| 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>net</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"><a name="net.8"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>net — Tool for administration of Samba and remote
|
|---|
| 2 | CIFS servers.
|
|---|
| 3 | </p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="literal">net</code> {<ads|rap|rpc>} [-h] [-w workgroup] [-W myworkgroup] [-U user] [-I ip-address] [-p port] [-n myname] [-s conffile] [-S server] [-l] [-P] [-d debuglevel] [-V]</p></div></div><div class="refsect1" lang="en"><a name="id259362"></a><h2>DESCRIPTION</h2><p>This tool is part of the <a href="samba.7.html"><span class="citerefentry"><span class="refentrytitle">samba</span>(7)</span></a> suite.</p><p>The samba net utility is meant to work just like the net utility
|
|---|
| 4 | available for windows and DOS. The first argument should be used
|
|---|
| 5 | to specify the protocol to use when executing a certain command.
|
|---|
| 6 | ADS is used for ActiveDirectory, RAP is using for old (Win9x/NT3)
|
|---|
| 7 | clients and RPC can be used for NT4 and Windows 2000. If this
|
|---|
| 8 | argument is omitted, net will try to determine it automatically.
|
|---|
| 9 | Not all commands are available on all protocols.
|
|---|
| 10 | </p></div><div class="refsect1" lang="en"><a name="id259387"></a><h2>OPTIONS</h2><div class="variablelist"><dl><dt><span class="term">-h|--help</span></dt><dd><p>Print a summary of command line options.
|
|---|
| 11 | </p></dd><dt><span class="term">-w target-workgroup</span></dt><dd><p>
|
|---|
| 12 | Sets target workgroup or domain. You have to specify
|
|---|
| 13 | either this option or the IP address or the name of a server.
|
|---|
| 14 | </p></dd><dt><span class="term">-W workgroup</span></dt><dd><p>
|
|---|
| 15 | Sets client workgroup or domain
|
|---|
| 16 | </p></dd><dt><span class="term">-U user</span></dt><dd><p>
|
|---|
| 17 | User name to use
|
|---|
| 18 | </p></dd><dt><span class="term">-I ip-address</span></dt><dd><p>
|
|---|
| 19 | IP address of target server to use. You have to
|
|---|
| 20 | specify either this option or a target workgroup or
|
|---|
| 21 | a target server.
|
|---|
| 22 | </p></dd><dt><span class="term">-p port</span></dt><dd><p>
|
|---|
| 23 | Port on the target server to connect to (usually 139 or 445).
|
|---|
| 24 | Defaults to trying 445 first, then 139.
|
|---|
| 25 | </p></dd><dt><span class="term">-n <primary NetBIOS name></span></dt><dd><p>This option allows you to override
|
|---|
| 26 | the NetBIOS name that Samba uses for itself. This is identical
|
|---|
| 27 | to setting the <a class="indexterm" name="id260390"></a> parameter in the <code class="filename">smb.conf</code> file.
|
|---|
| 28 | However, a command
|
|---|
| 29 | line setting will take precedence over settings in
|
|---|
| 30 | <code class="filename">smb.conf</code>.</p></dd><dt><span class="term">-s <configuration file></span></dt><dd><p>The file specified contains the
|
|---|
| 31 | configuration details required by the server. The
|
|---|
| 32 | information in this file includes server-specific
|
|---|
| 33 | information such as what printcap file to use, as well
|
|---|
| 34 | as descriptions of all the services that the server is
|
|---|
| 35 | to provide. See <code class="filename">smb.conf</code> for more information.
|
|---|
| 36 | The default configuration file name is determined at
|
|---|
| 37 | compile time.</p></dd><dt><span class="term">-S server</span></dt><dd><p>
|
|---|
| 38 | Name of target server. You should specify either
|
|---|
| 39 | this option or a target workgroup or a target IP address.
|
|---|
| 40 | </p></dd><dt><span class="term">-l</span></dt><dd><p>
|
|---|
| 41 | When listing data, give more information on each item.
|
|---|
| 42 | </p></dd><dt><span class="term">-P</span></dt><dd><p>
|
|---|
| 43 | Make queries to the external server using the machine account of the local server.
|
|---|
| 44 | </p></dd><dt><span class="term">-d|--debuglevel=level</span></dt><dd><p><em class="replaceable"><code>level</code></em> is an integer
|
|---|
| 45 | from 0 to 10. The default value if this parameter is
|
|---|
| 46 | not specified is zero.</p><p>The higher this value, the more detail will be
|
|---|
| 47 | logged to the log files about the activities of the
|
|---|
| 48 | server. At level 0, only critical errors and serious
|
|---|
| 49 | warnings will be logged. Level 1 is a reasonable level for
|
|---|
| 50 | day-to-day running - it generates a small amount of
|
|---|
| 51 | information about operations carried out.</p><p>Levels above 1 will generate considerable
|
|---|
| 52 | amounts of log data, and should only be used when
|
|---|
| 53 | investigating a problem. Levels above 3 are designed for
|
|---|
| 54 | use only by developers and generate HUGE amounts of log
|
|---|
| 55 | data, most of which is extremely cryptic.</p><p>Note that specifying this parameter here will
|
|---|
| 56 | override the <a class="indexterm" name="id260134"></a> parameter
|
|---|
| 57 | in the <code class="filename">smb.conf</code> file.</p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id260151"></a><h2>COMMANDS</h2><div class="refsect2" lang="en"><a name="id260156"></a><h3>CHANGESECRETPW</h3><p>This command allows the Samba machine account password to be set from an external application
|
|---|
| 58 | to a machine account password that has already been stored in Active Directory. DO NOT USE this command
|
|---|
| 59 | unless you know exactly what you are doing. The use of this command requires that the force flag (-f)
|
|---|
| 60 | be used also. There will be NO command prompt. Whatever information is piped into stdin, either by
|
|---|
| 61 | typing at the command line or otherwise, will be stored as the literal machine password. Do NOT use
|
|---|
| 62 | this without care and attention as it will overwrite a legitimate machine password without warning.
