Ignore:
Timestamp:
May 23, 2008, 6:56:41 AM (17 years ago)
Author:
Paul Smedley
Message:

Update source to 3.0.29

File:
1 edited

Legend:

Unmodified
Added
Removed

  • branches/samba-3.0/docs/htmldocs/manpages/smb.conf.5.html

    r44 r134  
    1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>smb.conf</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"><a name="smb.conf.5"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>smb.conf &#8212; The configuration file for the Samba suite</p></div><div class="refsect1" lang="en"><a name="id291806"></a><h2>SYNOPSIS</h2><p>
     1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>smb.conf</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"><a name="smb.conf.5"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>smb.conf &#8212; The configuration file for the Samba suite</p></div><div class="refsect1" lang="en"><a name="id315538"></a><h2>SYNOPSIS</h2><p>
    22        The <code class="filename">smb.conf</code> file is a configuration  file for the Samba suite. <code class="filename">smb.conf</code> contains  runtime configuration information for the Samba programs. The
    33         <code class="filename">smb.conf</code> file is designed to be configured and administered by the
    4          <a href="swat.8.html"><span class="citerefentry"><span class="refentrytitle">swat</span>(8)</span></a> program. The
     4         <a class="citerefentry" href="swat.8.html"><span class="citerefentry"><span class="refentrytitle">swat</span>(8)</span></a> program. The
    55        complete description of the file format and possible parameters held within are here for reference purposes.
    66        </p></div><div class="refsect1" lang="en"><a name="FILEFORMATSECT"></a><h2>FILE FORMAT</h2><p>
    … …  
    2727        which may be given as yes/no, 0/1 or true/false. Case is not significant in boolean values, but is preserved
    2828        in string values. Some items such as create masks are numeric.
    29         </p></div><div class="refsect1" lang="en"><a name="id259596"></a><h2>SECTION DESCRIPTIONS</h2><p>
     29        </p></div><div class="refsect1" lang="en"><a name="id282776"></a><h2>SECTION DESCRIPTIONS</h2><p>
    3030        Each section in the configuration file (except for the [global] section) describes a shared resource (known as
    3131        a &#8220;<span class="quote">share</span>&#8221;). The section name is the name of the shared resource and the parameters within the
    … …  
    5656</p><pre class="programlisting">
    5757        <em class="parameter"><code>[foo]</code></em>
    58         <a class="indexterm" name="id259433"></a>path = /home/bar
    59         <a class="indexterm" name="id260355"></a>read only = no
     58        <a class="link" href="smb.conf.5.html#PATH">path = /home/bar</a>
     59        <a class="link" href="smb.conf.5.html#READONLY">read only = no</a>
    6060</pre><p>
    6161        </p><p>
    … …  
    6565</p><pre class="programlisting">
    6666        <em class="parameter"><code>[aprinter]</code></em>
    67         <a class="indexterm" name="id260383"></a>path = /usr/spool/public
    68         <a class="indexterm" name="id260390"></a>read only = yes
    69         <a class="indexterm" name="id260397"></a>printable = yes
    70         <a class="indexterm" name="id260404"></a>guest ok = yes
     67        <a class="link" href="smb.conf.5.html#PATH">path = /usr/spool/public</a>
     68        <a class="link" href="smb.conf.5.html#READONLY">read only = yes</a>
     69        <a class="link" href="smb.conf.5.html#PRINTABLE">printable = yes</a>
     70        <a class="link" href="smb.conf.5.html#GUESTOK">guest ok = yes</a>
    7171</pre><p>
    72         </p></div><div class="refsect1" lang="en"><a name="id260415"></a><h2>SPECIAL SECTIONS</h2><div class="refsect2" lang="en"><a name="id260420"></a><h3>The [global] section</h3><p>
     72        </p></div><div class="refsect1" lang="en"><a name="id283054"></a><h2>SPECIAL SECTIONS</h2><div class="refsect2" lang="en"><a name="id283060"></a><h3>The [global] section</h3><p>
    7373                Parameters in this section apply to the server as a whole, or are defaults for sections that do not
    7474                specifically define certain items. See the notes under PARAMETERS for more information.
    … …  
    106106</p><pre class="programlisting">
    107107<em class="parameter"><code>[homes]</code></em>
    108 <a class="indexterm" name="id260157"></a>read only = no
     108<a class="link" href="smb.conf.5.html#READONLY">read only = no</a>
    109109</pre><p>
    110110                </p><p>
    … …  
    138138</p><pre class="programlisting">
    139139<em class="parameter"><code>[printers]</code></em>
    140 <a class="indexterm" name="id300481"></a>path = /usr/spool/public
    141 <a class="indexterm" name="id300488"></a>guest ok = yes
    142 <a class="indexterm" name="id300495"></a>printable = yes
     140<a class="link" href="smb.conf.5.html#PATH">path = /usr/spool/public</a>
     141<a class="link" href="smb.conf.5.html#GUESTOK">guest ok = yes</a>
     142<a class="link" href="smb.conf.5.html#PRINTABLE">printable = yes</a>
    143143</pre><p>
    144144                </p><p>
    … …  
    161161                <code class="literal">printcap name = lpstat</code> to automatically obtain a list of printers. See the
    162162                <code class="literal">printcap name</code> option for more details.
    163                 </p></div></div></div><div class="refsect1" lang="en"><a name="id300553"></a><h2>USERSHARES</h2><p>Starting with Samba version 3.0.23 the capability for non-root users to add, modify, and delete
     163                </p></div></div></div><div class="refsect1" lang="en"><a name="id324680"></a><h2>USERSHARES</h2><p>Starting with Samba version 3.0.23 the capability for non-root users to add, modify, and delete
    164164        their own share definitions has been added. This capability is called <span class="emphasis"><em>usershares</em></span> and
    165165        is controlled by a set of parameters in the [global] section of the smb.conf.
    … …  
    179179
    180180</p><pre class="programlisting">
    181         <a class="indexterm" name="id300682"></a>usershare path = /usr/local/samba/lib/usershares
    182         <a class="indexterm" name="id300690"></a>usershare max shares = 10 # (or the desired number of shares)
     181        <a class="link" href="smb.conf.5.html#USERSHAREPATH">usershare path = /usr/local/samba/lib/usershares</a>
     182        <a class="link" href="smb.conf.5.html#USERSHAREMAXSHARES">usershare max shares = 10</a> # (or the desired number of shares)
    183183</pre><p>
    184184
    185185        to the global
    186186        section of your <code class="filename">smb.conf</code>. Members of the group foo may then manipulate the user defined shares
    187         using the following commands.</p><div class="variablelist"><dl><dt><span class="term">net usershare add sharename path [comment] [acl] [guest_ok=[y|n]]</span></dt><dd><p>To create or modify (overwrite) a user defined share.</p></dd><dt><span class="term">net usershare delete sharename</span></dt><dd><p>To delete a user defined share.</p></dd><dt><span class="term">net usershare list wildcard-sharename</span></dt><dd><p>To list user defined shares.</p></dd><dt><span class="term">net usershare info wildcard-sharename</span></dt><dd><p>To print information about user defined shares.</p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id300757"></a><h2>PARAMETERS</h2><p>Parameters define the specific attributes of sections.</p><p>
     187        using the following commands.</p><div class="variablelist"><dl><dt><span class="term">net usershare add sharename path [comment] [acl] [guest_ok=[y|n]]</span></dt><dd><p>To create or modify (overwrite) a user defined share.</p></dd><dt><span class="term">net usershare delete sharename</span></dt><dd><p>To delete a user defined share.</p></dd><dt><span class="term">net usershare list wildcard-sharename</span></dt><dd><p>To list user defined shares.</p></dd><dt><span class="term">net usershare info wildcard-sharename</span></dt><dd><p>To print information about user defined shares.</p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id324875"></a><h2>PARAMETERS</h2><p>Parameters define the specific attributes of sections.</p><p>
    188188        Some parameters are specific to the [global] section (e.g., <span class="emphasis"><em>security</em></span>).  Some parameters
    189189        are usable in all sections (e.g., <span class="emphasis"><em>create mask</em></span>). All others are permissible only in normal
    … …  
    197197        find them! Where there are synonyms, the preferred synonym is described, others refer to the preferred
    198198        synonym.
