| 1 | <appendix label="F" id="SAMBA-AP-F">
|
|---|
| 2 | <title>Sample Configuration File</title>
|
|---|
| 3 |
|
|---|
| 4 |
|
|---|
| 5 |
|
|---|
| 6 |
|
|---|
| 7 | <para>
|
|---|
| 8 | <indexterm id="appf-idx-993481-0" class="startofrange"><primary>configuration files</primary><secondary>sample of</secondary></indexterm>This appendix gives an example of a production <filename>smb.conf</filename> file and looks at how many of the options are used in practice. The following is a slightly disguised version of one we used at a corporation with five Linux servers, five Windows for Workgroups clients and three NT Workstation clients:</para>
|
|---|
| 9 |
|
|---|
| 10 |
|
|---|
| 11 | <programlisting># smb.conf -- File Server System for: 1 Example.COM BSC & Management Office
|
|---|
| 12 | [globals]
|
|---|
| 13 | workgroup = 1EG_BSC
|
|---|
| 14 | interfaces = 10.10.1.14/24</programlisting>
|
|---|
| 15 |
|
|---|
| 16 |
|
|---|
| 17 | <para>We provide this service on only one of the machine's interfaces. The <literal>interfaces</literal> option sets its address and netmask, where <literal>/24</literal> is the same as using the netmask 255.255.255.0:</para>
|
|---|
| 18 |
|
|---|
| 19 |
|
|---|
| 20 | <programlisting>comment = Samba ver. %v
|
|---|
| 21 | preexec = csh -c `echo /usr/samba/bin/smbclient \
|
|---|
| 22 | -M %m -I %I` &</programlisting>
|
|---|
| 23 |
|
|---|
| 24 |
|
|---|
| 25 | <para>We use the <command>preexec</command> command to log information about all connections by machine name (<literal>%m</literal>) and IP address (<literal>%I)</literal>:</para>
|
|---|
| 26 |
|
|---|
| 27 |
|
|---|
| 28 | <programlisting># smbstatus will output various info on current status
|
|---|
| 29 | status = yes
|
|---|
| 30 | browseable = yes
|
|---|
| 31 | printing = bsd
|
|---|
| 32 |
|
|---|
| 33 | # the username that will be used for access to services
|
|---|
| 34 | # specified with 'guest = ok'
|
|---|
| 35 | guest account = samba</programlisting>
|
|---|
| 36 |
|
|---|
| 37 |
|
|---|
| 38 | <para>The default guest account was <literal>nobody</literal>, uid -1, which produced log messages on one of our machines saying "your server is being unfriendly," so we created a specific Samba guest account for browsing and printing:</para>
|
|---|
| 39 |
|
|---|
| 40 |
|
|---|
| 41 | <programlisting># superuser account - admin privileges to shares, with no
|
|---|
| 42 | # restrictions
|
|---|
| 43 | # WARNING - use this with care: files can be modified,
|
|---|
| 44 | # regardless of file permissions
|
|---|
| 45 | admin users = root
|
|---|
| 46 |
|
|---|
| 47 | # who is NOT allowed to connect to ANY service
|
|---|
| 48 | invalid users = @wheel, mail, deamon, adt</programlisting>
|
|---|
| 49 |
|
|---|
| 50 |
|
|---|
| 51 | <para>Daemons can't use Samba, only people. The <literal>invalid</literal> <literal>users</literal> option closes a security hole; it prevents intruders from breaking in by pretending to be a daemon process.</para>
|
|---|
| 52 |
|
|---|
| 53 |
|
|---|
| 54 | <programlisting># hosts that are ALLOWED or DENIED from connecting to ANY service
|
|---|
| 55 | hosts allow = 10.10.1.
|
|---|
| 56 | hosts deny = 10.10.1.6
|
|---|
| 57 |
|
|---|
| 58 | # where the lock files will be located
|
|---|
| 59 | lock directory = /var/lock/samba/locks
|
|---|
| 60 |
|
|---|
| 61 | # debug log files
|
|---|
| 62 | # %m = separate log for each NetBIOS name (each machine)
|
|---|
| 63 | log file = /var/log/samba/log.%m
|
|---|
| 64 |
|
|---|
| 65 | # We send priority 0, 1 and 2 messages to the system logs
|
|---|
| 66 | syslog = 2
|
|---|
| 67 |
|
|---|
| 68 | # If a WinPopup message is sent to the server,
|
|---|
| 69 | # redirect it to a user via e-mail
|
|---|
| 70 |
|
|---|
| 71 | message command = /bin/mail -s 'message from #% on %m' \
|
|---|
| 72 | pkelly < %s; rm %s
|
|---|
| 73 |
|
|---|
| 74 | # ---------------------------------------------------
|
|---|
| 75 | # [globals] Performance Tuning
|
|---|
| 76 | # ---------------------------------------------------
|
|---|
| 77 |
|
|---|
| 78 | # caching algorithm to reduce time doing getwd() calls.