|
|---|
| 63 | YOU HAVE BEEN WARNED.
|
|---|
| 64 | </p></div><div class="refsect2" lang="en"><a name="id260172"></a><h3>TIME</h3><p>The <code class="literal">NET TIME</code> command allows you to view the time on a remote server
|
|---|
| 65 | or synchronise the time on the local server with the time on the remote server.</p><div class="refsect3" lang="en"><a name="id260188"></a><h4>TIME</h4><p>Without any options, the <code class="literal">NET TIME</code> command
|
|---|
| 66 | displays the time on the remote server.
|
|---|
| 67 | </p></div><div class="refsect3" lang="en"><a name="id260203"></a><h4>TIME SYSTEM</h4><p>Displays the time on the remote server in a format ready for <code class="literal">/bin/date</code></p></div><div class="refsect3" lang="en"><a name="id300441"></a><h4>TIME SET</h4><p>Tries to set the date and time of the local server to that on
|
|---|
| 68 | the remote server using <code class="literal">/bin/date</code>. </p></div><div class="refsect3" lang="en"><a name="id300456"></a><h4>TIME ZONE</h4><p>Displays the timezone in hours from GMT on the remote computer.</p></div></div><div class="refsect2" lang="en"><a name="id300467"></a><h3>[RPC|ADS] JOIN [TYPE] [-U username[%password]] [createupn=UPN] [createcomputer=OU] [options]</h3><p>
|
|---|
| 69 | Join a domain. If the account already exists on the server, and
|
|---|
| 70 | [TYPE] is MEMBER, the machine will attempt to join automatically.
|
|---|
| 71 | (Assuming that the machine has been created in server manager)
|
|---|
| 72 | Otherwise, a password will be prompted for, and a new account may
|
|---|
| 73 | be created.</p><p>
|
|---|
| 74 | [TYPE] may be PDC, BDC or MEMBER to specify the type of server
|
|---|
| 75 | joining the domain.
|
|---|
| 76 | </p><p>
|
|---|
| 77 | [UPN] (ADS only) set the principalname attribute during the join. The default
|
|---|
| 78 | format is host/netbiosname@REALM.
|
|---|
| 79 | </p><p>
|
|---|
| 80 | [OU] (ADS only) Precreate the computer account in a specific OU. The
|
|---|
| 81 | OU string reads from top to bottom without RDNs, and is delimited by
|
|---|
| 82 | a '/'. Please note that '\' is used for escape by both the shell
|
|---|
| 83 | and ldap, so it may need to be doubled or quadrupled to pass through,
|
|---|
| 84 | and it is not used as a delimiter.
|
|---|
| 85 | </p></div><div class="refsect2" lang="en"><a name="id300496"></a><h3>[RPC] OLDJOIN [options]</h3><p>Join a domain. Use the OLDJOIN option to join the domain
|
|---|
| 86 | using the old style of domain joining - you need to create a trust
|
|---|
| 87 | account in server manager first.</p></div><div class="refsect2" lang="en"><a name="id300507"></a><h3>[RPC|ADS] USER</h3><div class="refsect3" lang="en"><a name="id300513"></a><h4>[RPC|ADS] USER</h4><p>List all users</p></div><div class="refsect3" lang="en"><a name="id300522"></a><h4>[RPC|ADS] USER DELETE <em class="replaceable"><code>target</code></em></h4><p>Delete specified user</p></div><div class="refsect3" lang="en"><a name="id300535"></a><h4>[RPC|ADS] USER INFO <em class="replaceable"><code>target</code></em></h4><p>List the domain groups of a the specified user.</p></div><div class="refsect3" lang="en"><a name="id300547"></a><h4>[RPC|ADS] USER RENAME <em class="replaceable"><code>oldname</code></em> <em class="replaceable"><code>newname</code></em></h4><p>Rename specified user.</p></div><div class="refsect3" lang="en"><a name="id300563"></a><h4>[RPC|ADS] USER ADD <em class="replaceable"><code>name</code></em> [password] [-F user flags] [-C comment]</h4><p>Add specified user.</p></div></div><div class="refsect2" lang="en"><a name="id300579"></a><h3>[RPC|ADS] GROUP</h3><div class="refsect3" lang="en"><a name="id300584"></a><h4>[RPC|ADS] GROUP [misc options] [targets]</h4><p>List user groups.</p></div><div class="refsect3" lang="en"><a name="id300595"></a><h4>[RPC|ADS] GROUP DELETE <em class="replaceable"><code>name</code></em> [misc. options]</h4><p>Delete specified group.</p></div><div class="refsect3" lang="en"><a name="id300608"></a><h4>[RPC|ADS] GROUP ADD <em class="replaceable"><code>name</code></em> [-C comment]</h4><p>Create specified group.</p></div></div><div class="refsect2" lang="en"><a name="id300623"></a><h3>[RAP|RPC] SHARE</h3><div class="refsect3" lang="en"><a name="id300629"></a><h4>[RAP|RPC] SHARE [misc. options] [targets]</h4><p>Enumerates all exported resources (network shares) on target server.</p></div><div class="refsect3" lang="en"><a name="id300640"></a><h4>[RAP|RPC] SHARE ADD <em class="replaceable"><code>name=serverpath</code></em> [-C comment] [-M maxusers] [targets]</h4><p>Adds a share from a server (makes the export active). Maxusers
|
|---|
| 88 | specifies the number of users that can be connected to the
|
|---|
| 89 | share simultaneously.</p></div><div class="refsect3" lang="en"><a name="id300655"></a><h4>SHARE DELETE <em class="replaceable"><code>sharenam</code></em></h4><p>Delete specified share.</p></div></div><div class="refsect2" lang="en"><a name="id300668"></a><h3>[RPC|RAP] FILE</h3><div class="refsect3" lang="en"><a name="id300674"></a><h4>[RPC|RAP] FILE</h4><p>List all open files on remote server.</p></div><div class="refsect3" lang="en"><a name="id300684"></a><h4>[RPC|RAP] FILE CLOSE <em class="replaceable"><code>fileid</code></em></h4><p>Close file with specified <em class="replaceable"><code>fileid</code></em> on
|
|---|
| 90 | remote server.</p></div><div class="refsect3" lang="en"><a name="id300701"></a><h4>[RPC|RAP] FILE INFO <em class="replaceable"><code>fileid</code></em></h4><p>
|
|---|
| 91 | Print information on specified <em class="replaceable"><code>fileid</code></em>.