    199         </p></div><div class="refsect1" lang="en"><a name="id300798"></a><h2>VARIABLE SUBSTITUTIONS</h2><p>
     199        </p></div><div class="refsect1" lang="en"><a name="id324914"></a><h2>VARIABLE SUBSTITUTIONS</h2><p>
    200200        Many of the strings that are settable in the config file can take substitutions. For example the option
    201201        &#8220;<span class="quote">path = /tmp/%u</span>&#8221; is interpreted as &#8220;<span class="quote">path = /tmp/john</span>&#8221; if the user connected with the
    … …  
    215215                </p></dd><dt><span class="term">%R</span></dt><dd><p>the selected protocol level after protocol negotiation. It can be one of CORE, COREPLUS,
    216216                        LANMAN1, LANMAN2 or NT1.</p></dd><dt><span class="term">%d</span></dt><dd><p>the process id of the current server
    217                         process.</p></dd><dt><span class="term">%a</span></dt><dd><p>the architecture of the remote
    218                         machine.  It currently recognizes Samba (<code class="constant">Samba</code>),
    219                         the Linux CIFS file system (<code class="constant">CIFSFS</code>), OS/2, (<code class="constant">OS2</code>),
    220                         Windows for Workgroups (<code class="constant">WfWg</code>), Windows 9x/ME
    221                         (<code class="constant">Win95</code>), Windows NT (<code class="constant">WinNT</code>),
    222                         Windows 2000 (<code class="constant">Win2K</code>), Windows XP (<code class="constant">WinXP</code>),
    223                         and Windows 2003 (<code class="constant">Win2K3</code>).  Anything else will be known as
    224                         <code class="constant">UNKNOWN</code>.</p></dd><dt><span class="term">%I</span></dt><dd><p>the IP address of the client machine.</p></dd><dt><span class="term">%i</span></dt><dd><p>the local IP address to which a client connected.</p></dd><dt><span class="term">%T</span></dt><dd><p>the current date and time.</p></dd><dt><span class="term">%D</span></dt><dd><p>name of the domain or workgroup of the current user.</p></dd><dt><span class="term">%w</span></dt><dd><p>the winbind separator.</p></dd><dt><span class="term">%$(<em class="replaceable"><code>envvar</code></em>)</span></dt><dd><p>the value of the environment variable
     217                        process.</p></dd><dt><span class="term">%a</span></dt><dd><p>
     218                    The architecture of the remote
     219                    machine.  It currently recognizes Samba (<code class="constant">Samba</code>),
     220                    the Linux CIFS file system (<code class="constant">CIFSFS</code>), OS/2, (<code class="constant">OS2</code>),
     221                    Windows for Workgroups (<code class="constant">WfWg</code>), Windows 9x/ME
     222                    (<code class="constant">Win95</code>), Windows NT (<code class="constant">WinNT</code>),
     223                    Windows 2000 (<code class="constant">Win2K</code>),
     224                    Windows XP (<code class="constant">WinXP</code>),
     225                    Windows XP 64-bit(<code class="constant">WinXP64</code>),
     226                    Windows 2003 including
     227                    2003R2 (<code class="constant">Win2K3</code>), and Windows
     228                    Vista (<code class="constant">Vista</code>).  Anything else will be known as
     229                    <code class="constant">UNKNOWN</code>.</p></dd><dt><span class="term">%I</span></dt><dd><p>the IP address of the client machine.</p></dd><dt><span class="term">%i</span></dt><dd><p>the local IP address to which a client connected.</p></dd><dt><span class="term">%T</span></dt><dd><p>the current date and time.</p></dd><dt><span class="term">%D</span></dt><dd><p>name of the domain or workgroup of the current user.</p></dd><dt><span class="term">%w</span></dt><dd><p>the winbind separator.</p></dd><dt><span class="term">%$(<em class="replaceable"><code>envvar</code></em>)</span></dt><dd><p>the value of the environment variable
    225230                <em class="replaceable"><code>envar</code></em>.</p></dd></dl></div><p>
    226231        The following substitutes apply only to some configuration options (only those that are
    … …  
    254259                controls what the default case is for new filenames (ie. files that don't currently exist in the filesystem).
    255260                Default <span class="emphasis"><em>lower</em></span>.  IMPORTANT NOTE: This option will be used to modify the case of
    256                 <span class="emphasis"><em>all</em></span> incoming client filenames, not just new filenames if the options <a class="indexterm" name="id301239"></a>case sensitive = yes, <a class="indexterm" name="id301246"></a>preserve case = No,
    257                 <a class="indexterm" name="id301253"></a>short preserve case = No are set.  This change is needed as part of the
     261                <span class="emphasis"><em>all</em></span> incoming client filenames, not just new filenames if the options <a class="link" href="smb.conf.5.html#CASESENSITIVE">case sensitive = yes</a>, <a class="link" href="smb.conf.5.html#PRESERVECASE">preserve case = No</a>,
     262                <a class="link" href="smb.conf.5.html#SHORTPRESERVECASE">short preserve case = No</a> are set.  This change is needed as part of the
    258263                optimisations for directories containing large numbers of files.
    259264                </p></dd><dt><span class="term">preserve case = yes/no</span></dt><dd><p>
    … …  
    301306                If the service is a guest service, a connection is made as the username given in the <code class="literal">guest account
    302307                =</code> for the service, irrespective of the supplied password.
    303                 </p></li></ol></div></div><div class="refsect1" lang="en"><a name="id301448"></a><h2>EXPLANATION OF EACH PARAMETER</h2><div class="variablelist"><dl><dt><span class="term"><a name="ABORTSHUTDOWNSCRIPT"></a>abort shutdown script (G)</span></dt><dd><p>This a full path name to a script called by <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> that
    304         should stop a shutdown procedure issued by the <a class="indexterm" name="id301488"></a>shutdown script.</p><p>If the connected user posseses the <code class="constant">SeRemoteShutdownPrivilege</code>,
     308                </p></li></ol></div></div><div class="refsect1" lang="en"><a name="id325539"></a><h2>EXPLANATION OF EACH PARAMETER</h2><div class="section" lang="en"><div class="titlepage"></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id325549"></a>
     309
     310abort shutdown script (G)
     311</h3></div></div></div><a class="indexterm" name="id325550"></a><a name="ABORTSHUTDOWNSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>This a full path name to a script called by <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> that
     312        should stop a shutdown procedure issued by the <a class="link" href="smb.conf.5.html#SHUTDOWNSCRIPT">shutdown script</a>.</p><p>If the connected user posseses the <code class="constant">SeRemoteShutdownPrivilege</code>,
    305313        right, this command will be run as user.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>abort shutdown script</code></em> = <code class="literal">""</code>
    306314</em></span>
    307315</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>abort shutdown script</code></em> = <code class="literal">/sbin/shutdown -c</code>
    308316</em></span>
    309 </p></dd><dt><span class="term"><a name="ACLCHECKPERMISSIONS"></a>acl check permissions (S)</span></dt><dd><p>This boolean parameter controls what <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>does on receiving a protocol request of "open for delete"
     317</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id325623"></a>
     318
     319acl check permissions (S)
     320</h3></div></div></div><a class="indexterm" name="id325624"></a><a name="ACLCHECKPERMISSIONS"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean parameter controls what <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>does on receiving a protocol request of "open for delete"
    310321    from a Windows client. If a Windows client doesn't have permissions to delete a file then they
    311322    expect this to be denied at open time. POSIX systems normally only detect restrictions on delete by
    … …  
    327338    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>acl check permissions</code></em> = <code class="literal">True</code>
    328339</em></span>
    329 </p></dd><dt><span class="term"><a name="ACLCOMPATIBILITY"></a>acl compatibility (S)</span></dt><dd><p>This parameter specifies what OS ACL semantics should
     340</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id282494"></a>
     341
     342acl compatibility (S)
     343</h3></div></div></div><a class="indexterm" name="id282495"></a><a name="ACLCOMPATIBILITY"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies what OS ACL semantics should
    330344        be compatible with. Possible values are <span class="emphasis"><em>winnt</em></span> for Windows NT 4,
    331345        <span class="emphasis"><em>win2k</em></span> for Windows 2000 and above and <span class="emphasis"><em>auto</em></span>.
    … …  
    336350</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>acl compatibility</code></em> = <code class="literal">win2k</code>
    337351</em></span>
    338 </p></dd><dt><span class="term"><a name="ACLGROUPCONTROL"></a>acl group control (S)</span></dt><dd><p>
     352</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id325826"></a>
     353
     354acl group control (S)
     355</h3></div></div></div><a class="indexterm" name="id325828"></a><a name="ACLGROUPCONTROL"></a><div class="variablelist"><dl><dt></dt><dd><p>
    339356        In a POSIX filesystem, only the owner of a file or directory and the superuser can modify the permissions
    340357        and ACLs on a file. If this parameter is set, then Samba overrides this restriction, and also allows the
    … …  
    349366        </p><p>
    350367        This parameter allows Samba to also permit delegation of the control over a point in the exported
    351         directory hierarchy in much the same was as Windows. This allows all members of a UNIX group to
     368        directory hierarchy in much the same way as Windows. This allows all members of a UNIX group to
    352369        control the permissions on a file or directory they have group ownership on.
    353370        </p><p>
    354         This parameter is best used with the <a class="indexterm" name="id301716"></a>inherit owner option and also
    355         on on a share containing directories with the UNIX <span class="emphasis"><em>setgid bit</em></span> bit set
     371        This parameter is best used with the <a class="link" href="smb.conf.5.html#INHERITOWNER">inherit owner</a> option and also
     372        on on a share containing directories with the UNIX <span class="emphasis"><em>setgid bit</em></span> set
    356373        on them, which causes new files and directories created within it to inherit the group
    357374        ownership from the containing directory.
