. See the section of
          each parameter for details. Note that some are synonyms.

          o+ _a_d_d _p_r_i_n_t_e_r _c_o_m_m_a_n_d

          o+ _a_d_d _s_h_a_r_e _c_o_m_m_a_n_d

          o+ _a_d_d _u_s_e_r _s_c_r_i_p_t

          o+ _a_l_l_o_w _t_r_u_s_t_e_d _d_o_m_a_i_n_s

          o+ _a_n_n_o_u_n_c_e _a_s

          o+ _a_n_n_o_u_n_c_e _v_e_r_s_i_o_n




     Page 9                                          (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _a_u_t_o _s_e_r_v_i_c_e_s

          o+ _b_i_n_d _i_n_t_e_r_f_a_c_e_s _o_n_l_y

          o+ _b_r_o_w_s_e _l_i_s_t

          o+ _c_h_a_n_g_e _n_o_t_i_f_y _t_i_m_e_o_u_t

          o+ _c_h_a_n_g_e _s_h_a_r_e _c_o_m_m_a_n_d

          o+ _c_h_a_r_a_c_t_e_r _s_e_t

          o+ _c_l_i_e_n_t _c_o_d_e _p_a_g_e

          o+ _c_o_d_e _p_a_g_e _d_i_r_e_c_t_o_r_y

          o+ _c_o_d_i_n_g _s_y_s_t_e_m

          o+ _c_o_n_f_i_g _f_i_l_e

          o+ _d_e_a_d_t_i_m_e

          o+ _d_e_b_u_g _h_i_r_e_s _t_i_m_e_s_t_a_m_p

          o+ _d_e_b_u_g _p_i_d

          o+ _d_e_b_u_g _t_i_m_e_s_t_a_m_p

          o+ _d_e_b_u_g _u_i_d

          o+ _d_e_b_u_g_l_e_v_e_l

          o+ _d_e_f_a_u_l_t

          o+ _d_e_f_a_u_l_t _s_e_r_v_i_c_e

          o+ _d_e_l_e_t_e _p_r_i_n_t_e_r _c_o_m_m_a_n_d

          o+ _d_e_l_e_t_e _s_h_a_r_e _c_o_m_m_a_n_d

          o+ _d_e_l_e_t_e _u_s_e_r _s_c_r_i_p_t

          o+ _d_f_r_e_e _c_o_m_m_a_n_d

          o+ _d_i_s_a_b_l_e _s_p_o_o_l_s_s

          o+ _d_n_s _p_r_o_x_y

          o+ _d_o_m_a_i_n _a_d_m_i_n _g_r_o_u_p

          o+ _d_o_m_a_i_n _g_u_e_s_t _g_r_o_u_p




     Page 10                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _d_o_m_a_i_n _l_o_g_o_n_s

          o+ _d_o_m_a_i_n _m_a_s_t_e_r

          o+ _e_n_c_r_y_p_t _p_a_s_s_w_o_r_d_s

          o+ _e_n_h_a_n_c_e_d _b_r_o_w_s_i_n_g

          o+ _e_n_u_m_p_o_r_t_s _c_o_m_m_a_n_d

          o+ _g_e_t_w_d _c_a_c_h_e

          o+ _h_i_d_e _l_o_c_a_l _u_s_e_r_s

          o+ _h_i_d_e _u_n_r_e_a_d_a_b_l_e

          o+ _h_o_m_e_d_i_r _m_a_p

          o+ _h_o_s_t _m_s_d_f_s

          o+ _h_o_s_t_s _e_q_u_i_v

          o+ _i_n_t_e_r_f_a_c_e_s

          o+ _k_e_e_p_a_l_i_v_e

          o+ _k_e_r_n_e_l _o_p_l_o_c_k_s

          o+ _l_a_n_m_a_n _a_u_t_h

          o+ _l_a_r_g_e _r_e_a_d_w_r_i_t_e

          o+ _l_d_a_p _a_d_m_i_n _d_n

          o+ _l_d_a_p _f_i_l_t_e_r

          o+ _l_d_a_p _p_o_r_t

          o+ _l_d_a_p _s_e_r_v_e_r

          o+ _l_d_a_p _s_s_l

          o+ _l_d_a_p _s_u_f_f_i_x

          o+ _l_m _a_n_n_o_u_n_c_e

          o+ _l_m _i_n_t_e_r_v_a_l

          o+ _l_o_a_d _p_r_i_n_t_e_r_s

          o+ _l_o_c_a_l _m_a_s_t_e_r




     Page 11                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _l_o_c_k _d_i_r

          o+ _l_o_c_k _d_i_r_e_c_t_o_r_y

          o+ _l_o_c_k _s_p_i_n _c_o_u_n_t

          o+ _l_o_c_k _s_p_i_n _t_i_m_e

          o+ _p_i_d _d_i_r_e_c_t_o_r_y

          o+ _l_o_g _f_i_l_e

          o+ _l_o_g _l_e_v_e_l

          o+ _l_o_g_o_n _d_r_i_v_e

          o+ _l_o_g_o_n _h_o_m_e

          o+ _l_o_g_o_n _p_a_t_h

          o+ _l_o_g_o_n _s_c_r_i_p_t

          o+ _l_p_q _c_a_c_h_e _t_i_m_e

          o+ _m_a_c_h_i_n_e _p_a_s_s_w_o_r_d _t_i_m_e_o_u_t

          o+ _m_a_n_g_l_e_d _s_t_a_c_k

          o+ _m_a_n_g_l_i_n_g _m_e_t_h_o_d

          o+ _m_a_p _t_o _g_u_e_s_t

          o+ _m_a_x _d_i_s_k _s_i_z_e

          o+ _m_a_x _l_o_g _s_i_z_e

          o+ _m_a_x _m_u_x

          o+ _m_a_x _o_p_e_n _f_i_l_e_s

          o+ _m_a_x _p_r_o_t_o_c_o_l

          o+ _m_a_x _s_m_b_d _p_r_o_c_e_s_s_e_s

          o+ _m_a_x _t_t_l

          o+ _m_a_x _w_i_n_s _t_t_l

          o+ _m_a_x _x_m_i_t

          o+ _m_e_s_s_a_g_e _c_o_m_m_a_n_d




     Page 12                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _m_i_n _p_a_s_s_w_d _l_e_n_g_t_h

          o+ _m_i_n _p_a_s_s_w_o_r_d _l_e_n_g_t_h

          o+ _m_i_n _p_r_o_t_o_c_o_l

          o+ _m_i_n _w_i_n_s _t_t_l

          o+ _n_a_m_e _r_e_s_o_l_v_e _o_r_d_e_r

          o+ _n_e_t_b_i_o_s _a_l_i_a_s_e_s

          o+ _n_e_t_b_i_o_s _n_a_m_e

          o+ _n_e_t_b_i_o_s _s_c_o_p_e

          o+ _n_i_s _h_o_m_e_d_i_r

          o+ _n_t _p_i_p_e _s_u_p_p_o_r_t

          o+ _n_t _s_m_b _s_u_p_p_o_r_t

          o+ _n_t _s_t_a_t_u_s _s_u_p_p_o_r_t

          o+ _n_u_l_l _p_a_s_s_w_o_r_d_s

          o+ _o_b_e_y _p_a_m _r_e_s_t_r_i_c_t_i_o_n_s

          o+ _o_p_l_o_c_k _b_r_e_a_k _w_a_i_t _t_i_m_e

          o+ _o_s _l_e_v_e_l

          o+ _o_s_2 _d_r_i_v_e_r _m_a_p

          o+ _p_a_m _p_a_s_s_w_o_r_d _c_h_a_n_g_e

          o+ _p_a_n_i_c _a_c_t_i_o_n

          o+ _p_a_s_s_w_d _c_h_a_t

          o+ _p_a_s_s_w_d _c_h_a_t _d_e_b_u_g

          o+ _p_a_s_s_w_d _p_r_o_g_r_a_m

          o+ _p_a_s_s_w_o_r_d _l_e_v_e_l

          o+ _p_a_s_s_w_o_r_d _s_e_r_v_e_r

          o+ _p_r_e_f_e_r_e_d _m_a_s_t_e_r

          o+ _p_r_e_f_e_r_r_e_d _m_a_s_t_e_r




     Page 13                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _p_r_e_l_o_a_d

          o+ _p_r_i_n_t_c_a_p

          o+ _p_r_i_n_t_c_a_p _n_a_m_e

          o+ _p_r_i_n_t_e_r _d_r_i_v_e_r _f_i_l_e

          o+ _p_r_o_t_o_c_o_l

          o+ _r_e_a_d _b_m_p_x

          o+ _r_e_a_d _r_a_w

          o+ _r_e_a_d _s_i_z_e

          o+ _r_e_m_o_t_e _a_n_n_o_u_n_c_e

          o+ _r_e_m_o_t_e _b_r_o_w_s_e _s_y_n_c

          o+ _r_e_s_t_r_i_c_t _a_n_o_n_y_m_o_u_s

          o+ _r_o_o_t

          o+ _r_o_o_t _d_i_r

          o+ _r_o_o_t _d_i_r_e_c_t_o_r_y

          o+ _s_e_c_u_r_i_t_y

          o+ _s_e_r_v_e_r _s_t_r_i_n_g

          o+ _s_h_o_w _a_d_d _p_r_i_n_t_e_r _w_i_z_a_r_d

          o+ _s_m_b _p_a_s_s_w_d _f_i_l_e

          o+ _s_o_c_k_e_t _a_d_d_r_e_s_s

          o+ _s_o_c_k_e_t _o_p_t_i_o_n_s

          o+ _s_o_u_r_c_e _e_n_v_i_r_o_n_m_e_n_t

          o+ _s_s_l

          o+ _s_s_l _C_A _c_e_r_t_D_i_r

          o+ _s_s_l _C_A _c_e_r_t_F_i_l_e

          o+ _s_s_l _c_i_p_h_e_r_s

          o+ _s_s_l _c_l_i_e_n_t _c_e_r_t




     Page 14                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _s_s_l _c_l_i_e_n_t _k_e_y

          o+ _s_s_l _c_o_m_p_a_t_i_b_i_l_i_t_y

          o+ _s_s_l _e_g_d _s_o_c_k_e_t

          o+ _s_s_l _e_n_t_r_o_p_y _b_y_t_e_s

          o+ _s_s_l _e_n_t_r_o_p_y _f_i_l_e

          o+ _s_s_l _h_o_s_t_s

          o+ _s_s_l _h_o_s_t_s _r_e_s_i_g_n

          o+ _s_s_l _r_e_q_u_i_r_e _c_l_i_e_n_t_c_e_r_t

          o+ _s_s_l _r_e_q_u_i_r_e _s_e_r_v_e_r_c_e_r_t

          o+ _s_s_l _s_e_r_v_e_r _c_e_r_t

          o+ _s_s_l _s_e_r_v_e_r _k_e_y

          o+ _s_s_l _v_e_r_s_i_o_n

          o+ _s_t_a_t _c_a_c_h_e

          o+ _s_t_a_t _c_a_c_h_e _s_i_z_e

          o+ _s_t_r_i_p _d_o_t

          o+ _s_y_s_l_o_g

          o+ _s_y_s_l_o_g _o_n_l_y

          o+ _t_e_m_p_l_a_t_e _h_o_m_e_d_i_r

          o+ _t_e_m_p_l_a_t_e _s_h_e_l_l

          o+ _t_i_m_e _o_f_f_s_e_t

          o+ _t_i_m_e _s_e_r_v_e_r

          o+ _t_i_m_e_s_t_a_m_p _l_o_g_s

          o+ _t_o_t_a_l _p_r_i_n_t _j_o_b_s

          o+ _u_n_i_x _e_x_t_e_n_s_i_o_n_s

          o+ _u_n_i_x _p_a_s_s_w_o_r_d _s_y_n_c

          o+ _u_p_d_a_t_e _e_n_c_r_y_p_t_e_d




     Page 15                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _u_s_e _m_m_a_p

          o+ _u_s_e _r_h_o_s_t_s

          o+ _u_s_e_r_n_a_m_e _l_e_v_e_l

          o+ _u_s_e_r_n_a_m_e _m_a_p

          o+ _u_t_m_p

          o+ _u_t_m_p _d_i_r_e_c_t_o_r_y

          o+ _v_a_l_i_d _c_h_a_r_s

          o+ _w_i_n_b_i_n_d _c_a_c_h_e _t_i_m_e

          o+ _w_i_n_b_i_n_d _e_n_u_m _u_s_e_r_s

          o+ _w_i_n_b_i_n_d _e_n_u_m _g_r_o_u_p_s

          o+ _w_i_n_b_i_n_d _g_i_d

          o+ _w_i_n_b_i_n_d _s_e_p_a_r_a_t_o_r

          o+ _w_i_n_b_i_n_d _u_i_d

          o+ _w_i_n_b_i_n_d _u_s_e _d_e_f_a_u_l_t _d_o_m_a_i_n

          o+ _w_i_n_s _h_o_o_k

          o+ _w_i_n_s _p_r_o_x_y

          o+ _w_i_n_s _s_e_r_v_e_r

          o+ _w_i_n_s _s_u_p_p_o_r_t

          o+ _w_o_r_k_g_r_o_u_p

          o+ _w_r_i_t_e _r_a_w

     CCCCOOOOMMMMPPPPLLLLEEEETTTTEEEE LLLLIIIISSSSTTTT OOOOFFFF SSSSEEEERRRRVVVVIIIICCCCEEEE PPPPAAAARRRRAAAAMMMMEEEETTTTEEEERRRRSSSS
          Here is a list of all service parameters. See the section on
          each parameter for details. Note that some are synonyms.

          o+ _a_d_m_i_n _u_s_e_r_s

          o+ _a_l_l_o_w _h_o_s_t_s

          o+ _a_v_a_i_l_a_b_l_e

          o+ _b_l_o_c_k_i_n_g _l_o_c_k_s




     Page 16                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _b_l_o_c_k _s_i_z_e

          o+ _b_r_o_w_s_a_b_l_e

          o+ _b_r_o_w_s_e_a_b_l_e

          o+ _c_a_s_e _s_e_n_s_i_t_i_v_e

          o+ _c_a_s_e_s_i_g_n_a_m_e_s

          o+ _c_o_m_m_e_n_t

          o+ _c_o_p_y

          o+ _c_r_e_a_t_e _m_a_s_k

          o+ _c_r_e_a_t_e _m_o_d_e

          o+ _c_s_c _p_o_l_i_c_y

          o+ _d_e_f_a_u_l_t _c_a_s_e

          o+ _d_e_f_a_u_l_t _d_e_v_m_o_d_e

          o+ _d_e_l_e_t_e _r_e_a_d_o_n_l_y

          o+ _d_e_l_e_t_e _v_e_t_o _f_i_l_e_s

          o+ _d_e_n_y _h_o_s_t_s

          o+ _d_i_r_e_c_t_o_r_y

          o+ _d_i_r_e_c_t_o_r_y _m_a_s_k

          o+ _d_i_r_e_c_t_o_r_y _m_o_d_e

          o+ _d_i_r_e_c_t_o_r_y _s_e_c_u_r_i_t_y _m_a_s_k

          o+ _d_o_n_t _d_e_s_c_e_n_d

          o+ _d_o_s _f_i_l_e_m_o_d_e

          o+ _d_o_s _f_i_l_e_t_i_m_e _r_e_s_o_l_u_t_i_o_n

          o+ _d_o_s _f_i_l_e_t_i_m_e_s

          o+ _e_x_e_c

          o+ _f_a_k_e _d_i_r_e_c_t_o_r_y _c_r_e_a_t_e _t_i_m_e_s

          o+ _f_a_k_e _o_p_l_o_c_k_s




     Page 17                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _f_o_l_l_o_w _s_y_m_l_i_n_k_s

          o+ _f_o_r_c_e _c_r_e_a_t_e _m_o_d_e

          o+ _f_o_r_c_e _d_i_r_e_c_t_o_r_y _m_o_d_e

          o+ _f_o_r_c_e _d_i_r_e_c_t_o_r_y _s_e_c_u_r_i_t_y _m_o_d_e

          o+ _f_o_r_c_e _g_r_o_u_p

          o+ _f_o_r_c_e _s_e_c_u_r_i_t_y _m_o_d_e

          o+ _f_o_r_c_e _u_n_k_n_o_w_n _a_c_l _u_s_e_r

          o+ _f_o_r_c_e _u_s_e_r

          o+ _f_s_t_y_p_e

          o+ _g_r_o_u_p

          o+ _g_u_e_s_t _a_c_c_o_u_n_t

          o+ _g_u_e_s_t _o_k

          o+ _g_u_e_s_t _o_n_l_y

          o+ _h_i_d_e _d_o_t _f_i_l_e_s

          o+ _h_i_d_e _f_i_l_e_s

          o+ _h_o_s_t_s _a_l_l_o_w

          o+ _h_o_s_t_s _d_e_n_y

          o+ _i_n_c_l_u_d_e

          o+ _i_n_h_e_r_i_t _a_c_l_s

          o+ _i_n_h_e_r_i_t _p_e_r_m_i_s_s_i_o_n_s

          o+ _i_n_v_a_l_i_d _u_s_e_r_s

          o+ _l_e_v_e_l_2 _o_p_l_o_c_k_s

          o+ _l_o_c_k_i_n_g

          o+ _l_p_p_a_u_s_e _c_o_m_m_a_n_d

          o+ _l_p_q _c_o_m_m_a_n_d

          o+ _l_p_r_e_s_u_m_e _c_o_m_m_a_n_d




     Page 18                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _l_p_r_m _c_o_m_m_a_n_d

          o+ _m_a_g_i_c _o_u_t_p_u_t

          o+ _m_a_g_i_c _s_c_r_i_p_t

          o+ _m_a_n_g_l_e _c_a_s_e

          o+ _m_a_n_g_l_e_d _m_a_p

          o+ _m_a_n_g_l_e_d _n_a_m_e_s

          o+ _m_a_n_g_l_i_n_g _c_h_a_r

          o+ _m_a_p _a_r_c_h_i_v_e

          o+ _m_a_p _h_i_d_d_e_n

          o+ _m_a_p _s_y_s_t_e_m

          o+ _m_a_x _c_o_n_n_e_c_t_i_o_n_s

          o+ _m_a_x _p_r_i_n_t _j_o_b_s

          o+ _m_i_n _p_r_i_n_t _s_p_a_c_e

          o+ _m_s_d_f_s _r_o_o_t

          o+ _n_t _a_c_l _s_u_p_p_o_r_t

          o+ _o_n_l_y _g_u_e_s_t

          o+ _o_n_l_y _u_s_e_r

          o+ _o_p_l_o_c_k _c_o_n_t_e_n_t_i_o_n _l_i_m_i_t

          o+ _o_p_l_o_c_k_s

          o+ _p_a_t_h

          o+ _p_o_s_i_x _l_o_c_k_i_n_g

          o+ _p_o_s_t_e_x_e_c

          o+ _p_o_s_t_s_c_r_i_p_t

          o+ _p_r_e_e_x_e_c

          o+ _p_r_e_e_x_e_c _c_l_o_s_e

          o+ _p_r_e_s_e_r_v_e _c_a_s_e




     Page 19                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _p_r_i_n_t _c_o_m_m_a_n_d

          o+ _p_r_i_n_t _o_k

          o+ _p_r_i_n_t_a_b_l_e

          o+ _p_r_i_n_t_e_r

          o+ _p_r_i_n_t_e_r _a_d_m_i_n

          o+ _p_r_i_n_t_e_r _d_r_i_v_e_r

          o+ _p_r_i_n_t_e_r _d_r_i_v_e_r _l_o_c_a_t_i_o_n

          o+ _p_r_i_n_t_e_r _n_a_m_e

          o+ _p_r_i_n_t_i_n_g

          o+ _p_r_o_f_i_l_e _a_c_l_s

          o+ _p_u_b_l_i_c

          o+ _q_u_e_u_e_p_a_u_s_e _c_o_m_m_a_n_d

          o+ _q_u_e_u_e_r_e_s_u_m_e _c_o_m_m_a_n_d

          o+ _r_e_a_d _l_i_s_t

          o+ _r_e_a_d _o_n_l_y

          o+ _r_o_o_t _p_o_s_t_e_x_e_c

          o+ _r_o_o_t _p_r_e_e_x_e_c

          o+ _r_o_o_t _p_r_e_e_x_e_c _c_l_o_s_e

          o+ _s_e_c_u_r_i_t_y _m_a_s_k

          o+ _s_e_t _d_i_r_e_c_t_o_r_y

          o+ _s_h_a_r_e _m_o_d_e_s

          o+ _s_h_o_r_t _p_r_e_s_e_r_v_e _c_a_s_e

          o+ _s_t_a_t_u_s

          o+ _s_t_r_i_c_t _a_l_l_o_c_a_t_e

          o+ _s_t_r_i_c_t _l_o_c_k_i_n_g

          o+ _s_t_r_i_c_t _s_y_n_c




     Page 20                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          o+ _s_y_n_c _a_l_w_a_y_s

          o+ _u_s_e _c_l_i_e_n_t _d_r_i_v_e_r

          o+ _u_s_e _s_e_n_d_f_i_l_e

          o+ _u_s_e_r

          o+ _u_s_e_r_n_a_m_e

          o+ _u_s_e_r_s

          o+ _v_a_l_i_d _u_s_e_r_s

          o+ _v_e_t_o _f_i_l_e_s

          o+ _v_e_t_o _o_p_l_o_c_k _f_i_l_e_s

          o+ _v_f_s _o_b_j_e_c_t

          o+ _v_f_s _o_p_t_i_o_n_s

          o+ _v_o_l_u_m_e

          o+ _w_i_d_e _l_i_n_k_s

          o+ _w_r_i_t_a_b_l_e

          o+ _w_r_i_t_e _c_a_c_h_e _s_i_z_e

          o+ _w_r_i_t_e _l_i_s_t

          o+ _w_r_i_t_e _o_k

          o+ _w_r_i_t_e_a_b_l_e

     EEEEXXXXPPPPLLLLAAAANNNNAAAATTTTIIIIOOOONNNN OOOOFFFF EEEEAAAACCCCHHHH PPPPAAAARRRRAAAAMMMMEEEETTTTEEEERRRR
          aaaadddddddd pppprrrriiiinnnntttteeeerrrr ccccoooommmmmmmmaaaannnndddd ((((GGGG))))
               With the introduction of MS-RPC based printing support
               for Windows NT/2000 clients in Samba 2.2, The MS Add
               Printer Wizard (APW) icon is now also available in the
               "Printers..." folder displayed a share listing. The APW
               allows for printers to be add remotely to a Samba or
               Windows NT/2000 print server.

               For a Samba host this means that the printer must be
               physically added to the underlying printing system. The
               _a_d_d _p_r_i_n_t_e_r _c_o_m_m_a_n_d defines a script to be run which
               will perform the necessary operations for adding the
               printer to the print system and to add the appropriate
               service definition to the _s_m_b._c_o_n_f file in order that
               it can be shared by ssssmmmmbbbbdddd((((8888))))



     Page 21                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               The _a_d_d _p_r_i_n_t_e_r _c_o_m_m_a_n_d is automatically invoked with
               the following parameter (in order:

               o+ _p_r_i_n_t_e_r _n_a_m_e

               o+ _s_h_a_r_e _n_a_m_e

               o+ _p_o_r_t _n_a_m_e

               o+ _d_r_i_v_e_r _n_a_m_e

               o+ _l_o_c_a_t_i_o_n

               o+ _W_i_n_d_o_w_s _9_x _d_r_i_v_e_r _l_o_c_a_t_i_o_n

          All parameters are filled in from the PRINTER_INFO_2
          structure sent by the Windows NT/2000 client with one
          exception. The "Windows 9x driver location" parameter is
          included for backwards compatibility only. The remaining
          fields in the structure are generated from answers to the
          APW questions.

          Once the _a_d_d _p_r_i_n_t_e_r _c_o_m_m_a_n_d has been executed, ssssmmmmbbbbdddd will
          reparse the  _s_m_b._c_o_n_f to determine if the share defined by
          the APW exists. If the sharename is still invalid, then ssssmmmmbbbbdddd
          will return an ACCESS_DENIED error to the client.

          See also  _d_e_l_e_t_e _p_r_i_n_t_e_r _c_o_m_m_a_n_d, _p_r_i_n_t_i_n_g, _s_h_o_w _a_d_d _p_r_i_n_t_e_r
          _w_i_z_a_r_d

          Default: nnnnoooonnnneeee

          Example: aaaaddddddddpppprrrriiiinnnntttteeeerrrr ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////bbbbiiiinnnn////aaaaddddddddpppprrrriiiinnnntttteeeerrrr

          aaaadddddddd sssshhhhaaaarrrreeee ccccoooommmmmmmmaaaannnndddd ((((GGGG))))
               Samba 2.2.0 introduced the ability to dynamically add
               and delete shares via the Windows NT 4.0 Server
               Manager. The _a_d_d _s_h_a_r_e _c_o_m_m_a_n_d is used to define an
               external program or script which will add a new service
               definition to _s_m_b._c_o_n_f. In order to successfully
               execute the _a_d_d _s_h_a_r_e _c_o_m_m_a_n_d, ssssmmmmbbbbdddd requires that the
               administrator be connected using a root account (i.e.
               uid == 0).

               When executed, ssssmmmmbbbbdddd will automatically invoke the _a_d_d
               _s_h_a_r_e _c_o_m_m_a_n_d with four parameters.

               o+ _c_o_n_f_i_g_F_i_l_e - the location of the global _s_m_b._c_o_n_f
                 file.

               o+ _s_h_a_r_e_N_a_m_e - the name of the new share.




     Page 22                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               o+ _p_a_t_h_N_a_m_e - path to an **existing** directory on disk.

               o+ _c_o_m_m_e_n_t - comment string to associate with the new
                 share.

          This parameter is only used for add file shares. To add
          printer shares, see the _a_d_d _p_r_i_n_t_e_r _c_o_m_m_a_n_d.

          See also _c_h_a_n_g_e _s_h_a_r_e _c_o_m_m_a_n_d, _d_e_l_e_t_e _s_h_a_r_e _c_o_m_m_a_n_d.

          Default: nnnnoooonnnneeee

          Example: aaaadddddddd sssshhhhaaaarrrreeee ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////llllooooccccaaaallll////bbbbiiiinnnn////aaaaddddddddsssshhhhaaaarrrreeee

          aaaadddddddd uuuusssseeeerrrr ssssccccrrrriiiipppptttt ((((GGGG))))
               This is the full pathname to a script that will be run
               AAAASSSS RRRROOOOOOOOTTTT by smbd(8)
                under special circumstances described below.

               Normally, a Samba server requires that UNIX users are
               created for all users accessing files on this server.
               For sites that use Windows NT account databases as
               their primary user database creating these users and
               keeping the user list in sync with the Windows NT PDC
               is an onerous task. This option allows smbd to create
               the required UNIX users OOOONNNN DDDDEEEEMMMMAAAANNNNDDDD when a user accesses
               the Samba server.

               In order to use this option, smbd must NNNNOOOOTTTT be set to
               _s_e_c_u_r_i_t_y = _s_h_a_r_e and _a_d_d _u_s_e_r _s_c_r_i_p_t must be set to a
               full pathname for a script that will create a UNIX user
               given one argument of %_u, which expands into the UNIX
               user name to create.

               When the Windows user attempts to access the Samba
               server, at login (session setup in the SMB protocol)
               time,  smbd contacts the _p_a_s_s_w_o_r_d _s_e_r_v_e_r and attempts
               to authenticate the given user with the given password.
               If the authentication succeeds then ssssmmmmbbbbdddd attempts to
               find a UNIX user in the UNIX password database to map
               the Windows user into. If this lookup fails, and _a_d_d
               _u_s_e_r _s_c_r_i_p_t is set then ssssmmmmbbbbdddd will call the specified
               script AAAASSSS RRRROOOOOOOOTTTT, expanding any %_u argument to be the
               user name to create.

               If this script successfully creates the user then ssssmmmmbbbbdddd
               will continue on as though the UNIX user already
               existed. In this way, UNIX users are dynamically
               created to match existing Windows NT accounts.

               See also  _s_e_c_u_r_i_t_y,  _p_a_s_s_w_o_r_d _s_e_r_v_e_r, _d_e_l_e_t_e _u_s_e_r
               _s_c_r_i_p_t.



     Page 23                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: aaaadddddddd uuuusssseeeerrrr ssssccccrrrriiiipppptttt ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               Example: aaaadddddddd uuuusssseeeerrrr ssssccccrrrriiiipppptttt ====
               ////uuuussssrrrr////llllooooccccaaaallll////ssssaaaammmmbbbbaaaa////bbbbiiiinnnn////aaaadddddddd____uuuusssseeeerrrr %%%%uuuu

          aaaaddddmmmmiiiinnnn uuuusssseeeerrrrssss ((((SSSS))))
               This is a list of users who will be granted
               administrative privileges on the share. This means that
               they will do all file operations as the super-user
               (root).

               You should use this option very carefully, as any user
               in this list will be able to do anything they like on
               the share, irrespective of file permissions.

               Default: nnnnoooo aaaaddddmmmmiiiinnnn uuuusssseeeerrrrssss

               Example: aaaaddddmmmmiiiinnnn uuuusssseeeerrrrssss ==== jjjjaaaassssoooonnnn

          aaaalllllllloooowwww hhhhoooossssttttssss ((((SSSS))))
               Synonym for  _h_o_s_t_s _a_l_l_o_w.

          aaaalllllllloooowwww ttttrrrruuuusssstttteeeedddd ddddoooommmmaaaaiiiinnnnssss ((((GGGG))))
               This option only takes effect when the _s_e_c_u_r_i_t_y option
               is set to server or domain. If it is set to no, then
               attempts to connect to a resource from a domain or
               workgroup other than the one which smbd is running in
               will fail, even if that domain is trusted by the remote
               server doing the authentication.

               This is useful if you only want your Samba server to
               serve resources to users in the domain it is a member
               of. As an example, suppose that there are two domains
               DOMA and DOMB. DOMB is trusted by DOMA, which contains
               the Samba server. Under normal circumstances, a user
               with an account in DOMB can then access the resources
               of a UNIX account with the same account name on the
               Samba server even if they do not have an account in
               DOMA. This can make implementing a security boundary
               difficult.

               Default: aaaalllllllloooowwww ttttrrrruuuusssstttteeeedddd ddddoooommmmaaaaiiiinnnnssss ==== yyyyeeeessss

          aaaannnnnnnnoooouuuunnnncccceeee aaaassss ((((GGGG))))
               This specifies what type of server nnnnmmmmbbbbdddd will announce
               itself as, to a network neighborhood browse list. By
               default this is set to Windows NT. The valid options
               are : "NT Server" (which can also be written as "NT"),
               "NT Workstation", "Win95" or "WfW" meaning Windows NT
               Server, Windows NT Workstation, Windows 95 and Windows
               for Workgroups respectively. Do not change this
               parameter unless you have a specific need to stop Samba



     Page 24                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               appearing as an NT server as this may prevent Samba
               servers from participating as browser servers
               correctly.

               Default: aaaannnnnnnnoooouuuunnnncccceeee aaaassss ==== NNNNTTTT SSSSeeeerrrrvvvveeeerrrr

               Example: aaaannnnnnnnoooouuuunnnncccceeee aaaassss ==== WWWWiiiinnnn99995555

          aaaannnnnnnnoooouuuunnnncccceeee vvvveeeerrrrssssiiiioooonnnn ((((GGGG))))
               This specifies the major and minor version numbers that
               nmbd will use when announcing itself as a server. The
               default is 4.5. Do not change this parameter unless you
               have a specific need to set a Samba server to be a
               downlevel server.

               Default: aaaannnnnnnnoooouuuunnnncccceeee vvvveeeerrrrssssiiiioooonnnn ==== 4444....5555

               Example: aaaannnnnnnnoooouuuunnnncccceeee vvvveeeerrrrssssiiiioooonnnn ==== 2222....0000

          aaaauuuuttttoooo sssseeeerrrrvvvviiiicccceeeessss ((((GGGG))))
               This is a synonym for the  _p_r_e_l_o_a_d.

          aaaavvvvaaaaiiiillllaaaabbbblllleeee ((((SSSS))))
               This parameter lets you "turn off" a service. If
               _a_v_a_i_l_a_b_l_e = _n_o, then AAAALLLLLLLL attempts to connect to the
               service will fail. Such failures are logged.

               Default: aaaavvvvaaaaiiiillllaaaabbbblllleeee ==== yyyyeeeessss

          bbbbiiiinnnndddd iiiinnnntttteeeerrrrffffaaaacccceeeessss oooonnnnllllyyyy ((((GGGG))))
               This global parameter allows the Samba admin to limit
               what interfaces on a machine will serve SMB requests.
               If affects file service smbd(8) and name service
               nmbd(8) in slightly different ways.

               For name service it causes nnnnmmmmbbbbdddd to bind to ports 137
               and 138 on the interfaces listed in the interfaces
               parameter. nnnnmmmmbbbbdddd also binds to the "all addresses"
               interface (0.0.0.0) on ports 137 and 138 for the
               purposes of reading broadcast messages. If this option
               is not set then nnnnmmmmbbbbdddd will service name requests on all
               of these sockets. If _b_i_n_d _i_n_t_e_r_f_a_c_e_s _o_n_l_y is set then
               nnnnmmmmbbbbdddd will check the source address of any packets
               coming in on the broadcast sockets and discard any that
               don't match the broadcast addresses of the interfaces
               in the _i_n_t_e_r_f_a_c_e_s parameter list. As unicast packets
               are received on the other sockets it allows nnnnmmmmbbbbdddd to
               refuse to serve names to machines that send packets
               that arrive through any interfaces not listed in the
               _i_n_t_e_r_f_a_c_e_s list. IP Source address spoofing does defeat
               this simple check, however so it must not be used
               seriously as a security feature for nnnnmmmmbbbbdddd.



     Page 25                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               For file service it causes smbd(8) to bind only to the
               interface list given in the  interfaces parameter. This
               restricts the networks that ssssmmmmbbbbdddd will serve to packets
               coming in those interfaces. Note that you should not
               use this parameter for machines that are serving PPP or
               other intermittent or non-broadcast network interfaces
               as it will not cope with non-permanent interfaces.

               If _b_i_n_d _i_n_t_e_r_f_a_c_e_s _o_n_l_y is set then unless the network
               address 111122227777....0000....0000....1111 is added to the _i_n_t_e_r_f_a_c_e_s parameter
               list ssssmmmmbbbbppppaaaasssssssswwwwdddd((((8888)))) and sssswwwwaaaatttt((((8888)))) may not work as expected
               due to the reasons covered below.

               To change a users SMB password, the ssssmmmmbbbbppppaaaasssssssswwwwdddd by
               default connects to the llllooooccccaaaallllhhhhoooosssstttt ---- 111122227777....0000....0000....1111 address
               as an SMB client to issue the password change request.
               If _b_i_n_d _i_n_t_e_r_f_a_c_e_s _o_n_l_y is set then unless the network
               address 111122227777....0000....0000....1111 is added to the _i_n_t_e_r_f_a_c_e_s parameter
               list then  ssssmmmmbbbbppppaaaasssssssswwwwdddd will fail to connect in it's
               default mode. ssssmmmmbbbbppppaaaasssssssswwwwdddd can be forced to use the
               primary IP interface of the local host by using its  -_r
               _r_e_m_o_t_e _m_a_c_h_i_n_e
                parameter, with _r_e_m_o_t_e _m_a_c_h_i_n_e set to the IP name of
               the primary interface of the local host.

               The sssswwwwaaaatttt status page tries to connect with ssssmmmmbbbbdddd and
               nnnnmmmmbbbbdddd at the address 111122227777....0000....0000....1111 to determine if they are
               running. Not adding 111122227777....0000....0000....1111 will cause  ssssmmmmbbbbdddd and nnnnmmmmbbbbdddd
               to always show "not running" even if they really are.
               This can prevent  sssswwwwaaaatttt from
               starting/stopping/restarting ssssmmmmbbbbdddd and nnnnmmmmbbbbdddd.

               Default: bbbbiiiinnnndddd iiiinnnntttteeeerrrrffffaaaacccceeeessss oooonnnnllllyyyy ==== nnnnoooo

          bbbblllloooocccckkkk ssssiiiizzzzeeee ((((SSSS))))
               This parameter controls the behavior of smbd(8) when
               reporting disk free sizes.  By default, this reports a
               disk block size of 1024 bytes.

               Changing this parameter may have some effect on the
               efficiency of client writes, this is not yet confirmed.
               This parameter was added to allow advanced
               administrators to change it (usually to a higher value)
               and test the effect it has on client write performance
               without re-compiling the code. As this is an
               experimental option it may be removed in a future
               release.

               Changing this option does not change the disk free
               reporting size, just the block size unit reported to
               the client.




     Page 26                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: bbbblllloooocccckkkk ssssiiiizzzzeeee ==== 1111000022224444

               Example: bbbblllloooocccckkkk ssssiiiizzzzeeee ==== 66665555555533336666

          bbbblllloooocccckkkkiiiinnnngggg lllloooocccckkkkssss ((((SSSS))))
               This parameter controls the behavior of smbd(8) when
               given a request by a client to obtain a byte range lock
               on a region of an open file, and the request has a time
               limit associated with it.

               If this parameter is set and the lock range requested
               cannot be immediately satisfied, Samba 2.2 will
               internally queue the lock request, and periodically
               attempt to obtain the lock until the timeout period
               expires.

               If this parameter is set to no, then Samba 2.2 will
               behave as previous versions of Samba would and will
               fail the lock request immediately if the lock range
               cannot be obtained.

               Default: bbbblllloooocccckkkkiiiinnnngggg lllloooocccckkkkssss ==== yyyyeeeessss

          bbbbrrrroooowwwwssssaaaabbbblllleeee ((((SSSS))))
               See the  _b_r_o_w_s_e_a_b_l_e.

          bbbbrrrroooowwwwsssseeee lllliiiisssstttt ((((GGGG))))
               This controls whether  ssssmmmmbbbbdddd((((8888)))) will serve a browse list
               to a client doing a NNNNeeeettttSSSSeeeerrrrvvvveeeerrrrEEEEnnnnuuuummmm call. Normally set to
               yes. You should never need to change this.

               Default: bbbbrrrroooowwwwsssseeee lllliiiisssstttt ==== yyyyeeeessss

          bbbbrrrroooowwwwsssseeeeaaaabbbblllleeee ((((SSSS))))
               This controls whether this share is seen in the list of
               available shares in a net view and in the browse list.

               Default: bbbbrrrroooowwwwsssseeeeaaaabbbblllleeee ==== yyyyeeeessss

          ccccaaaasssseeee sssseeeennnnssssiiiittttiiiivvvveeee ((((SSSS))))
               See the discussion in the section NAME MANGLING.

               Default: ccccaaaasssseeee sssseeeennnnssssiiiittttiiiivvvveeee ==== nnnnoooo

          ccccaaaasssseeeessssiiiiggggnnnnaaaammmmeeeessss ((((SSSS))))
               Synonym for case sensitive.

          cccchhhhaaaannnnggggeeee nnnnoooottttiiiiffffyyyy ttttiiiimmmmeeeeoooouuuutttt ((((GGGG))))
               This SMB allows a client to tell a server to "watch" a
               particular directory for any changes and only reply to
               the SMB request when a change has occurred. Such
               constant scanning of a directory is expensive under



     Page 27                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               UNIX, hence an  ssssmmmmbbbbdddd((((8888)))) daemon only performs such a
               scan on each requested directory once every _c_h_a_n_g_e
               _n_o_t_i_f_y _t_i_m_e_o_u_t seconds.