|
|---|
| 92 | Currently listed are: file-id, username, locks, path, permissions.
|
|---|
| 93 | </p></div><div class="refsect3" lang="en"><a name="id300718"></a><h4>[RAP|RPC] FILE USER</h4><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Currently NOT implemented.</p></div></div></div><div class="refsect2" lang="en"><a name="id300730"></a><h3>SESSION</h3><div class="refsect3" lang="en"><a name="id300736"></a><h4>RAP SESSION</h4><p>Without any other options, SESSION enumerates all active SMB/CIFS
|
|---|
| 94 | sessions on the target server.</p></div><div class="refsect3" lang="en"><a name="id300746"></a><h4>RAP SESSION DELETE|CLOSE <em class="replaceable"><code>CLIENT_NAME</code></em></h4><p>Close the specified sessions.</p></div><div class="refsect3" lang="en"><a name="id300759"></a><h4>RAP SESSION INFO <em class="replaceable"><code>CLIENT_NAME</code></em></h4><p>Give a list with all the open files in specified session.</p></div></div><div class="refsect2" lang="en"><a name="id300773"></a><h3>RAP SERVER <em class="replaceable"><code>DOMAIN</code></em></h3><p>List all servers in specified domain or workgroup. Defaults
|
|---|
| 95 | to local domain.</p></div><div class="refsect2" lang="en"><a name="id300786"></a><h3>RAP DOMAIN</h3><p>Lists all domains and workgroups visible on the
|
|---|
| 96 | current network.</p></div><div class="refsect2" lang="en"><a name="id300797"></a><h3>RAP PRINTQ</h3><div class="refsect3" lang="en"><a name="id300802"></a><h4>RAP PRINTQ LIST <em class="replaceable"><code>QUEUE_NAME</code></em></h4><p>Lists the specified print queue and print jobs on the server.
|
|---|
| 97 | If the <em class="replaceable"><code>QUEUE_NAME</code></em> is omitted, all
|
|---|
| 98 | queues are listed.</p></div><div class="refsect3" lang="en"><a name="id300819"></a><h4>RAP PRINTQ DELETE <em class="replaceable"><code>JOBID</code></em></h4><p>Delete job with specified id.</p></div></div><div class="refsect2" lang="en"><a name="id300833"></a><h3>RAP VALIDATE <em class="replaceable"><code>user</code></em> [<em class="replaceable"><code>password</code></em>]</h3><p>
|
|---|
| 99 | Validate whether the specified user can log in to the
|
|---|
| 100 | remote server. If the password is not specified on the commandline, it
|
|---|
| 101 | will be prompted.
|
|---|
| 102 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Currently NOT implemented.</p></div></div><div class="refsect2" lang="en"><a name="id300856"></a><h3>RAP GROUPMEMBER</h3><div class="refsect3" lang="en"><a name="id300861"></a><h4>RAP GROUPMEMBER LIST <em class="replaceable"><code>GROUP</code></em></h4><p>List all members of the specified group.</p></div><div class="refsect3" lang="en"><a name="id300874"></a><h4>RAP GROUPMEMBER DELETE <em class="replaceable"><code>GROUP</code></em> <em class="replaceable"><code>USER</code></em></h4><p>Delete member from group.</p></div><div class="refsect3" lang="en"><a name="id300890"></a><h4>RAP GROUPMEMBER ADD <em class="replaceable"><code>GROUP</code></em> <em class="replaceable"><code>USER</code></em></h4><p>Add member to group.</p></div></div><div class="refsect2" lang="en"><a name="id300907"></a><h3>RAP ADMIN <em class="replaceable"><code>command</code></em></h3><p>Execute the specified <em class="replaceable"><code>command</code></em> on
|
|---|
| 103 | the remote server. Only works with OS/2 servers.
|
|---|
| 104 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Currently NOT implemented.</p></div></div><div class="refsect2" lang="en"><a name="id300928"></a><h3>RAP SERVICE</h3><div class="refsect3" lang="en"><a name="id300934"></a><h4>RAP SERVICE START <em class="replaceable"><code>NAME</code></em> [arguments...]</h4><p>Start the specified service on the remote server. Not implemented yet.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Currently NOT implemented.</p></div></div><div class="refsect3" lang="en"><a name="id300953"></a><h4>RAP SERVICE STOP</h4><p>Stop the specified service on the remote server.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Currently NOT implemented.</p></div></div></div><div class="refsect2" lang="en"><a name="id300969"></a><h3>RAP PASSWORD <em class="replaceable"><code>USER</code></em> <em class="replaceable"><code>OLDPASS</code></em> <em class="replaceable"><code>NEWPASS</code></em></h3><p>
|
|---|
| 105 | Change password of <em class="replaceable"><code>USER</code></em> from <em class="replaceable"><code>OLDPASS</code></em> to <em class="replaceable"><code>NEWPASS</code></em>.
|
|---|
| 106 | </p></div><div class="refsect2" lang="en"><a name="id301000"></a><h3>LOOKUP</h3><div class="refsect3" lang="en"><a name="id301005"></a><h4>LOOKUP HOST <em class="replaceable"><code>HOSTNAME</code></em> [<em class="replaceable"><code>TYPE</code></em>]</h4><p>
|
|---|
| 107 | Lookup the IP address of the given host with the specified type (netbios suffix).
|
|---|
| 108 | The type defaults to 0x20 (workstation).
|
|---|
| 109 | </p></div><div class="refsect3" lang="en"><a name="id301023"></a><h4>LOOKUP LDAP [<em class="replaceable"><code>DOMAIN</code></em></h4><p>Give IP address of LDAP server of specified <em class="replaceable"><code>DOMAIN</code></em>. Defaults to local domain.</p></div><div class="refsect3" lang="en"><a name="id301040"></a><h4>LOOKUP KDC [<em class="replaceable"><code>REALM</code></em>]</h4><p>Give IP address of KDC for the specified <em class="replaceable"><code>REALM</code></em>.