    … …  
    361378        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>acl group control</code></em> = <code class="literal">no</code>
    362379</em></span>
    363 </p></dd><dt><span class="term"><a name="ACLMAPFULLCONTROL"></a>acl map full control (S)</span></dt><dd><p>
    364         This boolean parameter controls whether <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>maps a POSIX ACE entry of "rwx" (read/write/execute), the maximum
     380</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id325907"></a>
     381
     382acl map full control (S)
     383</h3></div></div></div><a class="indexterm" name="id325908"></a><a name="ACLMAPFULLCONTROL"></a><div class="variablelist"><dl><dt></dt><dd><p>
     384        This boolean parameter controls whether <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>maps a POSIX ACE entry of "rwx" (read/write/execute), the maximum
    365385        allowed POSIX permission set, into a Windows ACL of "FULL CONTROL". If this parameter is set to true any POSIX
    366386        ACE entry of "rwx" will be returned in a Windows ACL as "FULL CONTROL", is this parameter is set to false any
    … …  
    369389        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>acl map full control</code></em> = <code class="literal">True</code>
    370390</em></span>
    371 </p></dd><dt><span class="term"><a name="ADDGROUPSCRIPT"></a>add group script (G)</span></dt><dd><p>
    372         This is the full pathname to a script that will be run <span class="emphasis"><em>AS ROOT</em></span> by <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when a new group is requested. It
     391</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id325954"></a>
     392
     393add group script (G)
     394</h3></div></div></div><a class="indexterm" name="id325956"></a><a name="ADDGROUPSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>
     395        This is the full pathname to a script that will be run <span class="emphasis"><em>AS ROOT</em></span> by <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when a new group is requested. It
    373396        will expand any <em class="parameter"><code>%g</code></em> to the group name passed. This script is only useful
    374397        for installations using the Windows NT domain administration tools. The script is free to create a group with
    … …  
    379402</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>add group script</code></em> = <code class="literal">/usr/sbin/groupadd %g</code>
    380403</em></span>
    381 </p></dd><dt><span class="term"><a name="ADDMACHINESCRIPT"></a>add machine script (G)</span></dt><dd><p>
     404</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id326025"></a>
     405
     406add machine script (G)
     407</h3></div></div></div><a class="indexterm" name="id326026"></a><a name="ADDMACHINESCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>
    382408        This is the full pathname to a script that will  be run by
    383          <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when a machine is
     409         <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when a machine is
    384410        added to Samba's domain and a Unix account matching the machine's name appended with a "$" does not
    385411        already exist.
    386         </p><p>This option is very similar to the <a class="indexterm" name="id301914"></a>add user script, and likewise uses the %u
     412        </p><p>This option is very similar to the <a class="link" href="smb.conf.5.html#ADDUSERSCRIPT">add user script</a>, and likewise uses the %u
    387413        substitution for the account name.  Do not use the %m
    388414        substitution.  </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>add machine script</code></em> = <code class="literal"></code>
    … …  
    390416</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>add machine script</code></em> = <code class="literal">/usr/sbin/adduser -n -g machines -c Machine -d /var/lib/nobody -s /bin/false %u</code>
    391417</em></span>
    392 </p></dd><dt><span class="term"><a name="ADDPORTCOMMAND"></a>add port command (G)</span></dt><dd><p>Samba 3.0.23 introduces support for adding printer ports
     418</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id326098"></a>
     419
     420add port command (G)
     421</h3></div></div></div><a class="indexterm" name="id326100"></a><a name="ADDPORTCOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>Samba 3.0.23 introduced support for adding printer ports
    393422        remotely using the Windows "Add Standard TCP/IP Port Wizard".
    394423        This option defines an external program to be executed when
    395424        smbd receives a request to add a new Port to the system.
    396         he script is passed two parameters:
    397     </p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>port name</code></em></p></li><li><p><em class="parameter"><code>device URI</code></em></p></li></ul></div><p>The deviceURI is in the for of socket://&lt;hostname&gt;[:&lt;portnumber&gt;]
     425        The script is passed two parameters:</p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>port name</code></em></p></li><li><p><em class="parameter"><code>device URI</code></em></p></li></ul></div><p>The deviceURI is in the for of socket://&lt;hostname&gt;[:&lt;portnumber&gt;]
    398426        or lpd://&lt;hostname&gt;/&lt;queuename&gt;.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>add port command</code></em> = <code class="literal"></code>
    399427</em></span>
    400428</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>add port command</code></em> = <code class="literal">/etc/samba/scripts/addport.sh</code>
    401429</em></span>
    402 </p></dd><dt><span class="term"><a name="ADDPRINTERCOMMAND"></a>add printer command (G)</span></dt><dd><p>With the introduction of MS-RPC based printing
     430</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id326178"></a>
     431
     432add printer command (G)
     433</h3></div></div></div><a class="indexterm" name="id326179"></a><a name="ADDPRINTERCOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>With the introduction of MS-RPC based printing
    403434    support for Windows NT/2000 clients in Samba 2.2, The MS Add
    404435    Printer Wizard (APW) icon is now also available in the
    … …  
    411442    to the print system and to add the appropriate service definition
    412443    to the  <code class="filename">smb.conf</code> file in order that it can be
    413     shared by <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>.</p><p>The <em class="parameter"><code>addprinter command</code></em> is
     444    shared by <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>.</p><p>The <em class="parameter"><code>addprinter command</code></em> is
    414445    automatically invoked with the following parameter (in
    415446    order):</p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>printer name</code></em></p></li><li><p><em class="parameter"><code>share name</code></em></p></li><li><p><em class="parameter"><code>port name</code></em></p></li><li><p><em class="parameter"><code>driver name</code></em></p></li><li><p><em class="parameter"><code>location</code></em></p></li><li><p><em class="parameter"><code>Windows 9x driver location</code></em></p></li></ul></div><p>All parameters are filled in from the PRINTER_INFO_2 structure sent
    … …  
    429460</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>add printer command</code></em> = <code class="literal">/usr/bin/addprinter</code>
    430461</em></span>
    431 </p></dd><dt><span class="term"><a name="ADDSHARECOMMAND"></a>add share command (G)</span></dt><dd><p>Samba 2.2.0 introduced the ability to dynamically
    432         add and delete shares via the Windows NT 4.0 Server Manager.  The
    433         <em class="parameter"><code>add share command</code></em> is used to define an
    434         external program or script which will add a new service definition
    435         to <code class="filename">smb.conf</code>.  In order to successfully
    436         execute the <em class="parameter"><code>add share command</code></em>, <code class="literal">smbd</code>
    437         requires that the administrator be connected using a root account (i.e.
    438         uid == 0).
    439         </p><p>
    440         When executed, <code class="literal">smbd</code> will automatically invoke the
     462</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id326348"></a>
     463
     464add share command (G)
     465</h3></div></div></div><a class="indexterm" name="id326349"></a><a name="ADDSHARECOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>
     466        Samba 2.2.0 introduced the ability to dynamically add and delete shares via the Windows NT 4.0 Server
     467        Manager.  The <em class="parameter"><code>add share command</code></em> is used to define an external program
     468        or script which will add a new service definition to <code class="filename">smb.conf</code>.  In order
     469        to successfully execute the <em class="parameter"><code>add share command</code></em>, <code class="literal">smbd</code> requires that the administrator be connected using a root account (i.e.  uid == 0).
     470        </p><p>
     471    If the connected account has <code class="literal">SeDiskOperatorPrivilege</code>, scripts defined in
     472    <em class="parameter"><code>change share</code></em> parameter are executed as root.
     473    </p><p>
     474        When executed, <code class="literal">smbd</code> will automatically invoke the
    441475        <em class="parameter"><code>add share command</code></em> with five parameters.
    442         </p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>configFile</code></em> - the location
    443                         of the global <code class="filename">smb.conf</code> file.
    444                         </p></li><li><p><em class="parameter"><code>shareName</code></em> - the name of the new
    445                         share.
     476        </p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>configFile</code></em> - the location of the global <code class="filename">smb.conf</code> file.
     477                        </p></li><li><p><em class="parameter"><code>shareName</code></em> - the name of the new share.
    446478                        </p></li><li><p><em class="parameter"><code>pathName</code></em> - path to an **existing**
    447479                        directory on disk.
    448                         </p></li><li><p><em class="parameter"><code>comment</code></em> - comment string to associate
    449                         with the new share.
     480                        </p></li><li><p><em class="parameter"><code>comment</code></em> - comment string to associate with the new
     481                        share.
    450482                        </p></li><li><p><em class="parameter"><code>max
    451483                        connections</code></em>
    … …  
    453485                        share.
    454486                        </p></li></ul></div><p>
    455         This parameter is only used for add file shares.  To add printer shares,
    456         see the <a class="indexterm" name="id302354"></a>addprinter command.