               Default: cccchhhhaaaannnnggggeeee nnnnoooottttiiiiffffyyyy ttttiiiimmmmeeeeoooouuuutttt ==== 66660000

               Example: cccchhhhaaaannnnggggeeee nnnnoooottttiiiiffffyyyy ttttiiiimmmmeeeeoooouuuutttt ==== 333300000000

               Would change the scan time to every 5 minutes.

          cccchhhhaaaannnnggggeeee sssshhhhaaaarrrreeee ccccoooommmmmmmmaaaannnndddd ((((GGGG))))
               Samba 2.2.0 introduced the ability to dynamically add
               and delete shares via the Windows NT 4.0 Server
               Manager. The _c_h_a_n_g_e _s_h_a_r_e _c_o_m_m_a_n_d is used to define an
               external program or script which will modify an
               existing service definition in _s_m_b._c_o_n_f. In order to
               successfully execute the _c_h_a_n_g_e _s_h_a_r_e _c_o_m_m_a_n_d, ssssmmmmbbbbdddd
               requires that the administrator be connected using a
               root account (i.e. uid == 0).

               When executed, ssssmmmmbbbbdddd will automatically invoke the
               _c_h_a_n_g_e _s_h_a_r_e _c_o_m_m_a_n_d with four parameters.

               o+ _c_o_n_f_i_g_F_i_l_e - the location of the global _s_m_b._c_o_n_f
                 file.

               o+ _s_h_a_r_e_N_a_m_e - the name of the new share.

               o+ _p_a_t_h_N_a_m_e - path to an **existing** directory on disk.

               o+ _c_o_m_m_e_n_t - comment string to associate with the new
                 share.

          This parameter is only used modify existing file shares
          definitions. To modify printer shares, use the "Printers..."
          folder as seen when browsing the Samba host.

          See also _a_d_d _s_h_a_r_e _c_o_m_m_a_n_d, _d_e_l_e_t_e _s_h_a_r_e _c_o_m_m_a_n_d.

          Default: nnnnoooonnnneeee

          Example: cccchhhhaaaannnnggggeeee sssshhhhaaaarrrreeee ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////llllooooccccaaaallll////bbbbiiiinnnn////aaaaddddddddsssshhhhaaaarrrreeee

          cccchhhhaaaarrrraaaacccctttteeeerrrr sssseeeetttt ((((GGGG))))
               This allows smbd to map incoming filenames from a DOS
               Code page (see the client code page parameter) to
               several built in UNIX character sets. The built in code
               page translations are:

               o+ ISO8859-1 : Western European UNIX character set. The
                 parameter _c_l_i_e_n_t _c_o_d_e _p_a_g_e MMMMUUUUSSSSTTTT be set to code page
                 850 if the _c_h_a_r_a_c_t_e_r _s_e_t parameter is set to



     Page 28                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



                 ISO8859-1 in order for the conversion to the UNIX
                 character set to be done correctly.

               o+ ISO8859-2 : Eastern European UNIX character set. The
                 parameter _c_l_i_e_n_t _c_o_d_e _p_a_g_e MMMMUUUUSSSSTTTT be set to code page
                 852 if the  _c_h_a_r_a_c_t_e_r _s_e_t parameter is set to
                 ISO8859-2 in order for the conversion to the UNIX
                 character set to be done correctly.

               o+ ISO8859-5 : Russian Cyrillic UNIX character set. The
                 parameter _c_l_i_e_n_t _c_o_d_e _p_a_g_e MMMMUUUUSSSSTTTT be set to code page
                 866 if the _c_h_a_r_a_c_t_e_r _s_e_t  parameter is set to
                 ISO8859-5 in order for the conversion to the UNIX
                 character set to be done correctly.

               o+ ISO8859-7 : Greek UNIX character set. The parameter
                 _c_l_i_e_n_t _c_o_d_e _p_a_g_e MMMMUUUUSSSSTTTT be set to code page 737 if the
                 _c_h_a_r_a_c_t_e_r _s_e_t parameter is set to ISO8859-7 in order
                 for the conversion to the UNIX character set to be
                 done correctly.

               o+ KOI8-R : Alternate mapping for Russian Cyrillic UNIX
                 character set. The parameter _c_l_i_e_n_t _c_o_d_e _p_a_g_e MMMMUUUUSSSSTTTT be
                 set to code page 866 if the _c_h_a_r_a_c_t_e_r _s_e_t parameter
                 is set to KOI8-R in order for the conversion to the
                 UNIX character set to be done correctly.

          BBBBUUUUGGGG. These MSDOS code page to UNIX character set mappings
          should be dynamic, like the loading of MS DOS code pages,
          not static.

          Normally this parameter is not set, meaning no filename
          translation is done.

          Default: cccchhhhaaaarrrraaaacccctttteeeerrrr sssseeeetttt ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

          Example: cccchhhhaaaarrrraaaacccctttteeeerrrr sssseeeetttt ==== IIIISSSSOOOO8888888855559999----1111

          cccclllliiiieeeennnntttt ccccooooddddeeee ppppaaaaggggeeee ((((GGGG))))
               This parameter specifies the DOS code page that the
               clients accessing Samba are using. To determine what
               code page a Windows or DOS client is using, open a DOS
               command prompt and type the command cccchhhhccccpppp. This will
               output the code page. The default for USA MS-DOS,
               Windows 95, and Windows NT releases is code page 437.
               The default for western European releases of the above
               operating systems is code page 850.

               This parameter tells smbd(8) which of the _c_o_d_e_p_a_g_e._X_X_X
               files to dynamically load on startup. These files,
               described more fully in the manual page
               mmmmaaaakkkkeeee____ssssmmmmbbbbccccooooddddeeeeppppaaaaggggeeee((((1111)))) tell  ssssmmmmbbbbdddd how to map lower to



     Page 29                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               upper case characters to provide the case insensitivity
               of filenames that Windows clients expect.

               Samba currently ships with the following code page
               files :

               o+ Code Page 437 - MS-DOS Latin US

               o+ Code Page 737 - Windows '95 Greek

               o+ Code Page 850 - MS-DOS Latin 1

               o+ Code Page 852 - MS-DOS Latin 2

               o+ Code Page 861 - MS-DOS Icelandic

               o+ Code Page 866 - MS-DOS Cyrillic

               o+ Code Page 932 - MS-DOS Japanese SJIS

               o+ Code Page 936 - MS-DOS Simplified Chinese

               o+ Code Page 949 - MS-DOS Korean Hangul

               o+ Code Page 950 - MS-DOS Traditional Chinese

          Thus this parameter may have any of the values 437, 737,
          850, 852, 861, 932, 936, 949, or 950. If you don't find the
          codepage you need, read the comments in one of the other
          codepage files and the mmmmaaaakkkkeeee____ssssmmmmbbbbccccooooddddeeeeppppaaaaggggeeee((((1111)))) man page and
          write one. Please remember to donate it back to the Samba
          user community.

          This parameter co-operates with the _v_a_l_i_d _c_h_a_r_s parameter in
          determining what characters are valid in filenames and how
          capitalization is done. If you set both this parameter and
          the _v_a_l_i_d _c_h_a_r_s parameter the _c_l_i_e_n_t _c_o_d_e _p_a_g_e parameter
          MMMMUUUUSSSSTTTT be set before the _v_a_l_i_d _c_h_a_r_s parameter in the _s_m_b._c_o_n_f
          file. The _v_a_l_i_d _c_h_a_r_s string will then augment the character
          settings in the _c_l_i_e_n_t _c_o_d_e _p_a_g_e parameter.

          If not set, _c_l_i_e_n_t _c_o_d_e _p_a_g_e defaults to 850.

          See also : _v_a_l_i_d _c_h_a_r_s,  _c_o_d_e _p_a_g_e _d_i_r_e_c_t_o_r_y

          Default: cccclllliiiieeeennnntttt ccccooooddddeeee ppppaaaaggggeeee ==== 888855550000

          Example: cccclllliiiieeeennnntttt ccccooooddddeeee ppppaaaaggggeeee ==== 999933336666

          ccccooooddddeeee ppppaaaaggggeeee ddddiiiirrrreeeeccccttttoooorrrryyyy ((((GGGG))))
               Define the location of the various client code page
               files.



     Page 30                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               See also _c_l_i_e_n_t _c_o_d_e _p_a_g_e

               Default: ccccooooddddeeee ppppaaaaggggeeee ddddiiiirrrreeeeccccttttoooorrrryyyy ==== $$$${{{{pppprrrreeeeffffiiiixxxx}}}}////lllliiiibbbb////ccccooooddddeeeeppppaaaaggggeeeessss

               Example: ccccooooddddeeee ppppaaaaggggeeee ddddiiiirrrreeeeccccttttoooorrrryyyy ====
               ////uuuussssrrrr////sssshhhhaaaarrrreeee////ssssaaaammmmbbbbaaaa////ccccooooddddeeeeppppaaaaggggeeeessss

          ccccooooddddiiiinnnngggg ssssyyyysssstttteeeemmmm ((((GGGG))))
               This parameter is used to determine how incoming
               Shift-JIS Japanese characters are mapped from the
               incoming _c_l_i_e_n_t _c_o_d_e _p_a_g_e used by the client, into file
               names in the UNIX filesystem. Only useful if _c_l_i_e_n_t
               _c_o_d_e _p_a_g_e is set to 932 (Japanese Shift-JIS). The
               options are :

               o+ SJIS - Shift-JIS. Does no conversion of the incoming
                 filename.

               o+ JIS8, J8BB, J8BH, J8@B, J8@J, J8@H  - Convert from
                 incoming Shift-JIS to eight bit JIS code with
                 different shift-in, shift out codes.

               o+ JIS7, J7BB, J7BH, J7@B, J7@J, J7@H  - Convert from
                 incoming Shift-JIS to seven bit JIS code with
                 different shift-in, shift out codes.

               o+ JUNET, JUBB, JUBH, JU@B, JU@J, JU@H - Convert from
                 incoming Shift-JIS to JUNET code with different
                 shift-in, shift out codes.

               o+ EUC - Convert an incoming Shift-JIS character to EUC
                 code.

               o+ HEX - Convert an incoming Shift-JIS character to a 3
                 byte hex representation, i.e. :AB.

               o+ CAP - Convert an incoming Shift-JIS character to the
                 3 byte hex representation used by the Columbia
                 AppleTalk Program (CAP), i.e. :AB. This is used for
                 compatibility between Samba and CAP.

          Default: ccccooooddddiiiinnnngggg ssssyyyysssstttteeeemmmm ==== <<<<eeeemmmmppppttttyyyy vvvvaaaalllluuuueeee>>>>

          ccccoooommmmmmmmeeeennnntttt ((((SSSS))))
               This is a text field that is seen next to a share when
               a client does a queries the server, either via the
               network neighborhood or via nnnneeeetttt vvvviiiieeeewwww to list what
               shares are available.

               If you want to set the string that is displayed next to
               the machine name then see the  _s_e_r_v_e_r _s_t_r_i_n_g parameter.




     Page 31                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: NNNNoooo ccccoooommmmmmmmeeeennnntttt ssssttttrrrriiiinnnngggg

               Example: ccccoooommmmmmmmeeeennnntttt ==== FFFFrrrreeeedddd''''ssss FFFFiiiilllleeeessss

          ccccoooonnnnffffiiiigggg ffffiiiilllleeee ((((GGGG))))
               This allows you to override the config file to use,
               instead of the default (usually _s_m_b._c_o_n_f). There is a
               chicken and egg problem here as this option is set in
               the config file!

               For this reason, if the name of the config file has
               changed when the parameters are loaded then it will
               reload them from the new config file.

               This option takes the usual substitutions, which can be
               very useful.

               If the config file doesn't exist then it won't be
               loaded (allowing you to special case the config files
               of just a few clients).

               Example: ccccoooonnnnffffiiiigggg ffffiiiilllleeee ==== ////uuuussssrrrr////llllooooccccaaaallll////ssssaaaammmmbbbbaaaa////lllliiiibbbb////ssssmmmmbbbb....ccccoooonnnnffff....%%%%mmmm

          ccccooooppppyyyy ((((SSSS))))
               This parameter allows you to "clone" service entries.
               The specified service is simply duplicated under the
               current service's name. Any parameters specified in the
               current section will override those in the section
               being copied.

               This feature lets you set up a 'template' service and
               create similar services easily. Note that the service
               being copied must occur earlier in the configuration
               file than the service doing the copying.

               Default: nnnnoooo vvvvaaaalllluuuueeee

               Example: ccccooooppppyyyy ==== ooootttthhhheeeerrrrsssseeeerrrrvvvviiiicccceeee

          ccccrrrreeeeaaaatttteeee mmmmaaaasssskkkk ((((SSSS))))
               A synonym for this parameter is _c_r_e_a_t_e _m_o_d_e .

               When a file is created, the necessary permissions are
               calculated according to the mapping from DOS modes to
               UNIX permissions, and the resulting UNIX mode is then
               bit-wise 'AND'ed with this parameter. This parameter
               may be thought of as a bit-wise MASK for the UNIX modes
               of a file. Any bit nnnnooootttt set here will be removed from
               the modes set on a file when it is created.

               The default value of this parameter removes the 'group'
               and 'other' write and execute bits from the UNIX modes.



     Page 32                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Following this Samba will bit-wise 'OR' the UNIX mode
               created from this parameter with the value of the _f_o_r_c_e
               _c_r_e_a_t_e _m_o_d_e parameter which is set to 000 by default.

               This parameter does not affect directory modes. See the
               parameter _d_i_r_e_c_t_o_r_y _m_o_d_e for details.

               See also the _f_o_r_c_e _c_r_e_a_t_e _m_o_d_e parameter for forcing
               particular mode bits to be set on created files. See
               also the  _d_i_r_e_c_t_o_r_y _m_o_d_e parameter for masking mode
               bits on created directories. See also the  _i_n_h_e_r_i_t
               _p_e_r_m_i_s_s_i_o_n_s parameter.

               Note that this parameter does not apply to permissions
               set by Windows NT/2000 ACL editors. If the
               administrator wishes to enforce a mask on access
               control lists also, they need to set the _s_e_c_u_r_i_t_y _m_a_s_k.

               Default: ccccrrrreeeeaaaatttteeee mmmmaaaasssskkkk ==== 0000777744444444

               Example: ccccrrrreeeeaaaatttteeee mmmmaaaasssskkkk ==== 0000777777775555

          ccccrrrreeeeaaaatttteeee mmmmooooddddeeee ((((SSSS))))
               This is a synonym for  _c_r_e_a_t_e _m_a_s_k.

          ccccsssscccc ppppoooolllliiiiccccyyyy ((((SSSS))))
               This stands for cccclllliiiieeeennnntttt----ssssiiiiddddeeee ccccaaaacccchhhhiiiinnnngggg ppppoooolllliiiiccccyyyy, and
               specifies how clients capable of offline caching will
               cache the files in the share. The valid values are:
               manual, documents, programs, disable.

               These values correspond to those used on Windows
               servers.

               For example, shares containing roaming profiles can
               have offline caching disabled using ccccsssscccc ppppoooolllliiiiccccyyyy ====
               ddddiiiissssaaaabbbblllleeee .

               Default: ccccsssscccc ppppoooolllliiiiccccyyyy ==== mmmmaaaannnnuuuuaaaallll

               Example: ccccsssscccc ppppoooolllliiiiccccyyyy ==== pppprrrrooooggggrrrraaaammmmssss

          ddddeeeeaaaaddddttttiiiimmmmeeee ((((GGGG))))
               The value of the parameter (a decimal integer)
               represents the number of minutes of inactivity before a
               connection is considered dead, and it is disconnected.
               The deadtime only takes effect if the number of open
               files is zero.

               This is useful to stop a server's resources being
               exhausted by a large number of inactive connections.




     Page 33                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Most clients have an auto-reconnect feature when a
               connection is broken so in most cases this parameter
               should be transparent to users.

               Using this parameter with a timeout of a few minutes is
               recommended for most systems.

               A deadtime of zero indicates that no auto-disconnection
               should be performed.

               Default: ddddeeeeaaaaddddttttiiiimmmmeeee ==== 0000

               Example: ddddeeeeaaaaddddttttiiiimmmmeeee ==== 11115555

          ddddeeeebbbbuuuugggg hhhhiiiirrrreeeessss ttttiiiimmmmeeeessssttttaaaammmmpppp ((((GGGG))))
               Sometimes the timestamps in the log messages are needed
               with a resolution of higher that seconds, this boolean
               parameter adds microsecond resolution to the timestamp
               message header when turned on.

               Note that the parameter  _d_e_b_u_g _t_i_m_e_s_t_a_m_p must be on for
               this to have an effect.

               Default: ddddeeeebbbbuuuugggg hhhhiiiirrrreeeessss ttttiiiimmmmeeeessssttttaaaammmmpppp ==== nnnnoooo

          ddddeeeebbbbuuuugggg ppppiiiidddd ((((GGGG))))
               When using only one log file for more then one forked
               smbdprocess there may be hard to follow which process
               outputs which message. This boolean parameter is adds
               the process-id to the timestamp message headers in the
               logfile when turned on.

               Note that the parameter  _d_e_b_u_g _t_i_m_e_s_t_a_m_p must be on for
               this to have an effect.

               Default: ddddeeeebbbbuuuugggg ppppiiiidddd ==== nnnnoooo

          ddddeeeebbbbuuuugggg ttttiiiimmmmeeeessssttttaaaammmmpppp ((((GGGG))))
               Samba 2.2 debug log messages are timestamped by
               default. If you are running at a high  _d_e_b_u_g _l_e_v_e_l
               these timestamps can be distracting. This boolean
               parameter allows timestamping to be turned off.

               Default: ddddeeeebbbbuuuugggg ttttiiiimmmmeeeessssttttaaaammmmpppp ==== yyyyeeeessss

          ddddeeeebbbbuuuugggg uuuuiiiidddd ((((GGGG))))
               Samba is sometimes run as root and sometime run as the
               connected user, this boolean parameter inserts the
               current euid, egid, uid and gid to the timestamp
               message headers in the log file if turned on.

               Note that the parameter  _d_e_b_u_g _t_i_m_e_s_t_a_m_p must be on for



     Page 34                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               this to have an effect.

               Default: ddddeeeebbbbuuuugggg uuuuiiiidddd ==== nnnnoooo

          ddddeeeebbbbuuuugggglllleeeevvvveeeellll ((((GGGG))))
               Synonym for  _l_o_g _l_e_v_e_l.

          ddddeeeeffffaaaauuuulllltttt ((((GGGG))))
               A synonym for  _d_e_f_a_u_l_t _s_e_r_v_i_c_e.

          ddddeeeeffffaaaauuuulllltttt ccccaaaasssseeee ((((SSSS))))
               See the section on  NAME MANGLING. Also note the  _s_h_o_r_t
               _p_r_e_s_e_r_v_e _c_a_s_e parameter.

               Default: ddddeeeeffffaaaauuuulllltttt ccccaaaasssseeee ==== lllloooowwwweeeerrrr

          ddddeeeeffffaaaauuuulllltttt ddddeeeevvvvmmmmooooddddeeee ((((SSSS))))
               This parameter is only applicable to printable
               services. When smbd is serving Printer Drivers to
               Windows NT/2k/XP clients, each printer on the Samba
               server has a Device Mode which defines things such as
               paper size and orientation and duplex settings. The
               device mode can only correctly be generated by the
               printer driver itself (which can only be executed on a
               Win32 platform). Because smbd is unable to execute the
               driver code to generate the device mode, the default
               behavior is to set this field to NULL.

               Most problems with serving printer drivers to Windows
               NT/2k/XP clients can be traced to a problem with the
               generated device mode. Certain drivers will do things
               such as crashing the client's Explorer.exe with a NULL
               devmode.  However, other printer drivers can cause the
               client's spooler service (spoolsv.exe) to die if the
               devmode was not created by the driver itself (i.e. smbd
               generates a default devmode).

               This parameter should be used with care and tested with
               the printer driver in question. It is better to leave
               the device mode to NULL and let the Windows client set
               the correct values. Because drivers do not do this all
               the time, setting ddddeeeeffffaaaauuuulllltttt ddddeeeevvvvmmmmooooddddeeee ==== yyyyeeeessss will instruct
               smbd to generate a default one.

               For more information on Windows NT/2k printing and
               Device Modes, see the MSDN documentation
               <URL:http://msdn.microsoft.com/>.

               Default: ddddeeeeffffaaaauuuulllltttt ddddeeeevvvvmmmmooooddddeeee ==== nnnnoooo

          ddddeeeeffffaaaauuuulllltttt sssseeeerrrrvvvviiiicccceeee ((((GGGG))))
               This parameter specifies the name of a service which



     Page 35                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               will be connected to if the service actually requested
               cannot be found. Note that the square brackets are NNNNOOOOTTTT
               given in the parameter value (see example below).

               There is no default value for this parameter. If this
               parameter is not given, attempting to connect to a
               nonexistent service results in an error.

               Typically the default service would be a  _g_u_e_s_t _o_k,
               _r_e_a_d-_o_n_l_y service.

               Also note that the apparent service name will be
               changed to equal that of the requested service, this is
               very useful as it allows you to use macros like %_S to
               make a wildcard service.

               Note also that any "_" characters in the name of the
               service used in the default service will get mapped to
               a "/". This allows for interesting things.

               Example:


               [global]
                    default service = pub

               [pub]
                    path = /%S



          ddddeeeelllleeeetttteeee pppprrrriiiinnnntttteeeerrrr ccccoooommmmmmmmaaaannnndddd ((((GGGG))))
               With the introduction of MS-RPC based printer support
               for Windows NT/2000 clients in Samba 2.2, it is now
               possible to delete printer at run time by issuing the
               DeletePrinter() RPC call.

               For a Samba host this means that the printer must be
               physically deleted from underlying printing system. The
               _d_e_l_e_t_e_p_r_i_n_t_e_r _c_o_m_m_a_n_d defines a script to be run which
               will perform the necessary operations for removing the
               printer from the print system and from _s_m_b._c_o_n_f.

               The _d_e_l_e_t_e _p_r_i_n_t_e_r _c_o_m_m_a_n_d is automatically called with
               only one parameter:  "_p_r_i_n_t_e_r _n_a_m_e".

               Once the _d_e_l_e_t_e _p_r_i_n_t_e_r _c_o_m_m_a_n_d has been executed, ssssmmmmbbbbdddd
               will reparse the  _s_m_b._c_o_n_f to associated printer no
               longer exists. If the sharename is still valid, then
               ssssmmmmbbbbdddd will return an ACCESS_DENIED error to the client.

               See also  _a_d_d _p_r_i_n_t_e_r _c_o_m_m_a_n_d, _p_r_i_n_t_i_n_g, _s_h_o_w _a_d_d



     Page 36                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               _p_r_i_n_t_e_r _w_i_z_a_r_d

               Default: nnnnoooonnnneeee

               Example: ddddeeeelllleeeetttteeeepppprrrriiiinnnntttteeeerrrr ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////bbbbiiiinnnn////rrrreeeemmmmoooovvvveeeepppprrrriiiinnnntttteeeerrrr

          ddddeeeelllleeeetttteeee rrrreeeeaaaaddddoooonnnnllllyyyy ((((SSSS))))
               This parameter allows readonly files to be deleted.
               This is not normal DOS semantics, but is allowed by
               UNIX.

               This option may be useful for running applications such
               as rcs, where UNIX file ownership prevents changing
               file permissions, and DOS semantics prevent deletion of
               a read only file.

               Default: ddddeeeelllleeeetttteeee rrrreeeeaaaaddddoooonnnnllllyyyy ==== nnnnoooo

          ddddeeeelllleeeetttteeee sssshhhhaaaarrrreeee ccccoooommmmmmmmaaaannnndddd ((((GGGG))))
               Samba 2.2.0 introduced the ability to dynamically add
               and delete shares via the Windows NT 4.0 Server
               Manager. The _d_e_l_e_t_e _s_h_a_r_e _c_o_m_m_a_n_d is used to define an
               external program or script which will remove an
               existing service definition from _s_m_b._c_o_n_f. In order to
               successfully execute the _d_e_l_e_t_e _s_h_a_r_e _c_o_m_m_a_n_d, ssssmmmmbbbbdddd
               requires that the administrator be connected using a
               root account (i.e. uid == 0).

               When executed, ssssmmmmbbbbdddd will automatically invoke the
               _d_e_l_e_t_e _s_h_a_r_e _c_o_m_m_a_n_d with two parameters.

               o+ _c_o_n_f_i_g_F_i_l_e - the location of the global _s_m_b._c_o_n_f
                 file.

               o+ _s_h_a_r_e_N_a_m_e - the name of the existing service.

          This parameter is only used to remove file shares. To delete
          printer shares, see the _d_e_l_e_t_e _p_r_i_n_t_e_r _c_o_m_m_a_n_d.

          See also _a_d_d _s_h_a_r_e _c_o_m_m_a_n_d, _c_h_a_n_g_e _s_h_a_r_e _c_o_m_m_a_n_d.

          Default: nnnnoooonnnneeee

          Example: ddddeeeelllleeeetttteeee sssshhhhaaaarrrreeee ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////llllooooccccaaaallll////bbbbiiiinnnn////ddddeeeellllsssshhhhaaaarrrreeee

          ddddeeeelllleeeetttteeee uuuusssseeeerrrr ssssccccrrrriiiipppptttt ((((GGGG))))
               This is the full pathname to a script that will be run
               AAAASSSS RRRROOOOOOOOTTTT by  ssssmmmmbbbbdddd((((8888)))) under special circumstances
               described below.

               Normally, a Samba server requires that UNIX users are
               created for all users accessing files on this server.



     Page 37                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               For sites that use Windows NT account databases as
               their primary user database creating these users and
               keeping the user list in sync with the Windows NT PDC
               is an onerous task. This option allows  ssssmmmmbbbbdddd to delete
               the required UNIX users OOOONNNN DDDDEEEEMMMMAAAANNNNDDDD when a user accesses
               the Samba server and the Windows NT user no longer
               exists.

               In order to use this option, ssssmmmmbbbbdddd must be set to
               _s_e_c_u_r_i_t_y = _d_o_m_a_i_n or _s_e_c_u_r_i_t_y = _u_s_e_r and _d_e_l_e_t_e _u_s_e_r
               _s_c_r_i_p_t must be set to a full pathname for a script that
               will delete a UNIX user given one argument of %_u, which
               expands into the UNIX user name to delete.

               When the Windows user attempts to access the Samba
               server, at llllooooggggiiiinnnn (session setup in the SMB protocol)
               time, ssssmmmmbbbbdddd contacts the  _p_a_s_s_w_o_r_d _s_e_r_v_e_r and attempts
               to authenticate the given user with the given password.
               If the authentication fails with the specific Domain
               error code meaning that the user no longer exists then
               ssssmmmmbbbbdddd attempts to find a UNIX user in the UNIX password
               database that matches the Windows user account. If this
               lookup succeeds, and _d_e_l_e_t_e _u_s_e_r _s_c_r_i_p_t is set then
               ssssmmmmbbbbdddd will all the specified script AAAASSSS RRRROOOOOOOOTTTT, expanding
               any %_u argument to be the user name to delete.

               This script should delete the given UNIX username. In
               this way, UNIX users are dynamically deleted to match
               existing Windows NT accounts.

               See also security = domain, _p_a_s_s_w_o_r_d _s_e_r_v_e_r , _a_d_d _u_s_e_r
               _s_c_r_i_p_t .

               Default: ddddeeeelllleeeetttteeee uuuusssseeeerrrr ssssccccrrrriiiipppptttt ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               Example: ddddeeeelllleeeetttteeee uuuusssseeeerrrr ssssccccrrrriiiipppptttt ====
               ////uuuussssrrrr////llllooooccccaaaallll////ssssaaaammmmbbbbaaaa////bbbbiiiinnnn////ddddeeeellll____uuuusssseeeerrrr %%%%uuuu

          ddddeeeelllleeeetttteeee vvvveeeettttoooo ffffiiiilllleeeessss ((((SSSS))))
               This option is used when Samba is attempting to delete
               a directory that contains one or more vetoed
               directories (see the _v_e_t_o _f_i_l_e_s option). If this option
               is set to no (the default) then if a vetoed directory
               contains any non-vetoed files or directories then the
               directory delete will fail. This is usually what you
               want.

               If this option is set to yes, then Samba will attempt
               to recursively delete any files and directories within
               the vetoed directory. This can be useful for
               integration with file serving systems such as NetAtalk
               which create meta-files within directories you might



     Page 38                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               normally veto DOS/Windows users from seeing (e.g.
               ._A_p_p_l_e_D_o_u_b_l_e)

               Setting ddddeeeelllleeeetttteeee vvvveeeettttoooo ffffiiiilllleeeessss ==== yyyyeeeessss allows these
               directories to be transparently deleted when the parent
               directory is deleted (so long as the user has
               permissions to do so).

               See also the _v_e_t_o _f_i_l_e_s parameter.

               Default: ddddeeeelllleeeetttteeee vvvveeeettttoooo ffffiiiilllleeeessss ==== nnnnoooo

          ddddeeeennnnyyyy hhhhoooossssttttssss ((((SSSS))))
               Synonym for _h_o_s_t_s _d_e_n_y.

          ddddffffrrrreeeeeeee ccccoooommmmmmmmaaaannnndddd ((((GGGG))))
               The _d_f_r_e_e _c_o_m_m_a_n_d setting should only be used on
               systems where a problem occurs with the internal disk
               space calculations. This has been known to happen with
               Ultrix, but may occur with other operating systems. The
               symptom that was seen was an error of "Abort Retry
               Ignore" at the end of each directory listing.

               This setting allows the replacement of the internal
               routines to calculate the total disk space and amount
               available with an external routine. The example below
               gives a possible script that might fulfill this
               function.

               The external program will be passed a single parameter
               indicating a directory in the filesystem being queried.
               This will typically consist of the string ./. The
               script should return two integers in ASCII. The first
               should be the total disk space in blocks, and the
               second should be the number of available blocks. An
               optional third return value can give the block size in
               bytes. The default blocksize is 1024 bytes.

               Note: Your script should NNNNOOOOTTTT be setuid or setgid and
               should be owned by (and writeable only by) root!

               Default: BBBByyyy ddddeeeeffffaaaauuuulllltttt iiiinnnntttteeeerrrrnnnnaaaallll rrrroooouuuuttttiiiinnnneeeessss ffffoooorrrr ddddeeeetttteeeerrrrmmmmiiiinnnniiiinnnngggg
               tttthhhheeee ddddiiiisssskkkk ccccaaaappppaaaacccciiiittttyyyy aaaannnndddd rrrreeeemmmmaaaaiiiinnnniiiinnnngggg ssssppppaaaacccceeee wwwwiiiillllllll bbbbeeee uuuusssseeeedddd....

               Example: ddddffffrrrreeeeeeee ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////llllooooccccaaaallll////ssssaaaammmmbbbbaaaa////bbbbiiiinnnn////ddddffffrrrreeeeeeee

               Where the script dfree (which must be made executable)
               could be:



                         #!/bin/sh



     Page 39                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



                         df $1 | tail -1 | awk '{print $2" "$4}'



               or perhaps (on Sys V based systems):



                         #!/bin/sh
                         /usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'



               Note that you may have to replace the command names
               with full path names on some systems.

          ddddiiiirrrreeeeccccttttoooorrrryyyy ((((SSSS))))
               Synonym for _p_a_t_h .

          ddddiiiirrrreeeeccccttttoooorrrryyyy mmmmaaaasssskkkk ((((SSSS))))
               This parameter is the octal modes which are used when
               converting DOS modes to UNIX modes when creating UNIX
               directories.

               When a directory is created, the necessary permissions
               are calculated according to the mapping from DOS modes
               to UNIX permissions, and the resulting UNIX mode is
               then bit-wise 'AND'ed with this parameter. This
               parameter may be thought of as a bit-wise MASK for the
               UNIX modes of a directory. Any bit nnnnooootttt set here will be
               removed from the modes set on a directory when it is
               created.

               The default value of this parameter removes the 'group'
               and 'other' write bits from the UNIX mode, allowing
               only the user who owns the directory to modify it.

               Following this Samba will bit-wise 'OR' the UNIX mode
               created from this parameter with the value of the _f_o_r_c_e
               _d_i_r_e_c_t_o_r_y _m_o_d_e parameter. This parameter is set to 000
               by default (i.e. no extra mode bits are added).

               Note that this parameter does not apply to permissions
               set by Windows NT/2000 ACL editors. If the
               administrator wishes to enforce a mask on access
               control lists also, they need to set the _d_i_r_e_c_t_o_r_y
               _s_e_c_u_r_i_t_y _m_a_s_k.

               See the _f_o_r_c_e _d_i_r_e_c_t_o_r_y _m_o_d_e parameter to cause
               particular mode bits to always be set on created
               directories.




     Page 40                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               See also the _c_r_e_a_t_e _m_o_d_e parameter for masking mode
               bits on created files, and the _d_i_r_e_c_t_o_r_y _s_e_c_u_r_i_t_y _m_a_s_k
               parameter.

               Also refer to the  _i_n_h_e_r_i_t _p_e_r_m_i_s_s_i_o_n_s parameter.

               Default: ddddiiiirrrreeeeccccttttoooorrrryyyy mmmmaaaasssskkkk ==== 0000777755555555

               Example: ddddiiiirrrreeeeccccttttoooorrrryyyy mmmmaaaasssskkkk ==== 0000777777775555

          ddddiiiirrrreeeeccccttttoooorrrryyyy mmmmooooddddeeee ((((SSSS))))
               Synonym for  _d_i_r_e_c_t_o_r_y _m_a_s_k

          ddddiiiirrrreeeeccccttttoooorrrryyyy sssseeeeccccuuuurrrriiiittttyyyy mmmmaaaasssskkkk ((((SSSS))))
               This parameter controls what UNIX permission bits can
               be modified when a Windows NT client is manipulating
               the UNIX permission on a directory using the native NT
               security dialog box.

               This parameter is applied as a mask (AND'ed with) to
               the changed permission bits, thus preventing any bits
               not in this mask from being modified. Essentially, zero
               bits in this mask may be treated as a set of bits the
               user is not allowed to change.

               If not set explicitly this parameter is set to 0777
               meaning a user is allowed to modify all the
               user/group/world permissions on a directory.

               NNNNooootttteeee that users who can access the Samba server through
               other means can easily bypass this restriction, so it
               is primarily useful for standalone "appliance" systems.
               Administrators of most normal systems will probably
               want to leave it as the default of 0777.

               See also the  _f_o_r_c_e _d_i_r_e_c_t_o_r_y _s_e_c_u_r_i_t_y _m_o_d_e, _s_e_c_u_r_i_t_y
               _m_a_s_k, _f_o_r_c_e _s_e_c_u_r_i_t_y _m_o_d_e parameters.

               Default: ddddiiiirrrreeeeccccttttoooorrrryyyy sssseeeeccccuuuurrrriiiittttyyyy mmmmaaaasssskkkk ==== 0000777777777777

               Example: ddddiiiirrrreeeeccccttttoooorrrryyyy sssseeeeccccuuuurrrriiiittttyyyy mmmmaaaasssskkkk ==== 0000777700000000

          ddddiiiissssaaaabbbblllleeee ssssppppoooooooollllssssssss ((((GGGG))))
               Enabling this parameter will disables Samba's support
               for the SPOOLSS set of MS-RPC's and will yield
               identical behavior as Samba 2.0.x. Windows NT/2000
               clients will downgrade to using Lanman style printing
               commands. Windows 9x/ME will be uneffected by the
               parameter. However, this will also disable the ability
               to upload printer drivers to a Samba server via the
               Windows NT Add Printer Wizard or by using the NT
               printer properties dialog window. It will also disable



     Page 41                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               the capability of Windows NT/2000 clients to download
               print drivers from the Samba host upon demand.  BBBBeeee vvvveeeerrrryyyy
               ccccaaaarrrreeeeffffuuuullll aaaabbbboooouuuutttt eeeennnnaaaabbbblllliiiinnnngggg tttthhhhiiiissss ppppaaaarrrraaaammmmeeeetttteeeerrrr....

               See also use client driver

               Default : ddddiiiissssaaaabbbblllleeee ssssppppoooooooollllssssssss ==== nnnnoooo

          ddddnnnnssss pppprrrrooooxxxxyyyy ((((GGGG))))
               Specifies that nmbd(8) when acting as a WINS server and
               finding that a NetBIOS name has not been registered,
               should treat the NetBIOS name word-for-word as a DNS
               name and do a lookup with the DNS server for that name
               on behalf of the name-querying client.

               Note that the maximum length for a NetBIOS name is 15
               characters, so the DNS name (or DNS alias) can likewise
               only be 15 characters, maximum.

               nnnnmmmmbbbbdddd spawns a second copy of itself to do the DNS name
               lookup requests, as doing a name lookup is a blocking
               action.

               See also the parameter  _w_i_n_s _s_u_p_p_o_r_t.

               Default: ddddnnnnssss pppprrrrooooxxxxyyyy ==== yyyyeeeessss

          ddddoooommmmaaaaiiiinnnn aaaaddddmmmmiiiinnnn ggggrrrroooouuuupppp ((((GGGG))))
               This parameter is intended as a temporary solution to
               enable users to be a member of the "Domain Admins"
               group when a Samba host is acting as a PDC. A complete
               solution will be provided by a system for mapping
               Windows NT/2000 groups onto UNIX groups.  Please note
               that this parameter has a somewhat confusing name. It
               accepts a list of usernames and of group names in
               standard _s_m_b._c_o_n_f notation.

               See also _d_o_m_a_i_n _g_u_e_s_t _g_r_o_u_p, _d_o_m_a_i_n _l_o_g_o_n_s

               Default: nnnnoooo ddddoooommmmaaaaiiiinnnn aaaaddddmmmmiiiinnnniiiissssttttrrrraaaattttoooorrrrssss

               Example: ddddoooommmmaaaaiiiinnnn aaaaddddmmmmiiiinnnn ggggrrrroooouuuupppp ==== rrrrooooooootttt @@@@wwwwhhhheeeeeeeellll

          ddddoooommmmaaaaiiiinnnn gggguuuueeeesssstttt ggggrrrroooouuuupppp ((((GGGG))))
               This parameter is intended as a temporary solution to
               enable users to be a member of the "Domain Guests"
               group when a Samba host is acting as a PDC. A complete
               solution will be provided by a system for mapping
               Windows NT/2000 groups onto UNIX groups.  Please note
               that this parameter has a somewhat confusing name. It
               accepts a list of usernames and of group names in
               standard _s_m_b._c_o_n_f notation.



     Page 42                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               See also _d_o_m_a_i_n _a_d_m_i_n _g_r_o_u_p, _d_o_m_a_i_n _l_o_g_o_n_s

               Default: nnnnoooo ddddoooommmmaaaaiiiinnnn gggguuuueeeessssttttssss

               Example: ddddoooommmmaaaaiiiinnnn gggguuuueeeesssstttt ggggrrrroooouuuupppp ==== nnnnoooobbbbooooddddyyyy @@@@gggguuuueeeesssstttt

          ddddoooommmmaaaaiiiinnnn llllooooggggoooonnnnssss ((((GGGG))))
               If set to yes, the Samba server will serve Windows
               95/98 Domain logons for the  _w_o_r_k_g_r_o_u_p it is in. Samba
               2.2 also has limited capability to act as a domain
               controller for Windows NT 4 Domains. For more details
               on setting up this feature see the Samba-PDC-HOWTO
               included in the _h_t_m_l_d_o_c_s/ directory shipped with the
               source code.