|
|---|
| 110 | Defaults to local realm.</p></div><div class="refsect3" lang="en"><a name="id301058"></a><h4>LOOKUP DC [<em class="replaceable"><code>DOMAIN</code></em>]</h4><p>Give IP's of Domain Controllers for specified <em class="replaceable"><code>
|
|---|
| 111 | DOMAIN</code></em>. Defaults to local domain.</p></div><div class="refsect3" lang="en"><a name="id301075"></a><h4>LOOKUP MASTER <em class="replaceable"><code>DOMAIN</code></em></h4><p>Give IP of master browser for specified <em class="replaceable"><code>DOMAIN</code></em>
|
|---|
| 112 | or workgroup. Defaults to local domain.</p></div></div><div class="refsect2" lang="en"><a name="id301093"></a><h3>CACHE</h3><p>Samba uses a general caching interface called 'gencache'. It
|
|---|
| 113 | can be controlled using 'NET CACHE'.</p><p>All the timeout parameters support the suffixes:
|
|---|
| 114 |
|
|---|
| 115 | </p><table class="simplelist" border="0" summary="Simple list"><tr><td>s - Seconds</td></tr><tr><td>m - Minutes</td></tr><tr><td>h - Hours</td></tr><tr><td>d - Days</td></tr><tr><td>w - Weeks</td></tr></table><p>
|
|---|
| 116 |
|
|---|
| 117 | </p><div class="refsect3" lang="en"><a name="id301129"></a><h4>CACHE ADD <em class="replaceable"><code>key</code></em> <em class="replaceable"><code>data</code></em> <em class="replaceable"><code>time-out</code></em></h4><p>Add specified key+data to the cache with the given timeout.</p></div><div class="refsect3" lang="en"><a name="id301149"></a><h4>CACHE DEL <em class="replaceable"><code>key</code></em></h4><p>Delete key from the cache.</p></div><div class="refsect3" lang="en"><a name="id301161"></a><h4>CACHE SET <em class="replaceable"><code>key</code></em> <em class="replaceable"><code>data</code></em> <em class="replaceable"><code>time-out</code></em></h4><p>Update data of existing cache entry.</p></div><div class="refsect3" lang="en"><a name="id301181"></a><h4>CACHE SEARCH <em class="replaceable"><code>PATTERN</code></em></h4><p>Search for the specified pattern in the cache data.</p></div><div class="refsect3" lang="en"><a name="id301194"></a><h4>CACHE LIST</h4><p>
|
|---|
| 118 | List all current items in the cache.
|
|---|
| 119 | </p></div><div class="refsect3" lang="en"><a name="id301204"></a><h4>CACHE FLUSH</h4><p>Remove all the current items from the cache.</p></div></div><div class="refsect2" lang="en"><a name="id301215"></a><h3>GETLOCALSID [DOMAIN]</h3><p>Print the SID of the specified domain, or if the parameter is
|
|---|
| 120 | omitted, the SID of the domain the local server is in.</p></div><div class="refsect2" lang="en"><a name="id301226"></a><h3>SETLOCALSID S-1-5-21-x-y-z</h3><p>Sets domain sid for the local server to the specified SID.</p></div><div class="refsect2" lang="en"><a name="id301237"></a><h3>GROUPMAP</h3><p>Manage the mappings between Windows group SIDs and UNIX groups.
|
|---|
| 121 | Parameters take the for "parameter=value". Common options include:</p><div class="itemizedlist"><ul type="disc"><li><p>unixgroup - Name of the UNIX group</p></li><li><p>ntgroup - Name of the Windows NT group (must be
|
|---|
| 122 | resolvable to a SID</p></li><li><p>rid - Unsigned 32-bit integer</p></li><li><p>sid - Full SID in the form of "S-1-..."</p></li><li><p>type - Type of the group; either 'domain', 'local',
|
|---|
| 123 | or 'builtin'</p></li><li><p>comment - Freeform text description of the group</p></li></ul></div><div class="refsect3" lang="en"><a name="id301279"></a><h4>GROUPMAP ADD</h4><p>
|
|---|
| 124 | Add a new group mapping entry:
|
|---|
| 125 | </p><pre class="programlisting">
|
|---|
| 126 | net groupmap add {rid=int|sid=string} unixgroup=string \
|
|---|
| 127 | [type={domain|local}] [ntgroup=string] [comment=string]
|
|---|
| 128 | </pre><p>
|
|---|
| 129 | </p></div><div class="refsect3" lang="en"><a name="id301296"></a><h4>GROUPMAP DELETE</h4><p>Delete a group mapping entry. If more then one group name matches, the first entry found is deleted.</p><p>net groupmap delete {ntgroup=string|sid=SID}</p></div><div class="refsect3" lang="en"><a name="id301310"></a><h4>GROUPMAP MODIFY</h4><p>Update en existing group entry</p><p>
|
|---|
| 130 | </p><pre class="programlisting">
|
|---|
| 131 | net groupmap modify {ntgroup=string|sid=SID} [unixgroup=string] \
|
|---|
| 132 | [comment=string] [type={domain|local}]
|
|---|
| 133 | </pre><p>
|
|---|
| 134 | </p></div><div class="refsect3" lang="en"><a name="id301330"></a><h4>GROUPMAP LIST</h4><p>List existing group mapping entries</p><p>net groupmap list [verbose] [ntgroup=string] [sid=SID]</p></div></div><div class="refsect2" lang="en"><a name="id301345"></a><h3>MAXRID</h3><p>Prints out the highest RID currently in use on the local
|
|---|
| 135 | server (by the active 'passdb backend').
|
|---|
| 136 | </p></div><div class="refsect2" lang="en"><a name="id301356"></a><h3>RPC INFO</h3><p>Print information about the domain of the remote server,
|
|---|
| 137 | such as domain name, domain sid and number of users and groups.