     487        This parameter is only used for add file shares.  To add printer shares, see the <a class="link" href="smb.conf.5.html#ADDPRINTERCOMMAND">addprinter command</a>.
    457488        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>add share command</code></em> = <code class="literal"></code>
    458489</em></span>
    459490</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>add share command</code></em> = <code class="literal">/usr/local/bin/addshare</code>
    460491</em></span>
    461 </p></dd><dt><span class="term"><a name="ADDUSERSCRIPT"></a>add user script (G)</span></dt><dd><p>
     492</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id326523"></a>
     493
     494add user script (G)
     495</h3></div></div></div><a class="indexterm" name="id326524"></a><a name="ADDUSERSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>
    462496        This is the full pathname to a script that will be run <span class="emphasis"><em>AS ROOT</em></span> by
    463         <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>
     497        <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>
    464498        under special circumstances described below.
    465499        </p><p>
    … …  
    470504         <span class="emphasis"><em>ON DEMAND</em></span> when a user accesses the Samba server.
    471505        </p><p>
    472         In order to use this option, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> must <span class="emphasis"><em>NOT</em></span> be set to
    473         <a class="indexterm" name="id302456"></a>security = share and <a class="indexterm" name="id302463"></a>add user script
     506        In order to use this option, <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> must <span class="emphasis"><em>NOT</em></span> be set to
     507        <a class="link" href="smb.conf.5.html#SECURITY">security = share</a> and <a class="link" href="smb.conf.5.html#ADDUSERSCRIPT">add user script</a>
    474508        must be set to a full pathname for a script that will create a UNIX user given one argument of
    475509        <em class="parameter"><code>%u</code></em>, which expands into the UNIX user name to create.
    476510        </p><p>
    477511        When the Windows user attempts to access the Samba server, at login (session setup in
    478         the SMB protocol) time, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> contacts the <a class="indexterm" name="id302489"></a>password server
     512        the SMB protocol) time, <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> contacts the <a class="link" href="smb.conf.5.html#PASSWORDSERVER">password server</a>
    479513        and attempts to authenticate the given user with the given password. If the authentication
    480514        succeeds then <code class="literal">smbd</code> attempts to find a UNIX user in the UNIX
    481515        password database to map the Windows user into. If this lookup fails, and
    482         <a class="indexterm" name="id302504"></a>add user script is set then <code class="literal">smbd</code> will
     516        <a class="link" href="smb.conf.5.html#ADDUSERSCRIPT">add user script</a> is set then <code class="literal">smbd</code> will
    483517        call the specified script <span class="emphasis"><em>AS ROOT</em></span>, expanding any
    484518        <em class="parameter"><code>%u</code></em> argument to be the user name to create.
    … …  
    488522        match existing Windows NT accounts.
    489523        </p><p>
    490         See also <a class="indexterm" name="id302541"></a>security, <a class="indexterm" name="id302548"></a>password server,
    491         <a class="indexterm" name="id302555"></a>delete user script.
     524        See also <a class="link" href="smb.conf.5.html#SECURITY">security</a>, <a class="link" href="smb.conf.5.html#PASSWORDSERVER">password server</a>,
     525        <a class="link" href="smb.conf.5.html#DELETEUSERSCRIPT">delete user script</a>.
    492526        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>add user script</code></em> = <code class="literal"></code>
    493527</em></span>
    494528</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>add user script</code></em> = <code class="literal">/usr/local/samba/bin/add_user %u</code>
    495529</em></span>
    496 </p></dd><dt><span class="term"><a name="ADDUSERTOGROUPSCRIPT"></a>add user to group script (G)</span></dt><dd><p>
     530</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id326711"></a>
     531
     532add user to group script (G)
     533</h3></div></div></div><a class="indexterm" name="id326712"></a><a name="ADDUSERTOGROUPSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>
    497534        Full path to the script that will be called when a user is added to a group using the Windows NT domain administration
    498         tools. It will be run by <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>
     535        tools. It will be run by <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>
    499536        <span class="emphasis"><em>AS ROOT</em></span>. Any <em class="parameter"><code>%g</code></em> will be replaced with the group name and
    500537        any <em class="parameter"><code>%u</code></em> will be replaced with the user name.
    … …  
    506543</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>add user to group script</code></em> = <code class="literal">/usr/sbin/adduser %u %g</code>
    507544</em></span>
    508 </p></dd><dt><span class="term"><a name="ADMINUSERS"></a>admin users (S)</span></dt><dd><p>This is a list of users who will be granted
     545</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id326794"></a>
     546
     547admin users (S)
     548</h3></div></div></div><a class="indexterm" name="id326795"></a><a name="ADMINUSERS"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a list of users who will be granted
    509549    administrative privileges on the share. This means that they
    510550    will do all file operations as the super-user (root).</p><p>You should use this option very carefully, as any user in
    511551    this list will be able to do anything they like on the share,
    512     irrespective of file permissions.</p><p>This parameter will not work with the <a class="indexterm" name="id302715"></a>security = share in
     552    irrespective of file permissions.</p><p>This parameter will not work with the <a class="link" href="smb.conf.5.html#SECURITY">security = share</a> in
    513553    Samba 3.0.  This is by design.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>admin users</code></em> = <code class="literal"></code>
    514554</em></span>
    515555</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>admin users</code></em> = <code class="literal">jason</code>
    516556</em></span>
    517 </p></dd><dt><span class="term"><a name="AFSSHARE"></a>afs share (S)</span></dt><dd><p>This parameter controls whether special AFS features are enabled
     557</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id326862"></a>
     558
     559afs share (S)
     560</h3></div></div></div><a class="indexterm" name="id326864"></a><a name="AFSSHARE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls whether special AFS features are enabled
    518561        for this share. If enabled, it assumes that the directory exported via
    519562        the <em class="parameter"><code>path</code></em> parameter is a local AFS import. The
    … …  
    522565        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>afs share</code></em> = <code class="literal">no</code>
    523566</em></span>
    524 </p></dd><dt><span class="term"><a name="AFSUSERNAMEMAP"></a>afs username map (G)</span></dt><dd><p>If you are using the fake kaserver AFS feature, you might
     567</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id326907"></a>
     568
     569afs username map (G)
     570</h3></div></div></div><a class="indexterm" name="id326908"></a><a name="AFSUSERNAMEMAP"></a><div class="variablelist"><dl><dt></dt><dd><p>If you are using the fake kaserver AFS feature, you might
    525571        want to hand-craft the usernames you are creating tokens for.
    526572        For example this is necessary if you have users from several domain
    … …  
    532578</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>afs username map</code></em> = <code class="literal">%u@afs.samba.org</code>
    533579</em></span>
    534 </p></dd><dt><span class="term"><a name="AIOREADSIZE"></a>aio read size (S)</span></dt><dd><p>If Samba has been built with asynchronous I/O support and this
     580</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id326966"></a>
     581
     582aio read size (S)
     583</h3></div></div></div><a class="indexterm" name="id326967"></a><a name="AIOREADSIZE"></a><div class="variablelist"><dl><dt></dt><dd><p>If Samba has been built with asynchronous I/O support and this
    535584    integer parameter is set to non-zero value,
    536585    Samba will read from file asynchronously when size of request is bigger
    537586    than this value. Note that it happens only for non-chained and non-chaining
    538587    reads and when not using write cache.</p><p>Current implementation of asynchronous I/O in Samba 3.0 does support
    539     only up to 10 outstanding asynchronous requests, read and write combined.</p>
    540 
    541   write cache size
    542   aio write size
    543 
    544 <p>Default: <span class="emphasis"><em><em class="parameter"><code>aio read size</code></em> = <code class="literal">0</code>
     588    only up to 10 outstanding asynchronous requests, read and write combined.</p><p>Related command: <a class="link" href="smb.conf.5.html#WRITECACHESIZE">write cache size</a></p><p>Related command: <a class="link" href="smb.conf.5.html#AIOWRITESIZE">aio write size</a></p><p>Default: <span class="emphasis"><em><em class="parameter"><code>aio read size</code></em> = <code class="literal">0</code>
    545589</em></span>
    546590</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>aio read size</code></em> = <code class="literal">16384
    … …  
    548592    request size</code>
    549593</em></span>
    550 </p></dd><dt><span class="term"><a name="AIOWRITESIZE"></a>aio write size (S)</span></dt><dd><p>If Samba has been built with asynchronous I/O support and this
     594</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327045"></a>
     595
     596aio write size (S)
     597</h3></div></div></div><a class="indexterm" name="id327046"></a><a name="AIOWRITESIZE"></a><div class="variablelist"><dl><dt></dt><dd><p>If Samba has been built with asynchronous I/O support and this
    551598    integer parameter is set to non-zero value,
    552599    Samba will write to file asynchronously when size of request is bigger
    553600    than this value. Note that it happens only for non-chained and non-chaining
    554601    reads and when not using write cache.</p><p>Current implementation of asynchronous I/O in Samba 3.0 does support
    555     only up to 10 outstanding asynchronous requests, read and write combined.</p>
    556  
    557   write cache size
    558   aio read size
    559 
    560 <p>Default: <span class="emphasis"><em><em class="parameter"><code>aio write size</code></em> = <code class="literal">0</code>
     602    only up to 10 outstanding asynchronous requests, read and write combined.</p><p>Related command: <a class="link" href="smb.conf.5.html#WRITECACHESIZE">write cache size</a></p><p>Related command: <a class="link" href="smb.conf.5.html#AIOREADSIZE">aio read size</a></p><p>Default: <span class="emphasis"><em><em class="parameter"><code>aio write size</code></em> = <code class="literal">0</code>
    561603</em></span>
    562604</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>aio write size</code></em> = <code class="literal">16384
    … …  
    564606    request size</code>
    565607</em></span>
    566 </p></dd><dt><span class="term"><a name="ALGORITHMICRIDBASE"></a>algorithmic rid base (G)</span></dt><dd><p>This determines how Samba will use its
     608</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327124"></a>
     609
     610algorithmic rid base (G)
     611</h3></div></div></div><a class="indexterm" name="id327125"></a><a name="ALGORITHMICRIDBASE"></a><div class="variablelist"><dl><dt></dt><dd><p>This determines how Samba will use its