               Default: ddddoooommmmaaaaiiiinnnn llllooooggggoooonnnnssss ==== nnnnoooo

          ddddoooommmmaaaaiiiinnnn mmmmaaaasssstttteeeerrrr ((((GGGG))))
               Tell  nnnnmmmmbbbbdddd((((8888)))) to enable WAN-wide browse list collation.
               Setting this option causes nnnnmmmmbbbbdddd to claim a special
               domain specific NetBIOS name that identifies it as a
               domain master browser for its given  _w_o_r_k_g_r_o_u_p. Local
               master browsers in the same _w_o_r_k_g_r_o_u_p on broadcast-
               isolated subnets will give this nnnnmmmmbbbbdddd their local browse
               lists, and then ask ssssmmmmbbbbdddd((((8888)))) for a complete copy of the
               browse list for the whole wide area network. Browser
               clients will then contact their local master browser,
               and will receive the domain-wide browse list, instead
               of just the list for their broadcast-isolated subnet.

               Note that Windows NT Primary Domain Controllers expect
               to be able to claim this _w_o_r_k_g_r_o_u_p specific special
               NetBIOS name that identifies them as domain master
               browsers for that _w_o_r_k_g_r_o_u_p by default (i.e. there is
               no way to prevent a Windows NT PDC from attempting to
               do this). This means that if this parameter is set and
               nnnnmmmmbbbbdddd claims the special name for a _w_o_r_k_g_r_o_u_p before a
               Windows NT PDC is able to do so then cross subnet
               browsing will behave strangely and may fail.

               If ddddoooommmmaaaaiiiinnnn llllooooggggoooonnnnssss ==== yyyyeeeessss , then the default behavior is
               to enable the _d_o_m_a_i_n _m_a_s_t_e_r parameter. If _d_o_m_a_i_n _l_o_g_o_n_s
               is not enabled (the default setting), then neither will
               _d_o_m_a_i_n _m_a_s_t_e_r be enabled by default.

               Default: ddddoooommmmaaaaiiiinnnn mmmmaaaasssstttteeeerrrr ==== aaaauuuuttttoooo

          ddddoooonnnntttt ddddeeeesssscccceeeennnndddd ((((SSSS))))
               There are certain directories on some systems (e.g.,
               the /_p_r_o_c tree under Linux) that are either not of
               interest to clients or are infinitely deep (recursive).
               This parameter allows you to specify a comma-delimited



     Page 43                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               list of directories that the server should always show
               as empty.

               Note that Samba can be very fussy about the exact
               format of the "dont descend" entries. For example you
               may need  ./_p_r_o_c instead of just /_p_r_o_c. Experimentation
               is the best policy :-)

               Default: nnnnoooonnnneeee ((((iiii....eeee....,,,, aaaallllllll ddddiiiirrrreeeeccccttttoooorrrriiiieeeessss aaaarrrreeee OOOOKKKK ttttoooo ddddeeeesssscccceeeennnndddd))))

               Example: ddddoooonnnntttt ddddeeeesssscccceeeennnndddd ==== ////pppprrrroooocccc,,,,////ddddeeeevvvv

          ddddoooossss ffffiiiilllleeeemmmmooooddddeeee ((((SSSS))))
               The default behavior in Samba is to provide UNIX-like
               behavior where only the owner of a file/directory is
               able to change the permissions on it. However, this
               behavior is often confusing to DOS/Windows users.
               Enabling this parameter allows a user who has write
               access to the file (by whatever means) to modify the
               permissions on it. Note that a user belonging to the
               group owning the file will not be allowed to change
               permissions if the group is only granted read access.
               Ownership of the file/directory is not changed, only
               the permissions are modified.

               Default: ddddoooossss ffffiiiilllleeeemmmmooooddddeeee ==== nnnnoooo

          ddddoooossss ffffiiiilllleeeettttiiiimmmmeeee rrrreeeessssoooolllluuuuttttiiiioooonnnn ((((SSSS))))
               Under the DOS and Windows FAT filesystem, the finest
               granularity on time resolution is two seconds. Setting
               this parameter for a share causes Samba to round the
               reported time down to the nearest two second boundary
               when a query call that requires one second resolution
               is made to ssssmmmmbbbbdddd((((8888))))


               This option is mainly used as a compatibility option
               for Visual C++ when used against Samba shares. If
               oplocks are enabled on a share, Visual C++ uses two
               different time reading calls to check if a file has
               changed since it was last read. One of these calls uses
               a one-second granularity, the other uses a two second
               granularity. As the two second call rounds any odd
               second down, then if the file has a timestamp of an odd
               number of seconds then the two timestamps will not
               match and Visual C++ will keep reporting the file has
               changed. Setting this option causes the two timestamps
               to match, and Visual C++ is happy.

               Default: ddddoooossss ffffiiiilllleeeettttiiiimmmmeeee rrrreeeessssoooolllluuuuttttiiiioooonnnn ==== nnnnoooo

          ddddoooossss ffffiiiilllleeeettttiiiimmmmeeeessss ((((SSSS))))



     Page 44                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Under DOS and Windows, if a user can write to a file
               they can change the timestamp on it. Under POSIX
               semantics, only the owner of the file or root may
               change the timestamp. By default, Samba runs with POSIX
               semantics and refuses to change the timestamp on a file
               if the user ssssmmmmbbbbdddd is acting on behalf of is not the file
               owner. Setting this option to  yes allows DOS semantics
               and smbd will change the file timestamp as DOS
               requires.

               Default: ddddoooossss ffffiiiilllleeeettttiiiimmmmeeeessss ==== nnnnoooo

          eeeennnnccccrrrryyyypppptttt ppppaaaasssssssswwwwoooorrrrddddssss ((((GGGG))))
               This boolean controls whether encrypted passwords will
               be negotiated with the client. Note that Windows NT 4.0
               SP3 and above and also Windows 98 will by default
               expect encrypted passwords unless a registry entry is
               changed. To use encrypted passwords in Samba see the
               file ENCRYPTION.txt in the Samba documentation
               directory _d_o_c_s/ shipped with the source code.

               In order for encrypted passwords to work correctly
               ssssmmmmbbbbdddd((((8888)))) must either have access to a local _s_m_b_p_a_s_s_w_d(_5)
                program for information on how to set up and maintain
               this file), or set the security = [server|domain]
               parameter which causes ssssmmmmbbbbdddd to authenticate against
               another server.

               Default: eeeennnnccccrrrryyyypppptttt ppppaaaasssssssswwwwoooorrrrddddssss ==== nnnnoooo

          eeeennnnhhhhaaaannnncccceeeedddd bbbbrrrroooowwwwssssiiiinnnngggg ((((GGGG))))
               This option enables a couple of enhancements to cross-
               subnet browse propagation that have been added in Samba
               but which are not standard in Microsoft
               implementations.

               The first enhancement to browse propagation consists of
               a regular wildcard query to a Samba WINS server for all
               Domain Master Browsers, followed by a browse
               synchronization with each of the returned DMBs. The
               second enhancement consists of a regular randomised
               browse synchronization with all currently known DMBs.

               You may wish to disable this option if you have a
               problem with empty workgroups not disappearing from
               browse lists. Due to the restrictions of the browse
               protocols these enhancements can cause a empty
               workgroup to stay around forever which can be annoying.

               In general you should leave this option enabled as it
               makes cross-subnet browse propagation much more
               reliable.



     Page 45                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: eeeennnnhhhhaaaannnncccceeeedddd bbbbrrrroooowwwwssssiiiinnnngggg ==== yyyyeeeessss

          eeeennnnuuuummmmppppoooorrrrttttssss ccccoooommmmmmmmaaaannnndddd ((((GGGG))))
               The concept of a "port" is fairly foreign to UNIX
               hosts. Under Windows NT/2000 print servers, a port is
               associated with a port monitor and generally takes the
               form of a local port (i.e. LPT1:, COM1:, FILE:) or a
               remote port (i.e. LPD Port Monitor, etc...). By
               default, Samba has only one port defined--"Samba
               Printer Port". Under Windows NT/2000, all printers must
               have a valid port name. If you wish to have a list of
               ports displayed (ssssmmmmbbbbdddd does not use a port name for
               anything) other than the default "Samba Printer Port",
               you can define _e_n_u_m_p_o_r_t_s _c_o_m_m_a_n_d to point to a program
               which should generate a list of ports, one per line, to
               standard output. This listing will then be used in
               response to the level 1 and 2 EnumPorts() RPC.

               Default: nnnnoooo eeeennnnuuuummmmppppoooorrrrttttssss ccccoooommmmmmmmaaaannnndddd

               Example: eeeennnnuuuummmmppppoooorrrrttttssss ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////bbbbiiiinnnn////lllliiiissssttttppppoooorrrrttttssss

          eeeexxxxeeeecccc ((((SSSS))))
               This is a synonym for  _p_r_e_e_x_e_c.

          ffffaaaakkkkeeee ddddiiiirrrreeeeccccttttoooorrrryyyy ccccrrrreeeeaaaatttteeee ttttiiiimmmmeeeessss ((((SSSS))))
               NTFS and Windows VFAT file systems keep a create time
               for all files and directories. This is not the same as
               the ctime - status change time - that Unix keeps, so
               Samba by default reports the earliest of the various
               times Unix does keep. Setting this parameter for a
               share causes Samba to always report midnight 1-1-1980
               as the create time for directories.

               This option is mainly used as a compatibility option
               for Visual C++ when used against Samba shares. Visual
               C++ generated makefiles have the object directory as a
               dependency for each object file, and a make rule to
               create the directory. Also, when NMAKE compares
               timestamps it uses the creation time when examining a
               directory. Thus the object directory will be created if
               it does not exist, but once it does exist it will
               always have an earlier timestamp than the object files
               it contains.

               However, Unix time semantics mean that the create time
               reported by Samba will be updated whenever a file is
               created or or deleted in the directory. NMAKE finds all
               object files in the object directory. The timestamp of
               the last one built is then compared to the timestamp of
               the object directory. If the directory's timestamp if
               newer, then all object files will be rebuilt. Enabling



     Page 46                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               this option ensures directories always predate their
               contents and an NMAKE build will proceed as expected.

               Default: ffffaaaakkkkeeee ddddiiiirrrreeeeccccttttoooorrrryyyy ccccrrrreeeeaaaatttteeee ttttiiiimmmmeeeessss ==== nnnnoooo

          ffffaaaakkkkeeee oooopppplllloooocccckkkkssss ((((SSSS))))
               Oplocks are the way that SMB clients get permission
               from a server to locally cache file operations. If a
               server grants an oplock (opportunistic lock) then the
               client is free to assume that it is the only one
               accessing the file and it will aggressively cache file
               data. With some oplock types the client may even cache
               file open/close operations. This can give enormous
               performance benefits.

               When you set ffffaaaakkkkeeee oooopppplllloooocccckkkkssss ==== yyyyeeeessss, ssssmmmmbbbbdddd((((8888)))) will always
               grant oplock requests no matter how many clients are
               using the file.

               It is generally much better to use the real _o_p_l_o_c_k_s
               support rather than this parameter.

               If you enable this option on all read-only shares or
               shares that you know will only be accessed from one
               client at a time such as physically read-only media
               like CDROMs, you will see a big performance improvement
               on many operations. If you enable this option on shares
               where multiple clients may be accessing the files
               read-write at the same time you can get data
               corruption. Use this option carefully!

               Default: ffffaaaakkkkeeee oooopppplllloooocccckkkkssss ==== nnnnoooo

          ffffoooolllllllloooowwww ssssyyyymmmmlllliiiinnnnkkkkssss ((((SSSS))))
               This parameter allows the Samba administrator to stop
               ssssmmmmbbbbdddd((((8888)))) from following symbolic links in a particular
               share. Setting this parameter to no prevents any file
               or directory that is a symbolic link from being
               followed (the user will get an error). This option is
               very useful to stop users from adding a symbolic link
               to /_e_t_c/_p_a_s_s_w_d in their home directory for instance.
               However it will slow filename lookups down slightly.

               This option is enabled (i.e. ssssmmmmbbbbdddd will follow symbolic
               links) by default.

               Default: ffffoooolllllllloooowwww ssssyyyymmmmlllliiiinnnnkkkkssss ==== yyyyeeeessss

          ffffoooorrrrcccceeee ccccrrrreeeeaaaatttteeee mmmmooooddddeeee ((((SSSS))))
               This parameter specifies a set of UNIX mode bit
               permissions that will aaaallllwwwwaaaayyyyssss be set on a file created
               by Samba. This is done by bitwise 'OR'ing these bits



     Page 47                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               onto the mode bits of a file that is being created or
               having its permissions changed. The default for this
               parameter is (in octal) 000. The modes in this
               parameter are bitwise 'OR'ed onto the file mode after
               the mask set in the _c_r_e_a_t_e _m_a_s_k parameter is applied.

               See also the parameter _c_r_e_a_t_e _m_a_s_k for details on
               masking mode bits on files.

               See also the _i_n_h_e_r_i_t _p_e_r_m_i_s_s_i_o_n_s parameter.

               Default: ffffoooorrrrcccceeee ccccrrrreeeeaaaatttteeee mmmmooooddddeeee ==== 000000000000

               Example: ffffoooorrrrcccceeee ccccrrrreeeeaaaatttteeee mmmmooooddddeeee ==== 0000777755555555

               would force all created files to have read and execute
               permissions set for 'group' and 'other' as well as the
               read/write/execute bits set for the 'user'.

          ffffoooorrrrcccceeee ddddiiiirrrreeeeccccttttoooorrrryyyy mmmmooooddddeeee ((((SSSS))))
               This parameter specifies a set of UNIX mode bit
               permissions that will aaaallllwwwwaaaayyyyssss be set on a directory
               created by Samba. This is done by bitwise 'OR'ing these
               bits onto the mode bits of a directory that is being
               created. The default for this parameter is (in octal)
               0000 which will not add any extra permission bits to a
               created directory. This operation is done after the
               mode mask in the parameter _d_i_r_e_c_t_o_r_y _m_a_s_k is applied.

               See also the parameter  _d_i_r_e_c_t_o_r_y _m_a_s_k for details on
               masking mode bits on created directories.

               See also the  _i_n_h_e_r_i_t _p_e_r_m_i_s_s_i_o_n_s parameter.

               Default: ffffoooorrrrcccceeee ddddiiiirrrreeeeccccttttoooorrrryyyy mmmmooooddddeeee ==== 000000000000

               Example: ffffoooorrrrcccceeee ddddiiiirrrreeeeccccttttoooorrrryyyy mmmmooooddddeeee ==== 0000777755555555

               would force all created directories to have read and
               execute permissions set for 'group' and 'other' as well
               as the read/write/execute bits set for the 'user'.

          ffffoooorrrrcccceeee ddddiiiirrrreeeeccccttttoooorrrryyyy
               This parameter controls what UNIX permission bits can
               be modified when a Windows NT client is manipulating
               the UNIX permission on a directory using the native NT
               security dialog box.

               This parameter is applied as a mask (OR'ed with) to the
               changed permission bits, thus forcing any bits in this
               mask that the user may have modified to be on.
               Essentially, one bits in this mask may be treated as a



     Page 48                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               set of bits that, when modifying security on a
               directory, the user has always set to be 'on'.

               If not set explicitly this parameter is 000, which
               allows a user to modify all the user/group/world
               permissions on a directory without restrictions.

               NNNNooootttteeee that users who can access the Samba server through
               other means can easily bypass this restriction, so it
               is primarily useful for standalone "appliance" systems.
               Administrators of most normal systems will probably
               want to leave it set as 0000.

               See also the  _d_i_r_e_c_t_o_r_y _s_e_c_u_r_i_t_y _m_a_s_k,  _s_e_c_u_r_i_t_y _m_a_s_k,
               _f_o_r_c_e _s_e_c_u_r_i_t_y _m_o_d_e parameters.

               Default: ffffoooorrrrcccceeee ddddiiiirrrreeeeccccttttoooorrrryyyy sssseeeeccccuuuurrrriiiittttyyyy mmmmooooddddeeee ==== 0000

               Example: ffffoooorrrrcccceeee ddddiiiirrrreeeeccccttttoooorrrryyyy sssseeeeccccuuuurrrriiiittttyyyy mmmmooooddddeeee ==== 777700000000

          ffffoooorrrrcccceeee ggggrrrroooouuuupppp ((((SSSS))))
               This specifies a UNIX group name that will be assigned
               as the default primary group for all users connecting
               to this service. This is useful for sharing files by
               ensuring that all access to files on service will use
               the named group for their permissions checking. Thus,
               by assigning permissions for this group to the files
               and directories within this service the Samba
               administrator can restrict or allow sharing of these
               files.

               In Samba 2.0.5 and above this parameter has extended
               functionality in the following way. If the group name
               listed here has a '+' character prepended to it then
               the current user accessing the share only has the
               primary group default assigned to this group if they
               are already assigned as a member of that group. This
               allows an administrator to decide that only users who
               are already in a particular group will create files
               with group ownership set to that group. This gives a
               finer granularity of ownership assignment. For example,
               the setting _f_o_r_c_e _g_r_o_u_p = +_s_y_s means that only users
               who are already in group sys will have their default
               primary group assigned to sys when accessing this Samba
               share. All other users will retain their ordinary
               primary group.

               If the _f_o_r_c_e _u_s_e_r parameter is also set the group
               specified in _f_o_r_c_e _g_r_o_u_p will override the primary
               group set in _f_o_r_c_e _u_s_e_r.

               See also _f_o_r_c_e _u_s_e_r.



     Page 49                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: nnnnoooo ffffoooorrrrcccceeeedddd ggggrrrroooouuuupppp

               Example: ffffoooorrrrcccceeee ggggrrrroooouuuupppp ==== aaaaggggrrrroooouuuupppp

          ffffoooorrrrcccceeee sssseeeeccccuuuurrrriiiittttyyyy mmmmooooddddeeee ((((SSSS))))
               This parameter controls what UNIX permission bits can
               be modified when a Windows NT client is manipulating
               the UNIX permission on a file using the native NT
               security dialog box.

               This parameter is applied as a mask (OR'ed with) to the
               changed permission bits, thus forcing any bits in this
               mask that the user may have modified to be on.
               Essentially, one bits in this mask may be treated as a
               set of bits that, when modifying security on a file,
               the user has always set to be 'on'.

               If not set explicitly this parameter is set to 0, and
               allows a user to modify all the user/group/world
               permissions on a file, with no restrictions.

               NNNNooootttteeee that users who can access the Samba server through
               other means can easily bypass this restriction, so it
               is primarily useful for standalone "appliance" systems.
               Administrators of most normal systems will probably
               want to leave this set to 0000.

               See also the  _f_o_r_c_e _d_i_r_e_c_t_o_r_y _s_e_c_u_r_i_t_y _m_o_d_e, _d_i_r_e_c_t_o_r_y
               _s_e_c_u_r_i_t_y _m_a_s_k,  _s_e_c_u_r_i_t_y _m_a_s_k parameters.

               Default: ffffoooorrrrcccceeee sssseeeeccccuuuurrrriiiittttyyyy mmmmooooddddeeee ==== 0000

               Example: ffffoooorrrrcccceeee sssseeeeccccuuuurrrriiiittttyyyy mmmmooooddddeeee ==== 777700000000

          ffffoooorrrrcccceeee uuuunnnnkkkknnnnoooowwwwnnnn aaaaccccllll uuuusssseeeerrrr ((((SSSS))))
               If this parameter is set, a Windows NT ACL that
               contains an unknown SID (security descriptor, or
               representation of a user or group id) as the owner or
               group owner of the file will be silently mapped into
               the current UNIX uid or gid of the currently connected
               user.

               This is designed to allow Windows NT clients to copy
               files and folders containing ACLs that were created
               locally on the client machine and contain users local
               to that machine only (no domain users) to be copied to
               a Samba server (usually with XCOPY /O) and have the
               unknown userid and groupid of the file owner map to the
               current connected user.  This can only be fixed
               correctly when winbindd allows arbitrary mapping from
               any Windows NT SID to a UNIX uid or gid.




     Page 50                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Try using this parameter when XCOPY /O gives an
               ACCESS_DENIED error.

               See also _f_o_r_c_e _g_r_o_u_p

               Default: FFFFaaaallllsssseeee

               Example: ffffoooorrrrcccceeee uuuunnnnkkkknnnnoooowwwwnnnn aaaaccccllll uuuusssseeeerrrr ==== yyyyeeeessss

          ffffoooorrrrcccceeee uuuusssseeeerrrr ((((SSSS))))
               This specifies a UNIX user name that will be assigned
               as the default user for all users connecting to this
               service. This is useful for sharing files. You should
               also use it carefully as using it incorrectly can cause
               security problems.

               This user name only gets used once a connection is
               established. Thus clients still need to connect as a
               valid user and supply a valid password. Once connected,
               all file operations will be performed as the "forced
               user", no matter what username the client connected as.
               This can be very useful.

               In Samba 2.0.5 and above this parameter also causes the
               primary group of the forced user to be used as the
               primary group for all file activity. Prior to 2.0.5 the
               primary group was left as the primary group of the
               connecting user (this was a bug).

               See also _f_o_r_c_e _g_r_o_u_p

               Default: nnnnoooo ffffoooorrrrcccceeeedddd uuuusssseeeerrrr

               Example: ffffoooorrrrcccceeee uuuusssseeeerrrr ==== aaaauuuusssseeeerrrr

          ffffssssttttyyyyppppeeee ((((SSSS))))
               This parameter allows the administrator to configure
               the string that specifies the type of filesystem a
               share is using that is reported by ssssmmmmbbbbdddd((((8888))))
                when a client queries the filesystem type for a share.
               The default type is NTFS for compatibility with Windows
               NT but this can be changed to other strings such as
               Samba or FAT if required.

               Default: ffffssssttttyyyyppppeeee ==== NNNNTTTTFFFFSSSS

               Example: ffffssssttttyyyyppppeeee ==== SSSSaaaammmmbbbbaaaa

          ggggeeeettttwwwwdddd ccccaaaacccchhhheeee ((((GGGG))))
               This is a tuning option. When this is enabled a caching
               algorithm will be used to reduce the time taken for
               getwd() calls. This can have a significant impact on



     Page 51                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               performance, especially when the _w_i_d_e _l_i_n_k_s parameter
               is set to no.

               Default: ggggeeeettttwwwwdddd ccccaaaacccchhhheeee ==== yyyyeeeessss

          ggggrrrroooouuuupppp ((((SSSS))))
               Synonym for _f_o_r_c_e _g_r_o_u_p.

          gggguuuueeeesssstttt aaaaccccccccoooouuuunnnntttt ((((SSSS))))
               This is a username which will be used for access to
               services which are specified as  _g_u_e_s_t _o_k (see below).
               Whatever privileges this user has will be available to
               any client connecting to the guest service. Typically
               this user will exist in the password file, but will not
               have a valid login. The user account "ftp" is often a
               good choice for this parameter. If a username is
               specified in a given service, the specified username
               overrides this one.

               One some systems the default guest account "nobody" may
               not be able to print. Use another account in this case.
               You should test this by trying to log in as your guest
               user (perhaps by using the ssssuuuu ---- command) and trying to
               print using the system print command such as llllpppprrrr((((1111)))) or
               llllpppp((((1111)))).

               Default: ssssppppeeeecccciiiiffffiiiieeeedddd aaaatttt ccccoooommmmppppiiiilllleeee ttttiiiimmmmeeee,,,, uuuussssuuuuaaaallllllllyyyy """"nnnnoooobbbbooooddddyyyy""""

               Example: gggguuuueeeesssstttt aaaaccccccccoooouuuunnnntttt ==== ffffttttpppp

          gggguuuueeeesssstttt ooookkkk ((((SSSS))))
               If this parameter is yes for a service, then no
               password is required to connect to the service.
               Privileges will be those of the  _g_u_e_s_t _a_c_c_o_u_n_t.

               See the section below on  _s_e_c_u_r_i_t_y for more information
               about this option.

               Default: gggguuuueeeesssstttt ooookkkk ==== nnnnoooo

          gggguuuueeeesssstttt oooonnnnllllyyyy ((((SSSS))))
               If this parameter is yes for a service, then only guest
               connections to the service are permitted. This
               parameter will have no effect if  _g_u_e_s_t _o_k is not set
               for the service.

               See the section below on  _s_e_c_u_r_i_t_y for more information
               about this option.

               Default: gggguuuueeeesssstttt oooonnnnllllyyyy ==== nnnnoooo

          hhhhiiiiddddeeee ddddooootttt ffffiiiilllleeeessss ((((SSSS))))



     Page 52                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               This is a boolean parameter that controls whether files
               starting with a dot appear as hidden files.

               Default: hhhhiiiiddddeeee ddddooootttt ffffiiiilllleeeessss ==== yyyyeeeessss

          hhhhiiiiddddeeee ffffiiiilllleeeessss((((SSSS))))
               This is a list of files or directories that are not
               visible but are accessible. The DOS 'hidden' attribute
               is applied to any files or directories that match.

               Each entry in the list must be separated by a '/',
               which allows spaces to be included in the entry. '*'
               and '?' can be used to specify multiple files or
               directories as in DOS wildcards.

               Each entry must be a Unix path, not a DOS path and must
               not include the Unix directory separator '/'.

               Note that the case sensitivity option is applicable in
               hiding files.

               Setting this parameter will affect the performance of
               Samba, as it will be forced to check all files and
               directories for a match as they are scanned.

               See also _h_i_d_e _d_o_t _f_i_l_e_s,  _v_e_t_o _f_i_l_e_s and  _c_a_s_e
               _s_e_n_s_i_t_i_v_e.

               Default: nnnnoooo ffffiiiilllleeee aaaarrrreeee hhhhiiiiddddddddeeeennnn

               Example: hhhhiiiiddddeeee ffffiiiilllleeeessss ====
               ////....****////DDDDeeeesssskkkkttttooooppppFFFFoooollllddddeeeerrrrDDDDBBBB////TTTTrrrraaaasssshhhhFFFFoooorrrr%%%%mmmm////rrrreeeessssoooouuuurrrrcccceeee....ffffrrrrkkkk////

               The above example is based on files that the Macintosh
               SMB client (DAVE) available from Thursby
               <URL:http://www.thursby.com> creates for internal use,
               and also still hides all files beginning with a dot.

          hhhhiiiiddddeeee llllooooccccaaaallll uuuusssseeeerrrrssss((((GGGG))))
               This parameter toggles the hiding of local UNIX users
               (root, wheel, floppy, etc) from remote clients.

               Default: hhhhiiiiddddeeee llllooooccccaaaallll uuuusssseeeerrrrssss ==== nnnnoooo

          hhhhiiiiddddeeee uuuunnnnrrrreeeeaaaaddddaaaabbbblllleeee ((((SSSS))))
               This parameter prevents clients from seeing the
               existance of files that cannot be read. Defaults to
               off.

               Default: hhhhiiiiddddeeee uuuunnnnrrrreeeeaaaaddddaaaabbbblllleeee ==== nnnnoooo

          hhhhoooommmmeeeeddddiiiirrrr mmmmaaaapppp ((((GGGG))))



     Page 53                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               If_n_i_s _h_o_m_e_d_i_r is yes, and ssssmmmmbbbbdddd((((8888)))) is also acting as a
               Win95/98 _l_o_g_o_n _s_e_r_v_e_r then this parameter specifies the
               NIS (or YP) map from which the server for the user's
               home directory should be extracted. At present, only
               the Sun auto.home map format is understood. The form of
               the map is:

               uuuusssseeeerrrrnnnnaaaammmmeeee sssseeeerrrrvvvveeeerrrr::::////ssssoooommmmeeee////ffffiiiilllleeee////ssssyyyysssstttteeeemmmm

               and the program will extract the servername from before
               the first ':'. There should probably be a better
               parsing system that copes with different map formats
               and also Amd (another automounter) maps.

               NNNNOOOOTTTTEEEE ::::A working NIS client is required on the system
               for this option to work.

               See also _n_i_s _h_o_m_e_d_i_r , _d_o_m_a_i_n _l_o_g_o_n_s .

               Default: hhhhoooommmmeeeeddddiiiirrrr mmmmaaaapppp ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               Example: hhhhoooommmmeeeeddddiiiirrrr mmmmaaaapppp ==== aaaammmmdddd....hhhhoooommmmeeeeddddiiiirrrr

          hhhhoooosssstttt mmmmssssddddffffssss ((((GGGG))))
               This boolean parameter is only available if Samba has
               been configured and compiled with the  --------wwwwiiiitttthhhh----mmmmssssddddffffssss
               option. If set to yes, Samba will act as a Dfs server,
               and allow Dfs-aware clients to browse Dfs trees hosted
               on the server.

               See also the  _m_s_d_f_s _r_o_o_t share level parameter. For
               more information on setting up a Dfs tree on Samba,
               refer to msdfs_setup.html

               Default: hhhhoooosssstttt mmmmssssddddffffssss ==== nnnnoooo

          hhhhoooossssttttssss aaaalllllllloooowwww ((((SSSS))))
               A synonym for this parameter is _a_l_l_o_w _h_o_s_t_s.

               This parameter is a comma, space, or tab delimited set
               of hosts which are permitted to access a service.

               If specified in the [global] section then it will apply
               to all services, regardless of whether the individual
               service has a different setting.

               You can specify the hosts by name or IP number. For
               example, you could restrict access to only the hosts on
               a Class C subnet with something like aaaalllllllloooowwww hhhhoooossssttttssss ====
               111155550000....222200003333....5555....  . The full syntax of the list is described
               in the man page _h_o_s_t_s__a_c_c_e_s_s(_5). Note that this man
               page may not be present on your system, so a brief



     Page 54                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               description will be given here also.

               Note that the localhost address 127.0.0.1 will always
               be allowed access unless specifically denied by a _h_o_s_t_s
               _d_e_n_y option.

               You can also specify hosts by network/netmask pairs and
               by netgroup names if your system supports netgroups.
               The EEEEXXXXCCCCEEEEPPPPTTTT keyword can also be used to limit a wildcard
               list. The following examples may provide some help:

               Example 1: allow all IPs in 150.203.*.*; except one

               hhhhoooossssttttssss aaaalllllllloooowwww ==== 111155550000....222200003333.... EEEEXXXXCCCCEEEEPPPPTTTT 111155550000....222200003333....6666....66666666

               Example 2: allow hosts that match the given
               network/netmask

               hhhhoooossssttttssss aaaalllllllloooowwww ==== 111155550000....222200003333....11115555....0000////222255555555....222255555555....222255555555....0000

               Example 3: allow a couple of hosts

               hhhhoooossssttttssss aaaalllllllloooowwww ==== llllaaaappppllllaaaannnndddd,,,, aaaarrrrvvvviiiiddddssssjjjjaaaauuuurrrr

               Example 4: allow only hosts in NIS netgroup "foonet",
               but deny access from one particular host

               hhhhoooossssttttssss aaaalllllllloooowwww ==== @@@@ffffoooooooonnnneeeetttt

               hhhhoooossssttttssss ddddeeeennnnyyyy ==== ppppiiiirrrraaaatttteeee

               Note that access still requires suitable user-level
               passwords.

               See tttteeeessssttttppppaaaarrrrmmmm((((1111))))
                for a way of testing your host access to see if it
               does what you expect.

               Default: nnnnoooonnnneeee ((((iiii....eeee....,,,, aaaallllllll hhhhoooossssttttssss ppppeeeerrrrmmmmiiiitttttttteeeedddd aaaacccccccceeeessssssss))))

               Example: aaaalllllllloooowwww hhhhoooossssttttssss ==== 111155550000....222200003333....5555.... mmmmyyyyhhhhoooosssstttt....mmmmyyyynnnneeeetttt....eeeedddduuuu....aaaauuuu

          hhhhoooossssttttssss ddddeeeennnnyyyy ((((SSSS))))
               The opposite of _h_o_s_t_s _a_l_l_o_w - hosts listed here are NNNNOOOOTTTT
               permitted access to services unless the specific
               services have their own lists to override this one.
               Where the lists conflict, the _a_l_l_o_w list takes
               precedence.

               Default: nnnnoooonnnneeee ((((iiii....eeee....,,,, nnnnoooo hhhhoooossssttttssss ssssppppeeeecccciiiiffffiiiiccccaaaallllllllyyyy eeeexxxxcccclllluuuuddddeeeedddd))))

               Example: hhhhoooossssttttssss ddddeeeennnnyyyy ==== 111155550000....222200003333....4444.... bbbbaaaaddddhhhhoooosssstttt....mmmmyyyynnnneeeetttt....eeeedddduuuu....aaaauuuu



     Page 55                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          hhhhoooossssttttssss eeeeqqqquuuuiiiivvvv ((((GGGG))))
               If this global parameter is a non-null string, it
               specifies the name of a file to read for the names of
               hosts and users who will be allowed access without
               specifying a password.

               This is not be confused with  _h_o_s_t_s _a_l_l_o_w which is
               about hosts access to services and is more useful for
               guest services.  _h_o_s_t_s _e_q_u_i_v may be useful for NT
               clients which will not supply passwords to Samba.

               NNNNOOOOTTTTEEEE :::: The use of _h_o_s_t_s _e_q_u_i_v can be a major security
               hole. This is because you are trusting the PC to supply
               the correct username. It is very easy to get a PC to
               supply a false username. I recommend that the _h_o_s_t_s
               _e_q_u_i_v option be only used if you really know what you
               are doing, or perhaps on a home network where you trust
               your spouse and kids. And only if you rrrreeeeaaaallllllllyyyy trust them
               :-).

               Default: nnnnoooo hhhhoooosssstttt eeeeqqqquuuuiiiivvvvaaaalllleeeennnncccceeeessss

               Example: hhhhoooossssttttssss eeeeqqqquuuuiiiivvvv ==== ////eeeettttcccc////hhhhoooossssttttssss....eeeeqqqquuuuiiiivvvv

          iiiinnnncccclllluuuuddddeeee ((((GGGG))))
               This allows you to include one config file inside
               another. The file is included literally, as though
               typed in place.

               It takes the standard substitutions, except %_u , %_P and
               %_S.

               Default: nnnnoooo ffffiiiilllleeee iiiinnnncccclllluuuuddddeeeedddd

               Example: iiiinnnncccclllluuuuddddeeee ==== ////uuuussssrrrr////llllooooccccaaaallll////ssssaaaammmmbbbbaaaa////lllliiiibbbb////aaaaddddmmmmiiiinnnn____ssssmmmmbbbb....ccccoooonnnnffff

          iiiinnnnhhhheeeerrrriiiitttt aaaaccccllllssss ((((SSSS))))
               This parameter can be used to ensure that if default
               acls exist on parent directories, they are always
               honored when creating a subdirectory.  The default
               behavior is to use the mode specified when creating the
               directory. Enabling this option sets the mode to 0777,
               thus guaranteeing that default directory acls are
               propagated.

               Default: iiiinnnnhhhheeeerrrriiiitttt aaaaccccllllssss ==== nnnnoooo

          iiiinnnnhhhheeeerrrriiiitttt ppppeeeerrrrmmmmiiiissssssssiiiioooonnnnssss ((((SSSS))))
               The permissions on new files and directories are
               normally governed by  _c_r_e_a_t_e _m_a_s_k,  _d_i_r_e_c_t_o_r_y _m_a_s_k,
               _f_o_r_c_e _c_r_e_a_t_e _m_o_d_e and _f_o_r_c_e _d_i_r_e_c_t_o_r_y _m_o_d_e but the
               boolean inherit permissions parameter overrides this.



     Page 56                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               New directories inherit the mode of the parent
               directory, including bits such as setgid.

               New files inherit their read/write bits from the parent
               directory. Their execute bits continue to be determined
               by _m_a_p _a_r_c_h_i_v_e , _m_a_p _h_i_d_d_e_n and _m_a_p _s_y_s_t_e_m as usual.

               Note that the setuid bit is nnnneeeevvvveeeerrrr set via inheritance
               (the code explicitly prohibits this).

               This can be particularly useful on large systems with
               many users, perhaps several thousand, to allow a single
               [homes] share to be used flexibly by each user.

               See also _c_r_e_a_t_e _m_a_s_k ,  _d_i_r_e_c_t_o_r_y _m_a_s_k,  _f_o_r_c_e _c_r_e_a_t_e
               _m_o_d_e and _f_o_r_c_e _d_i_r_e_c_t_o_r_y _m_o_d_e .

               Default: iiiinnnnhhhheeeerrrriiiitttt ppppeeeerrrrmmmmiiiissssssssiiiioooonnnnssss ==== nnnnoooo

          iiiinnnntttteeeerrrrffffaaaacccceeeessss ((((GGGG))))
               This option allows you to override the default network
               interfaces list that Samba will use for browsing, name
               registration and other NBT traffic. By default Samba
               will query the kernel for the list of all active
               interfaces and use any interfaces except 127.0.0.1 that
               are broadcast capable.

               The option takes a list of interface strings. Each
               string can be in any of the following forms:

               o+ a network interface name (such as eth0). This may
                 include shell-like wildcards so eth* will match any
                 interface starting with the substring "eth"

               o+ an IP address. In this case the netmask is determined
                 from the list of interfaces obtained from the kernel

               o+ an IP/mask pair.

               o+ a broadcast/mask pair.

          The "mask" parameters can either be a bit length (such as 24
          for a C class network) or a full netmask in dotted decimal
          form.

          The "IP" parameters above can either be a full dotted
          decimal IP address or a hostname which will be looked up via
          the OS's normal hostname resolution mechanisms.

          For example, the following line:

          iiiinnnntttteeeerrrrffffaaaacccceeeessss ==== eeeetttthhhh0000 111199992222....111166668888....2222....11110000////22224444 111199992222....111166668888....3333....11110000////222255555555....222255555555....222255555555....0000



     Page 57                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          would configure three network interfaces corresponding to
          the eth0 device and IP addresses 192.168.2.10 and
          192.168.3.10. The netmasks of the latter two interfaces
          would be set to 255.255.255.0.

          See also _b_i_n_d _i_n_t_e_r_f_a_c_e_s _o_n_l_y.

          Default: aaaallllllll aaaaccccttttiiiivvvveeee iiiinnnntttteeeerrrrffffaaaacccceeeessss eeeexxxxcccceeeepppptttt 111122227777....0000....0000....1111 tttthhhhaaaatttt aaaarrrreeee
          bbbbrrrrooooaaaaddddccccaaaasssstttt ccccaaaappppaaaabbbblllleeee

          iiiinnnnvvvvaaaalllliiiidddd uuuusssseeeerrrrssss ((((SSSS))))
               This is a list of users that should not be allowed to
               login to this service. This is really a ppppaaaarrrraaaannnnooooiiiidddd check
               to absolutely ensure an improper setting does not
               breach your security.

               A name starting with a '@' is interpreted as an NIS
               netgroup first (if your system supports NIS), and then
               as a UNIX group if the name was not found in the NIS
               netgroup database.

               A name starting with '+' is interpreted only by looking
               in the UNIX group database. A name starting with '&' is
               interpreted only by looking in the NIS netgroup
               database (this requires NIS to be working on your
               system). The characters '+' and '&' may be used at the
               start of the name in either order so the value +&_g_r_o_u_p
               means check the UNIX group database, followed by the
               NIS netgroup database, and the value &+_g_r_o_u_p means
               check the NIS netgroup database, followed by the UNIX
               group database (the same as the '@' prefix).

               The current servicename is substituted for %_S. This is
               useful in the [homes] section.

               See also _v_a_l_i_d _u_s_e_r_s .

               Default: nnnnoooo iiiinnnnvvvvaaaalllliiiidddd uuuusssseeeerrrrssss

               Example: iiiinnnnvvvvaaaalllliiiidddd uuuusssseeeerrrrssss ==== rrrrooooooootttt ffffrrrreeeedddd aaaaddddmmmmiiiinnnn @@@@wwwwhhhheeeeeeeellll

          kkkkeeeeeeeeppppaaaalllliiiivvvveeee ((((GGGG))))
               The value of the parameter (an integer) represents the
               number of seconds between _k_e_e_p_a_l_i_v_e packets. If this
               parameter is zero, no keepalive packets will be sent.
               Keepalive packets, if sent, allow the server to tell
               whether a client is still present and responding.

               Keepalives should, in general, not be needed if the
               socket being used has the SO_KEEPALIVE attribute set on
               it (see _s_o_c_k_e_t _o_p_t_i_o_n_s). Basically you should only use
               this option if you strike difficulties.