|
|---|
| 79 | getwd cache = yes
|
|---|
| 80 |
|
|---|
| 81 | socket options = TCP_NODELAY
|
|---|
| 82 |
|
|---|
| 83 | # tell the server whether the client is present and
|
|---|
| 84 | # responding in seconds
|
|---|
| 85 | keep alive = 60
|
|---|
| 86 |
|
|---|
| 87 | # num minutes of inactivity before a connection is
|
|---|
| 88 | # considered dead
|
|---|
| 89 | dead time = 30
|
|---|
| 90 |
|
|---|
| 91 | read prediction = yes
|
|---|
| 92 | max xmit = 17384
|
|---|
| 93 | read size = 512</programlisting>
|
|---|
| 94 |
|
|---|
| 95 |
|
|---|
| 96 | <para>The <literal>share</literal> <literal>modes</literal>, <literal>max</literal>, <literal>xinit</literal>, and <literal>read</literal> <literal>size</literal> options are machine-specific (see <link linkend="SAMBA-AP-B">Appendix B</link>):</para>
|
|---|
| 97 |
|
|---|
| 98 |
|
|---|
| 99 | <programlisting># locking is done by the server
|
|---|
| 100 | locking = yes
|
|---|
| 101 |
|
|---|
| 102 | # control whether dos style attributes should be mapped
|
|---|
| 103 | # to unix execute bits
|
|---|
| 104 | map hidden = yes
|
|---|
| 105 | map archive = yes
|
|---|
| 106 | map system = yes</programlisting>
|
|---|
| 107 |
|
|---|
| 108 |
|
|---|
| 109 | <para>The three <literal>map</literal> options will work only on shares with a create mode that includes the execute bits (0111). Our <literal>homes</literal> and <literal>printers</literal> shares won't honor them, but the [<literal>www]</literal> share will:</para>
|
|---|
| 110 |
|
|---|
| 111 |
|
|---|
| 112 | <programlisting># ---------------------------------------------------------
|
|---|
| 113 | # [globals] Security and Domain Logon Services
|
|---|
| 114 | # ---------------------------------------------------------
|
|---|
| 115 | # connections are made with UID and GID, not as shares
|
|---|
| 116 | security = user
|
|---|
| 117 |
|
|---|
| 118 | # boolean variable that controls whether passwords
|
|---|
| 119 | # will be encrypted
|
|---|
| 120 | encrypt passwords = yes
|
|---|
| 121 | passwd chat = "*New password:*" %n\r "*New password (again):*" %n\r \ "*Password changed*"
|
|---|
| 122 | passwd program = /usr/bin/passwd %u
|
|---|
| 123 |
|
|---|
| 124 | # Always become the local master browser
|
|---|
| 125 | domain master = yes
|
|---|
| 126 | preferred master = yes
|
|---|
| 127 | os level = 34
|
|---|
| 128 |
|
|---|
| 129 | # For domain logons to work correctly. Samba acts as a
|
|---|
| 130 | # primary domain controller.
|
|---|
| 131 | domain logons = yes
|
|---|
| 132 |
|
|---|
| 133 | # Logon script to run for user off the server each time
|
|---|
| 134 | # username (%U) logs in. Set the time, connect to shares,
|
|---|
| 135 | # virus checks, etc.