    567612    algorithmic mapping from uids/gid to the RIDs needed to construct
    568613    NT Security Identifiers.
    … …  
    574619    mapping can't be 'turned off', but pushing it 'out of the way' should
    575620    resolve the issues.  Users and groups can then be assigned 'low' RIDs
    576     in arbitary-rid supporting backends.
     621    in arbitrary-rid supporting backends.
    577622    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>algorithmic rid base</code></em> = <code class="literal">1000</code>
    578623</em></span>
    579624</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>algorithmic rid base</code></em> = <code class="literal">100000</code>
    580625</em></span>
    581 </p></dd><dt><span class="term"><a name="ALLOCATIONROUNDUPSIZE"></a>allocation roundup size (S)</span></dt><dd><p>This parameter allows an administrator to tune the
     626</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327189"></a>
     627
     628allocation roundup size (S)
     629</h3></div></div></div><a class="indexterm" name="id327190"></a><a name="ALLOCATIONROUNDUPSIZE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter allows an administrator to tune the
    582630    allocation size reported to Windows clients.  The default
    583631    size of 1Mb generally results in improved Windows client
    … …  
    591639# (to disable roundups)</code>
    592640</em></span>
    593 </p></dd><dt><span class="term"><a name="ALLOWTRUSTEDDOMAINS"></a>allow trusted domains (G)</span></dt><dd><p>
    594     This option only takes effect when the <a class="indexterm" name="id303140"></a>security option is set to
     641</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327249"></a>
     642
     643allow trusted domains (G)
     644</h3></div></div></div><a class="indexterm" name="id327250"></a><a name="ALLOWTRUSTEDDOMAINS"></a><div class="variablelist"><dl><dt></dt><dd><p>
     645    This option only takes effect when the <a class="link" href="smb.conf.5.html#SECURITY">security</a> option is set to
    595646    <code class="constant">server</code>, <code class="constant">domain</code> or <code class="constant">ads</code>. 
    596647    If it is set to no, then attempts to connect to a resource from
    … …  
    606657    can make implementing a security boundary difficult.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>allow trusted domains</code></em> = <code class="literal">yes</code>
    607658</em></span>
    608 </p></dd><dt><span class="term"><a name="ANNOUNCEAS"></a>announce as (G)</span></dt><dd><p>This specifies what type of server <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> will announce itself as, to a network neighborhood browse
     659</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327313"></a>
     660
     661announce as (G)
     662</h3></div></div></div><a class="indexterm" name="id327314"></a><a name="ANNOUNCEAS"></a><div class="variablelist"><dl><dt></dt><dd><p>This specifies what type of server <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> will announce itself as, to a network neighborhood browse
    609663    list. By default this is set to Windows NT. The valid options
    610664    are : "NT Server" (which can also be written as "NT"),
    … …  
    618672</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>announce as</code></em> = <code class="literal">Win95</code>
    619673</em></span>
    620 </p></dd><dt><span class="term"><a name="ANNOUNCEVERSION"></a>announce version (G)</span></dt><dd><p>This specifies the major and minor version numbers
     674</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327382"></a>
     675
     676announce version (G)
     677</h3></div></div></div><a class="indexterm" name="id327383"></a><a name="ANNOUNCEVERSION"></a><div class="variablelist"><dl><dt></dt><dd><p>This specifies the major and minor version numbers
    621678    that nmbd will use when announcing itself as a server. The default
    622679    is 4.9.  Do not change this parameter unless you have a specific
    … …  
    625682</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>announce version</code></em> = <code class="literal">2.0</code>
    626683</em></span>
    627 </p></dd><dt><span class="term"><a name="AUTHMETHODS"></a>auth methods (G)</span></dt><dd><p>
     684</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327436"></a>
     685
     686auth methods (G)
     687</h3></div></div></div><a class="indexterm" name="id327438"></a><a name="AUTHMETHODS"></a><div class="variablelist"><dl><dt></dt><dd><p>
    628688    This option allows the administrator to chose what authentication methods <code class="literal">smbd</code>
    629     will use when authenticating a user. This option defaults to sensible values based on <a class="indexterm" name="id303341"></a>security. 
     689    will use when authenticating a user. This option defaults to sensible values based on <a class="link" href="smb.conf.5.html#SECURITY">security</a>. 
    630690    This should be considered a developer option and used only in rare circumstances.  In the majority (if not all)
    631691    of production servers, the default setting should be adequate.
    … …  
    646706</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>auth methods</code></em> = <code class="literal">guest sam winbind</code>
    647707</em></span>
    648 </p></dd><dt><span class="term"><a name="AVAILABLE"></a>available (S)</span></dt><dd><p>This parameter lets you "turn off" a service. If
     708</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327532"></a>
     709
     710available (S)
     711</h3></div></div></div><a class="indexterm" name="id327533"></a><a name="AVAILABLE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter lets you "turn off" a service. If
    649712        <em class="parameter"><code>available = no</code></em>, then <span class="emphasis"><em>ALL</em></span>
    650713        attempts to connect to the service will fail. Such failures are
    651714        logged.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>available</code></em> = <code class="literal">yes</code>
    652715</em></span>
    653 </p></dd><dt><span class="term"><a name="BINDINTERFACESONLY"></a>bind interfaces only (G)</span></dt><dd><p>This global parameter allows the Samba admin
     716</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327578"></a>
     717
     718bind interfaces only (G)
     719</h3></div></div></div><a class="indexterm" name="id327579"></a><a name="BINDINTERFACESONLY"></a><div class="variablelist"><dl><dt></dt><dd><p>This global parameter allows the Samba admin
    654720        to limit what interfaces on a machine will serve SMB requests. It
    655         affects file service <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> and name service <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> in a slightly different ways.</p><p>
     721        affects file service <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> and name service <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> in a slightly different ways.</p><p>
    656722        For name service it causes <code class="literal">nmbd</code> to bind to ports 137 and 138 on the
    657         interfaces listed in the <a class="indexterm" name="id303510"></a>interfaces parameter. <code class="literal">nmbd</code>
     723        interfaces listed in the <a class="link" href="smb.conf.5.html#INTERFACES">interfaces</a> parameter. <code class="literal">nmbd</code>
    658724        also binds to the "all addresses" interface (0.0.0.0) on ports 137 and 138 for the purposes of
    659725        reading broadcast messages.  If this option is not set then <code class="literal">nmbd</code> will
    660         service name requests on all of these sockets. If <a class="indexterm" name="id303531"></a>bind interfaces only is set then
     726        service name requests on all of these sockets. If <a class="link" href="smb.conf.5.html#BINDINTERFACESONLY">bind interfaces only</a> is set then
    661727         <code class="literal">nmbd</code> will check the source address of any packets coming in on the
    662728        broadcast sockets and discard any that don't match the broadcast addresses of the interfaces in the
    663         <a class="indexterm" name="id303545"></a>interfaces parameter list.  As unicast packets are received on the other sockets it
     729        <a class="link" href="smb.conf.5.html#INTERFACES">interfaces</a> parameter list.  As unicast packets are received on the other sockets it
    664730        allows <code class="literal">nmbd</code> to refuse to serve names to machines that send packets that
    665         arrive through any interfaces not listed in the <a class="indexterm" name="id303560"></a>interfaces list.  IP Source address
     731        arrive through any interfaces not listed in the <a class="link" href="smb.conf.5.html#INTERFACES">interfaces</a> list.  IP Source address
    666732        spoofing does defeat this simple check, however, so it must not be used seriously as a security feature for
    667733         <code class="literal">nmbd</code>.