     Page 58                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: kkkkeeeeeeeeppppaaaalllliiiivvvveeee ==== 333300000000

               Example: kkkkeeeeeeeeppppaaaalllliiiivvvveeee ==== 666600000000

          kkkkeeeerrrrnnnneeeellll oooopppplllloooocccckkkkssss ((((GGGG))))
               For UNIXes that support kernel based _o_p_l_o_c_k_s (currently
               only IRIX and the Linux 2.4 kernel), this parameter
               allows the use of them to be turned on or off.

               Kernel oplocks support allows Samba _o_p_l_o_c_k_s to be
               broken whenever a local UNIX process or NFS operation
               accesses a file that ssssmmmmbbbbdddd((((8888))))
                has oplocked. This allows complete data consistency
               between SMB/CIFS, NFS and local file access (and is a
               vvvveeeerrrryyyy cool feature :-).

               This parameter defaults to on, but is translated to a
               no-op on systems that no not have the necessary kernel
               support.  You should never need to touch this
               parameter.

               See also the _o_p_l_o_c_k_s and _l_e_v_e_l_2 _o_p_l_o_c_k_s parameters.

               Default: kkkkeeeerrrrnnnneeeellll oooopppplllloooocccckkkkssss ==== yyyyeeeessss

          llllaaaannnnmmmmaaaannnn aaaauuuutttthhhh ((((GGGG))))
               This parameter determines whether or not smbd will
               attempt to authenticate users using the LANMAN password
               hash.  If disabled, only clients which support NT
               password hashes (e.g. Windows NT/2000 clients,
               smbclient, etc... but not Windows 95/98 or the MS DOS
               network client) will be able to connect to the Samba
               host.

               Default : llllaaaannnnmmmmaaaannnn aaaauuuutttthhhh ==== yyyyeeeessss

          llllaaaarrrrggggeeee rrrreeeeaaaaddddwwwwrrrriiiitttteeee ((((GGGG))))
               This parameter determines whether or not smbd supports
               the new 64k streaming read and write varient SMB
               requests introduced with Windows 2000. Note that due to
               Windows 2000 client redirector bugs this requires Samba
               to be running on a 64-bit capable operating system such
               as IRIX, Solaris or a Linux 2.4 kernel. Can improve
               performance by 10% with Windows 2000 clients. Defaults
               to on. Windows NT 4.0 only supports read version of
               this call, and ignores the write version.

               Default : llllaaaarrrrggggeeee rrrreeeeaaaaddddwwwwrrrriiiitttteeee ==== yyyyeeeessss

          llllddddaaaapppp aaaaddddmmmmiiiinnnn ddddnnnn ((((GGGG))))
               This parameter is only available if Samba has been
               configure to include the --------wwwwiiiitttthhhh----llllddddaaaappppssssaaaammmm option at



     Page 59                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               compile time. This option should be considered
               experimental and under active development.

               The _l_d_a_p _a_d_m_i_n _d_n defines the Distinguished Name (DN)
               name used by Samba to contact the ldap server when
               retreiving user account information. The _l_d_a_p _a_d_m_i_n _d_n
               is used in conjunction with the admin dn password
               stored in the _p_r_i_v_a_t_e/_s_e_c_r_e_t_s._t_d_b file. See the
               ssssmmmmbbbbppppaaaasssssssswwwwdddd((((8888)))) man page for more information on how to
               accmplish this.

               Default : nnnnoooonnnneeee

          llllddddaaaapppp ffffiiiilllltttteeeerrrr ((((GGGG))))
               This parameter is only available if Samba has been
               configure to include the --------wwwwiiiitttthhhh----llllddddaaaappppssssaaaammmm option at
               compile time. This option should be considered
               experimental and under active development.

               This parameter specifies the RFC 2254 compliant LDAP
               search filter.  The default is to match the login name
               with the uid attribute for all entries matching the
               sambaAccount objectclass. Note that this filter should
               only return one entry.

               Default : llllddddaaaapppp ffffiiiilllltttteeeerrrr ====
               ((((&&&&((((uuuuiiiidddd====%%%%uuuu))))((((oooobbbbjjjjeeeeccccttttccccllllaaaassssssss====ssssaaaammmmbbbbaaaaAAAAccccccccoooouuuunnnntttt))))))))

          llllddddaaaapppp ppppoooorrrrtttt ((((GGGG))))
               This parameter is only available if Samba has been
               configure to include the --------wwwwiiiitttthhhh----llllddddaaaappppssssaaaammmm option at
               compile time. This option should be considered
               experimental and under active development.

               This option is used to control the tcp port number used
               to contact the _l_d_a_p _s_e_r_v_e_r.  The default is to use the
               stand LDAPS port 636.

               See Also: ldap ssl

               Default : llllddddaaaapppp ppppoooorrrrtttt ==== 666633336666 ;;;; iiiiffff llllddddaaaapppp ssssssssllll ==== oooonnnn

               Default : llllddddaaaapppp ppppoooorrrrtttt ==== 333388889999 ;;;; iiiiffff llllddddaaaapppp ssssssssllll ==== ooooffffffff

          llllddddaaaapppp sssseeeerrrrvvvveeeerrrr ((((GGGG))))
               This parameter is only available if Samba has been
               configure to include the --------wwwwiiiitttthhhh----llllddddaaaappppssssaaaammmm option at
               compile time. This option should be considered
               experimental and under active development.

               This parameter should contains the FQDN of the ldap
               directory server which should be queried to locate user



     Page 60                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               account information.

               Default : llllddddaaaapppp sssseeeerrrrvvvveeeerrrr ==== llllooooccccaaaallllhhhhoooosssstttt

          llllddddaaaapppp ssssssssllll ((((GGGG))))
               This parameter is only available if Samba has been
               configure to include the --------wwwwiiiitttthhhh----llllddddaaaappppssssaaaammmm option at
               compile time. This option should be considered
               experimental and under active development.

               This option is used to define whether or not Samba
               should use SSL when connecting to the _l_d_a_p _s_e_r_v_e_r. This
               is NNNNOOOOTTTT related to Samba SSL support which is enabled by
               specifying the --------wwwwiiiitttthhhh----ssssssssllll option to the _c_o_n_f_i_g_u_r_e
               script (see _s_s_l).

               The _l_d_a_p _s_s_l can be set to one of three values: (a) on
               - Always use SSL when contacting the _l_d_a_p _s_e_r_v_e_r, (b)
               off - Never use SSL when querying the directory, or (c)
               start_tls - Use the LDAPv3 StartTLS extended operation
               (RFC2830) for communicating with the directory server.

               Default : llllddddaaaapppp ssssssssllll ==== oooonnnn

          llllddddaaaapppp ssssuuuuffffffffiiiixxxx ((((GGGG))))
               This parameter is only available if Samba has been
               configure to include the --------wwwwiiiitttthhhh----llllddddaaaappppssssaaaammmm option at
               compile time. This option should be considered
               experimental and under active development.

               Default : nnnnoooonnnneeee

          lllleeeevvvveeeellll2222 oooopppplllloooocccckkkkssss ((((SSSS))))
               This parameter controls whether Samba supports level2
               (read-only) oplocks on a share.

               Level2, or read-only oplocks allow Windows NT clients
               that have an oplock on a file to downgrade from a
               read-write oplock to a read-only oplock once a second
               client opens the file (instead of releasing all oplocks
               on a second open, as in traditional, exclusive
               oplocks). This allows all openers of the file that
               support level2 oplocks to cache the file for read-ahead
               only (ie. they may not cache writes or lock requests)
               and increases performance for many accesses of files
               that are not commonly written (such as application .EXE
               files).

               Once one of the clients which have a read-only oplock
               writes to the file all clients are notified (no reply
               is needed or waited for) and told to break their
               oplocks to "none" and delete any read-ahead caches.



     Page 61                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               It is recommended that this parameter be turned on to
               speed access to shared executables.

               For more discussions on level2 oplocks see the CIFS
               spec.

               Currently, if _k_e_r_n_e_l _o_p_l_o_c_k_s are supported then level2
               oplocks are not granted (even if this parameter is set
               to yes). Note also, the _o_p_l_o_c_k_s parameter must be set
               to yes on this share in order for this parameter to
               have any effect.

               See also the _o_p_l_o_c_k_s and _k_e_r_n_e_l _o_p_l_o_c_k_s parameters.

               Default: lllleeeevvvveeeellll2222 oooopppplllloooocccckkkkssss ==== yyyyeeeessss

          llllmmmm aaaannnnnnnnoooouuuunnnncccceeee ((((GGGG))))
               This parameter determines if  nnnnmmmmbbbbdddd((((8888)))) will produce
               Lanman announce broadcasts that are needed by OS/2
               clients in order for them to see the Samba server in
               their browse list. This parameter can have three
               values, yes, no, or auto. The default is auto. If set
               to no Samba will never produce these broadcasts. If set
               to yes Samba will produce Lanman announce broadcasts at
               a frequency set by the parameter _l_m _i_n_t_e_r_v_a_l. If set to
               auto Samba will not send Lanman announce broadcasts by
               default but will listen for them. If it hears such a
               broadcast on the wire it will then start sending them
               at a frequency set by the parameter _l_m _i_n_t_e_r_v_a_l.

               See also _l_m _i_n_t_e_r_v_a_l .

               Default: llllmmmm aaaannnnnnnnoooouuuunnnncccceeee ==== aaaauuuuttttoooo

               Example: llllmmmm aaaannnnnnnnoooouuuunnnncccceeee ==== yyyyeeeessss

          llllmmmm iiiinnnntttteeeerrrrvvvvaaaallll ((((GGGG))))
               If Samba is set to produce Lanman announce broadcasts
               needed by OS/2 clients (see the  _l_m _a_n_n_o_u_n_c_e parameter)
               then this parameter defines the frequency in seconds
               with which they will be made. If this is set to zero
               then no Lanman announcements will be made despite the
               setting of the _l_m _a_n_n_o_u_n_c_e parameter.

               See also _l_m _a_n_n_o_u_n_c_e.

               Default: llllmmmm iiiinnnntttteeeerrrrvvvvaaaallll ==== 66660000

               Example: llllmmmm iiiinnnntttteeeerrrrvvvvaaaallll ==== 111122220000

          llllooooaaaadddd pppprrrriiiinnnntttteeeerrrrssss ((((GGGG))))
               A boolean variable that controls whether all printers



     Page 62                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               in the printcap will be loaded for browsing by default.
               See the printers section for more details.

               Default: llllooooaaaadddd pppprrrriiiinnnntttteeeerrrrssss ==== yyyyeeeessss

          llllooooccccaaaallll mmmmaaaasssstttteeeerrrr ((((GGGG))))
               This option allows  nnnnmmmmbbbbdddd((((8888)))) to try and become a local
               master browser on a subnet. If set to no then  nnnnmmmmbbbbdddd
               will not attempt to become a local master browser on a
               subnet and will also lose in all browsing elections. By
               default this value is set to yes. Setting this value to
               yes doesn't mean that Samba will bbbbeeeeccccoooommmmeeee the local
               master browser on a subnet, just that nnnnmmmmbbbbdddd will
               ppppaaaarrrrttttiiiicccciiiippppaaaatttteeee in elections for local master browser.

               Setting this value to no will cause nnnnmmmmbbbbdddd nnnneeeevvvveeeerrrr to
               become a local master browser.

               Default: llllooooccccaaaallll mmmmaaaasssstttteeeerrrr ==== yyyyeeeessss

          lllloooocccckkkk ddddiiiirrrr ((((GGGG))))
               Synonym for  _l_o_c_k _d_i_r_e_c_t_o_r_y.

          lllloooocccckkkk ddddiiiirrrreeeeccccttttoooorrrryyyy ((((GGGG))))
               This option specifies the directory where lock files
               will be placed. The lock files are used to implement
               the _m_a_x _c_o_n_n_e_c_t_i_o_n_s option.

               Default: lllloooocccckkkk ddddiiiirrrreeeeccccttttoooorrrryyyy ==== $$$${{{{pppprrrreeeeffffiiiixxxx}}}}////vvvvaaaarrrr////lllloooocccckkkkssss

               Example: lllloooocccckkkk ddddiiiirrrreeeeccccttttoooorrrryyyy ==== ////vvvvaaaarrrr////rrrruuuunnnn////ssssaaaammmmbbbbaaaa////lllloooocccckkkkssss

          lllloooocccckkkk ssssppppiiiinnnn ccccoooouuuunnnntttt ((((GGGG))))
               This parameter controls the number of times that smbd
               should attempt to gain a byte range lock on the behalf
               of a client request. Experiments have shown that
               Windows 2k servers do not reply with a failure if the
               lock could not be immediately granted, but try a few
               more times in case the lock could later be aquired.
               This behavior is used to support PC database formats
               such as MS Access and FoxPro.

               Default: lllloooocccckkkk ssssppppiiiinnnn ccccoooouuuunnnntttt ==== 2222

          lllloooocccckkkk ssssppppiiiinnnn ttttiiiimmmmeeee ((((GGGG))))
               The time in microseconds that smbd should pause before
               attempting to gain a failed lock. See _l_o_c_k _s_p_i_n _c_o_u_n_t
               for more details.

               Default: lllloooocccckkkk ssssppppiiiinnnn ttttiiiimmmmeeee ==== 11110000

          lllloooocccckkkkiiiinnnngggg ((((SSSS))))



     Page 63                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               This controls whether or not locking will be performed
               by the server in response to lock requests from the
               client.

               If lllloooocccckkkkiiiinnnngggg ==== nnnnoooo, all lock and unlock requests will
               appear to succeed and all lock queries will report that
               the file in question is available for locking.

               If lllloooocccckkkkiiiinnnngggg ==== yyyyeeeessss, real locking will be performed by the
               server.

               This option mmmmaaaayyyy be useful for read-only filesystems
               which mmmmaaaayyyy not need locking (such as CDROM drives),
               although setting this parameter of no is not really
               recommended even in this case.

               Be careful about disabling locking either globally or
               in a specific service, as lack of locking may result in
               data corruption. You should never need to set this
               parameter.

               Default: lllloooocccckkkkiiiinnnngggg ==== yyyyeeeessss

          lllloooogggg ffffiiiilllleeee ((((GGGG))))
               This option allows you to override the name of the
               Samba log file (also known as the debug file).

               This option takes the standard substitutions, allowing
               you to have separate log files for each user or
               machine.

               Example: lllloooogggg ffffiiiilllleeee ==== ////uuuussssrrrr////llllooooccccaaaallll////ssssaaaammmmbbbbaaaa////vvvvaaaarrrr////lllloooogggg....%%%%mmmm

          lllloooogggg lllleeeevvvveeeellll ((((GGGG))))
               The value of the parameter (an integer) allows the
               debug level (logging level) to be specified in the
               _s_m_b._c_o_n_f file. This is to give greater flexibility in
               the configuration of the system.

               The default will be the log level specified on the
               command line or level zero if none was specified.

               Example: lllloooogggg lllleeeevvvveeeellll ==== 3333

          llllooooggggoooonnnn ddddrrrriiiivvvveeee ((((GGGG))))
               This parameter specifies the local path to which the
               home directory will be connected (see _l_o_g_o_n _h_o_m_e) and
               is only used by NT Workstations.

               Note that this option is only useful if Samba is set up
               as a logon server.




     Page 64                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: llllooooggggoooonnnn ddddrrrriiiivvvveeee ==== zzzz::::

               Example: llllooooggggoooonnnn ddddrrrriiiivvvveeee ==== hhhh::::

          llllooooggggoooonnnn hhhhoooommmmeeee ((((GGGG))))
               This parameter specifies the home directory location
               when a Win95/98 or NT Workstation logs into a Samba
               PDC. It allows you to do

               C:\> NNNNEEEETTTT UUUUSSSSEEEE HHHH:::: ////HHHHOOOOMMMMEEEE

               from a command prompt, for example.

               This option takes the standard substitutions, allowing
               you to have separate logon scripts for each user or
               machine.

               This parameter can be used with Win9X workstations to
               ensure that roaming profiles are stored in a
               subdirectory of the user's home directory. This is done
               in the following way:

               llllooooggggoooonnnn hhhhoooommmmeeee ==== \\\\\\\\%%%%NNNN\\\\%%%%UUUU\\\\pppprrrrooooffffiiiilllleeee

               This tells Samba to return the above string, with
               substitutions made when a client requests the info,
               generally in a NetUserGetInfo request. Win9X clients
               truncate the info to \\server\share when a user does
               nnnneeeetttt uuuusssseeee ////hhhhoooommmmeeee but use the whole string when dealing
               with profiles.

               Note that in prior versions of Samba, the  _l_o_g_o_n _p_a_t_h
               was returned rather than _l_o_g_o_n _h_o_m_e. This broke nnnneeeetttt uuuusssseeee
               ////hhhhoooommmmeeee but allowed profiles outside the home directory.
               The current implementation is correct, and can be used
               for profiles if you use the above trick.

               This option is only useful if Samba is set up as a
               logon server.

               Default: llllooooggggoooonnnn hhhhoooommmmeeee ==== """"\\\\\\\\%%%%NNNN\\\\%%%%UUUU""""

               Example: llllooooggggoooonnnn hhhhoooommmmeeee ==== """"\\\\\\\\rrrreeeemmmmooootttteeee____ssssmmmmbbbb____sssseeeerrrrvvvveeeerrrr\\\\%%%%UUUU""""

          llllooooggggoooonnnn ppppaaaatttthhhh ((((GGGG))))
               This parameter specifies the home directory where
               roaming profiles (NTuser.dat etc files for Windows NT)
               are stored. Contrary to previous versions of these
               manual pages, it has nothing to do with Win 9X roaming
               profiles. To find out how to handle roaming profiles
               for Win 9X system, see the  _l_o_g_o_n _h_o_m_e parameter.




     Page 65                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               This option takes the standard substitutions, allowing
               you to have separate logon scripts for each user or
               machine. It also specifies the directory from which the
               "Application Data", (_d_e_s_k_t_o_p, _s_t_a_r_t _m_e_n_u, _n_e_t_w_o_r_k
               _n_e_i_g_h_b_o_r_h_o_o_d, _p_r_o_g_r_a_m_s and other folders, and their
               contents, are loaded and displayed on your Windows NT
               client.

               The share and the path must be readable by the user for
               the preferences and directories to be loaded onto the
               Windows NT client. The share must be writeable when the
               user logs in for the first time, in order that the
               Windows NT client can create the NTuser.dat and other
               directories.

               Thereafter, the directories and any of the contents
               can, if required, be made read-only. It is not
               advisable that the NTuser.dat file be made read-only -
               rename it to NTuser.man to achieve the desired effect
               (a MMMMAAAANNNNdatory profile).

               Windows clients can sometimes maintain a connection to
               the [homes] share, even though there is no user logged
               in. Therefore, it is vital that the logon path does not
               include a reference to the homes share (i.e. setting
               this parameter to \%N\%U\profile_path will cause
               problems).

               This option takes the standard substitutions, allowing
               you to have separate logon scripts for each user or
               machine.

               Note that this option is only useful if Samba is set up
               as a logon server.

               Default: llllooooggggoooonnnn ppppaaaatttthhhh ==== \\\\\\\\%%%%NNNN\\\\%%%%UUUU\\\\pppprrrrooooffffiiiilllleeee

               Example: llllooooggggoooonnnn ppppaaaatttthhhh ==== \\\\\\\\PPPPRRRROOOOFFFFIIIILLLLEEEESSSSEEEERRRRVVVVEEEERRRR\\\\PPPPRRRROOOOFFFFIIIILLLLEEEE\\\\%%%%UUUU

          llllooooggggoooonnnn ssssccccrrrriiiipppptttt ((((GGGG))))
               This parameter specifies the batch file (.bat) or NT
               command file (.cmd) to be downloaded and run on a
               machine when a user successfully logs in. The file must
               contain the DOS style CR/LF line endings. Using a DOS-
               style editor to create the file is recommended.

               The script must be a relative path to the [netlogon]
               service. If the [netlogon] service specifies a  _p_a_t_h of
               /_u_s_r/_l_o_c_a_l/_s_a_m_b_a/_n_e_t_l_o_g_o_n , and llllooooggggoooonnnn ssssccccrrrriiiipppptttt ====
               SSSSTTTTAAAARRRRTTTTUUUUPPPP....BBBBAAAATTTT, then the file that will be downloaded is:

               /_u_s_r/_l_o_c_a_l/_s_a_m_b_a/_n_e_t_l_o_g_o_n/_S_T_A_R_T_U_P._B_A_T



     Page 66                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               The contents of the batch file are entirely your
               choice. A suggested command would be to add NNNNEEEETTTT TTTTIIIIMMMMEEEE
               \\\\\\\\SSSSEEEERRRRVVVVEEEERRRR ////SSSSEEEETTTT ////YYYYEEEESSSS, to force every machine to
               synchronize clocks with the same time server. Another
               use would be to add NNNNEEEETTTT UUUUSSSSEEEE UUUU:::: \\\\\\\\SSSSEEEERRRRVVVVEEEERRRR\\\\UUUUTTTTIIIILLLLSSSS for
               commonly used utilities, or  NNNNEEEETTTT UUUUSSSSEEEE QQQQ::::
               \\\\\\\\SSSSEEEERRRRVVVVEEEERRRR\\\\IIIISSSSOOOO9999000000001111____QQQQAAAA for example.

               Note that it is particularly important not to allow
               write access to the [netlogon] share, or to grant users
               write permission on the batch files in a secure
               environment, as this would allow the batch files to be
               arbitrarily modified and security to be breached.

               This option takes the standard substitutions, allowing
               you to have separate logon scripts for each user or
               machine.

               This option is only useful if Samba is set up as a
               logon server.

               Default: nnnnoooo llllooooggggoooonnnn ssssccccrrrriiiipppptttt ddddeeeeffffiiiinnnneeeedddd

               Example: llllooooggggoooonnnn ssssccccrrrriiiipppptttt ==== ssssccccrrrriiiippppttttssss\\\\%%%%UUUU....bbbbaaaatttt

          llllppppppppaaaauuuusssseeee ccccoooommmmmmmmaaaannnndddd ((((SSSS))))
               This parameter specifies the command to be executed on
               the server host in order to stop printing or spooling a
               specific print job.

               This command should be a program or script which takes
               a printer name and job number to pause the print job.
               One way of implementing this is by using job
               priorities, where jobs having a too low priority won't
               be sent to the printer.

               If a %_p is given then the printer name is put in its
               place. A %_j is replaced with the job number (an
               integer). On HPUX (see _p_r_i_n_t_i_n_g=_h_p_u_x ), if the -_p%_p
               option is added to the lpq command, the job will show
               up with the correct status, i.e. if the job priority is
               lower than the set fence priority it will have the
               PAUSED status, whereas if the priority is equal or
               higher it will have the SPOOLED or PRINTING status.

               Note that it is good practice to include the absolute
               path in the lppause command as the PATH may not be
               available to the server.

               See also the _p_r_i_n_t_i_n_g parameter.

               Default: Currently no default value is given to this



     Page 67                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               string, unless the value of the _p_r_i_n_t_i_n_g parameter is
               SYSV, in which case the default is :

               llllpppp ----iiii %%%%pppp----%%%%jjjj ----HHHH hhhhoooolllldddd

               or if the value of the _p_r_i_n_t_i_n_g parameter is SOFTQ,
               then the default is:

               qqqqssssttttaaaatttt ----ssss ----jjjj%%%%jjjj ----hhhh

               Example for HPUX: llllppppppppaaaauuuusssseeee ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////bbbbiiiinnnn////llllppppaaaalllltttt %%%%pppp----
               %%%%jjjj ----pppp0000

          llllppppqqqq ccccaaaacccchhhheeee ttttiiiimmmmeeee ((((GGGG))))
               This controls how long lpq info will be cached for to
               prevent the llllppppqqqq command being called too often. A
               separate cache is kept for each variation of the  llllppppqqqq
               command used by the system, so if you use different llllppppqqqq
               commands for different users then they won't share
               cache information.

               The cache files are stored in /_t_m_p/_l_p_q._x_x_x_x where xxxx
               is a hash of the llllppppqqqq command in use.

               The default is 10 seconds, meaning that the cached
               results of a previous identical llllppppqqqq command will be
               used if the cached data is less than 10 seconds old. A
               large value may be advisable if your llllppppqqqq command is
               very slow.

               A value of 0 will disable caching completely.

               See also the _p_r_i_n_t_i_n_g parameter.

               Default: llllppppqqqq ccccaaaacccchhhheeee ttttiiiimmmmeeee ==== 11110000

               Example: llllppppqqqq ccccaaaacccchhhheeee ttttiiiimmmmeeee ==== 33330000

          llllppppqqqq ccccoooommmmmmmmaaaannnndddd ((((SSSS))))
               This parameter specifies the command to be executed on
               the server host in order to obtain llllppppqqqq -style printer
               status information.

               This command should be a program or script which takes
               a printer name as its only parameter and outputs
               printer status information.

               Currently nine styles of printer status information are
               supported; BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX, CUPS,
               and SOFTQ. This covers most UNIX systems. You control
               which type is expected using the _p_r_i_n_t_i_n_g = option.




     Page 68                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Some clients (notably Windows for Workgroups) may not
               correctly send the connection number for the printer
               they are requesting status information about. To get
               around this, the server reports on the first printer
               service connected to by the client. This only happens
               if the connection number sent is invalid.

               If a %_p is given then the printer name is put in its
               place. Otherwise it is placed at the end of the
               command.

               Note that it is good practice to include the absolute
               path in the _l_p_q _c_o_m_m_a_n_d as the $$$$PPPPAAAATTTTHHHH may not be
               available to the server. When compiled with the CUPS
               libraries, no _l_p_q _c_o_m_m_a_n_d is needed because smbd will
               make a library call to obtain the print queue listing.

               See also the _p_r_i_n_t_i_n_g parameter.

               Default: ddddeeeeppppeeeennnnddddssss oooonnnn tttthhhheeee sssseeeettttttttiiiinnnngggg ooooffff  _p_r_i_n_t_i_n_g

               Example: llllppppqqqq ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////bbbbiiiinnnn////llllppppqqqq ----PPPP%%%%pppp

          llllpppprrrreeeessssuuuummmmeeee ccccoooommmmmmmmaaaannnndddd ((((SSSS))))
               This parameter specifies the command to be executed on
               the server host in order to restart or continue
               printing or spooling a specific print job.

               This command should be a program or script which takes
               a printer name and job number to resume the print job.
               See also the _l_p_p_a_u_s_e _c_o_m_m_a_n_d parameter.

               If a %_p is given then the printer name is put in its
               place. A %_j is replaced with the job number (an
               integer).

               Note that it is good practice to include the absolute
               path in the _l_p_r_e_s_u_m_e _c_o_m_m_a_n_d as the PATH may not be
               available to the server.

               See also the _p_r_i_n_t_i_n_g parameter.

               Default: Currently no default value is given to this
               string, unless the value of the _p_r_i_n_t_i_n_g parameter is
               SYSV, in which case the default is :

               llllpppp ----iiii %%%%pppp----%%%%jjjj ----HHHH rrrreeeessssuuuummmmeeee

               or if the value of the _p_r_i_n_t_i_n_g parameter is SOFTQ,
               then the default is:

               qqqqssssttttaaaatttt ----ssss ----jjjj%%%%jjjj ----rrrr



     Page 69                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Example for HPUX: llllpppprrrreeeessssuuuummmmeeee ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////bbbbiiiinnnn////llllppppaaaalllltttt
               %%%%pppp----%%%%jjjj ----pppp2222

          llllpppprrrrmmmm ccccoooommmmmmmmaaaannnndddd ((((SSSS))))
               This parameter specifies the command to be executed on
               the server host in order to delete a print job.

               This command should be a program or script which takes
               a printer name and job number, and deletes the print
               job.

               If a %_p is given then the printer name is put in its
               place. A %_j is replaced with the job number (an
               integer).

               Note that it is good practice to include the absolute
               path in the _l_p_r_m _c_o_m_m_a_n_d as the PATH may not be
               available to the server.

               See also the _p_r_i_n_t_i_n_g parameter.

               Default: ddddeeeeppppeeeennnnddddssss oooonnnn tttthhhheeee sssseeeettttttttiiiinnnngggg ooooffff _p_r_i_n_t_i_n_g

               Example 1: llllpppprrrrmmmm ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////bbbbiiiinnnn////llllpppprrrrmmmm ----PPPP%%%%pppp %%%%jjjj

               Example 2: llllpppprrrrmmmm ccccoooommmmmmmmaaaannnndddd ==== ////uuuussssrrrr////bbbbiiiinnnn////ccccaaaannnncccceeeellll %%%%pppp----%%%%jjjj

          mmmmaaaacccchhhhiiiinnnneeee ppppaaaasssssssswwwwoooorrrrdddd ttttiiiimmmmeeeeoooouuuutttt ((((GGGG))))
               If a Samba server is a member of a Windows NT Domain
               (see the security = domain) parameter) then
               periodically a running  smbd(8) process will try and
               change the MACHINE ACCOUNT PASSWORD stored in the TDB
               called _p_r_i_v_a_t_e/_s_e_c_r_e_t_s._t_d_b . This parameter specifies
               how often this password will be changed, in seconds.
               The default is one week (expressed in seconds), the
               same as a Windows NT Domain member server.

               See also ssssmmmmbbbbppppaaaasssssssswwwwdddd((((8888))))
                and the  security = domain) parameter.

               Default: mmmmaaaacccchhhhiiiinnnneeee ppppaaaasssssssswwwwoooorrrrdddd ttttiiiimmmmeeeeoooouuuutttt ==== 666600004444888800000000

          mmmmaaaaggggiiiicccc oooouuuuttttppppuuuutttt ((((SSSS))))
               This parameter specifies the name of a file which will
               contain output created by a magic script (see the _m_a_g_i_c
               _s_c_r_i_p_t parameter below).

               Warning: If two clients use the same _m_a_g_i_c _s_c_r_i_p_t in
               the same directory the output file content is
               undefined.

               Default: mmmmaaaaggggiiiicccc oooouuuuttttppppuuuutttt ==== <<<<mmmmaaaaggggiiiicccc ssssccccrrrriiiipppptttt nnnnaaaammmmeeee>>>>....oooouuuutttt



     Page 70                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Example: mmmmaaaaggggiiiicccc oooouuuuttttppppuuuutttt ==== mmmmyyyyffffiiiilllleeee....ttttxxxxtttt

          mmmmaaaaggggiiiicccc ssssccccrrrriiiipppptttt ((((SSSS))))
               This parameter specifies the name of a file which, if
               opened, will be executed by the server when the file is
               closed. This allows a UNIX script to be sent to the
               Samba host and executed on behalf of the connected
               user.

               Scripts executed in this way will be deleted upon
               completion assuming that the user has the appropriate
               level of privilege and the file permissions allow the
               deletion.

               If the script generates output, output will be sent to
               the file specified by the  _m_a_g_i_c _o_u_t_p_u_t parameter (see
               above).

               Note that some shells are unable to interpret scripts
               containing CR/LF instead of CR as the end-of-line
               marker. Magic scripts must be executable aaaassss iiiissss on the
               host, which for some hosts and some shells will require
               filtering at the DOS end.

               Magic scripts are EEEEXXXXPPPPEEEERRRRIIIIMMMMEEEENNNNTTTTAAAALLLL and should NNNNOOOOTTTT be relied
               upon.

               Default: NNNNoooonnnneeee.... MMMMaaaaggggiiiicccc ssssccccrrrriiiippppttttssss ddddiiiissssaaaabbbblllleeeedddd....

               Example: mmmmaaaaggggiiiicccc ssssccccrrrriiiipppptttt ==== uuuusssseeeerrrr....ccccsssshhhh

          mmmmaaaannnngggglllleeee ccccaaaasssseeee ((((SSSS))))
               See the section on  NAME MANGLING

               Default: mmmmaaaannnngggglllleeee ccccaaaasssseeee ==== nnnnoooo

          mmmmaaaannnngggglllleeeedddd mmmmaaaapppp ((((SSSS))))
               This is for those who want to directly map UNIX file
               names which cannot be represented on Windows/DOS. The
               mangling of names is not always what is needed. In
               particular you may have documents with file extensions
               that differ between DOS and UNIX. For example, under
               UNIX it is common to use ._h_t_m_l for HTML files, whereas
               under Windows/DOS ._h_t_m is more commonly used.

               So to map _h_t_m_l to _h_t_m you would use:

               mmmmaaaannnngggglllleeeedddd mmmmaaaapppp ==== ((((****....hhhhttttmmmmllll ****....hhhhttttmmmm))))

               One very useful case is to remove the annoying ;_1 off
               the ends of filenames on some CDROMs (only visible
               under some UNIXes). To do this use a map of (*;1 *;).



     Page 71                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: nnnnoooo mmmmaaaannnngggglllleeeedddd mmmmaaaapppp

               Example: mmmmaaaannnngggglllleeeedddd mmmmaaaapppp ==== ((((****;;;;1111 ****;;;;))))

          mmmmaaaannnngggglllleeeedddd nnnnaaaammmmeeeessss ((((SSSS))))
               This controls whether non-DOS names under UNIX should
               be mapped to DOS-compatible names ("mangled") and made
               visible, or whether non-DOS names should simply be
               ignored.

               See the section on  NAME MANGLING for details on how to
               control the mangling process.

               If mangling algorithm "hash" is used then the mangling
               algorithm is as follows:

               o+ The first (up to) five alphanumeric characters before
                 the rightmost dot of the filename are preserved,
                 forced to upper case, and appear as the first (up to)
                 five characters of the mangled name.

               o+ A tilde "~" is appended to the first part of the
                 mangled name, followed by a two-character unique
                 sequence, based on the original root name (i.e., the
                 original filename minus its final extension). The
                 final extension is included in the hash calculation
                 only if it contains any upper case characters or is
                 longer than three characters.

                 Note that the character to use may be specified using
                 the _m_a_n_g_l_i_n_g _c_h_a_r option, if you don't like '~'.

               o+ The first three alphanumeric characters of the final
                 extension are preserved, forced to upper case and
                 appear as the extension of the mangled name. The
                 final extension is defined as that part of the
                 original filename after the rightmost dot. If there
                 are no dots in the filename, the mangled name will
                 have no extension (except in the case of "hidden
                 files" - see below).

               o+ Files whose UNIX name begins with a dot will be
                 presented as DOS hidden files. The mangled name will
                 be created as for other filenames, but with the
                 leading dot removed and "___" as its extension
                 regardless of actual original extension (that's three
                 underscores).

          The two-digit hash value consists of upper case alphanumeric
          characters.

          This algorithm can cause name collisions only if files in a



     Page 72                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          directory share the same first five alphanumeric characters.
          The probability of such a clash is 1/1300.

          If mangling algorithm "hash2" is used then the mangling
          algorithm is as follows:

               o+ The first alphanumeric character before the rightmost
                 dot of the filename is preserved, forced to upper
                 case, and appears as the first character of the
                 mangled name.

               o+ A base63 hash of 5 characters is generated and the
                 first 4 characters of that hash are appended to the
                 first character.

               o+ A tilde "~" is appended to the first part of the
                 mangled name, followed by the final character of the
                 base36 hash of the name.

                 Note that the character to use may be specified using
                 the _m_a_n_g_l_i_n_g _c_h_a_r option, if you don't like '~'.

               o+ The first three alphanumeric characters of the final
                 extension are preserved, forced to upper case and
                 appear as the extension of the mangled name. The
                 final extension is defined as that part of the
                 original filename after the rightmost dot. If there
                 are no dots in the filename, the mangled name will
                 have no extension (except in the case of "hidden
                 files" - see below).

               o+ Files whose UNIX name begins with a dot will be
                 presented as DOS hidden files. The mangled name will
                 be created as for other filenames, but with the
                 leading dot removed and "___" as its extension
                 regardless of actual original extension (that's three
                 underscores).

          The name mangling (if enabled) allows a file to be copied
          between UNIX directories from Windows/DOS while retaining
          the long UNIX filename. UNIX files can be renamed to a new
          extension from Windows/DOS and will retain the same
          basename. Mangled names do not change between sessions.

          Default: mmmmaaaannnngggglllleeeedddd nnnnaaaammmmeeeessss ==== yyyyeeeessss

          mmmmaaaannnngggglllleeeedddd ssssttttaaaacccckkkk ((((GGGG))))
               This parameter controls the number of mangled names
               that should be cached in the Samba server  smbd(8)

               This stack is a list of recently mangled base names
               (extensions are only maintained if they are longer than



     Page 73                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               3 characters or contains upper case characters).

               The larger this value, the more likely it is that
               mangled names can be successfully converted to correct
               long UNIX names. However, large stack sizes will slow
               most directory accesses. Smaller stacks save memory in
               the server (each stack element costs 256 bytes).

               It is not possible to absolutely guarantee correct long
               filenames, so be prepared for some surprises!

               Default: mmmmaaaannnngggglllleeeedddd ssssttttaaaacccckkkk ==== 55550000

               Example: mmmmaaaannnngggglllleeeedddd ssssttttaaaacccckkkk ==== 111100000000

          mmmmaaaannnngggglllliiiinnnngggg cccchhhhaaaarrrr ((((SSSS))))
               This controls what character is used as the mmmmaaaaggggiiiicccc
               character in name mangling. The default is a '~' but
               this may interfere with some software. Use this option
               to set it to whatever you prefer.

               Default: mmmmaaaannnngggglllliiiinnnngggg cccchhhhaaaarrrr ==== ~~~~

               Example: mmmmaaaannnngggglllliiiinnnngggg cccchhhhaaaarrrr ==== ^^^^

          mmmmaaaannnngggglllliiiinnnngggg mmmmaaaatttthhhhoooodddd((((GGGG))))
               controls the algorithm used for the generating the
               mangled names. Can take two different values, "hash"
               and "hash2". "hash" is the default and is the algorithm
               that has been used in Samba for many years. "hash2" is
               a newer and considered a better algorithm (generates
               less collisions) in the names.  However, many Win32
               applications store the mangled names and so changing to
               the new algorithm must not be done lightly as these
               applications may break unless reinstalled.  New
               installations of Samba may set the default to hash2.

               Default: mmmmaaaannnngggglllliiiinnnngggg mmmmeeeetttthhhhoooodddd ==== hhhhaaaasssshhhh

               Example: mmmmaaaannnngggglllliiiinnnngggg mmmmeeeetttthhhhoooodddd ==== hhhhaaaasssshhhh2222

          mmmmaaaapppp aaaarrrrcccchhhhiiiivvvveeee ((((SSSS))))
               This controls whether the DOS archive attribute should
               be mapped to the UNIX owner execute bit. The DOS
               archive bit is set when a file has been modified since
               its last backup. One motivation for this option it to
               keep Samba/your PC from making any file it touches from
               becoming executable under UNIX. This can be quite
               annoying for shared source code, documents, etc...

               Note that this requires the _c_r_e_a_t_e _m_a_s_k parameter to be
               set such that owner execute bit is not masked out (i.e.



     Page 74                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               it must include 100). See the parameter  _c_r_e_a_t_e _m_a_s_k
               for details.

               Default: mmmmaaaapppp aaaarrrrcccchhhhiiiivvvveeee ==== yyyyeeeessss

          mmmmaaaapppp hhhhiiiiddddddddeeeennnn ((((SSSS))))
               This controls whether DOS style hidden files should be
               mapped to the UNIX world execute bit.

               Note that this requires the _c_r_e_a_t_e _m_a_s_k to be set such
               that the world execute bit is not masked out (i.e. it
               must include 001). See the parameter  _c_r_e_a_t_e _m_a_s_k for
               details.

               Default: mmmmaaaapppp hhhhiiiiddddddddeeeennnn ==== nnnnoooo

          mmmmaaaapppp ssssyyyysssstttteeeemmmm ((((SSSS))))
               This controls whether DOS style system files should be
               mapped to the UNIX group execute bit.