|
|---|
| 138 | </p></div><div class="refsect2" lang="en"><a name="id301367"></a><h3>[RPC|ADS] TESTJOIN</h3><p>Check whether participation in a domain is still valid.</p></div><div class="refsect2" lang="en"><a name="id301378"></a><h3>[RPC|ADS] CHANGETRUSTPW</h3><p>Force change of domain trust password.</p></div><div class="refsect2" lang="en"><a name="id301388"></a><h3>RPC TRUSTDOM</h3><div class="refsect3" lang="en"><a name="id301393"></a><h4>RPC TRUSTDOM ADD <em class="replaceable"><code>DOMAIN</code></em></h4><p>Add a interdomain trust account for
|
|---|
| 139 | <em class="replaceable"><code>DOMAIN</code></em> to the remote server.
|
|---|
| 140 | </p></div><div class="refsect3" lang="en"><a name="id301410"></a><h4>RPC TRUSTDOM DEL <em class="replaceable"><code>DOMAIM</code></em></h4><p>Remove interdomain trust account for
|
|---|
| 141 | <em class="replaceable"><code>DOMAIN</code></em> from the remote server.
|
|---|
| 142 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Currently NOT implemented.</p></div></div><div class="refsect3" lang="en"><a name="id301431"></a><h4>RPC TRUSTDOM ESTABLISH <em class="replaceable"><code>DOMAIN</code></em></h4><p>
|
|---|
| 143 | Establish a trust relationship to a trusting domain.
|
|---|
| 144 | Interdomain account must already be created on the remote PDC.
|
|---|
| 145 | </p></div><div class="refsect3" lang="en"><a name="id301444"></a><h4>RPC TRUSTDOM REVOKE <em class="replaceable"><code>DOMAIN</code></em></h4><p>Abandon relationship to trusted domain</p></div><div class="refsect3" lang="en"><a name="id301457"></a><h4>RPC TRUSTDOM LIST</h4><p>List all current interdomain trust relationships.</p></div><div class="refsect3" lang="en"><a name="id301468"></a><h4>RPC RIGHTS</h4><p>This subcommand is used to view and manage Samba's rights assignments (also
|
|---|
| 146 | referred to as privileges). There are three options current available:
|
|---|
| 147 | <em class="parameter"><code>list</code></em>, <em class="parameter"><code>grant</code></em>, and
|
|---|
| 148 | <em class="parameter"><code>revoke</code></em>. More details on Samba's privilege model and its use
|
|---|
| 149 | can be found in the Samba-HOWTO-Collection.</p></div></div><div class="refsect2" lang="en"><a name="id301498"></a><h3>RPC ABORTSHUTDOWN</h3><p>Abort the shutdown of a remote server.</p></div><div class="refsect2" lang="en"><a name="id301509"></a><h3>RPC SHUTDOWN [-t timeout] [-r] [-f] [-C message]</h3><p>Shut down the remote server.</p><div class="variablelist"><dl><dt><span class="term">-r</span></dt><dd><p>
|
|---|
| 150 | Reboot after shutdown.
|
|---|
| 151 | </p></dd><dt><span class="term">-f</span></dt><dd><p>
|
|---|
| 152 | Force shutting down all applications.
|
|---|
| 153 | </p></dd><dt><span class="term">-t timeout</span></dt><dd><p>
|
|---|
| 154 | Timeout before system will be shut down. An interactive
|
|---|
| 155 | user of the system can use this time to cancel the shutdown.
|
|---|
| 156 | </p></dd><dt><span class="term">-C message</span></dt><dd><p>Display the specified message on the screen to
|
|---|
| 157 | announce the shutdown.</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id301568"></a><h3>RPC SAMDUMP</h3><p>Print out sam database of remote server. You need
|
|---|
| 158 | to run this against the PDC, from a Samba machine joined as a BDC. </p></div><div class="refsect2" lang="en"><a name="id301579"></a><h3>RPC VAMPIRE</h3><p>Export users, aliases and groups from remote server to
|
|---|
| 159 | local server. You need to run this against the PDC, from a Samba machine joined as a BDC.
|
|---|
| 160 | </p></div><div class="refsect2" lang="en"><a name="id301591"></a><h3>RPC GETSID</h3><p>Fetch domain SID and store it in the local <code class="filename">secrets.tdb</code>. </p></div><div class="refsect2" lang="en"><a name="id301607"></a><h3>ADS LEAVE</h3><p>Make the remote host leave the domain it is part of. </p></div><div class="refsect2" lang="en"><a name="id301617"></a><h3>ADS STATUS</h3><p>Print out status of machine account of the local machine in ADS.
|
|---|
| 161 | Prints out quite some debug info. Aimed at developers, regular
|
|---|
| 162 | users should use <code class="literal">NET ADS TESTJOIN</code>.</p></div><div class="refsect2" lang="en"><a name="id301634"></a><h3>ADS PRINTER</h3><div class="refsect3" lang="en"><a name="id301640"></a><h4>ADS PRINTER INFO [<em class="replaceable"><code>PRINTER</code></em>] [<em class="replaceable"><code>SERVER</code></em>]</h4><p>
|
|---|
| 163 | Lookup info for <em class="replaceable"><code>PRINTER</code></em> on <em class="replaceable"><code>SERVER</code></em>. The printer name defaults to "*", the
|
|---|
| 164 | server name defaults to the local host.</p></div><div class="refsect3" lang="en"><a name="id301665"></a><h4>ADS PRINTER PUBLISH <em class="replaceable"><code>PRINTER</code></em></h4><p>Publish specified printer using ADS.</p></div><div class="refsect3" lang="en"><a name="id301677"></a><h4>ADS PRINTER REMOVE <em class="replaceable"><code>PRINTER</code></em></h4><p>Remove specified printer from ADS directory.</p></div></div><div class="refsect2" lang="en"><a name="id301691"></a><h3>ADS SEARCH <em class="replaceable"><code>EXPRESSION</code></em> <em class="replaceable"><code>ATTRIBUTES...</code></em></h3><p>Perform a raw LDAP search on a ADS server and dump the results. The
|
|---|
| 165 | expression is a standard LDAP search expression, and the
|
|---|
| 166 | attributes are a list of LDAP fields to show in the results.</p><p>Example: <strong class="userinput"><code>net ads search '(objectCategory=group)' sAMAccountName</code></strong>
|
|---|
| 167 | </p></div><div class="refsect2" lang="en"><a name="id301718"></a><h3>ADS DN <em class="replaceable"><code>DN</code></em> <em class="replaceable"><code>(attributes)</code></em></h3><p>
|
|---|
| 168 | Perform a raw LDAP search on a ADS server and dump the results. The
|
|---|
| 169 | DN standard LDAP DN, and the attributes are a list of LDAP fields
|
|---|
| 170 | to show in the result.