    668734        </p><p>
    669         For file service it causes <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> to bind only to the interface list given in the <a class="indexterm" name="id303585"></a>interfaces parameter. This restricts the networks that <code class="literal">smbd</code> will
     735        For file service it causes <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> to bind only to the interface list given in the <a class="link" href="smb.conf.5.html#INTERFACES">interfaces</a> parameter. This restricts the networks that <code class="literal">smbd</code> will
    670736        serve to packets coming in those interfaces.  Note that you should not use this parameter for machines that
    671737        are serving PPP or other intermittent or non-broadcast network interfaces as it will not cope with
    672738        non-permanent interfaces.
    673739        </p><p>
    674         If <a class="indexterm" name="id303604"></a>bind interfaces only is set then unless the network address
    675          <span class="emphasis"><em>127.0.0.1</em></span> is added to the <a class="indexterm" name="id303615"></a>interfaces parameter list
    676          <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a> and
    677          <a href="swat.8.html"><span class="citerefentry"><span class="refentrytitle">swat</span>(8)</span></a> may not work as
     740        If <a class="link" href="smb.conf.5.html#BINDINTERFACESONLY">bind interfaces only</a> is set then unless the network address
     741         <span class="emphasis"><em>127.0.0.1</em></span> is added to the <a class="link" href="smb.conf.5.html#INTERFACES">interfaces</a> parameter list
     742         <a class="citerefentry" href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a> and
     743         <a class="citerefentry" href="swat.8.html"><span class="citerefentry"><span class="refentrytitle">swat</span>(8)</span></a> may not work as
    678744        expected due to the reasons covered below.
    679745        </p><p>
    680746        To change a users SMB password, the <code class="literal">smbpasswd</code> by default connects to the
    681747         <span class="emphasis"><em>localhost - 127.0.0.1</em></span> address as an SMB client to issue the password change request. If
    682         <a class="indexterm" name="id303653"></a>bind interfaces only is set then unless the network address
    683          <span class="emphasis"><em>127.0.0.1</em></span> is added to the <a class="indexterm" name="id303664"></a>interfaces parameter list then <code class="literal"> smbpasswd</code> will fail to connect in it's default mode.  <code class="literal">smbpasswd</code> can be forced to use the primary IP interface of the local host by using
    684         its <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>    <em class="parameter"><code>-r <em class="replaceable"><code>remote machine</code></em></code></em> parameter, with <em class="replaceable"><code>remote
     748        <a class="link" href="smb.conf.5.html#BINDINTERFACESONLY">bind interfaces only</a> is set then unless the network address
     749         <span class="emphasis"><em>127.0.0.1</em></span> is added to the <a class="link" href="smb.conf.5.html#INTERFACES">interfaces</a> parameter list then <code class="literal"> smbpasswd</code> will fail to connect in it's default mode.  <code class="literal">smbpasswd</code> can be forced to use the primary IP interface of the local host by using
     750        its <a class="citerefentry" href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>       <em class="parameter"><code>-r <em class="replaceable"><code>remote machine</code></em></code></em> parameter, with <em class="replaceable"><code>remote
    685751        machine</code></em> set to the IP name of the primary interface of the local host.
    686752        </p><p>
    … …  
    692758        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>bind interfaces only</code></em> = <code class="literal">no</code>
    693759</em></span>
    694 </p></dd><dt><span class="term"><a name="BLOCKINGLOCKS"></a>blocking locks (S)</span></dt><dd><p>This parameter controls the behavior
    695         of <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when given a request by a client
     760</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327875"></a>
     761
     762blocking locks (S)
     763</h3></div></div></div><a class="indexterm" name="id327876"></a><a name="BLOCKINGLOCKS"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls the behavior
     764        of <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when given a request by a client
    696765        to obtain a byte range lock on a region of an open file, and the
    697766        request has a time limit associated with it.</p><p>If this parameter is set and the lock range requested
    … …  
    703772        cannot be obtained.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>blocking locks</code></em> = <code class="literal">yes</code>
    704773</em></span>
    705 </p></dd><dt><span class="term"><a name="BLOCKSIZE"></a>block size (S)</span></dt><dd><p>This parameter controls the behavior of <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when reporting disk free
     774</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id327934"></a>
     775
     776block size (S)
     777</h3></div></div></div><a class="indexterm" name="id327935"></a><a name="BLOCKSIZE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls the behavior of <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when reporting disk free
    706778    sizes. By default, this reports a disk block size of 1024 bytes.
    707779    </p><p>Changing this parameter may have some effect on the
    … …  
    717789</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>block size</code></em> = <code class="literal">4096</code>
    718790</em></span>
    719 </p></dd><dt><span class="term"><a name="BROWSABLE"></a>browsable</span></dt><dd><p>This parameter is a synonym for browseable.</p></dd><dt><span class="term"><a name="BROWSEABLE"></a>browseable (S)</span></dt><dd><p>This controls whether this share is seen in
     791</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328005"></a><a name="BROWSABLE"></a>browsable</h3></div></div></div><a class="indexterm" name="id328006"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#BROWSEABLE">browseable</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328031"></a>
     792
     793browseable (S)
     794</h3></div></div></div><a class="indexterm" name="id328032"></a><a name="BROWSEABLE"></a><div class="variablelist"><dl><dt></dt><dd><p>This controls whether this share is seen in
    720795        the list of available shares in a net view and in the browse list.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>browseable</code></em> = <code class="literal">yes</code>
    721796</em></span>
    722 </p></dd><dt><span class="term"><a name="BROWSELIST"></a>browse list (G)</span></dt><dd><p>This controls whether <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will serve a browse list to
     797</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328068"></a>
     798
     799browse list (G)
     800</h3></div></div></div><a class="indexterm" name="id328070"></a><a name="BROWSELIST"></a><div class="variablelist"><dl><dt></dt><dd><p>This controls whether <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will serve a browse list to
    723801        a client doing a <code class="literal">NetServerEnum</code> call. Normally
    724802        set to <code class="constant">yes</code>. You should never need to change
    725803        this.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>browse list</code></em> = <code class="literal">yes</code>
    726804</em></span>
    727 </p></dd><dt><span class="term"><a name="CASESIGNAMES"></a>casesignames</span></dt><dd><p>This parameter is a synonym for case sensitive.</p></dd><dt><span class="term"><a name="CASESENSITIVE"></a>case sensitive (S)</span></dt><dd><p>See the discussion in the section <a class="indexterm" name="id304074"></a>name mangling.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>case sensitive</code></em> = <code class="literal">no</code>
    728 </em></span>
    729 </p></dd><dt><span class="term"><a name="CHANGENOTIFY"></a>change notify (S)</span></dt><dd><p>This parameter specifies whether Samba should reply
     805</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328121"></a><a name="CASESIGNAMES"></a>casesignames</h3></div></div></div><a class="indexterm" name="id328122"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#CASESENSITIVE">case sensitive</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328146"></a>
     806
     807case sensitive (S)
     808</h3></div></div></div><a class="indexterm" name="id328147"></a><a name="CASESENSITIVE"></a><div class="variablelist"><dl><dt></dt><dd><p>See the discussion in the section <a class="link" href="smb.conf.5.html#NAMEMANGLING">name mangling</a>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>case sensitive</code></em> = <code class="literal">no</code>
     809</em></span>
     810</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328190"></a>
     811
     812change notify (S)
     813</h3></div></div></div><a class="indexterm" name="id328191"></a><a name="CHANGENOTIFY"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies whether Samba should reply
    730814        to a client's file change notify requests.
    731         </p><p>You should never need to change this parameter</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>change notify</code></em> = <code class="literal">no</code>
    732 </em></span>
    733 </p></dd><dt><span class="term"><a name="CHANGESHARECOMMAND"></a>change share command (G)</span></dt><dd><p>Samba 2.2.0 introduced the ability to dynamically
    734         add and delete shares via the Windows NT 4.0 Server Manager.  The
    735         <em class="parameter"><code>change share command</code></em> is used to define an
    736         external program or script which will modify an existing service definition
    737         in <code class="filename">smb.conf</code>.  In order to successfully
    738         execute the <em class="parameter"><code>change share command</code></em>, <code class="literal">smbd</code>
    739         requires that the administrator be connected using a root account (i.e.
    740         uid == 0).
    741         </p><p>
    742         When executed, <code class="literal">smbd</code> will automatically invoke the
     815        </p><p>You should never need to change this parameter</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>change notify</code></em> = <code class="literal">yes</code>
     816</em></span>
     817</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328231"></a>
     818
     819change share command (G)
     820</h3></div></div></div><a class="indexterm" name="id328232"></a><a name="CHANGESHARECOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>
     821        Samba 2.2.0 introduced the ability to dynamically add and delete shares via the Windows NT 4.0 Server
     822Manager.  The <em class="parameter"><code>change share command</code></em> is used to define an external
     823program or script which will modify an existing service definition in <code class="filename">smb.conf</code>.  In order to successfully execute the <em class="parameter"><code>change
     824share command</code></em>, <code class="literal">smbd</code> requires that the administrator be
     825connected using a root account (i.e. uid == 0).