               Note that this requires the _c_r_e_a_t_e _m_a_s_k to be set such
               that the group execute bit is not masked out (i.e. it
               must include 010). See the parameter  _c_r_e_a_t_e _m_a_s_k for
               details.

               Default: mmmmaaaapppp ssssyyyysssstttteeeemmmm ==== nnnnoooo

          mmmmaaaapppp ttttoooo gggguuuueeeesssstttt ((((GGGG))))
               This parameter is only useful in  security modes other
               than _s_e_c_u_r_i_t_y = _s_h_a_r_e - i.e. user, server, and domain.

               This parameter can take three different values, which
               tell smbd(8) what to do with user login requests that
               don't match a valid UNIX user in some way.

               The three settings are :

               o+ Never - Means user login requests with an invalid
                 password are rejected. This is the default.

               o+ Bad User - Means user logins with an invalid password
                 are rejected, unless the username does not exist, in
                 which case it is treated as a guest login and mapped
                 into the  _g_u_e_s_t _a_c_c_o_u_n_t.

               o+ Bad Password - Means user logins with an invalid
                 password are treated as a guest login and mapped into
                 the guest account. Note that this can cause problems
                 as it means that any user incorrectly typing their
                 password will be silently logged on as "guest" - and
                 will not know the reason they cannot access files
                 they think they should - there will have been no



     Page 75                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



                 message given to them that they got their password
                 wrong. Helpdesk services will hhhhaaaatttteeee you if you set the
                 _m_a_p _t_o _g_u_e_s_t parameter this way :-).

          Note that this parameter is needed to set up "Guest" share
          services when using _s_e_c_u_r_i_t_y modes other than share. This is
          because in these modes the name of the resource being
          requested is nnnnooootttt sent to the server until after the server
          has successfully authenticated the client so the server
          cannot make authentication decisions at the correct time
          (connection to the share) for "Guest" shares.

          For people familiar with the older Samba releases, this
          parameter maps to the old compile-time setting of the
          GUEST_SESSSETUP value in local.h.

          Default: mmmmaaaapppp ttttoooo gggguuuueeeesssstttt ==== NNNNeeeevvvveeeerrrr

          Example: mmmmaaaapppp ttttoooo gggguuuueeeesssstttt ==== BBBBaaaadddd UUUUsssseeeerrrr

          mmmmaaaaxxxx ccccoooonnnnnnnneeeeccccttttiiiioooonnnnssss ((((SSSS))))
               This option allows the number of simultaneous
               connections to a service to be limited. If _m_a_x
               _c_o_n_n_e_c_t_i_o_n_s is greater than 0 then connections will be
               refused if this number of connections to the service
               are already open. A value of zero mean an unlimited
               number of connections may be made.

               Record lock files are used to implement this feature.
               The lock files will be stored in the directory
               specified by the _l_o_c_k _d_i_r_e_c_t_o_r_y option.

               Default: mmmmaaaaxxxx ccccoooonnnnnnnneeeeccccttttiiiioooonnnnssss ==== 0000

               Example: mmmmaaaaxxxx ccccoooonnnnnnnneeeeccccttttiiiioooonnnnssss ==== 11110000

          mmmmaaaaxxxx ddddiiiisssskkkk ssssiiiizzzzeeee ((((GGGG))))
               This option allows you to put an upper limit on the
               apparent size of disks. If you set this option to 100
               then all shares will appear to be not larger than 100
               MB in size.

               Note that this option does not limit the amount of data
               you can put on the disk. In the above case you could
               still store much more than 100 MB on the disk, but if a
               client ever asks for the amount of free disk space or
               the total disk size then the result will be bounded by
               the amount specified in _m_a_x _d_i_s_k _s_i_z_e.

               This option is primarily useful to work around bugs in
               some pieces of software that can't handle very large
               disks, particularly disks over 1GB in size.



     Page 76                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               A _m_a_x _d_i_s_k _s_i_z_e of 0 means no limit.

               Default: mmmmaaaaxxxx ddddiiiisssskkkk ssssiiiizzzzeeee ==== 0000

               Example: mmmmaaaaxxxx ddddiiiisssskkkk ssssiiiizzzzeeee ==== 1111000000000000

          mmmmaaaaxxxx lllloooogggg ssssiiiizzzzeeee ((((GGGG))))
               This option (an integer in kilobytes) specifies the max
               size the log file should grow to. Samba periodically
               checks the size and if it is exceeded it will rename
               the file, adding a ._o_l_d extension.

               A size of 0 means no limit.

               Default: mmmmaaaaxxxx lllloooogggg ssssiiiizzzzeeee ==== 5555000000000000

               Example: mmmmaaaaxxxx lllloooogggg ssssiiiizzzzeeee ==== 1111000000000000

          mmmmaaaaxxxx mmmmuuuuxxxx ((((GGGG))))
               This option controls the maximum number of outstanding
               simultaneous SMB operations that Samba tells the client
               it will allow. You should never need to set this
               parameter.

               Default: mmmmaaaaxxxx mmmmuuuuxxxx ==== 55550000

          mmmmaaaaxxxx ooooppppeeeennnn ffffiiiilllleeeessss ((((GGGG))))
               This parameter limits the maximum number of open files
               that one smbd(8) file serving process may have open for
               a client at any one time. The default for this
               parameter is set very high (10,000) as Samba uses only
               one bit per unopened file.

               The limit of the number of open files is usually set by
               the UNIX per-process file descriptor limit rather than
               this parameter so you should never need to touch this
               parameter.

               Default: mmmmaaaaxxxx ooooppppeeeennnn ffffiiiilllleeeessss ==== 11110000000000000000

          mmmmaaaaxxxx pppprrrriiiinnnntttt jjjjoooobbbbssss ((((SSSS))))
               This parameter limits the maximum number of jobs
               allowable in a Samba printer queue at any given moment.
               If this number is exceeded,  ssssmmmmbbbbdddd((((8888)))) will remote "Out
               of Space" to the client.  See all _t_o_t_a_l _p_r_i_n_t _j_o_b_s.

               Default: mmmmaaaaxxxx pppprrrriiiinnnntttt jjjjoooobbbbssss ==== 1111000000000000

               Example: mmmmaaaaxxxx pppprrrriiiinnnntttt jjjjoooobbbbssss ==== 5555000000000000

          mmmmaaaaxxxx pppprrrroooottttooooccccoooollll ((((GGGG))))
               The value of the parameter (a string) is the highest



     Page 77                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               protocol level that will be supported by the server.

               Possible values are :

               o+ CORE: Earliest version. No concept of user names.

               o+ COREPLUS: Slight improvements on CORE for efficiency.

               o+ LANMAN1: First  mmmmooooddddeeeerrrrnnnn version of the protocol. Long
                 filename support.

               o+ LANMAN2: Updates to Lanman1 protocol.

               o+ NT1: Current up to date version of the protocol. Used
                 by Windows NT. Known as CIFS.

          Normally this option should not be set as the automatic
          negotiation phase in the SMB protocol takes care of choosing
          the appropriate protocol.

          See also _m_i_n _p_r_o_t_o_c_o_l

          Default: mmmmaaaaxxxx pppprrrroooottttooooccccoooollll ==== NNNNTTTT1111

          Example: mmmmaaaaxxxx pppprrrroooottttooooccccoooollll ==== LLLLAAAANNNNMMMMAAAANNNN1111

          mmmmaaaaxxxx ssssmmmmbbbbdddd pppprrrroooocccceeeesssssssseeeessss ((((GGGG))))
               This parameter limits the maximum number of ssssmmmmbbbbdddd((((8888))))
               processes concurrently running on a system and is
               intended as a stopgap to prevent degrading service to
               clients in the event that the server has insufficient
               resources to handle more than this number of
               connections. Remember that under normal operating
               conditions, each user will have an smbd associated with
               him or her to handle connections to all shares from a
               given host.

               Default: mmmmaaaaxxxx ssssmmmmbbbbdddd pppprrrroooocccceeeesssssssseeeessss ==== 0000 ## no limit

               Example: mmmmaaaaxxxx ssssmmmmbbbbdddd pppprrrroooocccceeeesssssssseeeessss ==== 1111000000000000

          mmmmaaaaxxxx ttttttttllll ((((GGGG))))
               This option tells nmbd(8) what the default 'time to
               live' of NetBIOS names should be (in seconds) when nnnnmmmmbbbbdddd
               is requesting a name using either a broadcast packet or
               from a WINS server. You should never need to change
               this parameter. The default is 3 days.

               Default: mmmmaaaaxxxx ttttttttllll ==== 222255559999222200000000

          mmmmaaaaxxxx wwwwiiiinnnnssss ttttttttllll ((((GGGG))))
               This option tells nmbd(8)



     Page 78                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



                when acting as a WINS server ( _w_i_n_s _s_u_p_p_o_r_t = _y_e_s)
               what the maximum 'time to live' of NetBIOS names that
               nnnnmmmmbbbbdddd will grant will be (in seconds). You should never
               need to change this parameter. The default is 6 days
               (518400 seconds).

               See also the _m_i_n _w_i_n_s _t_t_l parameter.

               Default: mmmmaaaaxxxx wwwwiiiinnnnssss ttttttttllll ==== 555511118888444400000000

          mmmmaaaaxxxx xxxxmmmmiiiitttt ((((GGGG))))
               This option controls the maximum packet size that will
               be negotiated by Samba. The default in Samba 2.2.6 is
               now 16644 (changed from 65535 in earlier releases)
               which matches Windows 2000. This allows better
               performance with Windows NT clients.  The maximum is
               65535. In some cases you may find you get better
               performance with a smaller value. A value below 2048 is
               likely to cause problems.

               Default: mmmmaaaaxxxx xxxxmmmmiiiitttt ==== 11116666666644444444

               Example: mmmmaaaaxxxx xxxxmmmmiiiitttt ==== 8888111199992222

          mmmmeeeessssssssaaaaggggeeee ccccoooommmmmmmmaaaannnndddd ((((GGGG))))
               This specifies what command to run when the server
               receives a WinPopup style message.

               This would normally be a command that would deliver the
               message somehow. How this is to be done is up to your
               imagination.

               An example is:

               mmmmeeeessssssssaaaaggggeeee ccccoooommmmmmmmaaaannnndddd ==== ccccsssshhhh ----cccc ''''xxxxeeeeddddiiiitttt %%%%ssss;;;;rrrrmmmm %%%%ssss'''' &&&&

               This delivers the message using xxxxeeeeddddiiiitttt, then removes it
               afterwards. NNNNOOOOTTTTEEEE TTTTHHHHAAAATTTT IIIITTTT IIIISSSS VVVVEEEERRRRYYYY IIIIMMMMPPPPOOOORRRRTTTTAAAANNNNTTTT TTTTHHHHAAAATTTT TTTTHHHHIIIISSSS
               CCCCOOOOMMMMMMMMAAAANNNNDDDD RRRREEEETTTTUUUURRRRNNNN IIIIMMMMMMMMEEEEDDDDIIIIAAAATTTTEEEELLLLYYYY. That's why I have the '&'
               on the end. If it doesn't return immediately then your
               PCs may freeze when sending messages (they should
               recover after 30 seconds, hopefully).

               All messages are delivered as the global guest user.
               The command takes the standard substitutions, although
               %_u won't work (%_U may be better in this case).

               Apart from the standard substitutions, some additional
               ones apply. In particular:

               o+ %_s = the filename containing the message.




     Page 79                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               o+ %_t = the destination that the message was sent to
                 (probably the server name).

               o+ %_f = who the message is from.

          You could make this command send mail, or whatever else
          takes your fancy. Please let us know of any really
          interesting ideas you have.

          Here's a way of sending the messages as mail to root:

          mmmmeeeessssssssaaaaggggeeee ccccoooommmmmmmmaaaannnndddd ==== ////bbbbiiiinnnn////mmmmaaaaiiiillll ----ssss ''''mmmmeeeessssssssaaaaggggeeee ffffrrrroooommmm %%%%ffff oooonnnn %%%%mmmm'''' rrrrooooooootttt
          <<<< %%%%ssss;;;; rrrrmmmm %%%%ssss

          If you don't have a message command then the message won't
          be delivered and Samba will tell the sender there was an
          error. Unfortunately WfWg totally ignores the error code and
          carries on regardless, saying that the message was
          delivered.

          If you want to silently delete it then try:

          mmmmeeeessssssssaaaaggggeeee ccccoooommmmmmmmaaaannnndddd ==== rrrrmmmm %%%%ssss

          Default: nnnnoooo mmmmeeeessssssssaaaaggggeeee ccccoooommmmmmmmaaaannnndddd

          Example: mmmmeeeessssssssaaaaggggeeee ccccoooommmmmmmmaaaannnndddd ==== ccccsssshhhh ----cccc ''''xxxxeeeeddddiiiitttt %%%%ssss;;;; rrrrmmmm %%%%ssss'''' &&&&

          mmmmiiiinnnn ppppaaaasssssssswwwwdddd lllleeeennnnggggtttthhhh ((((GGGG))))
               Synonym for  _m_i_n _p_a_s_s_w_o_r_d _l_e_n_g_t_h.

          mmmmiiiinnnn ppppaaaasssssssswwwwoooorrrrdddd lllleeeennnnggggtttthhhh ((((GGGG))))
               This option sets the minimum length in characters of a
               plaintext password that ssssmmmmbbbbdddd will accept when
               performing UNIX password changing.

               See also _u_n_i_x _p_a_s_s_w_o_r_d _s_y_n_c,  _p_a_s_s_w_d _p_r_o_g_r_a_m and _p_a_s_s_w_d
               _c_h_a_t _d_e_b_u_g .

               Default: mmmmiiiinnnn ppppaaaasssssssswwwwoooorrrrdddd lllleeeennnnggggtttthhhh ==== 5555

          mmmmiiiinnnn pppprrrriiiinnnntttt ssssppppaaaacccceeee ((((SSSS))))
               This sets the minimum amount of free disk space that
               must be available before a user will be able to spool a
               print job. It is specified in kilobytes. The default is
               0, which means a user can always spool a print job.

               See also the _p_r_i_n_t_i_n_g parameter.

               Default: mmmmiiiinnnn pppprrrriiiinnnntttt ssssppppaaaacccceeee ==== 0000

               Example: mmmmiiiinnnn pppprrrriiiinnnntttt ssssppppaaaacccceeee ==== 2222000000000000



     Page 80                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          mmmmiiiinnnn pppprrrroooottttooooccccoooollll ((((GGGG))))
               The value of the parameter (a string) is the lowest SMB
               protocol dialect than Samba will support. Please refer
               to the _m_a_x _p_r_o_t_o_c_o_l parameter for a list of valid
               protocol names and a brief description of each. You may
               also wish to refer to the C source code in
               _s_o_u_r_c_e/_s_m_b_d/_n_e_g_p_r_o_t._c for a listing of known protocol
               dialects supported by clients.

               If you are viewing this parameter as a security
               measure, you should also refer to the _l_a_n_m_a_n _a_u_t_h
               parameter. Otherwise, you should never need to change
               this parameter.

               Default : mmmmiiiinnnn pppprrrroooottttooooccccoooollll ==== CCCCOOOORRRREEEE

               Example : mmmmiiiinnnn pppprrrroooottttooooccccoooollll ==== NNNNTTTT1111 # disable DOS clients

          mmmmiiiinnnn wwwwiiiinnnnssss ttttttttllll ((((GGGG))))
               This option tells nmbd(8) when acting as a WINS server
               ( _w_i_n_s _s_u_p_p_o_r_t = _y_e_s) what the minimum 'time to live'
               of NetBIOS names that nnnnmmmmbbbbdddd will grant will be (in
               seconds). You should never need to change this
               parameter. The default is 6 hours (21600 seconds).

               Default: mmmmiiiinnnn wwwwiiiinnnnssss ttttttttllll ==== 22221111666600000000

          mmmmssssddddffffssss rrrrooooooootttt ((((SSSS))))
               This boolean parameter is only available if Samba is
               configured and compiled with the  --------wwwwiiiitttthhhh----mmmmssssddddffffssss option.
               If set to yes, Samba treats the share as a Dfs root and
               allows clients to browse the distributed file system
               tree rooted at the share directory. Dfs links are
               specified in the share directory by symbolic links of
               the form _m_s_d_f_s:_s_e_r_v_e_r_A\_s_h_a_r_e_A,_s_e_r_v_e_r_B\_s_h_a_r_e_B and so on.
               For more information on setting up a Dfs tree on Samba,
               refer to msdfs_setup.html


               See also _h_o_s_t _m_s_d_f_s

               Default: mmmmssssddddffffssss rrrrooooooootttt ==== nnnnoooo

          nnnnaaaammmmeeee rrrreeeessssoooollllvvvveeee oooorrrrddddeeeerrrr ((((GGGG))))
               This option is used by the programs in the Samba suite
               to determine what naming services to use and in what
               order to resolve host names to IP addresses. The option
               takes a space separated string of name resolution
               options.

               The options are :"lmhosts", "host", "wins" and "bcast".
               They cause names to be resolved as follows :



     Page 81                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               o+ lmhosts : Lookup an IP address in the Samba lmhosts
                 file. If the line in lmhosts has no name type
                 attached to the NetBIOS name (see the lmhosts(5) for
                 details) then any name type matches for lookup.

               o+ host : Do a standard host name to IP address
                 resolution, using the system /_e_t_c/_h_o_s_t_s , NIS, or DNS
                 lookups. This method of name resolution is operating
                 system depended for instance on IRIX or Solaris this
                 may be controlled by the /_e_t_c/_n_s_s_w_i_t_c_h._c_o_n_f file.
                 Note that this method is only used if the NetBIOS
                 name type being queried is the 0x20 (server) name
                 type, otherwise it is ignored.

               o+ wins : Query a name with the IP address listed in the
                 _w_i_n_s _s_e_r_v_e_r parameter. If no WINS server has been
                 specified this method will be ignored.

               o+ bcast : Do a broadcast on each of the known local
                 interfaces listed in the _i_n_t_e_r_f_a_c_e_s parameter. This
                 is the least reliable of the name resolution methods
                 as it depends on the target host being on a locally
                 connected subnet.

          Default: nnnnaaaammmmeeee rrrreeeessssoooollllvvvveeee oooorrrrddddeeeerrrr ==== llllmmmmhhhhoooossssttttssss hhhhoooosssstttt wwwwiiiinnnnssss bbbbccccaaaasssstttt

          Example: nnnnaaaammmmeeee rrrreeeessssoooollllvvvveeee oooorrrrddddeeeerrrr ==== llllmmmmhhhhoooossssttttssss bbbbccccaaaasssstttt hhhhoooosssstttt

          This will cause the local lmhosts file to be examined first,
          followed by a broadcast attempt, followed by a normal system
          hostname lookup.

          nnnneeeettttbbbbiiiioooossss aaaalllliiiiaaaasssseeeessss ((((GGGG))))
               This is a list of NetBIOS names that nmbd(8) will
               advertise as additional names by which the Samba server
               is known. This allows one machine to appear in browse
               lists under multiple names. If a machine is acting as a
               browse server or logon server none of these names will
               be advertised as either browse server or logon servers,
               only the primary name of the machine will be advertised
               with these capabilities.

               See also _n_e_t_b_i_o_s _n_a_m_e.

               Default: eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg ((((nnnnoooo aaaaddddddddiiiittttiiiioooonnnnaaaallll nnnnaaaammmmeeeessss))))

               Example: nnnneeeettttbbbbiiiioooossss aaaalllliiiiaaaasssseeeessss ==== TTTTEEEESSSSTTTT TTTTEEEESSSSTTTT1111 TTTTEEEESSSSTTTT2222

          nnnneeeettttbbbbiiiioooossss nnnnaaaammmmeeee ((((GGGG))))
               This sets the NetBIOS name by which a Samba server is
               known. By default it is the same as the first component
               of the host's DNS name. If a machine is a browse server



     Page 82                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               or logon server this name (or the first component of
               the hosts DNS name) will be the name that these
               services are advertised under.

               See also _n_e_t_b_i_o_s _a_l_i_a_s_e_s.

               Default: mmmmaaaacccchhhhiiiinnnneeee DDDDNNNNSSSS nnnnaaaammmmeeee

               Example: nnnneeeettttbbbbiiiioooossss nnnnaaaammmmeeee ==== MMMMYYYYNNNNAAAAMMMMEEEE

          nnnneeeettttbbbbiiiioooossss ssssccccooooppppeeee ((((GGGG))))
               This sets the NetBIOS scope that Samba will operate
               under. This should not be set unless every machine on
               your LAN also sets this value.

          nnnniiiissss hhhhoooommmmeeeeddddiiiirrrr ((((GGGG))))
               Get the home share server from a NIS map. For UNIX
               systems that use an automounter, the user's home
               directory will often be mounted on a workstation on
               demand from a remote server.

               When the Samba logon server is not the actual home
               directory server, but is mounting the home directories
               via NFS then two network hops would be required to
               access the users home directory if the logon server
               told the client to use itself as the SMB server for
               home directories (one over SMB and one over NFS). This
               can be very slow.

               This option allows Samba to return the home share as
               being on a different server to the logon server and as
               long as a Samba daemon is running on the home directory
               server, it will be mounted on the Samba client directly
               from the directory server. When Samba is returning the
               home share to the client, it will consult the NIS map
               specified in  _h_o_m_e_d_i_r _m_a_p and return the server listed
               there.

               Note that for this option to work there must be a
               working NIS system and the Samba server with this
               option must also be a logon server.

               Default: nnnniiiissss hhhhoooommmmeeeeddddiiiirrrr ==== nnnnoooo

          nnnntttt aaaaccccllll ssssuuuuppppppppoooorrrrtttt ((((SSSS))))
               This boolean parameter controls whether smbd(8) will
               attempt to map UNIX permissions into Windows NT access
               control lists.  This parameter was formally a global
               parameter in releases prior to 2.2.2.

               Default: nnnntttt aaaaccccllll ssssuuuuppppppppoooorrrrtttt ==== yyyyeeeessss




     Page 83                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          nnnntttt ppppiiiippppeeee ssssuuuuppppppppoooorrrrtttt ((((GGGG))))
               This boolean parameter controls whether smbd(8) will
               allow Windows NT clients to connect to the NT SMB
               specific IPC$ pipes. This is a developer debugging
               option and can be left alone.

               Default: nnnntttt ppppiiiippppeeee ssssuuuuppppppppoooorrrrtttt ==== yyyyeeeessss

          nnnntttt ssssmmmmbbbb ssssuuuuppppppppoooorrrrtttt ((((GGGG))))
               This boolean parameter controls whether smbd(8) will
               negotiate NT specific SMB support with Windows NT/2k/XP
               clients. Although this is a developer debugging option
               and should be left alone, benchmarking has discovered
               that Windows NT clients give faster performance with
               this option set to no. This is still being
               investigated.  If this option is set to no then Samba
               offers exactly the same SMB calls that versions prior
               to Samba 2.0 offered.  This information may be of use
               if any users are having problems with NT SMB support.

               You should not need to ever disable this parameter.

               Default: nnnntttt ssssmmmmbbbb ssssuuuuppppppppoooorrrrtttt ==== yyyyeeeessss

          nnnntttt ssssttttaaaattttuuuussss ssssuuuuppppppppoooorrrrtttt ((((GGGG))))
               This boolean parameter controls whether smbd(8) will
               negotiate NT specific status support with Windows
               NT/2k/XP clients. This is a developer debugging option
               and should be left alone.  If this option is set to no
               then Samba offers exactly the same DOS error codes that
               versions prior to Samba 2.2.3 reported.

               You should not need to ever disable this parameter.

               Default: nnnntttt ssssttttaaaattttuuuussss ssssuuuuppppppppoooorrrrtttt ==== yyyyeeeessss

          nnnnuuuullllllll ppppaaaasssssssswwwwoooorrrrddddssss ((((GGGG))))
               Allow or disallow client access to accounts that have
               null passwords.

               See also smbpasswd (5)

               Default: nnnnuuuullllllll ppppaaaasssssssswwwwoooorrrrddddssss ==== nnnnoooo

          oooobbbbeeeeyyyy ppppaaaammmm rrrreeeessssttttrrrriiiiccccttttiiiioooonnnnssss ((((GGGG))))
               When Samba 2.2 is configured to enable PAM support
               (i.e. --with-pam), this parameter will control whether
               or not Samba should obey PAM's account and session
               management directives. The default behavior is to use
               PAM for clear text authentication only and to ignore
               any account or session management. Note that Samba
               always ignores PAM for authentication in the case of



     Page 84                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               _e_n_c_r_y_p_t _p_a_s_s_w_o_r_d_s _= _y_e_s . The reason is that PAM
               modules cannot support the challenge/response
               authentication mechanism needed in the presence of SMB
               password encryption.

               Default: oooobbbbeeeeyyyy ppppaaaammmm rrrreeeessssttttrrrriiiiccccttttiiiioooonnnnssss ==== nnnnoooo

          oooonnnnllllyyyy uuuusssseeeerrrr ((((SSSS))))
               This is a boolean option that controls whether
               connections with usernames not in the _u_s_e_r list will be
               allowed. By default this option is disabled so that a
               client can supply a username to be used by the server.
               Enabling this parameter will force the server to only
               user the login names from the _u_s_e_r list and is only
               really useful in shave level security.

               Note that this also means Samba won't try to deduce
               usernames from the service name. This can be annoying
               for the [homes] section. To get around this you could
               use uuuusssseeeerrrr ==== %%%%SSSS which means your _u_s_e_r list will be just
               the service name, which for home directories is the
               name of the user.

               See also the _u_s_e_r parameter.

               Default: oooonnnnllllyyyy uuuusssseeeerrrr ==== nnnnoooo

          oooonnnnllllyyyy gggguuuueeeesssstttt ((((SSSS))))
               A synonym for  _g_u_e_s_t _o_n_l_y.

          oooopppplllloooocccckkkk bbbbrrrreeeeaaaakkkk wwwwaaaaiiiitttt ttttiiiimmmmeeee ((((GGGG))))
               This is a tuning parameter added due to bugs in both
               Windows 9x and WinNT. If Samba responds to a client too
               quickly when that client issues an SMB that can cause
               an oplock break request, then the network client can
               fail and not respond to the break request. This tuning
               parameter (which is set in milliseconds) is the amount
               of time Samba will wait before sending an oplock break
               request to such (broken) clients.

               DDDDOOOO NNNNOOOOTTTT CCCCHHHHAAAANNNNGGGGEEEE TTTTHHHHIIIISSSS PPPPAAAARRRRAAAAMMMMEEEETTTTEEEERRRR UUUUNNNNLLLLEEEESSSSSSSS YYYYOOOOUUUU HHHHAAAAVVVVEEEE RRRREEEEAAAADDDD AAAANNNNDDDD
               UUUUNNNNDDDDEEEERRRRSSSSTTTTOOOOOOOODDDD TTTTHHHHEEEE SSSSAAAAMMMMBBBBAAAA OOOOPPPPLLLLOOOOCCCCKKKK CCCCOOOODDDDEEEE.

               Default: oooopppplllloooocccckkkk bbbbrrrreeeeaaaakkkk wwwwaaaaiiiitttt ttttiiiimmmmeeee ==== 0000

          oooopppplllloooocccckkkk ccccoooonnnntttteeeennnnttttiiiioooonnnn lllliiiimmmmiiiitttt ((((SSSS))))
               This is a vvvveeeerrrryyyy advanced smbd(8) tuning option to
               improve the efficiency of the granting of oplocks under
               multiple client contention for the same file.

               In brief it specifies a number, which causes smbd not
               to grant an oplock even when requested if the



     Page 85                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               approximate number of clients contending for an oplock
               on the same file goes over this limit. This causes ssssmmmmbbbbdddd
               to behave in a similar way to Windows NT.

               DDDDOOOO NNNNOOOOTTTT CCCCHHHHAAAANNNNGGGGEEEE TTTTHHHHIIIISSSS PPPPAAAARRRRAAAAMMMMEEEETTTTEEEERRRR UUUUNNNNLLLLEEEESSSSSSSS YYYYOOOOUUUU HHHHAAAAVVVVEEEE RRRREEEEAAAADDDD AAAANNNNDDDD
               UUUUNNNNDDDDEEEERRRRSSSSTTTTOOOOOOOODDDD TTTTHHHHEEEE SSSSAAAAMMMMBBBBAAAA OOOOPPPPLLLLOOOOCCCCKKKK CCCCOOOODDDDEEEE.

               Default: oooopppplllloooocccckkkk ccccoooonnnntttteeeennnnttttiiiioooonnnn lllliiiimmmmiiiitttt ==== 2222

          oooopppplllloooocccckkkkssss ((((SSSS))))
               This boolean option tells ssssmmmmbbbbdddd whether to issue oplocks
               (opportunistic locks) to file open requests on this
               share. The oplock code can dramatically (approx. 30% or
               more) improve the speed of access to files on Samba
               servers. It allows the clients to aggressively cache
               files locally and you may want to disable this option
               for unreliable network environments (it is turned on by
               default in Windows NT Servers). For more information
               see the file _S_p_e_e_d._t_x_t in the Samba _d_o_c_s/ directory.

               Oplocks may be selectively turned off on certain files
               with a share. See the  _v_e_t_o _o_p_l_o_c_k _f_i_l_e_s parameter. On
               some systems oplocks are recognized by the underlying
               operating system. This allows data synchronization
               between all access to oplocked files, whether it be via
               Samba or NFS or a local UNIX process. See the _k_e_r_n_e_l
               _o_p_l_o_c_k_s parameter for details.

               See also the _k_e_r_n_e_l _o_p_l_o_c_k_s and  _l_e_v_e_l_2 _o_p_l_o_c_k_s
               parameters.

               Default: oooopppplllloooocccckkkkssss ==== yyyyeeeessss

          oooossss lllleeeevvvveeeellll ((((GGGG))))
               This integer value controls what level Samba advertises
               itself as for browse elections. The value of this
               parameter determines whether nmbd(8) has a chance of
               becoming a local master browser for the  _W_O_R_K_G_R_O_U_P in
               the local broadcast area.

               NNNNooootttteeee ::::By default, Samba will win a local master
               browsing election over all Microsoft operating systems
               except a Windows NT 4.0/2000 Domain Controller. This
               means that a misconfigured Samba host can effectively
               isolate a subnet for browsing purposes. See
               _B_R_O_W_S_I_N_G._t_x_t in the Samba _d_o_c_s/ directory for details.

               Default: oooossss lllleeeevvvveeeellll ==== 22220000

               Example: oooossss lllleeeevvvveeeellll ==== 66665555

          oooossss2222 ddddrrrriiiivvvveeeerrrr mmmmaaaapppp ((((GGGG))))



     Page 86                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               The parameter is used to define the absolute path to a
               file containing a mapping of Windows NT printer driver
               names to OS/2 printer driver names. The format is:

               <nt driver name> = <os2 driver name>.<device name>

               For example, a valid entry using the HP LaserJet 5
               printer driver would appear as HHHHPPPP LLLLaaaasssseeeerrrrJJJJeeeetttt 5555LLLL ====
               LLLLAAAASSSSEEEERRRRJJJJEEEETTTT....HHHHPPPP LLLLaaaasssseeeerrrrJJJJeeeetttt 5555LLLL.

               The need for the file is due to the printer driver
               namespace problem described in the Samba Printing HOWTO
               For more details on OS/2 clients, please refer to the
               OS2-Client-HOWTO
                containing in the Samba documentation.

               Default: oooossss2222 ddddrrrriiiivvvveeeerrrr mmmmaaaapppp ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

          ppppaaaammmm ppppaaaasssssssswwwwoooorrrrdddd cccchhhhaaaannnnggggeeee ((((GGGG))))
               With the addition of better PAM support in Samba 2.2,
               this parameter, it is possible to use PAM's password
               change control flag for Samba. If enabled, then PAM
               will be used for password changes when requested by an
               SMB client instead of the program listed in _p_a_s_s_w_d
               _p_r_o_g_r_a_m. It should be possible to enable this without
               changing your _p_a_s_s_w_d _c_h_a_t parameter for most setups.

               Default: ppppaaaammmm ppppaaaasssssssswwwwoooorrrrdddd cccchhhhaaaannnnggggeeee ==== nnnnoooo

          ppppaaaannnniiiicccc aaaaccccttttiiiioooonnnn ((((GGGG))))
               This is a Samba developer option that allows a system
               command to be called when either  smbd(8) crashes. This
               is usually used to draw attention to the fact that a
               problem occurred.

               Default: ppppaaaannnniiiicccc aaaaccccttttiiiioooonnnn ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               Example: ppppaaaannnniiiicccc aaaaccccttttiiiioooonnnn ==== """"////bbbbiiiinnnn////sssslllleeeeeeeepppp 99990000000000000000""""

          ppppaaaasssssssswwwwdddd cccchhhhaaaatttt ((((GGGG))))
               This string controls the """"cccchhhhaaaatttt"""" conversation that takes
               places between smbd and the local password changing
               program to change the user's password. The string
               describes a sequence of response-receive pairs that
               smbd(8) uses to determine what to send to the _p_a_s_s_w_d
               _p_r_o_g_r_a_m and what to expect back. If the expected output
               is not received then the password is not changed.

               This chat sequence is often quite site specific,
               depending on what local methods are used for password
               control (such as NIS etc).




     Page 87                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Note that this parameter only is only used if the _u_n_i_x
               _p_a_s_s_w_o_r_d _s_y_n_c parameter is set to yes. This sequence is
               then called AAAASSSS RRRROOOOOOOOTTTT when the SMB password in the
               smbpasswd file is being changed, without access to the
               old password cleartext. This means that root must be
               able to reset the user's password without knowing the
               text of the previous password. In the presence of
               NIS/YP, this means that the passwd program must be
               executed on the NIS master.

               The string can contain the macro %_n which is
               substituted for the new password. The chat sequence can
               also contain the standard macros \n, \r,  \t and \s to
               give line-feed, carriage-return, tab and space. The
               chat sequence string can also contain a '*' which
               matches any sequence of characters.  Double quotes can
               be used to collect strings with spaces in them into a
               single string.

               If the send string in any part of the chat sequence is
               a full stop ".", then no string is sent. Similarly, if
               the expect string is a full stop then no string is
               expected.

               If the _p_a_m _p_a_s_s_w_o_r_d _c_h_a_n_g_e parameter is set to yes, the
               chat pairs may be matched in any order, and success is
               determined by the PAM result, not any particular
               output. The \n macro is ignored for PAM conversions.

               See also _u_n_i_x _p_a_s_s_w_o_r_d _s_y_n_c,  _p_a_s_s_w_d _p_r_o_g_r_a_m , _p_a_s_s_w_d
               _c_h_a_t _d_e_b_u_g and  _p_a_m _p_a_s_s_w_o_r_d _c_h_a_n_g_e.

               Default: ppppaaaasssssssswwwwdddd cccchhhhaaaatttt ==== ****nnnneeeewwww****ppppaaaasssssssswwwwoooorrrrdddd**** %%%%nnnn\\\\nnnn
               ****nnnneeeewwww****ppppaaaasssssssswwwwoooorrrrdddd**** %%%%nnnn\\\\nnnn ****cccchhhhaaaannnnggggeeeedddd****

               Example: ppppaaaasssssssswwwwdddd cccchhhhaaaatttt ==== """"****EEEEnnnntttteeeerrrr OOOOLLLLDDDD ppppaaaasssssssswwwwoooorrrrdddd****"""" %%%%oooo\\\\nnnn
               """"****EEEEnnnntttteeeerrrr NNNNEEEEWWWW ppppaaaasssssssswwwwoooorrrrdddd****"""" %%%%nnnn\\\\nnnn """"****RRRReeeeeeeennnntttteeeerrrr NNNNEEEEWWWW ppppaaaasssssssswwwwoooorrrrdddd****""""
               %%%%nnnn\\\\nnnn """"****PPPPaaaasssssssswwwwoooorrrrdddd cccchhhhaaaannnnggggeeeedddd****""""

          ppppaaaasssssssswwwwdddd cccchhhhaaaatttt ddddeeeebbbbuuuugggg ((((GGGG))))
               This boolean specifies if the passwd chat script
               parameter is run in ddddeeeebbbbuuuugggg mode. In this mode the
               strings passed to and received from the passwd chat are
               printed in the smbd(8) log with a _d_e_b_u_g _l_e_v_e_l of 100.
               This is a dangerous option as it will allow plaintext
               passwords to be seen in the ssssmmmmbbbbdddd log. It is available
               to help Samba admins debug their _p_a_s_s_w_d _c_h_a_t scripts
               when calling the _p_a_s_s_w_d _p_r_o_g_r_a_m and should be turned
               off after this has been done. This option has no effect
               if the _p_a_m _p_a_s_s_w_o_r_d _c_h_a_n_g_e paramter is set. This
               parameter is off by default.




     Page 88                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               See also _p_a_s_s_w_d _c_h_a_t , _p_a_m _p_a_s_s_w_o_r_d _c_h_a_n_g_e , _p_a_s_s_w_d
               _p_r_o_g_r_a_m .

               Default: ppppaaaasssssssswwwwdddd cccchhhhaaaatttt ddddeeeebbbbuuuugggg ==== nnnnoooo

          ppppaaaasssssssswwwwdddd pppprrrrooooggggrrrraaaammmm ((((GGGG))))
               The name of a program that can be used to set UNIX user
               passwords. Any occurrences of %_u will be replaced with
               the user name. The user name is checked for existence
               before calling the password changing program.

               Also note that many passwd programs insist in
               rrrreeeeaaaassssoooonnnnaaaabbbblllleeee passwords, such as a minimum length, or the
               inclusion of mixed case chars and digits. This can pose
               a problem as some clients (such as Windows for
               Workgroups) uppercase the password before sending it.

               NNNNooootttteeee that if the _u_n_i_x _p_a_s_s_w_o_r_d _s_y_n_c parameter is set to
               yes then this program is called AAAASSSS RRRROOOOOOOOTTTT before the SMB
               password in the smbpasswd(5)
                file is changed. If this UNIX password change fails,
               then ssssmmmmbbbbdddd will fail to change the SMB password also
               (this is by design).

               If the _u_n_i_x _p_a_s_s_w_o_r_d _s_y_n_c parameter is set this
               parameter MMMMUUUUSSSSTTTT UUUUSSSSEEEE AAAABBBBSSSSOOOOLLLLUUUUTTTTEEEE PPPPAAAATTTTHHHHSSSS for AAAALLLLLLLL programs
               called, and must be examined for security implications.
               Note that by default _u_n_i_x _p_a_s_s_w_o_r_d _s_y_n_c is set to no.

               See also _u_n_i_x _p_a_s_s_w_o_r_d _s_y_n_c.

               Default: ppppaaaasssssssswwwwdddd pppprrrrooooggggrrrraaaammmm ==== ////bbbbiiiinnnn////ppppaaaasssssssswwwwdddd

               Example: ppppaaaasssssssswwwwdddd pppprrrrooooggggrrrraaaammmm ==== ////ssssbbbbiiiinnnn////nnnnppppaaaasssssssswwwwdddd %%%%uuuu

          ppppaaaasssssssswwwwoooorrrrdddd lllleeeevvvveeeellll ((((GGGG))))
               Some client/server combinations have difficulty with
               mixed-case passwords. One offending client is Windows
               for Workgroups, which for some reason forces passwords
               to upper case when using the LANMAN1 protocol, but
               leaves them alone when using COREPLUS! Another problem
               child is the Windows 95/98 family of operating systems.
               These clients upper case clear text passwords even when
               NT LM 0.12 selected by the protocol negotiation
               request/response.

               This parameter defines the maximum number of characters
               that may be upper case in passwords.