|
|---|
| 171 | </p><p>Example: <strong class="userinput"><code>net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName</code></strong></p></div><div class="refsect2" lang="en"><a name="id301744"></a><h3>ADS WORKGROUP</h3><p>Print out workgroup name for specified kerberos realm.</p></div><div class="refsect2" lang="en"><a name="id301754"></a><h3>SAM CREATEBUILTINGROUP <NAME></h3><p>
|
|---|
| 172 | (Re)Create a BUILTIN group.
|
|---|
| 173 | Only a wellknown set of BUILTIN groups can be created with this command.
|
|---|
| 174 | This is the list of currently recognized group names: Administrators,
|
|---|
| 175 | Users, Guests, Power Users, Account Operators, Server Operators, Print
|
|---|
| 176 | Operators, Backup Operators, Replicator, RAS Servers, Pre-Windows 2000
|
|---|
| 177 | ompatible Access.
|
|---|
| 178 |
|
|---|
| 179 | This command requires a running Winbindd with idmap allocation properly
|
|---|
| 180 | configured. The group gid will be allocated out of the winbindd range.
|
|---|
| 181 | </p></div><div class="refsect2" lang="en"><a name="id301768"></a><h3>SAM CREATELOCALGROUP <NAME></h3><p>
|
|---|
| 182 | Create a LOCAL group (also known as Alias).
|
|---|
| 183 |
|
|---|
| 184 | This command requires a running Winbindd with idmap allocation properly
|
|---|
| 185 | configured. The group gid will be allocated out of the winbindd range.
|
|---|
| 186 | </p></div><div class="refsect2" lang="en"><a name="id301780"></a><h3>SAM DELETELOCALGROUP <NAME></h3><p>
|
|---|
| 187 | Delete an existing LOCAL group (also known as Alias).
|
|---|
| 188 |
|
|---|
| 189 | </p></div><div class="refsect2" lang="en"><a name="id301791"></a><h3>SAM MAPUNIXGROUP <NAME></h3><p>
|
|---|
| 190 | Map an existing Unix group and make it a Domain Group, the domain group
|
|---|
| 191 | will have the same name.
|
|---|
| 192 | </p></div><div class="refsect2" lang="en"><a name="id301802"></a><h3>SAM UNMAPUNIXGROUP <NAME></h3><p>
|
|---|
| 193 | Remove an existing group mapping entry.
|
|---|
| 194 | </p></div><div class="refsect2" lang="en"><a name="id301813"></a><h3>SAM ADDMEM <GROUP> <MEMBER></h3><p>
|
|---|
| 195 | Add a member to a Local group. The group can be specified only by name,
|
|---|
| 196 | the member can be specified by name or SID.
|
|---|
| 197 | </p></div><div class="refsect2" lang="en"><a name="id301824"></a><h3>SAM DELMEM <GROUP> <MEMBER></h3><p>
|
|---|
| 198 | Remove a member from a Local group. The group and the member must be
|
|---|
| 199 | specified by name.
|
|---|
| 200 | </p></div><div class="refsect2" lang="en"><a name="id301835"></a><h3>SAM LISTMEM <GROUP></h3><p>
|
|---|
| 201 | List Local group members. The group must be specified by name.
|
|---|
| 202 | </p></div><div class="refsect2" lang="en"><a name="id301846"></a><h3>SAM LIST <users|groups|localgroups|builtin|workstations> [verbose]</h3><p>
|
|---|
| 203 | List the specified set of accounts by name. If verbose is specified,
|
|---|
| 204 | the rid and description is also provided for each account.
|
|---|
| 205 | </p></div><div class="refsect2" lang="en"><a name="id301858"></a><h3>SAM SHOW <NAME></h3><p>
|
|---|
| 206 | Show the full DOMAIN\\NAME the SID and the type for the corrisponding
|
|---|
| 207 | account.
|
|---|
| 208 | </p></div><div class="refsect2" lang="en"><a name="id301868"></a><h3>SAM SET HOMEDIR <NAME> <DIRECTORY></h3><p>
|
|---|
| 209 | Set the home directory for a user account.
|
|---|
| 210 | </p></div><div class="refsect2" lang="en"><a name="id301879"></a><h3>SAM SET PROFILEPATH <NAME> <PATH></h3><p>
|
|---|
| 211 | Set the profile path for a user account.
|
|---|
| 212 | </p></div><div class="refsect2" lang="en"><a name="id301890"></a><h3>SAM SET COMMENT <NAME> <COMMENT></h3><p>
|
|---|
| 213 | Set the comment for a user or group account.
|
|---|
| 214 | </p></div><div class="refsect2" lang="en"><a name="id301900"></a><h3>SAM SET FULLNAME <NAME> <FULL NAME></h3><p>
|
|---|
| 215 | Set the full name for a user account.
|
|---|
| 216 | </p></div><div class="refsect2" lang="en"><a name="id301911"></a><h3>SAM SET LOGONSCRIPT <NAME> <SCRIPT></h3><p>
|
|---|
| 217 | Set the logon script for a user account.
|
|---|
| 218 | </p></div><div class="refsect2" lang="en"><a name="id301921"></a><h3>SAM SET HOMEDRIVE <NAME> <DRIVE></h3><p>
|
|---|
| 219 | Set the home drive for a user account.