     826        </p><p>
     827        If the connected account has <code class="literal">SeDiskOperatorPrivilege</code>, scripts defined in
     828        <em class="parameter"><code>change share</code></em> parameter are executed as root.
     829        </p><p>
     830        When executed, <code class="literal">smbd</code> will automatically invoke the
    743831        <em class="parameter"><code>change share command</code></em> with five parameters.
    744         </p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>configFile</code></em> - the location 
    745                         of the global <code class="filename">smb.conf</code> file. 
    746                         </p></li><li><p><em class="parameter"><code>shareName</code></em> - the name of the new 
     832        </p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>configFile</code></em> - the location
     833                        of the global <code class="filename">smb.conf</code> file.
     834                        </p></li><li><p><em class="parameter"><code>shareName</code></em> - the name of the new
    747835                        share.
    748836                        </p></li><li><p><em class="parameter"><code>pathName</code></em> - path to an **existing**
    749837                        directory on disk.
    750                         </p></li><li><p><em class="parameter"><code>comment</code></em> - comment string to associate 
     838                        </p></li><li><p><em class="parameter"><code>comment</code></em> - comment string to associate
    751839                        with the new share.
    752840                        </p></li><li><p><em class="parameter"><code>max
    … …  
    755843                        share.
    756844                        </p></li></ul></div><p>
    757         This parameter is only used modify existing file shares definitions.  To modify 
     845        This parameter is only used modify existing file shares definitions.  To modify
    758846        printer shares, use the "Printers..." folder as seen when browsing the Samba host.
    759847        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>change share command</code></em> = <code class="literal"></code>
    … …  
    761849</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>change share command</code></em> = <code class="literal">/usr/local/bin/addshare</code>
    762850</em></span>
    763 </p></dd><dt><span class="term"><a name="CHECKPASSWORDSCRIPT"></a>check password script (G)</span></dt><dd><p>The name of a program that can be used to check password
     851</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328401"></a>
     852
     853check password script (G)
     854</h3></div></div></div><a class="indexterm" name="id328402"></a><a name="CHECKPASSWORDSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>The name of a program that can be used to check password
    764855    complexity. The password is sent to the program's standrad input.</p><p>The program must return 0 on good password any other value otherwise.
    765856    In case the password is considered weak (the program do not return 0) the
    766857    user will be notified and the password change will fail.</p><p>Note: In the example directory there is a sample program called crackcheck
    767     that uses cracklib to checkpassword quality</p>.
    768 
    769 
    770 <p>Default: <span class="emphasis"><em><em class="parameter"><code>check password script</code></em> = <code class="literal">Disabled</code>
     858    that uses cracklib to checkpassword quality.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>check password script</code></em> = <code class="literal">Disabled</code>
    771859</em></span>
    772860</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>check password script</code></em> = <code class="literal">check password script = /usr/local/sbin/crackcheck</code>
    773861</em></span>
    774 </p></dd><dt><span class="term"><a name="CLIENTLANMANAUTH"></a>client lanman auth (G)</span></dt><dd><p>This parameter determines whether or not <a href="smbclient.8.html"><span class="citerefentry"><span class="refentrytitle">smbclient</span>(8)</span></a> and other samba client
     862</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328464"></a>
     863
     864client lanman auth (G)
     865</h3></div></div></div><a class="indexterm" name="id328465"></a><a name="CLIENTLANMANAUTH"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter determines whether or not <a class="citerefentry" href="smbclient.8.html"><span class="citerefentry"><span class="refentrytitle">smbclient</span>(8)</span></a> and other samba client
    775866    tools will attempt to authenticate itself to servers using the
    776867    weaker LANMAN password hash. If disabled, only server which support NT
    … …  
    783874    attempted.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>client lanman auth</code></em> = <code class="literal">yes</code>
    784875</em></span>
    785 </p></dd><dt><span class="term"><a name="CLIENTNTLMV2AUTH"></a>client ntlmv2 auth (G)</span></dt><dd><p>This parameter determines whether or not <a href="smbclient.8.html"><span class="citerefentry"><span class="refentrytitle">smbclient</span>(8)</span></a> will attempt to
     876</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328533"></a>
     877
     878client ntlmv2 auth (G)
     879</h3></div></div></div><a class="indexterm" name="id328534"></a><a name="CLIENTNTLMV2AUTH"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter determines whether or not <a class="citerefentry" href="smbclient.8.html"><span class="citerefentry"><span class="refentrytitle">smbclient</span>(8)</span></a> will attempt to
    786880    authenticate itself to servers using the NTLMv2 encrypted password
    787881    response.</p><p>If enabled, only an NTLMv2 and LMv2 response (both much more
    … …  
    795889        responses, and not the weaker LM or NTLM.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>client ntlmv2 auth</code></em> = <code class="literal">no</code>
    796890</em></span>
    797 </p></dd><dt><span class="term"><a name="CLIENTPLAINTEXTAUTH"></a>client plaintext auth (G)</span></dt><dd><p>Specifies whether a client should send a plaintext
     891</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328613"></a>
     892
     893client plaintext auth (G)
     894</h3></div></div></div><a class="indexterm" name="id328614"></a><a name="CLIENTPLAINTEXTAUTH"></a><div class="variablelist"><dl><dt></dt><dd><p>Specifies whether a client should send a plaintext
    798895                password if the server does not support encrypted passwords.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>client plaintext auth</code></em> = <code class="literal">yes</code>
    799896</em></span>
    800 </p></dd><dt><span class="term"><a name="CLIENTSCHANNEL"></a>client schannel (G)</span></dt><dd><p>
     897</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328651"></a>
     898
     899client schannel (G)
     900</h3></div></div></div><a class="indexterm" name="id328652"></a><a name="CLIENTSCHANNEL"></a><div class="variablelist"><dl><dt></dt><dd><p>
    801901    This controls whether the client offers or even demands the use of the netlogon schannel.
    802     <a class="indexterm" name="id304593"></a>client schannel = no does not offer the schannel,
    803     <a class="indexterm" name="id304601"></a>client schannel = auto offers the schannel but does not
    804     enforce it, and <a class="indexterm" name="id304608"></a>client schannel = yes denies access
     902    <a class="link" href="smb.conf.5.html#CLIENTSCHANNEL">client schannel = no</a> does not offer the schannel,
     903    <a class="link" href="smb.conf.5.html#CLIENTSCHANNEL">client schannel = auto</a> offers the schannel but does not
     904    enforce it, and <a class="link" href="smb.conf.5.html#CLIENTSCHANNEL">client schannel = yes</a> denies access
    805905    if the server is not able to speak netlogon schannel.
    806906    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>client schannel</code></em> = <code class="literal">auto</code>
    … …  
    808908</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>client schannel</code></em> = <code class="literal">yes</code>
    809909</em></span>
    810 </p></dd><dt><span class="term"><a name="CLIENTSIGNING"></a>client signing (G)</span></dt><dd><p>This controls whether the client offers or requires
     910</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328727"></a>
     911
     912client signing (G)
     913</h3></div></div></div><a class="indexterm" name="id328728"></a><a name="CLIENTSIGNING"></a><div class="variablelist"><dl><dt></dt><dd><p>This controls whether the client offers or requires
    811914    the server it talks to to use SMB signing. Possible values
    812915    are <span class="emphasis"><em>auto</em></span>, <span class="emphasis"><em>mandatory</em></span>
    … …  
    814917    </p><p>When set to auto, SMB signing is offered, but not enforced.
    815918    When set to mandatory, SMB signing is required and if set
    816         to disabled, SMB signing is not offered either.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>client signing</code></em> = <code class="literal">auto</code>
    817 </em></span>
    818 </p></dd><dt><span class="term"><a name="CLIENTUSESPNEGO"></a>client use spnego (G)</span></dt><dd><p> This variable controls whether Samba clients will try
     919        to disabled, SMB signing is not offered either.
     920</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>client signing</code></em> = <code class="literal">auto</code>
     921</em></span>
     922</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328779"></a>
     923
     924client use spnego (G)
     925</h3></div></div></div><a class="indexterm" name="id328780"></a><a name="CLIENTUSESPNEGO"></a><div class="variablelist"><dl><dt></dt><dd><p> This variable controls whether Samba clients will try
    819926    to use Simple and Protected NEGOciation (as specified by rfc2478) with
    820927    supporting servers (including WindowsXP, Windows2000 and Samba
    … …  
    822929    mechanism.  This enables Kerberos authentication in particular.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>client use spnego</code></em> = <code class="literal">yes</code>
    823930</em></span>
    824 </p></dd><dt><span class="term"><a name="COMMENT"></a>comment (S)</span></dt><dd><p>This is a text field that is seen next to a share
     931</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328818"></a>
     932
     933comment (S)
     934</h3></div></div></div><a class="indexterm" name="id328820"></a><a name="COMMENT"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a text field that is seen next to a share
    825935        when a client does a queries the server, either via the network
    826936        neighborhood or via <code class="literal">net view</code> to list what shares
    827937        are available.</p><p>If you want to set the string that is displayed next to the
    828                 machine name then see the <a class="indexterm" name="id304778"></a>server string parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>comment</code></em> = <code class="literal">
     938                machine name then see the <a class="link" href="smb.conf.5.html#SERVERSTRING">server string</a> parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>comment</code></em> = <code class="literal">
    829939# No comment</code>
    830940</em></span>
    831941</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>comment</code></em> = <code class="literal">Fred's Files</code>
    832942</em></span>
    833 </p></dd><dt><span class="term"><a name="CONFIGFILE"></a>config file (G)</span></dt><dd><p>This allows you to override the config file
     943</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328889"></a>
     944
     945config file (G)
     946</h3></div></div></div><a class="indexterm" name="id328890"></a><a name="CONFIGFILE"></a><div class="variablelist"><dl><dt></dt><dd><p>This allows you to override the config file
    834947        to use, instead of the default (usually <code class="filename">smb.conf</code>).