               For example, say the password given was "FRED". If
               _p_a_s_s_w_o_r_d _l_e_v_e_l is set to 1, the following combinations
               would be tried if "FRED" failed:



     Page 89                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               "Fred", "fred", "fRed", "frEd","freD"

               If _p_a_s_s_w_o_r_d _l_e_v_e_l was set to 2, the following
               combinations would also be tried:

               "FRed", "FrEd", "FreD", "fREd", "fReD", "frED", ..

               And so on.

               The higher value this parameter is set to the more
               likely it is that a mixed case password will be matched
               against a single case password. However, you should be
               aware that use of this parameter reduces security and
               increases the time taken to process a new connection.

               A value of zero will cause only two attempts to be made
               - the password as is and the password in all-lower
               case.

               Default: ppppaaaasssssssswwwwoooorrrrdddd lllleeeevvvveeeellll ==== 0000

               Example: ppppaaaasssssssswwwwoooorrrrdddd lllleeeevvvveeeellll ==== 4444

          ppppaaaasssssssswwwwoooorrrrdddd sssseeeerrrrvvvveeeerrrr ((((GGGG))))
               By specifying the name of another SMB server (such as a
               WinNT box) with this option, and using sssseeeeccccuuuurrrriiiittttyyyy ====
               ddddoooommmmaaaaiiiinnnn or sssseeeeccccuuuurrrriiiittttyyyy ==== sssseeeerrrrvvvveeeerrrr you can get Samba to do all
               its username/password validation via a remote server.

               This option sets the name of the password server to
               use. It must be a NetBIOS name, so if the machine's
               NetBIOS name is different from its Internet name then
               you may have to add its NetBIOS name to the lmhosts
               file which is stored in the same directory as the
               _s_m_b._c_o_n_f file.

               The name of the password server is looked up using the
               parameter _n_a_m_e _r_e_s_o_l_v_e _o_r_d_e_r and so may resolved by any
               method and order described in that parameter.

               The password server much be a machine capable of using
               the "LM1.2X002" or the "NT LM 0.12" protocol, and it
               must be in user level security mode.

               NNNNOOOOTTTTEEEE:::: Using a password server means your UNIX box
               (running Samba) is only as secure as your password
               server. DDDDOOOO NNNNOOOOTTTT CCCCHHHHOOOOOOOOSSSSEEEE AAAA PPPPAAAASSSSSSSSWWWWOOOORRRRDDDD SSSSEEEERRRRVVVVEEEERRRR TTTTHHHHAAAATTTT YYYYOOOOUUUU DDDDOOOONNNN''''TTTT
               CCCCOOOOMMMMPPPPLLLLEEEETTTTEEEELLLLYYYY TTTTRRRRUUUUSSSSTTTT.

               Never point a Samba server at itself for password
               serving. This will cause a loop and could lock up your
               Samba server!



     Page 90                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               The name of the password server takes the standard
               substitutions, but probably the only useful one is %_m ,
               which means the Samba server will use the incoming
               client as the password server. If you use this then you
               better trust your clients, and you had better restrict
               them with hosts allow!

               If the _s_e_c_u_r_i_t_y parameter is set to domain, then the
               list of machines in this option must be a list of
               Primary or Backup Domain controllers for the Domain or
               the character '*', as the Samba server is effectively
               in that domain, and will use cryptographically
               authenticated RPC calls to authenticate the user
               logging on. The advantage of using  sssseeeeccccuuuurrrriiiittttyyyy ==== ddddoooommmmaaaaiiiinnnn
               is that if you list several hosts in the _p_a_s_s_w_o_r_d
               _s_e_r_v_e_r option then ssssmmmmbbbbdddd will try each in turn till it
               finds one that responds. This is useful in case your
               primary server goes down.

               If the _p_a_s_s_w_o_r_d _s_e_r_v_e_r option is set to the character
               '*', then Samba will attempt to auto-locate the Primary
               or Backup Domain controllers to authenticate against by
               doing a query for the name WORKGROUP<1C> and then
               contacting each server returned in the list of IP
               addresses from the name resolution source.

               If the _s_e_c_u_r_i_t_y parameter is set to server, then there
               are different restrictions that sssseeeeccccuuuurrrriiiittttyyyy ==== ddddoooommmmaaaaiiiinnnn
               doesn't suffer from:

               o+ You may list several password servers in the _p_a_s_s_w_o_r_d
                 _s_e_r_v_e_r parameter, however if an ssssmmmmbbbbdddd makes a
                 connection to a password server, and then the
                 password server fails, no more users will be able to
                 be authenticated from this ssssmmmmbbbbdddd. This is a
                 restriction of the SMB/CIFS protocol when in sssseeeeccccuuuurrrriiiittttyyyy
                 ==== sssseeeerrrrvvvveeeerrrr mode and cannot be fixed in Samba.

               o+ If you are using a Windows NT server as your password
                 server then you will have to ensure that your users
                 are able to login from the Samba server, as when in
                 sssseeeeccccuuuurrrriiiittttyyyy ==== sssseeeerrrrvvvveeeerrrr mode the network logon will appear
                 to come from there rather than from the users
                 workstation.

          See also the _s_e_c_u_r_i_t_y parameter.

          Default: ppppaaaasssssssswwwwoooorrrrdddd sssseeeerrrrvvvveeeerrrr ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

          Example: ppppaaaasssssssswwwwoooorrrrdddd sssseeeerrrrvvvveeeerrrr ==== NNNNTTTT----PPPPDDDDCCCC,,,, NNNNTTTT----BBBBDDDDCCCC1111,,,, NNNNTTTT----BBBBDDDDCCCC2222

          Example: ppppaaaasssssssswwwwoooorrrrdddd sssseeeerrrrvvvveeeerrrr ==== ****



     Page 91                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          ppppaaaatttthhhh ((((SSSS))))
               This parameter specifies a directory to which the user
               of the service is to be given access. In the case of
               printable services, this is where print data will spool
               prior to being submitted to the host for printing.

               For a printable service offering guest access, the
               service should be readonly and the path should be
               world-writeable and have the sticky bit set. This is
               not mandatory of course, but you probably won't get the
               results you expect if you do otherwise.

               Any occurrences of %_u in the path will be replaced with
               the UNIX username that the client is using on this
               connection. Any occurrences of %_m will be replaced by
               the NetBIOS name of the machine they are connecting
               from. These replacements are very useful for setting up
               pseudo home directories for users.

               Note that this path will be based on  _r_o_o_t _d_i_r if one
               was specified.

               Default: nnnnoooonnnneeee

               Example: ppppaaaatttthhhh ==== ////hhhhoooommmmeeee////ffffrrrreeeedddd

          ppppiiiidddd ddddiiiirrrreeeeccccttttoooorrrryyyy ((((GGGG))))
               This option specifies the directory where pid files
               will be placed.

               Default: ppppiiiidddd ddddiiiirrrreeeeccccttttoooorrrryyyy ==== $$$${{{{pppprrrreeeeffffiiiixxxx}}}}////vvvvaaaarrrr////lllloooocccckkkkssss

               Example: ppppiiiidddd ddddiiiirrrreeeeccccttttoooorrrryyyy ==== ////vvvvaaaarrrr////rrrruuuunnnn////

          ppppoooossssiiiixxxx lllloooocccckkkkiiiinnnngggg ((((SSSS))))
               The ssssmmmmbbbbdddd((((8888)))) daemon maintains an database of file locks
               obtained by SMB clients.  The default behavior is to
               map this internal database to POSIX locks. This means
               that file locks obtained by SMB clients are consistent
               with those seen by POSIX compliant applications
               accessing the files via a non-SMB method (e.g. NFS or
               local file access). You should never need to disable
               this parameter.

               Default: ppppoooossssiiiixxxx lllloooocccckkkkiiiinnnngggg ==== yyyyeeeessss

          ppppoooosssstttteeeexxxxeeeecccc ((((SSSS))))
               This option specifies a command to be run whenever the
               service is disconnected. It takes the usual
               substitutions. The command may be run as the root on
               some systems.




     Page 92                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               An interesting example may be to unmount server
               resources:

               ppppoooosssstttteeeexxxxeeeecccc ==== ////eeeettttcccc////uuuummmmoooouuuunnnntttt ////ccccddddrrrroooommmm

               See also _p_r_e_e_x_e_c .

               Default: nnnnoooonnnneeee ((((nnnnoooo ccccoooommmmmmmmaaaannnndddd eeeexxxxeeeeccccuuuutttteeeedddd))))

               Example: ppppoooosssstttteeeexxxxeeeecccc ==== eeeecccchhhhoooo \\\\""""%%%%uuuu ddddiiiissssccccoooonnnnnnnneeeecccctttteeeedddd ffffrrrroooommmm %%%%SSSS ffffrrrroooommmm
               %%%%mmmm ((((%%%%IIII))))\\\\"""" >>>>>>>> ////ttttmmmmpppp////lllloooogggg

          ppppoooossssttttssssccccrrrriiiipppptttt ((((SSSS))))
               This parameter forces a printer to interpret the print
               files as PostScript. This is done by adding a %!  to
               the start of print output.

               This is most useful when you have lots of PCs that
               persist in putting a control-D at the start of print
               jobs, which then confuses your printer.

               Default: ppppoooossssttttssssccccrrrriiiipppptttt ==== nnnnoooo

          pppprrrreeeeeeeexxxxeeeecccc ((((SSSS))))
               This option specifies a command to be run whenever the
               service is connected to. It takes the usual
               substitutions.

               An interesting example is to send the users a welcome
               message every time they log in. Maybe a message of the
               day? Here is an example:

               pppprrrreeeeeeeexxxxeeeecccc ==== ccccsssshhhh ----cccc ''''eeeecccchhhhoooo \\\\""""WWWWeeeellllccccoooommmmeeee ttttoooo %%%%SSSS!!!!\\\\"""" ||||
               ////uuuussssrrrr////llllooooccccaaaallll////ssssaaaammmmbbbbaaaa////bbbbiiiinnnn////ssssmmmmbbbbcccclllliiiieeeennnntttt ----MMMM %%%%mmmm ----IIII %%%%IIII'''' &&&&

               Of course, this could get annoying after a while :-)

               See also _p_r_e_e_x_e_c _c_l_o_s_e and _p_o_s_t_e_x_e_c .

               Default: nnnnoooonnnneeee ((((nnnnoooo ccccoooommmmmmmmaaaannnndddd eeeexxxxeeeeccccuuuutttteeeedddd))))

               Example: pppprrrreeeeeeeexxxxeeeecccc ==== eeeecccchhhhoooo \\\\""""%%%%uuuu ccccoooonnnnnnnneeeecccctttteeeedddd ttttoooo %%%%SSSS ffffrrrroooommmm %%%%mmmm
               ((((%%%%IIII))))\\\\"""" >>>>>>>> ////ttttmmmmpppp////lllloooogggg

          pppprrrreeeeeeeexxxxeeeecccc cccclllloooosssseeee ((((SSSS))))
               This boolean option controls whether a non-zero return
               code from _p_r_e_e_x_e_c should close the service being
               connected to.

               Default: pppprrrreeeeeeeexxxxeeeecccc cccclllloooosssseeee ==== nnnnoooo

          pppprrrreeeeffffeeeerrrrrrrreeeedddd mmmmaaaasssstttteeeerrrr ((((GGGG))))



     Page 93                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               This boolean parameter controls if nmbd(8) is a
               preferred master browser for its workgroup.

               If this is set to yes, on startup, nnnnmmmmbbbbdddd will force an
               election, and it will have a slight advantage in
               winning the election. It is recommended that this
               parameter is used in conjunction with  _d_o_m_a_i_n _m_a_s_t_e_r ====
               yyyyeeeessss, so that  nnnnmmmmbbbbdddd can guarantee becoming a domain
               master.

               Use this option with caution, because if there are
               several hosts (whether Samba servers, Windows 95 or NT)
               that are preferred master browsers on the same subnet,
               they will each periodically and continuously attempt to
               become the local master browser. This will result in
               unnecessary broadcast traffic and reduced browsing
               capabilities.

               See also _o_s _l_e_v_e_l .

               Default: pppprrrreeeeffffeeeerrrrrrrreeeedddd mmmmaaaasssstttteeeerrrr ==== aaaauuuuttttoooo

          pppprrrreeeeffffeeeerrrreeeedddd mmmmaaaasssstttteeeerrrr ((((GGGG))))
               Synonym for  _p_r_e_f_e_r_r_e_d _m_a_s_t_e_r for people who cannot
               spell :-).

          pppprrrreeeellllooooaaaadddd
               This is a list of services that you want to be
               automatically added to the browse lists. This is most
               useful for homes and printers services that would
               otherwise not be visible.

               Note that if you just want all printers in your
               printcap file loaded then the  _l_o_a_d _p_r_i_n_t_e_r_s option is
               easier.

               Default: nnnnoooo pppprrrreeeellllooooaaaaddddeeeedddd sssseeeerrrrvvvviiiicccceeeessss

               Example: pppprrrreeeellllooooaaaadddd ==== ffffrrrreeeedddd llllpppp ccccoooolllloooorrrrllllpppp

          pppprrrreeeesssseeeerrrrvvvveeee ccccaaaasssseeee ((((SSSS))))
               This controls if new filenames are created with the
               case that the client passes, or if they are forced to
               be the _d_e_f_a_u_l_t _c_a_s_e .

               Default: pppprrrreeeesssseeeerrrrvvvveeee ccccaaaasssseeee ==== yyyyeeeessss

               See the section on NAME MANGLING for a fuller
               discussion.

          pppprrrriiiinnnntttt ccccoooommmmmmmmaaaannnndddd ((((SSSS))))
               After a print job has finished spooling to a service,



     Page 94                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               this command will be used via a ssssyyyysssstttteeeemmmm(((()))) call to
               process the spool file. Typically the command specified
               will submit the spool file to the host's printing
               subsystem, but there is no requirement that this be the
               case. The server will not remove the spool file, so
               whatever command you specify should remove the spool
               file when it has been processed, otherwise you will
               need to manually remove old spool files.

               The print command is simply a text string. It will be
               used verbatim after macro substitutions have been made:

               s, %p - the path to the spool file name

               %p - the appropriate printer name

               %J - the job name as transmitted by the client.

               %c - The number of printed pages of the spooled job (if
               known).

               %z - the size of the spooled print job (in bytes)

               The print command MMMMUUUUSSSSTTTT contain at least one occurrence
               of %_s or %_f - the %_p is optional. At the time a job is
               submitted, if no printer name is supplied the %_p will
               be silently removed from the printer command.

               If specified in the [global] section, the print command
               given will be used for any printable service that does
               not have its own print command specified.

               If there is neither a specified print command for a
               printable service nor a global print command, spool
               files will be created but not processed and (most
               importantly) not removed.

               Note that printing may fail on some UNIXes from the
               nobody account. If this happens then create an
               alternative guest account that can print and set the
               _g_u_e_s_t _a_c_c_o_u_n_t in the [global] section.

               You can form quite complex print commands by realizing
               that they are just passed to a shell. For example the
               following will log a print job, print the file, then
               remove it. Note that ';' is the usual separator for
               command in shell scripts.

               pppprrrriiiinnnntttt ccccoooommmmmmmmaaaannnndddd ==== eeeecccchhhhoooo PPPPrrrriiiinnnnttttiiiinnnngggg %%%%ssss >>>>>>>> ////ttttmmmmpppp////pppprrrriiiinnnntttt....lllloooogggg;;;; llllpppprrrr
               ----PPPP %%%%pppp %%%%ssss;;;; rrrrmmmm %%%%ssss

               You may have to vary this command considerably



     Page 95                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               depending on how you normally print files on your
               system. The default for the parameter varies depending
               on the setting of the  _p_r_i_n_t_i_n_g parameter.

               Default: For pppprrrriiiinnnnttttiiiinnnngggg ==== BBBBSSSSDDDD,,,, AAAAIIIIXXXX,,,, QQQQNNNNXXXX,,,, LLLLPPPPRRRRNNNNGGGG oooorrrr PPPPLLLLPPPP ::::

               pppprrrriiiinnnntttt ccccoooommmmmmmmaaaannnndddd ==== llllpppprrrr ----rrrr ----PPPP%%%%pppp %%%%ssss

               For pppprrrriiiinnnnttttiiiinnnngggg ==== SSSSYYYYSSSSVVVV oooorrrr HHHHPPPPUUUUXXXX ::::

               pppprrrriiiinnnntttt ccccoooommmmmmmmaaaannnndddd ==== llllpppp ----cccc ----dddd%%%%pppp %%%%ssss;;;; rrrrmmmm %%%%ssss

               For pppprrrriiiinnnnttttiiiinnnngggg ==== SSSSOOOOFFFFTTTTQQQQ ::::

               pppprrrriiiinnnntttt ccccoooommmmmmmmaaaannnndddd ==== llllpppp ----dddd%%%%pppp ----ssss %%%%ssss;;;; rrrrmmmm %%%%ssss

               For printing = CUPS : If SAMBA is compiled against
               libcups, then printcap = cups uses the CUPS API to
               submit jobs, etc. Otherwise it maps to the System V
               commands with the -oraw option for printing, i.e. it
               uses llllpppp ----cccc ----dddd%%%%pppp ----oooorrrraaaawwww;;;; rrrrmmmm %%%%ssss. With pppprrrriiiinnnnttttiiiinnnngggg ==== ccccuuuuppppssss, and
               if SAMBA is compiled against libcups, any manually set
               print command will be ignored.

               Example: pppprrrriiiinnnntttt ccccoooommmmmmmmaaaannnndddd ====
               ////uuuussssrrrr////llllooooccccaaaallll////ssssaaaammmmbbbbaaaa////bbbbiiiinnnn////mmmmyyyypppprrrriiiinnnnttttssssccccrrrriiiipppptttt %%%%pppp %%%%ssss

          pppprrrriiiinnnntttt ooookkkk ((((SSSS))))
               Synonym for  _p_r_i_n_t_a_b_l_e.

          pppprrrriiiinnnnttttaaaabbbblllleeee ((((SSSS))))
               If this parameter is yes, then clients may open, write
               to and submit spool files on the directory specified
               for the service.

               Note that a printable service will ALWAYS allow writing
               to the service path (user privileges permitting) via
               the spooling of print data. The _r_e_a_d _o_n_l_y parameter
               controls only non-printing access to the resource.

               Default: pppprrrriiiinnnnttttaaaabbbblllleeee ==== nnnnoooo

          pppprrrriiiinnnnttttccccaaaapppp ((((GGGG))))
               Synonym for  _p_r_i_n_t_c_a_p _n_a_m_e.

          pppprrrriiiinnnnttttccccaaaapppp nnnnaaaammmmeeee ((((GGGG))))
               This parameter may be used to override the compiled-in
               default printcap name used by the server (usually
               /_e_t_c/_p_r_i_n_t_c_a_p). See the discussion of the [printers]
               section above for reasons why you might want to do
               this.




     Page 96                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               To use the CUPS printing interface set pppprrrriiiinnnnttttccccaaaapppp nnnnaaaammmmeeee ====
               ccccuuuuppppssss . This should be supplemented by an addtional
               setting printing = cups in the [global] section.
               pppprrrriiiinnnnttttccccaaaapppp nnnnaaaammmmeeee ==== ccccuuuuppppssss will use the "dummy" printcap
               created by CUPS, as specified in your CUPS
               configuration file.

               On System V systems that use llllppppssssttttaaaatttt to list available
               printers you can use pppprrrriiiinnnnttttccccaaaapppp nnnnaaaammmmeeee ==== llllppppssssttttaaaatttt to
               automatically obtain lists of available printers. This
               is the default for systems that define SYSV at
               configure time in Samba (this includes most System V
               based systems). If  _p_r_i_n_t_c_a_p _n_a_m_e is set to llllppppssssttttaaaatttt on
               these systems then Samba will launch llllppppssssttttaaaatttt ----vvvv and
               attempt to parse the output to obtain a printer list.

               A minimal printcap file would look something like this:


                         print1|My Printer 1
                         print2|My Printer 2
                         print3|My Printer 3
                         print4|My Printer 4
                         print5|My Printer 5



               where the '|' separates aliases of a printer. The fact
               that the second alias has a space in it gives a hint to
               Samba that it's a comment.

               NNNNOOOOTTTTEEEE: Under AIX the default printcap name is
               /_e_t_c/_q_c_o_n_f_i_g. Samba will assume the file is in AIX
               _q_c_o_n_f_i_g format if the string _q_c_o_n_f_i_g appears in the
               printcap filename.

               Default: pppprrrriiiinnnnttttccccaaaapppp nnnnaaaammmmeeee ==== ////eeeettttcccc////pppprrrriiiinnnnttttccccaaaapppp

               Example: pppprrrriiiinnnnttttccccaaaapppp nnnnaaaammmmeeee ==== ////eeeettttcccc////mmmmyyyypppprrrriiiinnnnttttccccaaaapppp

          pppprrrriiiinnnntttteeeerrrr aaaaddddmmmmiiiinnnn ((((SSSS))))
               This is a list of users that can do anything to
               printers via the remote administration interfaces
               offered by MS-RPC (usually using a NT workstation).
               Note that the root user always has admin rights.

               Default: pppprrrriiiinnnntttteeeerrrr aaaaddddmmmmiiiinnnn ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               Example: pppprrrriiiinnnntttteeeerrrr aaaaddddmmmmiiiinnnn ==== aaaaddddmmmmiiiinnnn,,,, @@@@ssssttttaaaaffffffff

          pppprrrriiiinnnntttteeeerrrr ddddrrrriiiivvvveeeerrrr ((((SSSS))))
               NNNNooootttteeee ::::This is a deprecated parameter and will be



     Page 97                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               removed in the next major release following version
               2.2. Please see the instructions in the Samba 2.2.
               Printing HOWTO for more information on the new method
               of loading printer drivers onto a Samba server.

               This option allows you to control the string that
               clients receive when they ask the server for the
               printer driver associated with a printer. If you are
               using Windows95 or Windows NT then you can use this to
               automate the setup of printers on your system.

               You need to set this parameter to the exact string
               (case sensitive) that describes the appropriate printer
               driver for your system. If you don't know the exact
               string to use then you should first try with no
               _p_r_i_n_t_e_r _d_r_i_v_e_r option set and the client will give you
               a list of printer drivers. The appropriate strings are
               shown in a scroll box after you have chosen the printer
               manufacturer.

               See also _p_r_i_n_t_e_r _d_r_i_v_e_r _f_i_l_e.

               Example: pppprrrriiiinnnntttteeeerrrr ddddrrrriiiivvvveeeerrrr ==== HHHHPPPP LLLLaaaasssseeeerrrrJJJJeeeetttt 4444LLLL

          pppprrrriiiinnnntttteeeerrrr ddddrrrriiiivvvveeeerrrr ffffiiiilllleeee ((((GGGG))))
               NNNNooootttteeee ::::This is a deprecated parameter and will be
               removed in the next major release following version
               2.2. Please see the instructions in the Samba 2.2.
               Printing HOWTO for more information on the new method
               of loading printer drivers onto a Samba server.

               This parameter tells Samba where the printer driver
               definition file, used when serving drivers to Windows
               95 clients, is to be found. If this is not set, the
               default is :

               _S_A_M_B_A__I_N_S_T_A_L_L__D_I_R_E_C_T_O_R_Y /_l_i_b/_p_r_i_n_t_e_r_s._d_e_f

               This file is created from Windows 95 _m_s_p_r_i_n_t._i_n_f files
               found on the Windows 95 client system. For more details
               on setting up serving of printer drivers to Windows 95
               clients, see the outdated documentation file in the
               _d_o_c_s/ directory, _P_R_I_N_T_E_R__D_R_I_V_E_R._t_x_t.

               See also  _p_r_i_n_t_e_r _d_r_i_v_e_r _l_o_c_a_t_i_o_n.

               Default: NNNNoooonnnneeee ((((sssseeeetttt iiiinnnn ccccoooommmmppppiiiilllleeee))))....

               Example: pppprrrriiiinnnntttteeeerrrr ddddrrrriiiivvvveeeerrrr ffffiiiilllleeee ====
               ////uuuussssrrrr////llllooooccccaaaallll////ssssaaaammmmbbbbaaaa////pppprrrriiiinnnntttteeeerrrrssss////ddddrrrriiiivvvveeeerrrrssss....ddddeeeeffff

          pppprrrriiiinnnntttteeeerrrr ddddrrrriiiivvvveeeerrrr llllooooccccaaaattttiiiioooonnnn ((((SSSS))))



     Page 98                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               NNNNooootttteeee ::::This is a deprecated parameter and will be
               removed in the next major release following version
               2.2. Please see the instructions in the Samba 2.2.
               Printing HOWTO for more information on the new method
               of loading printer drivers onto a Samba server.

               This parameter tells clients of a particular printer
               share where to find the printer driver files for the
               automatic installation of drivers for Windows 95
               machines. If Samba is set up to serve printer drivers
               to Windows 95 machines, this should be set to

               \\\\\\\\MMMMAAAACCCCHHHHIIIINNNNEEEE\\\\PPPPRRRRIIIINNNNTTTTEEEERRRR$$$$

               Where MACHINE is the NetBIOS name of your Samba server,
               and PRINTER$ is a share you set up for serving printer
               driver files. For more details on setting this up see
               the outdated documentation file in the _d_o_c_s/ directory,
               _P_R_I_N_T_E_R__D_R_I_V_E_R._t_x_t.

               See also  _p_r_i_n_t_e_r _d_r_i_v_e_r _f_i_l_e.

               Default: nnnnoooonnnneeee

               Example: pppprrrriiiinnnntttteeeerrrr ddddrrrriiiivvvveeeerrrr llllooooccccaaaattttiiiioooonnnn ==== \\\\\\\\MMMMAAAACCCCHHHHIIIINNNNEEEE\\\\PPPPRRRRIIIINNNNTTTTEEEERRRR$$$$

          pppprrrriiiinnnntttteeeerrrr nnnnaaaammmmeeee ((((SSSS))))
               This parameter specifies the name of the printer to
               which print jobs spooled through a printable service
               will be sent.

               If specified in the [global] section, the printer name
               given will be used for any printable service that does
               not have its own printer name specified.

               Default: nnnnoooonnnneeee ((((bbbbuuuutttt mmmmaaaayyyy bbbbeeee llllpppp oooonnnn mmmmaaaannnnyyyy ssssyyyysssstttteeeemmmmssss))))

               Example: pppprrrriiiinnnntttteeeerrrr nnnnaaaammmmeeee ==== llllaaaasssseeeerrrrwwwwrrrriiiitttteeeerrrr

          pppprrrriiiinnnntttteeeerrrr ((((SSSS))))
               Synonym for  _p_r_i_n_t_e_r _n_a_m_e.

          pppprrrriiiinnnnttttiiiinnnngggg ((((SSSS))))
               This parameters controls how printer status information
               is interpreted on your system. It also affects the
               default values for the _p_r_i_n_t _c_o_m_m_a_n_d, _l_p_q _c_o_m_m_a_n_d,
               _l_p_p_a_u_s_e _c_o_m_m_a_n_d , _l_p_r_e_s_u_m_e _c_o_m_m_a_n_d, and _l_p_r_m _c_o_m_m_a_n_d if
               specified in the [global] section.

               Currently nine printing styles are supported. They are
               BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX, SOFTQ, and CUPS.




     Page 99                                         (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               To see what the defaults are for the other print
               commands when using the various options use the
               testparm(1) program.

               This option can be set on a per printer basis

               See also the discussion in the  [printers] section.

          pppprrrrooooffffiiiilllleeee aaaaccccllllssss ((((SSSS))))
               This boolean parameter was added to fix the problems
               that people have been having with storing user profiles
               on Samba shares from Windows 2000 or Windows XP
               clients. New versions of Windows 2000 or Windows XP
               service packs do security ACL checking on the owner and
               ability to write of the profile directory stored on a
               local workstation when copied from a Samba share. When
               not in domain mode with winbindd then the security info
               copied onto the local workstation has no meaning to the
               logged in user (SID) on that workstation so the profile
               storing fails. Adding this parameter onto a share used
               for profile storage changes two things about the
               returned Windows ACL. Firstly it changes the owner and
               group owner of all reported files and directories to be
               BUILTIN\Administrators, BUILTIN\Users respectively
               (SIDs S-1-5-32-544, S-1-5-32-545). Secondly it adds an
               ACE entry of "Full Control" to the SID BUILTIN\Users to
               every returned ACL. This will allow any Windows 2000 or
               XP workstation user to access the profile. Note that if
               you have multiple users logging on to a workstation
               then in order to prevent them from being able to access
               each others profiles you must remove the "Bypass
               traverse checking" advanced user right. This will
               prevent access to other users profile directories as
               the top level profile directory (named after the user)
               is created by the workstation profile code and has an
               ACL restricting entry to the directory tree to the
               owning user.

               If you didn't understand the above text, you probably
               should not set this parameter :-).

               Default pppprrrrooooffffiiiilllleeee aaaaccccllllssss ==== nnnnoooo

          pppprrrroooottttooooccccoooollll ((((GGGG))))
               Synonym for  _m_a_x _p_r_o_t_o_c_o_l.

          ppppuuuubbbblllliiiicccc ((((SSSS))))
               Synonym for _g_u_e_s_t _o_k.

          qqqquuuueeeeuuuueeeeppppaaaauuuusssseeee ccccoooommmmmmmmaaaannnndddd ((((SSSS))))
               This parameter specifies the command to be executed on
               the server host in order to pause the printer queue.



     Page 100                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               This command should be a program or script which takes
               a printer name as its only parameter and stops the
               printer queue, such that no longer jobs are submitted
               to the printer.

               This command is not supported by Windows for
               Workgroups, but can be issued from the Printers window
               under Windows 95 and NT.

               If a %_p is given then the printer name is put in its
               place. Otherwise it is placed at the end of the
               command.

               Note that it is good practice to include the absolute
               path in the command as the PATH may not be available to
               the server.

               Default: ddddeeeeppppeeeennnnddddssss oooonnnn tttthhhheeee sssseeeettttttttiiiinnnngggg ooooffff _p_r_i_n_t_i_n_g

               Example: qqqquuuueeeeuuuueeeeppppaaaauuuusssseeee ccccoooommmmmmmmaaaannnndddd ==== ddddiiiissssaaaabbbblllleeee %%%%pppp

          qqqquuuueeeeuuuueeeerrrreeeessssuuuummmmeeee ccccoooommmmmmmmaaaannnndddd ((((SSSS))))
               This parameter specifies the command to be executed on
               the server host in order to resume the printer queue.
               It is the command to undo the behavior that is caused
               by the previous parameter ( _q_u_e_u_e_p_a_u_s_e _c_o_m_m_a_n_d).

               This command should be a program or script which takes
               a printer name as its only parameter and resumes the
               printer queue, such that queued jobs are resubmitted to
               the printer.

               This command is not supported by Windows for
               Workgroups, but can be issued from the Printers window
               under Windows 95 and NT.

               If a %_p is given then the printer name is put in its
               place. Otherwise it is placed at the end of the
               command.

               Note that it is good practice to include the absolute
               path in the command as the PATH may not be available to
               the server.

               Default: ddddeeeeppppeeeennnnddddssss oooonnnn tttthhhheeee sssseeeettttttttiiiinnnngggg ooooffff _p_r_i_n_t_i_n_g

               Example: qqqquuuueeeeuuuueeeeppppaaaauuuusssseeee ccccoooommmmmmmmaaaannnndddd ==== eeeennnnaaaabbbblllleeee %%%%pppp

          rrrreeeeaaaadddd bbbbmmmmppppxxxx ((((GGGG))))
               This boolean parameter controls whether smbd(8) will
               support the "Read Block Multiplex" SMB. This is now
               rarely used and defaults to no. You should never need



     Page 101                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               to set this parameter.

               Default: rrrreeeeaaaadddd bbbbmmmmppppxxxx ==== nnnnoooo

          rrrreeeeaaaadddd lllliiiisssstttt ((((SSSS))))
               This is a list of users that are given read-only access
               to a service. If the connecting user is in this list
               then they will not be given write access, no matter
               what the _r_e_a_d _o_n_l_y option is set to. The list can
               include group names using the syntax described in the
               _i_n_v_a_l_i_d _u_s_e_r_s parameter.

               See also the  _w_r_i_t_e _l_i_s_t parameter and the _i_n_v_a_l_i_d
               _u_s_e_r_s parameter.

               Default: rrrreeeeaaaadddd lllliiiisssstttt ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               Example: rrrreeeeaaaadddd lllliiiisssstttt ==== mmmmaaaarrrryyyy,,,, @@@@ssssttttuuuuddddeeeennnnttttssss

          rrrreeeeaaaadddd oooonnnnllllyyyy ((((SSSS))))
               An inverted synonym is  _w_r_i_t_e_a_b_l_e.

               If this parameter is yes, then users of a service may
               not create or modify files in the service's directory.

               Note that a printable service (pppprrrriiiinnnnttttaaaabbbblllleeee ==== yyyyeeeessss) will
               AAAALLLLWWWWAAAAYYYYSSSS allow writing to the directory (user privileges
               permitting), but only via spooling operations.

               Default: rrrreeeeaaaadddd oooonnnnllllyyyy ==== yyyyeeeessss

          rrrreeeeaaaadddd rrrraaaawwww ((((GGGG))))
               This parameter controls whether or not the server will
               support the raw read SMB requests when transferring
               data to clients.

               If enabled, raw reads allow reads of 65535 bytes in one
               packet. This typically provides a major performance
               benefit.

               However, some clients either negotiate the allowable
               block size incorrectly or are incapable of supporting
               larger block sizes, and for these clients you may need
               to disable raw reads.

               In general this parameter should be viewed as a system
               tuning tool and left severely alone. See also  _w_r_i_t_e
               _r_a_w.

               Default: rrrreeeeaaaadddd rrrraaaawwww ==== yyyyeeeessss

          rrrreeeeaaaadddd ssssiiiizzzzeeee ((((GGGG))))



     Page 102                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               The option _r_e_a_d _s_i_z_e affects the overlap of disk
               reads/writes with network reads/writes. If the amount
               of data being transferred in several of the SMB
               commands (currently SMBwrite, SMBwriteX and
               SMBreadbraw) is larger than this value then the server
               begins writing the data before it has received the
               whole packet from the network, or in the case of
               SMBreadbraw, it begins writing to the network before
               all the data has been read from disk.

               This overlapping works best when the speeds of disk and
               network access are similar, having very little effect
               when the speed of one is much greater than the other.

               The default value is 16384, but very little
               experimentation has been done yet to determine the
               optimal value, and it is likely that the best value
               will vary greatly between systems anyway. A value over
               65536 is pointless and will cause you to allocate
               memory unnecessarily.

               Default: rrrreeeeaaaadddd ssssiiiizzzzeeee ==== 11116666333388884444

               Example: rrrreeeeaaaadddd ssssiiiizzzzeeee ==== 8888111199992222

          rrrreeeemmmmooootttteeee aaaannnnnnnnoooouuuunnnncccceeee ((((GGGG))))
               This option allows you to setup nmbd(8) to periodically
               announce itself to arbitrary IP addresses with an
               arbitrary workgroup name.

               This is useful if you want your Samba server to appear
               in a remote workgroup for which the normal browse
               propagation rules don't work. The remote workgroup can
               be anywhere that you can send IP packets to.

               For example:

               rrrreeeemmmmooootttteeee aaaannnnnnnnoooouuuunnnncccceeee ==== 111199992222....111166668888....2222....222255555555////SSSSEEEERRRRVVVVEEEERRRRSSSS
               111199992222....111166668888....4444....222255555555////SSSSTTTTAAAAFFFFFFFF

               the above line would cause nnnnmmmmbbbbdddd to announce itself to
               the two given IP addresses using the given workgroup
               names. If you leave out the workgroup name then the one
               given in the _w_o_r_k_g_r_o_u_p parameter is used instead.

               The IP addresses you choose would normally be the
               broadcast addresses of the remote networks, but can
               also be the IP addresses of known browse masters if
               your network config is that stable.

               See the documentation file _B_R_O_W_S_I_N_G._t_x_t in the _d_o_c_s/
               directory.



     Page 103                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: rrrreeeemmmmooootttteeee aaaannnnnnnnoooouuuunnnncccceeee ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

          rrrreeeemmmmooootttteeee bbbbrrrroooowwwwsssseeee ssssyyyynnnncccc ((((GGGG))))
               This option allows you to setup nmbd(8) to periodically
               request synchronization of browse lists with the master
               browser of a Samba server that is on a remote segment.
               This option will allow you to gain browse lists for
               multiple workgroups across routed networks. This is
               done in a manner that does not work with any non-Samba
               servers.

               This is useful if you want your Samba server and all
               local clients to appear in a remote workgroup for which
               the normal browse propagation rules don't work. The
               remote workgroup can be anywhere that you can send IP
               packets to.

               For example:

               rrrreeeemmmmooootttteeee bbbbrrrroooowwwwsssseeee ssssyyyynnnncccc ==== 111199992222....111166668888....2222....222255555555 111199992222....111166668888....4444....222255555555

               the above line would cause nnnnmmmmbbbbdddd to request the master
               browser on the specified subnets or addresses to
               synchronize their browse lists with the local server.

               The IP addresses you choose would normally be the
               broadcast addresses of the remote networks, but can
               also be the IP addresses of known browse masters if
               your network config is that stable. If a machine IP
               address is given Samba makes NO attempt to validate
               that the remote machine is available, is listening, nor
               that it is in fact the browse master on its segment.

               Default: rrrreeeemmmmooootttteeee bbbbrrrroooowwwwsssseeee ssssyyyynnnncccc ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

          rrrreeeessssttttrrrriiiicccctttt aaaannnnoooonnnnyyyymmmmoooouuuussss ((((GGGG))))
               This is a boolean parameter. If it is yes, then
               anonymous access to the server will be restricted,
               namely in the case where the server is expecting the
               client to send a username, but it doesn't. Setting it
               to yes will force these anonymous connections to be
               denied, and the client will be required to always
               supply a username and password when connecting. Use of
               this parameter is only recommended for homogeneous NT
               client environments.

               This parameter makes the use of macro expansions that
               rely on the username (%U, %G, etc) consistent. NT 4.0
               likes to use anonymous connections when refreshing the
               share list, and this is a way to work around that.

               When restrict anonymous is yes, all anonymous



     Page 104                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               connections are denied no matter what they are for.
               This can effect the ability of a machine to access the
               Samba Primary Domain Controller to revalidate its
               machine account after someone else has logged on the
               client interactively. The NT client will display a
               message saying that the machine's account in the domain
               doesn't exist or the password is bad. The best way to
               deal with this is to reboot NT client machines between
               interactive logons, using "Shutdown and Restart",
               rather than "Close all programs and logon as a
               different user".

               Default: rrrreeeessssttttrrrriiiicccctttt aaaannnnoooonnnnyyyymmmmoooouuuussss ==== nnnnoooo

          rrrrooooooootttt ((((GGGG))))
               Synonym for  _r_o_o_t _d_i_r_e_c_t_o_r_y".

          rrrrooooooootttt ddddiiiirrrr ((((GGGG))))
               Synonym for  _r_o_o_t _d_i_r_e_c_t_o_r_y".

          rrrrooooooootttt ddddiiiirrrreeeeccccttttoooorrrryyyy ((((GGGG))))
               The server will cccchhhhrrrrooooooootttt(((()))) (i.e. Change its root
               directory) to this directory on startup. This is not
               strictly necessary for secure operation. Even without
               it the server will deny access to files not in one of
               the service entries. It may also check for, and deny
               access to, soft links to other parts of the filesystem,
               or attempts to use ".." in file names to access other
               directories (depending on the setting of the _w_i_d_e _l_i_n_k_s
               parameter).