|
|---|
| 220 | </p></div><div class="refsect2" lang="en"><a name="id301932"></a><h3>SAM SET WORKSTATIONS <NAME> <WORKSTATIONS></h3><p>
|
|---|
| 221 | Set the workstations a user account is allowed to log in from.
|
|---|
| 222 | </p></div><div class="refsect2" lang="en"><a name="id301943"></a><h3>SAM SET DISABLE <NAME></h3><p>
|
|---|
| 223 | Set the "disabled" flag for a user account.
|
|---|
| 224 | </p></div><div class="refsect2" lang="en"><a name="id301953"></a><h3>SAM SET PWNOTREQ <NAME></h3><p>
|
|---|
| 225 | Set the "password not required" flag for a user account.
|
|---|
| 226 | </p></div><div class="refsect2" lang="en"><a name="id301964"></a><h3>SAM SET AUTOLOCK <NAME></h3><p>
|
|---|
| 227 | Set the "autolock" flag for a user account.
|
|---|
| 228 | </p></div><div class="refsect2" lang="en"><a name="id301974"></a><h3>SAM SET PWNOEXP <NAME></h3><p>
|
|---|
| 229 | Set the "password do not expire" flag for a user account.
|
|---|
| 230 | </p></div><div class="refsect2" lang="en"><a name="id301985"></a><h3>SAM SET PWMUSTCHANGENOW <NAME> [yes|no]</h3><p>
|
|---|
| 231 | Set or unset the "password must change" flag fro a user account.
|
|---|
| 232 | </p></div><div class="refsect2" lang="en"><a name="id301996"></a><h3>SAM POLICY LIST</h3><p>
|
|---|
| 233 | List the avilable account policies.
|
|---|
| 234 | </p></div><div class="refsect2" lang="en"><a name="id302006"></a><h3>SAM POLICY SHOW <account policy></h3><p>
|
|---|
| 235 | Show the account policy value.
|
|---|
| 236 | </p></div><div class="refsect2" lang="en"><a name="id302016"></a><h3>SAM POLICY SET <account policy> <value></h3><p>
|
|---|
| 237 | Set a value for the account policy.
|
|---|
| 238 | Valid values can be: "forever", "never", "off", or a number.
|
|---|
| 239 | </p></div><div class="refsect2" lang="en"><a name="id302028"></a><h3>SAM PROVISION</h3><p>
|
|---|
| 240 | Only available if ldapsam:editposix is set and winbindd is running.
|
|---|
| 241 | Properly populates the ldap tree with the basic accounts (Administrator)
|
|---|
| 242 | and groups (Domain Users, Domain Admins, Domain Guests) on the ldap tree.
|
|---|
| 243 | </p></div><div class="refsect2" lang="en"><a name="id302040"></a><h3>IDMAP DUMP <output file></h3><p>
|
|---|
| 244 | Dumps the mappings in the specified output file.
|
|---|
| 245 | </p></div><div class="refsect2" lang="en"><a name="id302050"></a><h3>IDMAP RESTORE [input file]</h3><p>
|
|---|
| 246 | Restore the mappings from the specified file or stdin.
|
|---|
| 247 | </p></div><div class="refsect2" lang="en"><a name="id302061"></a><h3>IDMAP SECRET <DOMAIN>|ALLOC <secret></h3><p>
|
|---|
| 248 | Store a secret for the sepcified domain, used primarily for domains
|
|---|
| 249 | that use idmap_ldap as a backend. In this case the secret is used
|
|---|
| 250 | as the password for the user DN used to bind to the ldap server.
|
|---|
| 251 | </p></div><div class="refsect2" lang="en"><a name="id302073"></a><h3>USERSHARE</h3><p>Starting with version 3.0.23, a Samba server now supports the ability for
|
|---|
| 252 | non-root users to add user define shares to be exported using the "net usershare"
|
|---|
| 253 | commands.
|
|---|
| 254 | </p><p>
|
|---|
| 255 | To set this up, first set up your smb.conf by adding to the [global] section :
|
|---|
| 256 |
|
|---|
| 257 | usershare path = /usr/local/samba/lib/usershares
|
|---|
| 258 |
|
|---|
| 259 | Next create the directory /usr/local/samba/lib/usershares, change the owner to root and
|
|---|
| 260 | set the group owner to the UNIX group who should have the ability to create usershares,
|
|---|
| 261 | for example a group called "serverops".
|
|---|
| 262 |
|
|---|
| 263 | Set the permissions on /usr/local/samba/lib/usershares to 01770.
|
|---|
| 264 |
|
|---|
| 265 | (Owner and group all access, no access for others, plus the sticky bit,
|
|---|
| 266 | which means that a file in that directory can be renamed or deleted only
|
|---|
| 267 | by the owner of the file).
|
|---|
| 268 |
|
|---|
| 269 | Finally, tell smbd how many usershares you will allow by adding to the [global]
|
|---|
| 270 | section of smb.conf a line such as :
|
|---|
| 271 |
|
|---|
| 272 | usershare max shares = 100.
|
|---|
| 273 |
|
|---|
| 274 | To allow 100 usershare definitions. Now, members of the UNIX group "serverops"
|
|---|
| 275 | can create user defined shares on demand using the commands below.
|
|---|
| 276 | </p><p>The usershare commands are:
|
|---|
| 277 |
|
|---|
| 278 | </p><table class="simplelist" border="0" summary="Simple list"><tr><td>net usershare add sharename path [comment] [acl] [guest_ok=[y|n]] - to add or change a user defined share.</td></tr><tr><td>net usershare delete sharename - to delete a user defined share.</td></tr><tr><td>net usershare info [-l|--long] [wildcard sharename] - to print info about a user defined share.</td></tr><tr><td>net usershare list [-l|--long] [wildcard sharename] - to list user defined shares.</td></tr></table><p>
|
|---|
| 279 |
|
|---|
| 280 | </p><div class="refsect3" lang="en"><a name="id302119"></a><h4>USERSHARE ADD <em class="replaceable"><code>sharename</code></em> <em class="replaceable"><code>path</code></em> <em class="replaceable"><code>[comment]</code></em> <em class="replaceable"><code>[acl]</code></em> <em class="replaceable"><code>[guest_ok=[y|n]]</code></em></h4><p>
|
|---|
| 281 | Add or replace a new user defined share, with name "sharename".