|
|---|
| 136 | logon script = scripts\%U.bat
|
|---|
| 137 |
|
|---|
| 138 | [netlogon]
|
|---|
| 139 | comment = "Domain Logon Services"
|
|---|
| 140 | path = /u/netlogon
|
|---|
| 141 | writable = yes
|
|---|
| 142 | create mode = 444
|
|---|
| 143 | guest ok = no
|
|---|
| 144 | volume = "Network"</programlisting>
|
|---|
| 145 |
|
|---|
| 146 |
|
|---|
| 147 | <para>This share, discussed in <link linkend="SAMBA-CH-6">Chapter 6</link>, is required for Samba to work smoothly in a Windows NT domain:</para>
|
|---|
| 148 |
|
|---|
| 149 |
|
|---|
| 150 | <programlisting># -----------------------------------------------------------
|
|---|
| 151 | # [homes] User Home Directories
|
|---|
| 152 | # -----------------------------------------------------------
|
|---|
| 153 | [homes]
|
|---|
| 154 | comment = "Home Directory for : %u "
|
|---|
| 155 | path = /u/users/%u</programlisting>
|
|---|
| 156 |
|
|---|
| 157 |
|
|---|
| 158 | <para>The password file of the Samba server specifies each person's home directory as <emphasis>/home/</emphasis><replaceable>machine_name</replaceable><emphasis>/</emphasis><replaceable>person</replaceable>, which NFS converts to point to the actual physicl location under <emphasis>/u/users</emphasis>. The <literal>path</literal> option in the <literal>[homes]</literal> share tells Samba the actual (non-NFS) location:</para>
|
|---|
| 159 |
|
|---|
| 160 |
|
|---|
| 161 | <programlisting>guest ok = no
|
|---|
| 162 | read only = no
|
|---|
| 163 | create mode = 644
|
|---|
| 164 | writable = yes
|
|---|
| 165 | browseable = no
|
|---|
| 166 |
|
|---|
| 167 | # -----------------------------------------------------------
|
|---|
| 168 | # [printers] System Printers
|
|---|
| 169 | # -----------------------------------------------------------
|
|---|
| 170 | [printers]
|
|---|
| 171 | comment = "Printers"
|
|---|
| 172 | path = /var/spool/lpd/samba
|
|---|
| 173 | printcap name = /etc/printcap
|
|---|
| 174 | printable = yes
|
|---|
| 175 | public = no
|
|---|
| 176 | writable = no
|
|---|
| 177 |
|
|---|
| 178 | lpq command = /usr/bin/lpq -P%p
|
|---|
| 179 | lprm command = /usr/bin/lprm -P%p %j
|
|---|
| 180 | lppause command = /usr/sbin/lpc stop %p
|
|---|
| 181 | lpresume command = /usr/sbin/lpc start %p
|
|---|
| 182 |
|
|---|
| 183 | create mode = 0700
|
|---|
| 184 |
|
|---|
| 185 | browseable = no
|
|---|
| 186 | load printers = yes
|
|---|
| 187 |
|
|---|
| 188 | # -----------------------------------------------------------
|
|---|
| 189 | # Specific Descriptions: [programs] [data] [retail]
|
|---|
| 190 | # -----------------------------------------------------------
|
|---|
| 191 | [programs]
|
|---|
| 192 | comment = "Shared Programs %T"
|
|---|
| 193 | volume = "programs"</programlisting>
|
|---|
| 194 |
|
|---|
| 195 |
|
|---|
| 196 | <para>Shared Programs shows up in the Network Neighborhood, and <literal>programs</literal> is the volume name you specify when an installation program wants to know the label of the CD-ROM from which it thinks it's loading:</para>
|
|---|
| 197 |
|
|---|
| 198 |
|
|---|
| 199 | <programlisting>path = /u/programs
|
|---|
| 200 | public = yes
|
|---|
| 201 | writeable = yes
|
|---|
| 202 | printable = no
|
|---|
| 203 | create mode = 664
|
|---|
| 204 | [cdrom]
|
|---|
| 205 | comment = "Unix CDROM"
|
|---|
| 206 | path = /u/cdrom
|
|---|
| 207 | public = no
|
|---|
| 208 | writeable = no
|
|---|
| 209 | printable = no
|
|---|
| 210 | volume = "cdrom"
|
|---|
| 211 |
|
|---|
| 212 | [data]
|
|---|
| 213 | comment = "Data Directories %T"
|
|---|
| 214 | path = /u/data
|
|---|
| 215 | public = no
|
|---|
| 216 | create mode = 770
|
|---|
| 217 | writeable = yes
|
|---|
| 218 | volume = "data"
|
|---|
| 219 |
|
|---|
| 220 | [nt4]
|
|---|
| 221 | comment = "NT4 Server"
|
|---|
| 222 | path = /u/systems/nt4
|
|---|
| 223 | public = yes
|
|---|
| 224 | create mode = 770
|
|---|
| 225 | writeable = yes
|
|---|
| 226 | volume = "nt4_server"
|
|---|
| 227 |
|
|---|
| 228 | [www]
|
|---|
| 229 | comment = "WWW System"
|
|---|
| 230 | path = /usr/www/http
|
|---|
| 231 | public = yes
|
|---|
| 232 | create mode = 775
|
|---|
| 233 | writeable = yes
|
|---|
| 234 | volume = "www_system"</programlisting>
|
|---|
| 235 |
|
|---|
| 236 |
|
|---|
| 237 | <para>The <literal>[www]</literal> share is the directory used on the Unix server to serve web pages. Samba makes the directory available to local PC users so the art department can update web pages.</para>
|
|---|
| 238 |
|
|---|
| 239 |
|
|---|
| 240 |
|
|---|
| 241 |
|
|---|
| 242 |
|
|---|
| 243 |
|
|---|
| 244 |
|
|---|
| 245 |
|
|---|
| 246 |
|
|---|
| 247 |
|
|---|
| 248 |
|
|---|
| 249 | </appendix>
|
|---|