               Adding a _r_o_o_t _d_i_r_e_c_t_o_r_y entry other than "/" adds an
               extra level of security, but at a price. It absolutely
               ensures that no access is given to files not in the
               sub-tree specified in the _r_o_o_t _d_i_r_e_c_t_o_r_y option,
               iiiinnnncccclllluuuuddddiiiinnnngggg some files needed for complete operation of
               the server. To maintain full operability of the server
               you will need to mirror some system files into the _r_o_o_t
               _d_i_r_e_c_t_o_r_y tree. In particular you will need to mirror
               /_e_t_c/_p_a_s_s_w_d (or a subset of it), and any binaries or
               configuration files needed for printing (if required).
               The set of files that must be mirrored is operating
               system dependent.

               Default: rrrrooooooootttt ddddiiiirrrreeeeccccttttoooorrrryyyy ==== ////

               Example: rrrrooooooootttt ddddiiiirrrreeeeccccttttoooorrrryyyy ==== ////hhhhoooommmmeeeessss////ssssmmmmbbbb

          rrrrooooooootttt ppppoooosssstttteeeexxxxeeeecccc ((((SSSS))))
               This is the same as the _p_o_s_t_e_x_e_c parameter except that
               the command is run as root. This is useful for
               unmounting filesystems (such as CDROMs) after a



     Page 105                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               connection is closed.

               See also  _p_o_s_t_e_x_e_c.

               Default: rrrrooooooootttt ppppoooosssstttteeeexxxxeeeecccc ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

          rrrrooooooootttt pppprrrreeeeeeeexxxxeeeecccc ((((SSSS))))
               This is the same as the _p_r_e_e_x_e_c parameter except that
               the command is run as root. This is useful for mounting
               filesystems (such as CDROMs) when a connection is
               opened.

               See also  _p_r_e_e_x_e_c and  _p_r_e_e_x_e_c _c_l_o_s_e.

               Default: rrrrooooooootttt pppprrrreeeeeeeexxxxeeeecccc ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

          rrrrooooooootttt pppprrrreeeeeeeexxxxeeeecccc cccclllloooosssseeee ((((SSSS))))
               This is the same as the _p_r_e_e_x_e_c _c_l_o_s_e parameter except
               that the command is run as root.

               See also  _p_r_e_e_x_e_c and  _p_r_e_e_x_e_c _c_l_o_s_e.

               Default: rrrrooooooootttt pppprrrreeeeeeeexxxxeeeecccc cccclllloooosssseeee ==== nnnnoooo

          sssseeeeccccuuuurrrriiiittttyyyy ((((GGGG))))
               This option affects how clients respond to Samba and is
               one of the most important settings in the  _s_m_b._c_o_n_f
               file.

               The option sets the "security mode bit" in replies to
               protocol negotiations with smbd(8)
                to turn share level security on or off. Clients decide
               based on this bit whether (and how) to transfer user
               and password information to the server.

               The default is sssseeeeccccuuuurrrriiiittttyyyy ==== uuuusssseeeerrrr, as this is the most
               common setting needed when talking to Windows 98 and
               Windows NT.

               The alternatives are sssseeeeccccuuuurrrriiiittttyyyy ==== sssshhhhaaaarrrreeee, sssseeeeccccuuuurrrriiiittttyyyy ====
               sssseeeerrrrvvvveeeerrrr or sssseeeeccccuuuurrrriiiittttyyyy ==== ddddoooommmmaaaaiiiinnnn .

               In versions of Samba prior to 2.0.0, the default was
               sssseeeeccccuuuurrrriiiittttyyyy ==== sssshhhhaaaarrrreeee mainly because that was the only
               option at one stage.

               There is a bug in WfWg that has relevance to this
               setting. When in user or server level security a WfWg
               client will totally ignore the password you type in the
               "connect drive" dialog box. This makes it very
               difficult (if not impossible) to connect to a Samba
               service as anyone except the user that you are logged



     Page 106                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               into WfWg as.

               If your PCs use usernames that are the same as their
               usernames on the UNIX machine then you will want to use
               sssseeeeccccuuuurrrriiiittttyyyy ==== uuuusssseeeerrrr. If you mostly use usernames that don't
               exist on the UNIX box then use sssseeeeccccuuuurrrriiiittttyyyy ==== sssshhhhaaaarrrreeee.

               You should also use sssseeeeccccuuuurrrriiiittttyyyy ==== sssshhhhaaaarrrreeee if you want to
               mainly setup shares without a password (guest shares).
               This is commonly used for a shared printer server. It
               is more difficult to setup guest shares with sssseeeeccccuuuurrrriiiittttyyyy ====
               uuuusssseeeerrrr, see the _m_a_p _t_o _g_u_e_s_t parameter for details.

               It is possible to use ssssmmmmbbbbdddd in a  hhhhyyyybbbbrrrriiiidddd mmmmooooddddeeee where it
               is offers both user and share level security under
               different  _N_e_t_B_I_O_S _a_l_i_a_s_e_s.

               The different settings will now be explained.

               SSSSEEEECCCCUUUURRRRIIIITTTTYYYY ==== SSSSHHHHAAAARRRREEEE

               When clients connect to a share level security server
               they need not log onto the server with a valid username
               and password before attempting to connect to a shared
               resource (although modern clients such as Windows 95/98
               and Windows NT will send a logon request with a
               username but no password when talking to a sssseeeeccccuuuurrrriiiittttyyyy ====
               sssshhhhaaaarrrreeee server). Instead, the clients send authentication
               information (passwords) on a per-share basis, at the
               time they attempt to connect to that share.

               Note that ssssmmmmbbbbdddd AAAALLLLWWWWAAAAYYYYSSSS uses a valid UNIX user to act on
               behalf of the client, even in sssseeeeccccuuuurrrriiiittttyyyy ==== sssshhhhaaaarrrreeee level
               security.

               As clients are not required to send a username to the
               server in share level security, ssssmmmmbbbbdddd uses several
               techniques to determine the correct UNIX user to use on
               behalf of the client.

               A list of possible UNIX usernames to match with the
               given client password is constructed using the
               following methods :

               o+ If the _g_u_e_s_t _o_n_l_y parameter is set, then all the
                 other stages are missed and only the  _g_u_e_s_t _a_c_c_o_u_n_t
                 username is checked.

               o+ Is a username is sent with the share connection
                 request, then this username (after mapping - see
                 _u_s_e_r_n_a_m_e _m_a_p), is added as a potential username.




     Page 107                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               o+ If the client did a previous llllooooggggoooonnnn request (the
                 SessionSetup SMB call) then the username sent in this
                 SMB will be added as a potential username.

               o+ The name of the service the client requested is added
                 as a potential username.

               o+ The NetBIOS name of the client is added to the list
                 as a potential username.

               o+ Any users on the  _u_s_e_r list are added as potential
                 usernames.

          If the _g_u_e_s_t _o_n_l_y parameter is not set, then this list is
          then tried with the supplied password. The first user for
          whom the password matches will be used as the UNIX user.

          If the _g_u_e_s_t _o_n_l_y parameter is set, or no username can be
          determined then if the share is marked as available to the
          _g_u_e_s_t _a_c_c_o_u_n_t, then this guest user will be used, otherwise
          access is denied.

          Note that it can be vvvveeeerrrryyyy confusing in share-level security
          as to which UNIX username will eventually be used in
          granting access.

          See also the section  NOTE ABOUT USERNAME/PASSWORD
          VALIDATION.

          SSSSEEEECCCCUUUURRRRIIIITTTTYYYY ==== UUUUSSSSEEEERRRR

          This is the default security setting in Samba 2.2. With
          user-level security a client must first "log-on" with a
          valid username and password (which can be mapped using the
          _u_s_e_r_n_a_m_e _m_a_p parameter). Encrypted passwords (see the
          _e_n_c_r_y_p_t_e_d _p_a_s_s_w_o_r_d_s parameter) can also be used in this
          security mode. Parameters such as  _u_s_e_r and  _g_u_e_s_t _o_n_l_y if
          set are then applied and may change the UNIX user to use on
          this connection, but only after the user has been
          successfully authenticated.

          NNNNooootttteeee that the name of the resource being requested is nnnnooootttt
          sent to the server until after the server has successfully
          authenticated the client. This is why guest shares don't
          work in user level security without allowing the server to
          automatically map unknown users into the _g_u_e_s_t _a_c_c_o_u_n_t. See
          the _m_a_p _t_o _g_u_e_s_t parameter for details on doing this.

          See also the section  NOTE ABOUT USERNAME/PASSWORD
          VALIDATION.

          SSSSEEEECCCCUUUURRRRIIIITTTTYYYY ==== SSSSEEEERRRRVVVVEEEERRRR



     Page 108                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          In this mode Samba will try to validate the
          username/password by passing it to another SMB server, such
          as an NT box. If this fails it will revert to sssseeeeccccuuuurrrriiiittttyyyy ====
          uuuusssseeeerrrr, but note that if encrypted passwords have been
          negotiated then Samba cannot revert back to checking the
          UNIX password file, it must have a valid _s_m_b_p_a_s_s_w_d file to
          check users against. See the documentation file in the _d_o_c_s/
          directory _E_N_C_R_Y_P_T_I_O_N._t_x_t for details on how to set this up.

          NNNNooootttteeee that from the client's point of view sssseeeeccccuuuurrrriiiittttyyyy ==== sssseeeerrrrvvvveeeerrrr
          is the same as  sssseeeeccccuuuurrrriiiittttyyyy ==== uuuusssseeeerrrr. It only affects how the
          server deals with the authentication, it does not in any way
          affect what the client sees.

          NNNNooootttteeee that the name of the resource being requested is nnnnooootttt
          sent to the server until after the server has successfully
          authenticated the client. This is why guest shares don't
          work in user level security without allowing the server to
          automatically map unknown users into the _g_u_e_s_t _a_c_c_o_u_n_t. See
          the _m_a_p _t_o _g_u_e_s_t parameter for details on doing this.

          See also the section  NOTE ABOUT USERNAME/PASSWORD
          VALIDATION.

          See also the _p_a_s_s_w_o_r_d _s_e_r_v_e_r parameter and the _e_n_c_r_y_p_t_e_d
          _p_a_s_s_w_o_r_d_s parameter.

          SSSSEEEECCCCUUUURRRRIIIITTTTYYYY ==== DDDDOOOOMMMMAAAAIIIINNNN

          This mode will only work correctly if smbpasswd(8) has been
          used to add this machine into a Windows NT Domain. It
          expects the _e_n_c_r_y_p_t_e_d _p_a_s_s_w_o_r_d_s parameter to be set to yes.
          In this mode Samba will try to validate the
          username/password by passing it to a Windows NT Primary or
          Backup Domain Controller, in exactly the same way that a
          Windows NT Server would do.

          NNNNooootttteeee that a valid UNIX user must still exist as well as the
          account on the Domain Controller to allow Samba to have a
          valid UNIX account to map file access to.

          NNNNooootttteeee that from the client's point of view sssseeeeccccuuuurrrriiiittttyyyy ==== ddddoooommmmaaaaiiiinnnn
          is the same as sssseeeeccccuuuurrrriiiittttyyyy ==== uuuusssseeeerrrr . It only affects how the
          server deals with the authentication, it does not in any way
          affect what the client sees.

          NNNNooootttteeee that the name of the resource being requested is nnnnooootttt
          sent to the server until after the server has successfully
          authenticated the client. This is why guest shares don't
          work in user level security without allowing the server to
          automatically map unknown users into the _g_u_e_s_t _a_c_c_o_u_n_t. See
          the _m_a_p _t_o _g_u_e_s_t parameter for details on doing this.



     Page 109                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          BBBBUUUUGGGG:::: There is currently a bug in the implementation of
          sssseeeeccccuuuurrrriiiittttyyyy ==== ddddoooommmmaaaaiiiinnnn with respect to multi-byte character set
          usernames. The communication with a Domain Controller must
          be done in UNICODE and Samba currently does not widen
          multi-byte user names to UNICODE correctly, thus a multi-
          byte username will not be recognized correctly at the Domain
          Controller. This issue will be addressed in a future
          release.

          See also the section  NOTE ABOUT USERNAME/PASSWORD
          VALIDATION.

          See also the _p_a_s_s_w_o_r_d _s_e_r_v_e_r parameter and the _e_n_c_r_y_p_t_e_d
          _p_a_s_s_w_o_r_d_s parameter.

          Default: sssseeeeccccuuuurrrriiiittttyyyy ==== UUUUSSSSEEEERRRR

          Example: sssseeeeccccuuuurrrriiiittttyyyy ==== DDDDOOOOMMMMAAAAIIIINNNN

          sssseeeeccccuuuurrrriiiittttyyyy mmmmaaaasssskkkk ((((SSSS))))
               This parameter controls what UNIX permission bits can
               be modified when a Windows NT client is manipulating
               the UNIX permission on a file using the native NT
               security dialog box.

               This parameter is applied as a mask (AND'ed with) to
               the changed permission bits, thus preventing any bits
               not in this mask from being modified. Essentially, zero
               bits in this mask may be treated as a set of bits the
               user is not allowed to change.

               If not set explicitly this parameter is 0777, allowing
               a user to modify all the user/group/world permissions
               on a file.

               NNNNooootttteeee that users who can access the Samba server through
               other means can easily bypass this restriction, so it
               is primarily useful for standalone "appliance" systems.
               Administrators of most normal systems will probably
               want to leave it set to 0777.

               See also the  _f_o_r_c_e _d_i_r_e_c_t_o_r_y _s_e_c_u_r_i_t_y _m_o_d_e, _d_i_r_e_c_t_o_r_y
               _s_e_c_u_r_i_t_y _m_a_s_k,  _f_o_r_c_e _s_e_c_u_r_i_t_y _m_o_d_e parameters.

               Default: sssseeeeccccuuuurrrriiiittttyyyy mmmmaaaasssskkkk ==== 0000777777777777

               Example: sssseeeeccccuuuurrrriiiittttyyyy mmmmaaaasssskkkk ==== 0000777777770000

          sssseeeerrrrvvvveeeerrrr ssssttttrrrriiiinnnngggg ((((GGGG))))
               This controls what string will show up in the printer
               comment box in print manager and next to the IPC
               connection in nnnneeeetttt vvvviiiieeeewwww. It can be any string that you



     Page 110                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               wish to show to your users.

               It also sets what will appear in browse lists next to
               the machine name.

               A %_v will be replaced with the Samba version number.

               A %_h will be replaced with the hostname.

               Default: sssseeeerrrrvvvveeeerrrr ssssttttrrrriiiinnnngggg ==== SSSSaaaammmmbbbbaaaa %%%%vvvv

               Example: sssseeeerrrrvvvveeeerrrr ssssttttrrrriiiinnnngggg ==== UUUUnnnniiiivvvveeeerrrrssssiiiittttyyyy ooooffff GGGGNNNNUUUUssss SSSSaaaammmmbbbbaaaa
               SSSSeeeerrrrvvvveeeerrrr

          sssseeeetttt ddddiiiirrrreeeeccccttttoooorrrryyyy ((((SSSS))))
               If sssseeeetttt ddddiiiirrrreeeeccccttttoooorrrryyyy ==== nnnnoooo, then users of the service may
               not use the setdir command to change directory.

               The sssseeeettttddddiiiirrrr command is only implemented in the Digital
               Pathworks client. See the Pathworks documentation for
               details.

               Default: sssseeeetttt ddddiiiirrrreeeeccccttttoooorrrryyyy ==== nnnnoooo

          sssshhhhaaaarrrreeee mmmmooooddddeeeessss ((((SSSS))))
               This enables or disables the honoring of the _s_h_a_r_e
               _m_o_d_e_s during a file open. These modes are used by
               clients to gain exclusive read or write access to a
               file.

               These open modes are not directly supported by UNIX, so
               they are simulated using shared memory, or lock files
               if your UNIX doesn't support shared memory (almost all
               do).

               The share modes that are enabled by this option are
               DENY_DOS, DENY_ALL, DENY_READ, DENY_WRITE, DENY_NONE
               and DENY_FCB.

               This option gives full share compatibility and enabled
               by default.

               You should NNNNEEEEVVVVEEEERRRR turn this parameter off as many
               Windows applications will break if you do so.

               Default: sssshhhhaaaarrrreeee mmmmooooddddeeeessss ==== yyyyeeeessss

          sssshhhhoooorrrrtttt pppprrrreeeesssseeeerrrrvvvveeee ccccaaaasssseeee ((((SSSS))))
               This boolean parameter controls if new files which
               conform to 8.3 syntax, that is all in upper case and of
               suitable length, are created upper case, or if they are
               forced to be the _d_e_f_a_u_l_t _c_a_s_e . This option can be use



     Page 111                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               with pppprrrreeeesssseeeerrrrvvvveeee ccccaaaasssseeee ==== yyyyeeeessss to permit long filenames to
               retain their case, while short names are lowered.

               See the section on  NAME MANGLING.

               Default: sssshhhhoooorrrrtttt pppprrrreeeesssseeeerrrrvvvveeee ccccaaaasssseeee ==== yyyyeeeessss

          sssshhhhoooowwww aaaadddddddd pppprrrriiiinnnntttteeeerrrr wwwwiiiizzzzaaaarrrrdddd ((((GGGG))))
               With the introduction of MS-RPC based printing support
               for Windows NT/2000 client in Samba 2.2, a
               "Printers..." folder will appear on Samba hosts in the
               share listing. Normally this folder will contain an
               icon for the MS Add Printer Wizard (APW). However, it
               is possible to disable this feature regardless of the
               level of privilege of the connected user.

               Under normal circumstances, the Windows NT/2000 client
               will open a handle on the printer server with
               OpenPrinterEx() asking for Administrator privileges. If
               the user does not have administrative access on the
               print server (i.e is not root or a member of the
               _p_r_i_n_t_e_r _a_d_m_i_n group), the OpenPrinterEx() call fails
               and the client makes another open call with a request
               for a lower privilege level. This should succeed,
               however the APW icon will not be displayed.

               Disabling the _s_h_o_w _a_d_d _p_r_i_n_t_e_r _w_i_z_a_r_d parameter will
               always cause the OpenPrinterEx() on the server to fail.
               Thus the APW icon will never be displayed.  NNNNooootttteeee ::::This
               does not prevent the same user from having
               administrative privilege on an individual printer.

               See also _a_d_d_p_r_i_n_t_e_r _c_o_m_m_a_n_d,  _d_e_l_e_t_e_p_r_i_n_t_e_r _c_o_m_m_a_n_d,
               _p_r_i_n_t_e_r _a_d_m_i_n

               Default :sssshhhhoooowwww aaaadddddddd pppprrrriiiinnnntttteeeerrrr wwwwiiiizzzzaaaarrrrdddd ==== yyyyeeeessss

          ssssmmmmbbbb ppppaaaasssssssswwwwdddd ffffiiiilllleeee ((((GGGG))))
               This option sets the path to the encrypted smbpasswd
               file. By default the path to the smbpasswd file is
               compiled into Samba.

               Default: ssssmmmmbbbb ppppaaaasssssssswwwwdddd ffffiiiilllleeee ==== $$$${{{{pppprrrreeeeffffiiiixxxx}}}}////pppprrrriiiivvvvaaaatttteeee////ssssmmmmbbbbppppaaaasssssssswwwwdddd

               Example: ssssmmmmbbbb ppppaaaasssssssswwwwdddd ffffiiiilllleeee ==== ////eeeettttcccc////ssssaaaammmmbbbbaaaa////ssssmmmmbbbbppppaaaasssssssswwwwdddd

          ssssoooocccckkkkeeeetttt aaaaddddddddrrrreeeessssssss ((((GGGG))))
               This option allows you to control what address Samba
               will listen for connections on. This is used to support
               multiple virtual interfaces on the one server, each
               with a different configuration.




     Page 112                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               By default Samba will accept connections on any
               address.

               Example: ssssoooocccckkkkeeeetttt aaaaddddddddrrrreeeessssssss ==== 111199992222....111166668888....2222....22220000

          ssssoooocccckkkkeeeetttt ooooppppttttiiiioooonnnnssss ((((GGGG))))
               This option allows you to set socket options to be used
               when talking with the client.

               Socket options are controls on the networking layer of
               the operating systems which allow the connection to be
               tuned.

               This option will typically be used to tune your Samba
               server for optimal performance for your local network.
               There is no way that Samba can know what the optimal
               parameters are for your net, so you must experiment and
               choose them yourself. We strongly suggest you read the
               appropriate documentation for your operating system
               first (perhaps mmmmaaaannnn sssseeeettttssssoooocccckkkkoooopppptttt will help).

               You may find that on some systems Samba will say
               "Unknown socket option" when you supply an option. This
               means you either incorrectly typed it or you need to
               add an include file to includes.h for your OS. If the
               latter is the case please send the patch to
               samba@samba.org <URL:mailto:samba@samba.org>.

               Any of the supported socket options may be combined in
               any way you like, as long as your OS allows it.

               This is the list of socket options currently settable
               using this option:

               o+ SO_KEEPALIVE

               o+ SO_REUSEADDR

               o+ SO_BROADCAST

               o+ TCP_NODELAY

               o+ IPTOS_LOWDELAY

               o+ IPTOS_THROUGHPUT

               o+ SO_SNDBUF *

               o+ SO_RCVBUF *

               o+ SO_SNDLOWAT *




     Page 113                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               o+ SO_RCVLOWAT *

          Those marked with a ''''****'''' take an integer argument. The others
          can optionally take a 1 or 0 argument to enable or disable
          the option, by default they will be enabled if you don't
          specify 1 or 0.

          To specify an argument use the syntax SOME_OPTION = VALUE
          for example SSSSOOOO____SSSSNNNNDDDDBBBBUUUUFFFF ==== 8888111199992222. Note that you must not have
          any spaces before or after the = sign.

          If you are on a local network then a sensible option might
          be

          ssssoooocccckkkkeeeetttt ooooppppttttiiiioooonnnnssss ==== IIIIPPPPTTTTOOOOSSSS____LLLLOOOOWWWWDDDDEEEELLLLAAAAYYYY

          If you have a local network then you could try:

          ssssoooocccckkkkeeeetttt ooooppppttttiiiioooonnnnssss ==== IIIIPPPPTTTTOOOOSSSS____LLLLOOOOWWWWDDDDEEEELLLLAAAAYYYY TTTTCCCCPPPP____NNNNOOOODDDDEEEELLLLAAAAYYYY

          If you are on a wide area network then perhaps try setting
          IPTOS_THROUGHPUT.

          Note that several of the options may cause your Samba server
          to fail completely. Use these options with caution!

          Default: ssssoooocccckkkkeeeetttt ooooppppttttiiiioooonnnnssss ==== TTTTCCCCPPPP____NNNNOOOODDDDEEEELLLLAAAAYYYY

          Example: ssssoooocccckkkkeeeetttt ooooppppttttiiiioooonnnnssss ==== IIIIPPPPTTTTOOOOSSSS____LLLLOOOOWWWWDDDDEEEELLLLAAAAYYYY

          ssssoooouuuurrrrcccceeee eeeennnnvvvviiiirrrroooonnnnmmmmeeeennnntttt ((((GGGG))))
               This parameter causes Samba to set environment
               variables as per the content of the file named.

               If the value of this parameter starts with a "|"
               character then Samba will treat that value as a pipe
               command to open and will set the environment variables
               from the output of the pipe.

               The contents of the file or the output of the pipe
               should be formatted as the output of the standard Unix
               eeeennnnvvvv((((1111)))) command. This is of the form :

               Example environment entry:

               SSSSAAAAMMMMBBBBAAAA____NNNNEEEETTTTBBBBIIIIOOOOSSSS____NNNNAAAAMMMMEEEE ==== mmmmyyyyhhhhoooossssttttnnnnaaaammmmeeee

               Default: NNNNoooo ddddeeeeffffaaaauuuulllltttt vvvvaaaalllluuuueeee

               Examples: ssssoooouuuurrrrcccceeee eeeennnnvvvviiiirrrroooonnnnmmmmeeeennnntttt ==== ||||////eeeettttcccc////ssssmmmmbbbb....ccccoooonnnnffff....sssshhhh

               Example: ssssoooouuuurrrrcccceeee eeeennnnvvvviiiirrrroooonnnnmmmmeeeennnntttt ==== ////uuuussssrrrr////llllooooccccaaaallll////ssssmmmmbbbb____eeeennnnvvvv____vvvvaaaarrrrssss



     Page 114                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          ssssssssllll ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This variable enables or disables the entire SSL mode.
               If it is set to no, the SSL-enabled Samba behaves
               exactly like the non-SSL Samba. If set to yes, it
               depends on the variables  _s_s_l _h_o_s_t_s and  _s_s_l _h_o_s_t_s
               _r_e_s_i_g_n whether an SSL connection will be required.

               Default: ssssssssllll ==== nnnnoooo

          ssssssssllll CCCCAAAA cccceeeerrrrttttDDDDiiiirrrr ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This variable defines where to look up the
               Certification Authorities. The given directory should
               contain one file for each CA that Samba will trust. The
               file name must be the hash value over the
               "Distinguished Name" of the CA. How this directory is
               set up is explained later in this document. All files
               within the directory that don't fit into this naming
               scheme are ignored. You don't need this variable if you
               don't verify client certificates.

               Default: ssssssssllll CCCCAAAA cccceeeerrrrttttDDDDiiiirrrr ==== ////uuuussssrrrr////llllooooccccaaaallll////ssssssssllll////cccceeeerrrrttttssss

          ssssssssllll CCCCAAAA cccceeeerrrrttttFFFFiiiilllleeee ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This variable is a second way to define the trusted
               CAs. The certificates of the trusted CAs are collected
               in one big file and this variable points to the file.
               You will probably only use one of the two ways to
               define your CAs. The first choice is preferable if you
               have many CAs or want to be flexible, the second is
               preferable if you only have one CA and want to keep
               things simple (you won't need to create the hashed file
               names). You don't need this variable if you don't
               verify client certificates.

               Default: ssssssssllll CCCCAAAA cccceeeerrrrttttFFFFiiiilllleeee ====
               ////uuuussssrrrr////llllooooccccaaaallll////ssssssssllll////cccceeeerrrrttttssss////ttttrrrruuuusssstttteeeeddddCCCCAAAAssss....ppppeeeemmmm




     Page 115                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          ssssssssllll cccciiiipppphhhheeeerrrrssss ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This variable defines the ciphers that should be
               offered during SSL negotiation. You should not set this
               variable unless you know what you are doing.

          ssssssssllll cccclllliiiieeeennnntttt cccceeeerrrrtttt ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               The certificate in this file is used by  ssssmmmmbbbbcccclllliiiieeeennnntttt((((1111))))
               if it exists. It's needed if the server requires a
               client certificate.

               Default: ssssssssllll cccclllliiiieeeennnntttt cccceeeerrrrtttt ====
               ////uuuussssrrrr////llllooooccccaaaallll////ssssssssllll////cccceeeerrrrttttssss////ssssmmmmbbbbcccclllliiiieeeennnntttt....ppppeeeemmmm

          ssssssssllll cccclllliiiieeeennnntttt kkkkeeeeyyyy ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This is the private key for  ssssmmmmbbbbcccclllliiiieeeennnntttt((((1111)))) It's only
               needed if the client should have a certificate.

               Default: ssssssssllll cccclllliiiieeeennnntttt kkkkeeeeyyyy ====
               ////uuuussssrrrr////llllooooccccaaaallll////ssssssssllll////pppprrrriiiivvvvaaaatttteeee////ssssmmmmbbbbcccclllliiiieeeennnntttt....ppppeeeemmmm

          ssssssssllll ccccoooommmmppppaaaattttiiiibbbbiiiilllliiiittttyyyy ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This variable defines whether OpenSSL should be
               configured for bug compatibility with other SSL
               implementations. This is probably not desirable because
               currently no clients with SSL implementations other
               than OpenSSL exist.

               Default: ssssssssllll ccccoooommmmppppaaaattttiiiibbbbiiiilllliiiittttyyyy ==== nnnnoooo

          ssssssssllll eeeeggggdddd ssssoooocccckkkkeeeetttt ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled



     Page 116                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This option is used to define the location of the
               communiation socket of an EGD or PRNGD daemon, from
               which entropy can be retrieved. This option can be used
               instead of or together with the _s_s_l _e_n_t_r_o_p_y _f_i_l_e
               directive. 255 bytes of entropy will be retrieved from
               the daemon.

               Default: nnnnoooonnnneeee

          ssssssssllll eeeennnnttttrrrrooooppppyyyy bbbbyyyytttteeeessss ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This parameter is used to define the number of bytes
               which should be read from the _s_s_l _e_n_t_r_o_p_y _f_i_l_e If a -1
               is specified, the entire file will be read.

               Default: ssssssssllll eeeennnnttttrrrrooooppppyyyy bbbbyyyytttteeeessss ==== 222255555555

          ssssssssllll eeeennnnttttrrrrooooppppyyyy ffffiiiilllleeee ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This parameter is used to specify a file from which
               processes will read "random bytes" on startup. In order
               to seed the internal pseudo random number generator,
               entropy must be provided. On system with a /_d_e_v/_u_r_a_n_d_o_m
               device file, the processes will retrieve its entropy
               from the kernel. On systems without kernel entropy
               support, a file can be supplied that will be read on
               startup and that will be used to seed the PRNG.

               Default: nnnnoooonnnneeee

          ssssssssllll hhhhoooossssttttssss ((((GGGG))))
               See  _s_s_l _h_o_s_t_s _r_e_s_i_g_n.

          ssssssssllll hhhhoooossssttttssss rrrreeeessssiiiiggggnnnn ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               These two variables define whether Samba will go into
               SSL mode or not. If none of them is defined, Samba will



     Page 117                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               allow only SSL connections. If the  _s_s_l _h_o_s_t_s variable
               lists hosts (by IP-address, IP-address range, net group
               or name), only these hosts will be forced into SSL
               mode. If the  _s_s_l _h_o_s_t_s _r_e_s_i_g_n variable lists hosts,
               only these hosts will NNNNOOOOTTTT be forced into SSL mode. The
               syntax for these two variables is the same as for the
               _h_o_s_t_s _a_l_l_o_w and  _h_o_s_t_s _d_e_n_y pair of variables, only
               that the subject of the decision is different: It's not
               the access right but whether SSL is used or not.

               The example below requires SSL connections from all
               hosts outside the local net (which is 192.168.*.*).

               Default: ssssssssllll hhhhoooossssttttssss ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               ssssssssllll hhhhoooossssttttssss rrrreeeessssiiiiggggnnnn ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               Example: ssssssssllll hhhhoooossssttttssss rrrreeeessssiiiiggggnnnn ==== 111199992222....111166668888....

          ssssssssllll rrrreeeeqqqquuuuiiiirrrreeee cccclllliiiieeeennnnttttcccceeeerrrrtttt ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               If this variable is set to yes, the server will not
               tolerate connections from clients that don't have a
               valid certificate. The directory/file given in _s_s_l _C_A
               _c_e_r_t_D_i_r and _s_s_l _C_A _c_e_r_t_F_i_l_e will be used to look up the
               CAs that issued the client's certificate. If the
               certificate can't be verified positively, the
               connection will be terminated. If this variable is set
               to no, clients don't need certificates. Contrary to web
               applications you really sssshhhhoooouuuulllldddd require client
               certificates. In the web environment the client's data
               is sensitive (credit card numbers) and the server must
               prove to be trustworthy. In a file server environment
               the server's data will be sensitive and the clients
               must prove to be trustworthy.

               Default: ssssssssllll rrrreeeeqqqquuuuiiiirrrreeee cccclllliiiieeeennnnttttcccceeeerrrrtttt ==== nnnnoooo

          ssssssssllll rrrreeeeqqqquuuuiiiirrrreeee sssseeeerrrrvvvveeeerrrrcccceeeerrrrtttt ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               If this variable is set to yes, the ssssmmmmbbbbcccclllliiiieeeennnntttt((((1111))))
                will request a certificate from the server. Same as
               _s_s_l _r_e_q_u_i_r_e _c_l_i_e_n_t_c_e_r_t for the server.




     Page 118                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: ssssssssllll rrrreeeeqqqquuuuiiiirrrreeee sssseeeerrrrvvvveeeerrrrcccceeeerrrrtttt ==== nnnnoooo

          ssssssssllll sssseeeerrrrvvvveeeerrrr cccceeeerrrrtttt ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This is the file containing the server's certificate.
               The server mmmmuuuusssstttt have a certificate. The file may also
               contain the server's private key. See later for how
               certificates and private keys are created.

               Default: ssssssssllll sssseeeerrrrvvvveeeerrrr cccceeeerrrrtttt ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

          ssssssssllll sssseeeerrrrvvvveeeerrrr kkkkeeeeyyyy ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This file contains the private key of the server. If
               this variable is not defined, the key is looked up in
               the certificate file (it may be appended to the
               certificate). The server mmmmuuuusssstttt have a private key and
               the certificate mmmmuuuusssstttt match this private key.

               Default: ssssssssllll sssseeeerrrrvvvveeeerrrr kkkkeeeeyyyy ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

          ssssssssllll vvvveeeerrrrssssiiiioooonnnn ((((GGGG))))
               This variable is part of SSL-enabled Samba. This is
               only available if the SSL libraries have been compiled
               on your system and the configure option --------wwwwiiiitttthhhh----ssssssssllll was
               given at configure time.

               This enumeration variable defines the versions of the
               SSL protocol that will be used. ssl2or3 allows dynamic
               negotiation of SSL v2 or v3, ssl2 results in SSL v2,
               ssl3 results in SSL v3 and tls1 results in TLS v1. TLS
               (Transport Layer Security) is the new standard for SSL.

               Default: ssssssssllll vvvveeeerrrrssssiiiioooonnnn ==== """"ssssssssllll2222oooorrrr3333""""

          ssssttttaaaatttt ccccaaaacccchhhheeee ((((GGGG))))
               This parameter determines if smbd(8) will use a cache
               in order to speed up case insensitive name mappings.
               You should never need to change this parameter.

               Default: ssssttttaaaatttt ccccaaaacccchhhheeee ==== yyyyeeeessss

          ssssttttaaaatttt ccccaaaacccchhhheeee ssssiiiizzzzeeee ((((GGGG))))
               This parameter determines the number of entries in the



     Page 119                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               _s_t_a_t _c_a_c_h_e. You should never need to change this
               parameter.

               Default: ssssttttaaaatttt ccccaaaacccchhhheeee ssssiiiizzzzeeee ==== 55550000

          ssssttttaaaattttuuuussss ((((GGGG))))
               This enables or disables logging of connections to a
               status file that smbstatus(1) can read.

               With this disabled ssssmmmmbbbbssssttttaaaattttuuuussss won't be able to tell you
               what connections are active. You should never need to
               change this parameter.

               Default: ssssttttaaaattttuuuussss ==== yyyyeeeessss

          ssssttttrrrriiiicccctttt aaaallllllllooooccccaaaatttteeee ((((SSSS))))
               This is a boolean that controls the handling of disk
               space allocation in the server. When this is set to yes
               the server will change from UNIX behaviour of not
               committing real disk storage blocks when a file is
               extended to the Windows behaviour of actually forcing
               the disk system to allocate real storage blocks when a
               file is created or extended to be a given size. In UNIX
               terminology this means that Samba will stop creating
               sparse files.  This can be slow on some systems.

               When strict allocate is no the server does sparse disk
               block allocation when a file is extended.

               Setting this to yes can help Samba return out of quota
               messages on systems that are restricting the disk quota
               of users.

               Default: ssssttttrrrriiiicccctttt aaaallllllllooooccccaaaatttteeee ==== nnnnoooo

          ssssttttrrrriiiicccctttt lllloooocccckkkkiiiinnnngggg ((((SSSS))))
               This is a boolean that controls the handling of file
               locking in the server. When this is set to yes the
               server will check every read and write access for file
               locks, and deny access if locks exist. This can be slow
               on some systems.

               When strict locking is no the server does file lock
               checks only when the client explicitly asks for them.

               Well-behaved clients always ask for lock checks when it
               is important, so in the vast majority of cases ssssttttrrrriiiicccctttt
               lllloooocccckkkkiiiinnnngggg ==== nnnnoooo is preferable.

               Default: ssssttttrrrriiiicccctttt lllloooocccckkkkiiiinnnngggg ==== nnnnoooo

          ssssttttrrrriiiicccctttt ssssyyyynnnncccc ((((SSSS))))



     Page 120                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Many Windows applications (including the Windows 98
               explorer shell) seem to confuse flushing buffer
               contents to disk with doing a sync to disk. Under UNIX,
               a sync call forces the process to be suspended until
               the kernel has ensured that all outstanding data in
               kernel disk buffers has been safely stored onto stable
               storage. This is very slow and should only be done
               rarely. Setting this parameter to no (the default)
               means that smbd ignores the Windows applications
               requests for a sync call. There is only a possibility
               of losing data if the operating system itself that
               Samba is running on crashes, so there is little danger
               in this default setting. In addition, this fixes many
               performance problems that people have reported with the
               new Windows98 explorer shell file copies.

               See also the _s_y_n_c _a_l_w_a_y_s> parameter.

               Default: ssssttttrrrriiiicccctttt ssssyyyynnnncccc ==== nnnnoooo

          ssssttttrrrriiiipppp ddddooootttt ((((GGGG))))
               This parameter is now unused in Samba (2.2.5 and
               above).  It used strip trailing dots off UNIX filenames
               but was not correctly implmented.  In Samba 2.2.5 and
               above UNIX filenames ending in a dot are invalid
               Windows long filenames (as they are in Windows NT and
               above) and are mangled to 8.3 before being returned to
               a client.

               Default: ssssttttrrrriiiipppp ddddooootttt ==== nnnnoooo

          ssssyyyynnnncccc aaaallllwwwwaaaayyyyssss ((((SSSS))))
               This is a boolean parameter that controls whether
               writes will always be written to stable storage before
               the write call returns. If this is no then the server
               will be guided by the client's request in each write
               call (clients can set a bit indicating that a
               particular write should be synchronous). If this is yes
               then every write will be followed by a ffffssssyyyynnnncccc(((()))) call to
               ensure the data is written to disk. Note that the
               _s_t_r_i_c_t _s_y_n_c parameter must be set to yes in order for
               this parameter to have any affect.

               See also the _s_t_r_i_c_t _s_y_n_c parameter.

               Default: ssssyyyynnnncccc aaaallllwwwwaaaayyyyssss ==== nnnnoooo

          ssssyyyysssslllloooogggg ((((GGGG))))
               This parameter maps how Samba debug messages are logged
               onto the system syslog logging levels. Samba debug
               level zero maps onto syslog LOG_ERR, debug level one
               maps onto LOG_WARNING, debug level two maps onto



     Page 121                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               LOG_NOTICE, debug level three maps onto LOG_INFO. All
               higher levels are mapped to  LOG_DEBUG.

               This parameter sets the threshold for sending messages
               to syslog. Only messages with debug level less than
               this value will be sent to syslog.

               Default: ssssyyyysssslllloooogggg ==== 1111

          ssssyyyysssslllloooogggg oooonnnnllllyyyy ((((GGGG))))
               If this parameter is set then Samba debug messages are
               logged into the system syslog only, and not to the
               debug log files.

               Default: ssssyyyysssslllloooogggg oooonnnnllllyyyy ==== nnnnoooo

          tttteeeemmmmppppllllaaaatttteeee hhhhoooommmmeeeeddddiiiirrrr ((((GGGG))))
               When filling out the user information for a Windows NT
               user, the winbindd(8) daemon uses this parameter to
               fill in the home directory for that user. If the string
               %_D is present it is substituted with the user's Windows
               NT domain name. If the string %_U is present it is
               substituted with the user's Windows NT user name.

               Default: tttteeeemmmmppppllllaaaatttteeee hhhhoooommmmeeeeddddiiiirrrr ==== ////hhhhoooommmmeeee////%%%%DDDD////%%%%UUUU

          tttteeeemmmmppppllllaaaatttteeee sssshhhheeeellllllll ((((GGGG))))
               When filling out the user information for a Windows NT
               user, the winbindd(8) daemon uses this parameter to
               fill in the login shell for that user.