|
|---|
| 282 | </p><p>
|
|---|
| 283 | "path" specifies the absolute pathname on the system to be exported.
|
|---|
| 284 | Restrictions may be put on this, see the global smb.conf parameters :
|
|---|
| 285 | "usershare owner only", "usershare prefix allow list", and
|
|---|
| 286 | "usershare prefix deny list".
|
|---|
| 287 | </p><p>
|
|---|
| 288 | The optional "comment" parameter is the comment that will appear
|
|---|
| 289 | on the share when browsed to by a client.
|
|---|
| 290 | </p><p>The optional "acl" field
|
|---|
| 291 | specifies which users have read and write access to the entire share.
|
|---|
| 292 | Note that guest connections are not allowed unless the smb.conf parameter
|
|---|
| 293 | "usershare allow guests" has been set. The definition of a user
|
|---|
| 294 | defined share acl is : "user:permission", where user is a valid
|
|---|
| 295 | username on the system and permission can be "F", "R", or "D".
|
|---|
| 296 | "F" stands for "full permissions", ie. read and write permissions.
|
|---|
| 297 | "D" stands for "deny" for a user, ie. prevent this user from accessing
|
|---|
| 298 | this share.
|
|---|
| 299 | "R" stands for "read only", ie. only allow read access to this
|
|---|
| 300 | share (no creation of new files or directories or writing to files).
|
|---|
| 301 | </p><p>
|
|---|
| 302 | The default if no "acl" is given is "Everyone:R", which means any
|
|---|
| 303 | authenticated user has read-only access.
|
|---|
| 304 | </p><p>
|
|---|
| 305 | The optional "guest_ok" has the same effect as the parameter of the
|
|---|
| 306 | same name in smb.conf, in that it allows guest access to this user
|
|---|
| 307 | defined share. This parameter is only allowed if the global parameter
|
|---|
| 308 | "usershare allow guests" has been set to true in the smb.conf.
|
|---|
| 309 | </p>
|
|---|
| 310 |
|
|---|
| 311 | There is no separate command to modify an existing user defined share,
|
|---|
| 312 | just use the "net usershare add [sharename]" command using the same
|
|---|
| 313 | sharename as the one you wish to modify and specify the new options
|
|---|
| 314 | you wish. The Samba smbd daemon notices user defined share modifications
|
|---|
| 315 | at connect time so will see the change immediately, there is no need
|
|---|
| 316 | to restart smbd on adding, deleting or changing a user defined share.
|
|---|
| 317 | </div><div class="refsect3" lang="en"><a name="id302183"></a><h4>USERSHARE DELETE <em class="replaceable"><code>sharename</code></em></h4><p>
|
|---|
| 318 | Deletes the user defined share by name. The Samba smbd daemon
|
|---|
| 319 | immediately notices this change, although it will not disconnect
|
|---|
| 320 | any users currently connected to the deleted share.
|
|---|
| 321 | </p></div><div class="refsect3" lang="en"><a name="id302197"></a><h4>USERSHARE INFO <em class="replaceable"><code>[-l|--long]</code></em> <em class="replaceable"><code>[wildcard sharename]</code></em></h4><p>
|
|---|
| 322 | Get info on user defined shares owned by the current user matching the given pattern, or all users.
|
|---|
| 323 | </p><p>
|
|---|
| 324 | net usershare info on its own dumps out info on the user defined shares that were
|
|---|
| 325 | created by the current user, or restricts them to share names that match the given
|
|---|
| 326 | wildcard pattern ('*' matches one or more characters, '?' matches only one character).
|
|---|
| 327 | If the '-l' or '--long' option is also given, it prints out info on user defined
|
|---|
| 328 | shares created by other users.
|
|---|
| 329 | </p><p>
|
|---|
| 330 | The information given about a share looks like :
|
|---|
| 331 |
|
|---|
| 332 | [foobar]
|
|---|
| 333 | path=/home/jeremy
|
|---|
| 334 | comment=testme
|
|---|
| 335 | usershare_acl=Everyone:F
|
|---|
| 336 | guest_ok=n
|
|---|
| 337 |
|
|---|
| 338 | And is a list of the current settings of the user defined share that can be
|
|---|
| 339 | modified by the "net usershare add" command.
|
|---|
| 340 | </p></div><div class="refsect3" lang="en"><a name="id302225"></a><h4>USERSHARE LIST <em class="replaceable"><code>[-l|--long]</code></em> <em class="replaceable"><code>wildcard sharename</code></em></h4><p>
|
|---|
| 341 | List all the user defined shares owned by the current user matching the given pattern, or all users.
|
|---|
| 342 | </p><p>
|
|---|
| 343 | net usershare list on its own list out the names of the user defined shares that were
|
|---|
| 344 | created by the current user, or restricts the list to share names that match the given
|
|---|
| 345 | wildcard pattern ('*' matches one or more characters, '?' matches only one character).
|
|---|
| 346 | If the '-l' or '--long' option is also given, it includes the names of user defined
|
|---|
| 347 | shares created by other users.
|
|---|
| 348 | </p></div></div><div class="refsect2" lang="en"><a name="id302250"></a><h3>HELP [COMMAND]</h3><p>Gives usage information for the specified command.</p></div></div><div class="refsect1" lang="en"><a name="id302261"></a><h2>VERSION</h2><p>This man page is complete for version 3.0 of the Samba
|
|---|
| 349 | suite.</p></div><div class="refsect1" lang="en"><a name="id302272"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities
|
|---|
| 350 | were created by Andrew Tridgell. Samba is now developed
|
|---|
| 351 | by the Samba Team as an Open Source project similar
|
|---|
| 352 | to the way the Linux kernel is developed.</p><p>The net manpage was written by Jelmer Vernooij.</p></div></div></body></html>
|
|---|