               Default: tttteeeemmmmppppllllaaaatttteeee sssshhhheeeellllllll ==== ////bbbbiiiinnnn////ffffaaaallllsssseeee

          ttttiiiimmmmeeee ooooffffffffsssseeeetttt ((((GGGG))))
               This parameter is a setting in minutes to add to the
               normal GMT to local time conversion. This is useful if
               you are serving a lot of PCs that have incorrect
               daylight saving time handling.

               Default: ttttiiiimmmmeeee ooooffffffffsssseeeetttt ==== 0000

               Example: ttttiiiimmmmeeee ooooffffffffsssseeeetttt ==== 66660000

          ttttiiiimmmmeeee sssseeeerrrrvvvveeeerrrr ((((GGGG))))
               This parameter determines if nmbd(8) advertises itself
               as a time server to Windows clients.

               Default: ttttiiiimmmmeeee sssseeeerrrrvvvveeeerrrr ==== nnnnoooo

          ttttiiiimmmmeeeessssttttaaaammmmpppp llllooooggggssss ((((GGGG))))
               Synonym for  _d_e_b_u_g _t_i_m_e_s_t_a_m_p.




     Page 122                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          ttttoooottttaaaallll pppprrrriiiinnnntttt jjjjoooobbbbssss ((((GGGG))))
               This parameter accepts an integer value which defines a
               limit on the maximum number of print jobs that will be
               accepted system wide at any given time. If a print job
               is submitted by a client which will exceed this number,
               then smbd will return an error indicating that no space
               is available on the server. The default value of 0
               means that no such limit exists. This parameter can be
               used to prevent a server from exceeding its capacity
               and is designed as a printing throttle. See also _m_a_x
               _p_r_i_n_t _j_o_b_s.

               Default: ttttoooottttaaaallll pppprrrriiiinnnntttt jjjjoooobbbbssss ==== 0000

               Example: ttttoooottttaaaallll pppprrrriiiinnnntttt jjjjoooobbbbssss ==== 5555000000000000

          uuuunnnniiiixxxx eeeexxxxtttteeeennnnssssiiiioooonnnnssss((((GGGG))))
               This boolean parameter controls whether Samba implments
               the CIFS UNIX extensions, as defined by HP. These
               extensions enable Samba to better serve UNIX CIFS
               clients by supporting features such as symbolic links,
               hard links, etc...  These extensions require a
               similarly enabled client, and are of no current use to
               Windows clients.

               Default: uuuunnnniiiixxxx eeeexxxxtttteeeennnnssssiiiioooonnnnssss ==== nnnnoooo

          uuuunnnniiiixxxx ppppaaaasssssssswwwwoooorrrrdddd ssssyyyynnnncccc ((((GGGG))))
               This boolean parameter controls whether Samba attempts
               to synchronize the UNIX password with the SMB password
               when the encrypted SMB password in the smbpasswd file
               is changed. If this is set to yes the program specified
               in the _p_a_s_s_w_d _p_r_o_g_r_a_mparameter is called AAAASSSS RRRROOOOOOOOTTTT - to
               allow the new UNIX password to be set without access to
               the old UNIX password (as the SMB password change code
               has no access to the old password cleartext, only the
               new).

               See also _p_a_s_s_w_d _p_r_o_g_r_a_m,  _p_a_s_s_w_d _c_h_a_t.

               Default: uuuunnnniiiixxxx ppppaaaasssssssswwwwoooorrrrdddd ssssyyyynnnncccc ==== nnnnoooo

          uuuuppppddddaaaatttteeee eeeennnnccccrrrryyyypppptttteeeedddd ((((GGGG))))
               This boolean parameter allows a user logging on with a
               plaintext password to have their encrypted (hashed)
               password in the smbpasswd file to be updated
               automatically as they log on. This option allows a site
               to migrate from plaintext password authentication
               (users authenticate with plaintext password over the
               wire, and are checked against a UNIX account database)
               to encrypted password authentication (the SMB
               challenge/response authentication mechanism) without



     Page 123                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               forcing all users to re-enter their passwords via
               smbpasswd at the time the change is made. This is a
               convenience option to allow the change over to
               encrypted passwords to be made over a longer period.
               Once all users have encrypted representations of their
               passwords in the smbpasswd file this parameter should
               be set to no.

               In order for this parameter to work correctly the
               _e_n_c_r_y_p_t _p_a_s_s_w_o_r_d_s parameter must be set to no when this
               parameter is set to yes.

               Note that even when this parameter is set a user
               authenticating to ssssmmmmbbbbdddd must still enter a valid
               password in order to connect correctly, and to update
               their hashed (smbpasswd) passwords.

               Default: uuuuppppddddaaaatttteeee eeeennnnccccrrrryyyypppptttteeeedddd ==== nnnnoooo

          uuuusssseeee cccclllliiiieeeennnntttt ddddrrrriiiivvvveeeerrrr ((((SSSS))))
               This parameter applies only to Windows NT/2000 clients.
               It has no affect on Windows 95/98/ME clients. When
               serving a printer to Windows NT/2000 clients without
               first installing a valid printer driver on the Samba
               host, the client will be required to install a local
               printer driver. From this point on, the client will
               treat the print as a local printer and not a network
               printer connection. This is much the same behavior that
               will occur when ddddiiiissssaaaabbbblllleeee ssssppppoooooooollllssssssss ==== yyyyeeeessss.

               The differentiating factor is that under normal
               circumstances, the NT/2000 client will attempt to open
               the network printer using MS-RPC. The problem is that
               because the client considers the printer to be local,
               it will attempt to issue the OpenPrinterEx() call
               requesting access rights associated with the logged on
               user. If the user possesses local administator rights
               but not root privilegde on the Samba host (often the
               case), the OpenPrinterEx() call will fail. The result
               is that the client will now display an "Access Denied;
               Unable to connect" message in the printer queue window
               (even though jobs may successfully be printed).

               If this parameter is enabled for a printer, then any
               attempt to open the printer with the
               PRINTER_ACCESS_ADMINISTER right is mapped to
               PRINTER_ACCESS_USE instead. Thus allowing the
               OpenPrinterEx() call to succeed. TTTThhhhiiiissss ppppaaaarrrraaaammmmeeeetttteeeerrrr MMMMUUUUSSSSTTTT
               nnnnooootttt bbbbeeee aaaabbbblllleeee eeeennnnaaaabbbblllleeeedddd oooonnnn aaaa pppprrrriiiinnnntttt sssshhhhaaaarrrreeee wwwwhhhhiiiicccchhhh hhhhaaaassss vvvvaaaalllliiiidddd
               pppprrrriiiinnnntttt ddddrrrriiiivvvveeeerrrr iiiinnnnssssttttaaaalllllllleeeedddd oooonnnn tttthhhheeee SSSSaaaammmmbbbbaaaa sssseeeerrrrvvvveeeerrrr....

               See also disable spoolss



     Page 124                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Default: uuuusssseeee cccclllliiiieeeennnntttt ddddrrrriiiivvvveeeerrrr ==== nnnnoooo

          uuuusssseeee mmmmmmmmaaaapppp ((((GGGG))))
               This global parameter determines if the tdb internals
               of Samba can depend on mmap working correctly on the
               running system. Samba requires a coherent mmap/read-
               write system memory cache. Currently only HPUX does not
               have such a coherent cache, and so this parameter is
               set to no by default on HPUX. On all other systems this
               parameter should be left alone. This parameter is
               provided to help the Samba developers track down
               problems with the tdb internal code.

               Default: uuuusssseeee mmmmmmmmaaaapppp ==== yyyyeeeessss

          uuuusssseeee rrrrhhhhoooossssttttssss ((((GGGG))))
               If this global parameter is yes, it specifies that the
               UNIX user's ._r_h_o_s_t_s file in their home directory will
               be read to find the names of hosts and users who will
               be allowed access without specifying a password.

               NNNNOOOOTTTTEEEE:::: The use of _u_s_e _r_h_o_s_t_s can be a major security
               hole. This is because you are trusting the PC to supply
               the correct username. It is very easy to get a PC to
               supply a false username. I recommend that the  _u_s_e
               _r_h_o_s_t_s option be only used if you really know what you
               are doing.

               Default: uuuusssseeee rrrrhhhhoooossssttttssss ==== nnnnoooo

          uuuusssseeeerrrr ((((SSSS))))
               Synonym for  _u_s_e_r_n_a_m_e.

          uuuusssseeeerrrrssss ((((SSSS))))
               Synonym for  _u_s_e_r_n_a_m_e.

          uuuusssseeeerrrrnnnnaaaammmmeeee ((((SSSS))))
               Multiple users may be specified in a comma-delimited
               list, in which case the supplied password will be
               tested against each username in turn (left to right).

               The _u_s_e_r_n_a_m_e line is needed only when the PC is unable
               to supply its own username. This is the case for the
               COREPLUS protocol or where your users have different
               WfWg usernames to UNIX usernames. In both these cases
               you may also be better using the \\server\share%user
               syntax instead.

               The _u_s_e_r_n_a_m_e line is not a great solution in many cases
               as it means Samba will try to validate the supplied
               password against each of the usernames in the _u_s_e_r_n_a_m_e
               line in turn. This is slow and a bad idea for lots of



     Page 125                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               users in case of duplicate passwords. You may get
               timeouts or security breaches using this parameter
               unwisely.

               Samba relies on the underlying UNIX security. This
               parameter does not restrict who can login, it just
               offers hints to the Samba server as to what usernames
               might correspond to the supplied password. Users can
               login as whoever they please and they will be able to
               do no more damage than if they started a telnet
               session. The daemon runs as the user that they log in
               as, so they cannot do anything that user cannot do.

               To restrict a service to a particular set of users you
               can use the _v_a_l_i_d _u_s_e_r_s parameter.

               If any of the usernames begin with a '@' then the name
               will be looked up first in the NIS netgroups list (if
               Samba is compiled with netgroup support), followed by a
               lookup in the UNIX groups database and will expand to a
               list of all users in the group of that name.

               If any of the usernames begin with a '+' then the name
               will be looked up only in the UNIX groups database and
               will expand to a list of all users in the group of that
               name.

               If any of the usernames begin with a '&'then the name
               will be looked up only in the NIS netgroups database
               (if Samba is compiled with netgroup support) and will
               expand to a list of all users in the netgroup group of
               that name.

               Note that searching though a groups database can take
               quite some time, and some clients may time out during
               the search.

               See the section NOTE ABOUT USERNAME/PASSWORD VALIDATION
               for more information on how this parameter determines
               access to the services.

               Default: TTTThhhheeee gggguuuueeeesssstttt aaaaccccccccoooouuuunnnntttt iiiiffff aaaa gggguuuueeeesssstttt sssseeeerrrrvvvviiiicccceeee,,,, eeeellllsssseeee
               <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>....

               Examples:uuuusssseeeerrrrnnnnaaaammmmeeee ==== ffffrrrreeeedddd,,,, mmmmaaaarrrryyyy,,,, jjjjaaaacccckkkk,,,, jjjjaaaannnneeee,,,, @@@@uuuusssseeeerrrrssss,,,,
               @@@@ppppccccggggrrrroooouuuupppp

          uuuusssseeeerrrrnnnnaaaammmmeeee lllleeeevvvveeeellll ((((GGGG))))
               This option helps Samba to try and 'guess' at the real
               UNIX username, as many DOS clients send an all-
               uppercase username. By default Samba tries all
               lowercase, followed by the username with the first



     Page 126                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               letter capitalized, and fails if the username is not
               found on the UNIX machine.

               If this parameter is set to non-zero the behavior
               changes. This parameter is a number that specifies the
               number of uppercase combinations to try while trying to
               determine the UNIX user name. The higher the number the
               more combinations will be tried, but the slower the
               discovery of usernames will be. Use this parameter when
               you have strange usernames on your UNIX machine, such
               as AstrangeUser .

               Default: uuuusssseeeerrrrnnnnaaaammmmeeee lllleeeevvvveeeellll ==== 0000

               Example: uuuusssseeeerrrrnnnnaaaammmmeeee lllleeeevvvveeeellll ==== 5555

          uuuusssseeeerrrrnnnnaaaammmmeeee mmmmaaaapppp ((((GGGG))))
               This option allows you to specify a file containing a
               mapping of usernames from the clients to the server.
               This can be used for several purposes. The most common
               is to map usernames that users use on DOS or Windows
               machines to those that the UNIX box uses. The other is
               to map multiple users to a single username so that they
               can more easily share files.

               The map file is parsed line by line. Each line should
               contain a single UNIX username on the left then a '='
               followed by a list of usernames on the right. The list
               of usernames on the right may contain names of the form
               @group in which case they will match any UNIX username
               in that group. The special client name '*' is a
               wildcard and matches any name. Each line of the map
               file may be up to 1023 characters long.

               The file is processed on each line by taking the
               supplied username and comparing it with each username
               on the right hand side of the '=' signs. If the
               supplied name matches any of the names on the right
               hand side then it is replaced with the name on the
               left. Processing then continues with the next line.

               If any line begins with a '#' or a ';' then it is
               ignored

               If any line begins with an '!' then the processing will
               stop after that line if a mapping was done by the line.
               Otherwise mapping continues with every line being
               processed. Using '!' is most useful when you have a
               wildcard mapping line later in the file.

               For example to map from the name admin or administrator
               to the UNIX name  root you would use:



     Page 127                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               rrrrooooooootttt ==== aaaaddddmmmmiiiinnnn aaaaddddmmmmiiiinnnniiiissssttttrrrraaaattttoooorrrr

               Or to map anyone in the UNIX group system to the UNIX
               name sys you would use:

               ssssyyyyssss ==== @@@@ssssyyyysssstttteeeemmmm

               You can have as many mappings as you like in a username
               map file.

               If your system supports the NIS NETGROUP option then
               the netgroup database is checked before the /_e_t_c/_g_r_o_u_p
               database for matching groups.

               You can map Windows usernames that have spaces in them
               by using double quotes around the name. For example:

               ttttrrrriiiiddddggggeeee ==== """"AAAAnnnnddddrrrreeeewwww TTTTrrrriiiiddddggggeeeellllllll""""

               would map the windows username "Andrew Tridgell" to the
               unix username "tridge".

               The following example would map mary and fred to the
               unix user sys, and map the rest to guest. Note the use
               of the '!' to tell Samba to stop processing if it gets
               a match on that line.


                         !sys = mary fred
                         guest = *



               Note that the remapping is applied to all occurrences
               of usernames. Thus if you connect to \\server\fred and
               fred is remapped to mary then you will actually be
               connecting to \\server\mary and will need to supply a
               password suitable for mary not fred. The only exception
               to this is the username passed to the  _p_a_s_s_w_o_r_d _s_e_r_v_e_r
               (if you have one). The password server will receive
               whatever username the client supplies without
               modification.

               Also note that no reverse mapping is done. The main
               effect this has is with printing. Users who have been
               mapped may have trouble deleting print jobs as
               PrintManager under WfWg will think they don't own the
               print job.

               Default: nnnnoooo uuuusssseeeerrrrnnnnaaaammmmeeee mmmmaaaapppp

               Example: uuuusssseeeerrrrnnnnaaaammmmeeee mmmmaaaapppp ==== ////uuuussssrrrr////llllooooccccaaaallll////ssssaaaammmmbbbbaaaa////lllliiiibbbb////uuuusssseeeerrrrssss....mmmmaaaapppp



     Page 128                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          uuuusssseeee sssseeeennnnddddffffiiiilllleeee ((((SSSS))))
               If this parameter is yes, and Samba was built with the
               --with-sendfile-support option, and the underlying
               operating system supports sendfile system call, then
               some SMB read calls (mainly ReadAndX and ReadRaw) will
               use the more efficient sendfile system call for files
               that are exclusively oplocked. This may make more
               efficient use of the system CPU's and cause Samba to be
               faster. This is off by default as it's effects are
               unknown as yet.

               Default: uuuusssseeee sssseeeennnnddddffffiiiilllleeee ==== nnnnoooo

          uuuuttttmmmmpppp ((((GGGG))))
               This boolean parameter is only available if Samba has
               been configured and compiled with the option  --------wwwwiiiitttthhhh----
               uuuuttttmmmmpppp. If set to yes then Samba will attempt to add utmp
               or utmpx records (depending on the UNIX system)
               whenever a connection is made to a Samba server. Sites
               may use this to record the user connecting to a Samba
               share.

               See also the  _u_t_m_p _d_i_r_e_c_t_o_r_y parameter.

               Default: uuuuttttmmmmpppp ==== nnnnoooo

          uuuuttttmmmmpppp ddddiiiirrrreeeeccccttttoooorrrryyyy((((GGGG))))
               This parameter is only available if Samba has been
               configured and compiled with the option  --------wwwwiiiitttthhhh----uuuuttttmmmmpppp.
               It specifies a directory pathname that is used to store
               the utmp or utmpx files (depending on the UNIX system)
               that record user connections to a Samba server. See
               also the  _u_t_m_p parameter. By default this is not set,
               meaning the system will use whatever utmp file the
               native system is set to use (usually /_v_a_r/_r_u_n/_u_t_m_p on
               Linux).

               Default: nnnnoooo uuuuttttmmmmpppp ddddiiiirrrreeeeccccttttoooorrrryyyy

          vvvvaaaalllliiiidddd cccchhhhaaaarrrrssss ((((GGGG))))
               The option allows you to specify additional characters
               that should be considered valid by the server in
               filenames. This is particularly useful for national
               character sets, such as adding u-umlaut or a-ring.

               The option takes a list of characters in either integer
               or character form with spaces between them. If you give
               two characters with a colon between them then it will
               be taken as an lowercase:uppercase pair.

               If you have an editor capable of entering the
               characters into the config file then it is probably



     Page 129                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               easiest to use this method. Otherwise you can specify
               the characters in octal, decimal or hexadecimal form
               using the usual C notation.

               For example to add the single character 'Z' to the
               charset (which is a pointless thing to do as it's
               already there) you could do one of the following


                         valid chars = Z
                         valid chars = z:Z
                         valid chars = 0132:0172



               The last two examples above actually add two
               characters, and alter the uppercase and lowercase
               mappings appropriately.

               Note that you MMMMUUUUSSSSTTTT specify this parameter after the
               _c_l_i_e_n_t _c_o_d_e _p_a_g_e parameter if you have both set. If
               _c_l_i_e_n_t _c_o_d_e _p_a_g_e is set after the _v_a_l_i_d _c_h_a_r_s parameter
               the _v_a_l_i_d _c_h_a_r_s settings will be overwritten.

               See also the _c_l_i_e_n_t _c_o_d_e _p_a_g_e parameter.

               Default: SSSSaaaammmmbbbbaaaa ddddeeeeffffaaaauuuullllttttssss ttttoooo uuuussssiiiinnnngggg aaaa rrrreeeeaaaassssoooonnnnaaaabbbblllleeee sssseeeetttt ooooffff
               vvvvaaaalllliiiidddd cccchhhhaaaarrrraaaacccctttteeeerrrrssss ffffoooorrrr EEEEnnnngggglllliiiisssshhhh ssssyyyysssstttteeeemmmmssss

               Example: vvvvaaaalllliiiidddd cccchhhhaaaarrrrssss ==== 0000333344445555::::0000333300005555 0000333366666666::::0000333322226666 0000333344444444::::0000333300004444

               The above example allows filenames to have the Swedish
               characters in them.

               NNNNOOOOTTTTEEEE:::: It is actually quite difficult to correctly
               produce a _v_a_l_i_d _c_h_a_r_s line for a particular system. To
               automate the process tino@augsburg.net
               <URL:mailto:tino@augsburg.net> has written a package
               called vvvvaaaalllliiiiddddcccchhhhaaaarrrrssss which will automatically produce a
               complete _v_a_l_i_d _c_h_a_r_s line for a given client system.
               Look in the _e_x_a_m_p_l_e_s/_v_a_l_i_d_c_h_a_r_s/ subdirectory of your
               Samba source code distribution for this package.

          vvvvaaaalllliiiidddd uuuusssseeeerrrrssss ((((SSSS))))
               This is a list of users that should be allowed to login
               to this service. Names starting with '@', '+' and '&'
               are interpreted using the same rules as described in
               the _i_n_v_a_l_i_d _u_s_e_r_s parameter.

               If this is empty (the default) then any user can login.
               If a username is in both this list and the _i_n_v_a_l_i_d
               _u_s_e_r_s list then access is denied for that user.



     Page 130                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               The current servicename is substituted for %_S . This is
               useful in the [homes] section.

               See also _i_n_v_a_l_i_d _u_s_e_r_s

               Default: NNNNoooo vvvvaaaalllliiiidddd uuuusssseeeerrrrssss lllliiiisssstttt ((((aaaannnnyyyyoooonnnneeee ccccaaaannnn llllooooggggiiiinnnn))))

               Example: vvvvaaaalllliiiidddd uuuusssseeeerrrrssss ==== ggggrrrreeeegggg,,,, @@@@ppppccccuuuusssseeeerrrrssss

          vvvveeeettttoooo ffffiiiilllleeeessss((((SSSS))))
               This is a list of files and directories that are
               neither visible nor accessible. Each entry in the list
               must be separated by a '/', which allows spaces to be
               included in the entry. '*' and '?' can be used to
               specify multiple files or directories as in DOS
               wildcards.

               Each entry must be a unix path, not a DOS path and must
               nnnnooootttt include the unix directory separator '/'.

               Note that the _c_a_s_e _s_e_n_s_i_t_i_v_e option is applicable in
               vetoing files.

               One feature of the veto files parameter that it is
               important to be aware of is Samba's behaviour when
               trying to delete a directory. If a directory that is to
               be deleted contains nothing but veto files this
               deletion will ffffaaaaiiiillll unless you also set the _d_e_l_e_t_e _v_e_t_o
               _f_i_l_e_s parameter to _y_e_s.

               Setting this parameter will affect the performance of
               Samba, as it will be forced to check all files and
               directories for a match as they are scanned.

               See also _h_i_d_e _f_i_l_e_s and  _c_a_s_e _s_e_n_s_i_t_i_v_e.

               Default: NNNNoooo ffffiiiilllleeeessss oooorrrr ddddiiiirrrreeeeccccttttoooorrrriiiieeeessss aaaarrrreeee vvvveeeettttooooeeeedddd....

               Examples:

               ; Veto any files containing the word Security,
               ; any ending in .tmp, and any directory containing the
               ; word root.
               veto files = /*Security*/*.tmp/*root*/

               ; Veto the Apple specific files that a NetAtalk server
               ; creates.
               veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/


          vvvveeeettttoooo oooopppplllloooocccckkkk ffffiiiilllleeeessss ((((SSSS))))
               This parameter is only valid when the _o_p_l_o_c_k_s parameter



     Page 131                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               is turned on for a share. It allows the Samba
               administrator to selectively turn off the granting of
               oplocks on selected files that match a wildcarded list,
               similar to the wildcarded list used in the _v_e_t_o _f_i_l_e_s
               parameter.

               Default: NNNNoooo ffffiiiilllleeeessss aaaarrrreeee vvvveeeettttooooeeeedddd ffffoooorrrr oooopppplllloooocccckkkk ggggrrrraaaannnnttttssss

               You might want to do this on files that you know will
               be heavily contended for by clients. A good example of
               this is in the NetBench SMB benchmark program, which
               causes heavy client contention for files ending in
               ._S_E_M. To cause Samba not to grant oplocks on these
               files you would use the line (either in the [global]
               section or in the section for the particular NetBench
               share :

               Example: vvvveeeettttoooo oooopppplllloooocccckkkk ffffiiiilllleeeessss ==== ////****....SSSSEEEEMMMM////

          vvvvffffssss oooobbbbjjjjeeeecccctttt ((((SSSS))))
               This parameter specifies a shared object file that is
               used for Samba VFS I/O operations. By default, normal
               disk I/O operations are used but these can be
               overloaded with a VFS object. The Samba VFS layer is
               new to Samba 2.2 and must be enabled at compile time
               with --with-vfs.

               Default : nnnnoooo vvvvaaaalllluuuueeee

          vvvvffffssss ooooppppttttiiiioooonnnnssss ((((SSSS))))
               This parameter allows parameters to be passed to the
               vfs layer at initialization time. The Samba VFS layer
               is new to Samba 2.2 and must be enabled at compile time
               with --with-vfs. See also  _v_f_s _o_b_j_e_c_t.

               Default : nnnnoooo vvvvaaaalllluuuueeee

          vvvvoooolllluuuummmmeeee ((((SSSS))))
               This allows you to override the volume label returned
               for a share. Useful for CDROMs with installation
               programs that insist on a particular volume label.

               Default: tttthhhheeee nnnnaaaammmmeeee ooooffff tttthhhheeee sssshhhhaaaarrrreeee

          wwwwiiiiddddeeee lllliiiinnnnkkkkssss ((((SSSS))))
               This parameter controls whether or not links in the
               UNIX file system may be followed by the server. Links
               that point to areas within the directory tree exported
               by the server are always allowed; this parameter
               controls access only to areas that are outside the
               directory tree being exported.




     Page 132                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Note that setting this parameter can have a negative
               effect on your server performance due to the extra
               system calls that Samba has to do in order to perform
               the link checks.

               Default: wwwwiiiiddddeeee lllliiiinnnnkkkkssss ==== yyyyeeeessss

          wwwwiiiinnnnbbbbiiiinnnndddd ccccaaaacccchhhheeee ttttiiiimmmmeeee ((((GGGG))))
               This parameter specifies the number of seconds the
               winbindd(8) daemon will cache user and group
               information before querying a Windows NT server again.

               Default: wwwwiiiinnnnbbbbiiiinnnndddd ccccaaaacccchhhheeee ttttyyyyppppeeee ==== 11115555

          wwwwiiiinnnnbbbbiiiinnnndddd eeeennnnuuuummmm uuuusssseeeerrrrssss ((((GGGG))))
               On large installations using winbindd(8) it may be
               necessary to suppress the enumeration of users through
               the sssseeeettttppppwwwweeeennnntttt(((()))), ggggeeeettttppppwwwweeeennnntttt(((()))) and eeeennnnddddppppwwwweeeennnntttt(((()))) group of
               system calls. If the _w_i_n_b_i_n_d _e_n_u_m _u_s_e_r_s parameter is
               no, calls to the ggggeeeettttppppwwwweeeennnntttt system call will not return
               any data.

               WWWWaaaarrrrnnnniiiinnnngggg:::: Turning off user enumeration may cause some
               programs to behave oddly. For example, the finger
               program relies on having access to the full user list
               when searching for matching usernames.

               Default: wwwwiiiinnnnbbbbiiiinnnndddd eeeennnnuuuummmm uuuusssseeeerrrrssss ==== yyyyeeeessss

          wwwwiiiinnnnbbbbiiiinnnndddd eeeennnnuuuummmm ggggrrrroooouuuuppppssss ((((GGGG))))
               On large installations using winbindd(8) it may be
               necessary to suppress the enumeration of groups through
               the sssseeeettttggggrrrreeeennnntttt(((()))), ggggeeeettttggggrrrreeeennnntttt(((()))) and eeeennnnddddggggrrrreeeennnntttt(((()))) group of
               system calls. If the _w_i_n_b_i_n_d _e_n_u_m _g_r_o_u_p_s parameter is
               no, calls to the ggggeeeettttggggrrrreeeennnntttt(((()))) system call will not return
               any data.

               WWWWaaaarrrrnnnniiiinnnngggg:::: Turning off group enumeration may cause some
               programs to behave oddly.

               Default: wwwwiiiinnnnbbbbiiiinnnndddd eeeennnnuuuummmm ggggrrrroooouuuuppppssss ==== yyyyeeeessss

          wwwwiiiinnnnbbbbiiiinnnndddd ggggiiiidddd ((((GGGG))))
               The winbind gid parameter specifies the range of group
               ids that are allocated by the  winbindd(8) daemon. This
               range of group ids should have no existing local or NIS
               groups within it as strange conflicts can occur
               otherwise.

               Default: wwwwiiiinnnnbbbbiiiinnnndddd ggggiiiidddd ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               Example: wwwwiiiinnnnbbbbiiiinnnndddd ggggiiiidddd ==== 11110000000000000000----22220000000000000000



     Page 133                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          wwwwiiiinnnnbbbbiiiinnnndddd sssseeeeppppaaaarrrraaaattttoooorrrr ((((GGGG))))
               This parameter allows an admin to define the character
               used when listing a username of the form of _D_O_M_A_I_N
               \_u_s_e_r. This parameter is only applicable when using the
               _p_a_m__w_i_n_b_i_n_d._s_o and _n_s_s__w_i_n_b_i_n_d._s_o modules for UNIX
               services.

               Please note that setting this parameter to + causes
               problems with group membership at least on glibc
               systems, as the character + is used as a special
               character for NIS in /etc/group.

               Default: wwwwiiiinnnnbbbbiiiinnnndddd sssseeeeppppaaaarrrraaaattttoooorrrr ==== ''''\\\\''''

               Example: wwwwiiiinnnnbbbbiiiinnnndddd sssseeeeppppaaaarrrraaaattttoooorrrr ==== ++++

          wwwwiiiinnnnbbbbiiiinnnndddd uuuuiiiidddd ((((GGGG))))
               The winbind gid parameter specifies the range of group
               ids that are allocated by the  winbindd(8) daemon. This
               range of ids should have no existing local or NIS users
               within it as strange conflicts can occur otherwise.

               Default: wwwwiiiinnnnbbbbiiiinnnndddd uuuuiiiidddd ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               Example: wwwwiiiinnnnbbbbiiiinnnndddd uuuuiiiidddd ==== 11110000000000000000----22220000000000000000

          wwwwiiiinnnnbbbbiiiinnnndddd uuuusssseeee ddddeeeeffffaaaauuuulllltttt ddddoooommmmaaaaiiiinnnn

          wwwwiiiinnnnbbbbiiiinnnndddd uuuusssseeee ddddeeeeffffaaaauuuulllltttt ddddoooommmmaaaaiiiinnnn
               This parameter specifies whether the  winbindd(8)
               daemon should operate on users without domain component
               in their username. Users without a domain component are
               treated as is part of the winbindd server's own domain.
               While this does not benifit Windows users, it makes
               SSH, FTP and e-mail function in a way much closer to
               the way they would in a native unix system.

               Default: wwwwiiiinnnnbbbbiiiinnnndddd uuuusssseeee ddddeeeeffffaaaauuuulllltttt ddddoooommmmaaaaiiiinnnn ==== <<<<nnnnoooo>>>>

               Example: wwwwiiiinnnnbbbbiiiinnnndddd uuuusssseeee ddddeeeeffffaaaauuuulllltttt ddddoooommmmaaaaiiiinnnn ==== yyyyeeeessss

          wwwwiiiinnnnssss hhhhooooooookkkk ((((GGGG))))
               When Samba is running as a WINS server this allows you
               to call an external program for all changes to the WINS
               database. The primary use for this option is to allow
               the dynamic update of external name resolution
               databases such as dynamic DNS.

               The wins hook parameter specifies the name of a script
               or executable that will be called as follows:

               wwwwiiiinnnnssss____hhhhooooooookkkk ooooppppeeeerrrraaaattttiiiioooonnnn nnnnaaaammmmeeee nnnnaaaammmmeeeettttyyyyppppeeee ttttttttllll IIIIPPPP____lllliiiisssstttt



     Page 134                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               o+ The first argument is the operation and is one of
                 "add", "delete", or "refresh". In most cases the
                 operation can be ignored as the rest of the
                 parameters provide sufficient information. Note that
                 "refresh" may sometimes be called when the name has
                 not previously been added, in that case it should be
                 treated as an add.

               o+ The second argument is the NetBIOS name. If the name
                 is not a legal name then the wins hook is not called.
                 Legal names contain only letters, digits, hyphens,
                 underscores and periods.

               o+ The third argument is the NetBIOS name type as a 2
                 digit hexadecimal number.

               o+ The fourth argument is the TTL (time to live) for the
                 name in seconds.

               o+ The fifth and subsequent arguments are the IP
                 addresses currently registered for that name. If this
                 list is empty then the name should be deleted.

          An example script that calls the BIND dynamic DNS update
          program nnnnssssuuuuppppddddaaaatttteeee is provided in the examples directory of
          the Samba source code.

          wwwwiiiinnnnssss pppprrrrooooxxxxyyyy ((((GGGG))))
               This is a boolean that controls if nmbd(8) will respond
               to broadcast name queries on behalf of other hosts. You
               may need to set this to yes for some older clients.

               Default: wwwwiiiinnnnssss pppprrrrooooxxxxyyyy ==== nnnnoooo

          wwwwiiiinnnnssss sssseeeerrrrvvvveeeerrrr ((((GGGG))))
               This specifies the IP address (or DNS name: IP address
               for preference) of the WINS server that  nmbd(8) should
               register with. If you have a WINS server on your
               network then you should set this to the WINS server's
               IP.

               You should point this at your WINS server if you have a
               multi-subnetted network.

               NNNNOOOOTTTTEEEE. You need to set up Samba to point to a WINS
               server if you have multiple subnets and wish cross-
               subnet browsing to work correctly.

               See the documentation file _B_R_O_W_S_I_N_G._t_x_t in the docs/
               directory of your Samba source distribution.

               Default: nnnnooootttt eeeennnnaaaabbbblllleeeedddd



     Page 135                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



               Example: wwwwiiiinnnnssss sssseeeerrrrvvvveeeerrrr ==== 111199992222....9999....222200000000....1111

          wwwwiiiinnnnssss ssssuuuuppppppppoooorrrrtttt ((((GGGG))))
               This boolean controls if the nmbd(8) process in Samba
               will act as a WINS server. You should not set this to
               yes unless you have a multi-subnetted network and you
               wish a particular nnnnmmmmbbbbdddd to be your WINS server. Note
               that you should NNNNEEEEVVVVEEEERRRR set this to yes on more than one
               machine in your network.

               Default: wwwwiiiinnnnssss ssssuuuuppppppppoooorrrrtttt ==== nnnnoooo

          wwwwoooorrrrkkkkggggrrrroooouuuupppp ((((GGGG))))
               This controls what workgroup your server will appear to
               be in when queried by clients. Note that this parameter
               also controls the Domain name used with the sssseeeeccccuuuurrrriiiittttyyyy ====
               ddddoooommmmaaaaiiiinnnn setting.

               Default: sssseeeetttt aaaatttt ccccoooommmmppppiiiilllleeee ttttiiiimmmmeeee ttttoooo WWWWOOOORRRRKKKKGGGGRRRROOOOUUUUPPPP

               Example: wwwwoooorrrrkkkkggggrrrroooouuuupppp ==== MMMMYYYYGGGGRRRROOOOUUUUPPPP

          wwwwrrrriiiittttaaaabbbblllleeee ((((SSSS))))
               Synonym for  _w_r_i_t_e_a_b_l_e for people who can't spell :-).

          wwwwrrrriiiitttteeee ccccaaaacccchhhheeee ssssiiiizzzzeeee ((((SSSS))))
               If this integer parameter is set to non-zero value,
               Samba will create an in-memory cache for each oplocked
               file (it does nnnnooootttt do this for non-oplocked files). All
               writes that the client does not request to be flushed
               directly to disk will be stored in this cache if
               possible. The cache is flushed onto disk when a write
               comes in whose offset would not fit into the cache or
               when the file is closed by the client. Reads for the
               file are also served from this cache if the data is
               stored within it.

               This cache allows Samba to batch client writes into a
               more efficient write size for RAID disks (i.e. writes
               may be tuned to be the RAID stripe size) and can
               improve performance on systems where the disk subsystem
               is a bottleneck but there is free memory for userspace
               programs.

               The integer parameter specifies the size of this cache
               (per oplocked file) in bytes.

               Default: wwwwrrrriiiitttteeee ccccaaaacccchhhheeee ssssiiiizzzzeeee ==== 0000

               Example: wwwwrrrriiiitttteeee ccccaaaacccchhhheeee ssssiiiizzzzeeee ==== 222266662222111144444444

               for a 256k cache size per file.



     Page 136                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



          wwwwrrrriiiitttteeee lllliiiisssstttt ((((SSSS))))
               This is a list of users that are given read-write
               access to a service. If the connecting user is in this
               list then they will be given write access, no matter
               what the _r_e_a_d _o_n_l_y option is set to. The list can
               include group names using the @group syntax.

               Note that if a user is in both the read list and the
               write list then they will be given write access.

               See also the _r_e_a_d _l_i_s_t option.

               Default: wwwwrrrriiiitttteeee lllliiiisssstttt ==== <<<<eeeemmmmppppttttyyyy ssssttttrrrriiiinnnngggg>>>>

               Example: wwwwrrrriiiitttteeee lllliiiisssstttt ==== aaaaddddmmmmiiiinnnn,,,, rrrrooooooootttt,,,, @@@@ssssttttaaaaffffffff

          wwwwrrrriiiitttteeee ooookkkk ((((SSSS))))
               Inverted synonym for  _r_e_a_d _o_n_l_y.

          wwwwrrrriiiitttteeee rrrraaaawwww ((((GGGG))))
               This parameter controls whether or not the server will
               support raw write SMB's when transferring data from
               clients. You should never need to change this
               parameter.

               Default: wwwwrrrriiiitttteeee rrrraaaawwww ==== yyyyeeeessss

          wwwwrrrriiiitttteeeeaaaabbbblllleeee ((((SSSS))))
               Inverted synonym for  _r_e_a_d _o_n_l_y.

     WWWWAAAARRRRNNNNIIIINNNNGGGGSSSS
          Although the configuration file permits service names to
          contain spaces, your client software may not. Spaces will be
          ignored in comparisons anyway, so it shouldn't be a problem
          - but be aware of the possibility.

          On a similar note, many clients - especially DOS clients -
          limit service names to eight characters. smbd(8)
           has no such limitation, but attempts to connect from such
          clients will fail if they truncate the service names. For
          this reason you should probably keep your service names down
          to eight characters in length.

          Use of the [homes] and [printers] special sections make life
          for an administrator easy, but the various combinations of
          default attributes can be tricky. Take extreme care when
          designing these sections. In particular, ensure that the
          permissions on spool directories are correct.

     VVVVEEEERRRRSSSSIIIIOOOONNNN
          This man page is correct for version 2.2 of the Samba suite.




     Page 137                                        (printed 1/7/103)






     SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))      UUUUNNNNIIIIXXXX SSSSyyyysssstttteeeemmmm VVVV ((((11115555 OOOOccccttttoooobbbbeeeerrrr 2222000000002222))))      SSSSMMMMBBBB....CCCCOOOONNNNFFFF((((5555))))



     SSSSEEEEEEEE AAAALLLLSSSSOOOO
          samba(7) ssssmmmmbbbbppppaaaasssssssswwwwdddd((((8888)))) sssswwwwaaaatttt((((8888)))) ssssmmmmbbbbdddd((((8888)))) nnnnmmmmbbbbdddd((((8888)))) ssssmmmmbbbbcccclllliiiieeeennnntttt((((1111))))
          nnnnmmmmbbbbllllooooooookkkkuuuupppp((((1111)))) tttteeeessssttttppppaaaarrrrmmmm((((1111)))) tttteeeessssttttpppprrrrnnnnssss((((1111))))

     AAAAUUUUTTTTHHHHOOOORRRR
          The original Samba software and related utilities were
          created by Andrew Tridgell. Samba is now developed by the
          Samba Team as an Open Source project similar to the way the
          Linux kernel is developed.

          The original Samba man pages were written by Karl Auer. The
          man page sources were converted to YODL format (another
          excellent piece of Open Source software, available at
          ftp://ftp.icce.rug.nl/pub/unix/
          <URL:ftp://ftp.icce.rug.nl/pub/unix/>) and updated for the
          Samba 2.0 release by Jeremy Allison. The conversion to
          DocBook for Samba 2.2 was done by Gerald Carter






































     Page 138                                        (printed 1/7/103)