    835948        There is a chicken and egg problem here as this option is set
    … …  
    841954        clients).</p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>config file</code></em> = <code class="literal">/usr/local/samba/lib/smb.conf.%m</code>
    842955</em></span>
    843 </p></dd><dt><span class="term"><a name="COPY"></a>copy (S)</span></dt><dd><p>This parameter allows you to "clone" service
     956</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id328950"></a>
     957
     958copy (S)
     959</h3></div></div></div><a class="indexterm" name="id328951"></a><a name="COPY"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter allows you to "clone" service
    844960        entries. The specified service is simply duplicated under the
    845961        current service's name. Any parameters specified in the current
    … …  
    851967</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>copy</code></em> = <code class="literal">otherservice</code>
    852968</em></span>
    853 </p></dd><dt><span class="term"><a name="CREATEMODE"></a>create mode</span></dt><dd><p>This parameter is a synonym for create mask.</p></dd><dt><span class="term"><a name="CREATEMASK"></a>create mask (S)</span></dt><dd><p>
     969</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329008"></a><a name="CREATEMODE"></a>create mode</h3></div></div></div><a class="indexterm" name="id329009"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#CREATEMASK">create mask</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329034"></a>
     970
     971create mask (S)
     972</h3></div></div></div><a class="indexterm" name="id329035"></a><a name="CREATEMASK"></a><div class="variablelist"><dl><dt></dt><dd><p>
    854973        When a file is created, the necessary permissions are calculated according to the mapping from DOS modes to
    855974        UNIX permissions, and the resulting UNIX mode is then bit-wise 'AND'ed with this parameter. This parameter may
    … …  
    861980        </p><p>
    862981        Following this Samba will bit-wise 'OR' the UNIX mode created from this parameter with the value of the
    863         <a class="indexterm" name="id305012"></a>force create mode parameter which is set to 000 by default.
    864         </p><p>
    865         This parameter does not affect directory masks. See the parameter <a class="indexterm" name="id305023"></a>directory mask
     982        <a class="link" href="smb.conf.5.html#FORCECREATEMODE">force create mode</a> parameter which is set to 000 by default.
     983        </p><p>
     984        This parameter does not affect directory masks. See the parameter <a class="link" href="smb.conf.5.html#DIRECTORYMASK">directory mask</a>
    866985        for details.
    867986        </p><p>
    868987        Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the
    869         administrator wishes to enforce a mask on access control lists also, they need to set the <a class="indexterm" name="id305036"></a>security mask.
     988        administrator wishes to enforce a mask on access control lists also, they need to set the <a class="link" href="smb.conf.5.html#SECURITYMASK">security mask</a>.
    870989        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>create mask</code></em> = <code class="literal">0744</code>
    871990</em></span>
    872991</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>create mask</code></em> = <code class="literal">0775</code>
    873992</em></span>
    874 </p></dd><dt><span class="term"><a name="CSCPOLICY"></a>csc policy (S)</span></dt><dd><p>
     993</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329141"></a>
     994
     995csc policy (S)
     996</h3></div></div></div><a class="indexterm" name="id329142"></a><a name="CSCPOLICY"></a><div class="variablelist"><dl><dt></dt><dd><p>
    875997        This stands for <span class="emphasis"><em>client-side caching policy</em></span>, and specifies how clients capable of offline
    876998        caching will cache the files in the share. The valid values are: manual, documents, programs, disable.
    … …  
    8791001        </p><p>
    8801002        For example, shares containing roaming profiles can have offline caching disabled using
    881         <a class="indexterm" name="id305112"></a>csc policy = disable.
     1003        <a class="link" href="smb.conf.5.html#CSCPOLICY">csc policy = disable</a>.
    8821004        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>csc policy</code></em> = <code class="literal">manual</code>
    8831005</em></span>
    8841006</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>csc policy</code></em> = <code class="literal">programs</code>
    8851007</em></span>
    886 </p></dd><dt><span class="term"><a name="CUPSOPTIONS"></a>cups options (S)</span></dt><dd><p>
    887     This parameter is only applicable if <a class="indexterm" name="id305175"></a>printing is
     1008</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329213"></a>
     1009
     1010cups options (S)
     1011</h3></div></div></div><a class="indexterm" name="id329214"></a><a name="CUPSOPTIONS"></a><div class="variablelist"><dl><dt></dt><dd><p>
     1012    This parameter is only applicable if <a class="link" href="smb.conf.5.html#PRINTING">printing</a> is
    8881013    set to <code class="constant">cups</code>.  Its value is a free form string of options
    8891014    passed directly to the cups library. 
    … …  
    8931018   specific option (as listed in "lpoptions -d printername -l")
    8941019   valid for the target queue.
     1020   Multiple parameters should be space-delimited name/value pairs according to
     1021   the PAPI text option ABNF specification. Collection values
     1022   ("name={a=... b=... c=...}") are stored with the curley brackets intact.
    8951023   </p><p>
    8961024   You should set this parameter to <code class="constant">raw</code> if your CUPS server
    … …  
    9011029   </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>cups options</code></em> = <code class="literal">""</code>
    9021030</em></span>
    903 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>cups options</code></em> = <code class="literal">"raw,media=a4,job-sheets=secret,secret"</code>
    904 </em></span>
    905 </p></dd><dt><span class="term"><a name="CUPSSERVER"></a>cups server (G)</span></dt><dd><p>
    906     This parameter is only applicable if <a class="indexterm" name="id305268"></a>printing is set to <code class="constant">cups</code>.
     1031</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>cups options</code></em> = <code class="literal">"raw media=a4"</code>
     1032</em></span>
     1033</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329303"></a>
     1034
     1035cups server (G)
     1036</h3></div></div></div><a class="indexterm" name="id329304"></a><a name="CUPSSERVER"></a><div class="variablelist"><dl><dt></dt><dd><p>
     1037    This parameter is only applicable if <a class="link" href="smb.conf.5.html#PRINTING">printing</a> is set to <code class="constant">cups</code>.
    9071038    </p><p>
    9081039   If set, this option overrides the ServerName option in the CUPS <code class="filename">client.conf</code>. This is
    … …  
    9171048</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>cups server</code></em> = <code class="literal">mycupsserver:1631</code>
    9181049</em></span>
    919 </p></dd><dt><span class="term"><a name="DEADTIME"></a>deadtime (G)</span></dt><dd><p>The value of the parameter (a decimal integer)
     1050</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329395"></a>
     1051
     1052deadtime (G)
     1053</h3></div></div></div><a class="indexterm" name="id329396"></a><a name="DEADTIME"></a><div class="variablelist"><dl><dt></dt><dd><p>The value of the parameter (a decimal integer)
    9201054    represents the number of minutes of inactivity before a connection
    9211055    is considered dead, and it is disconnected. The deadtime only takes
    … …  
    9291063</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>deadtime</code></em> = <code class="literal">15</code>
    9301064</em></span>
    931 </p></dd><dt><span class="term"><a name="DEBUGHIRESTIMESTAMP"></a>debug hires timestamp (G)</span></dt><dd><p>
     1065</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329467"></a>
     1066
     1067debug hires timestamp (G)
     1068</h3></div></div></div><a class="indexterm" name="id329468"></a><a name="DEBUGHIRESTIMESTAMP"></a><div class="variablelist"><dl><dt></dt><dd><p>
    9321069    Sometimes the timestamps in the log messages are needed with a resolution of higher that seconds, this
    9331070    boolean parameter adds microsecond resolution to the timestamp  message header when turned on.
    9341071    </p><p>
    935     Note that the parameter <a class="indexterm" name="id305445"></a>debug timestamp must be on for this to have an effect.
     1072    Note that the parameter <a class="link" href="smb.conf.5.html#DEBUGTIMESTAMP">debug timestamp</a> must be on for this to have an effect.
    9361073    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>debug hires timestamp</code></em> = <code class="literal">no</code>
    9371074</em></span>
    938 </p></dd><dt><span class="term"><a name="DEBUGPID"></a>debug pid (G)</span></dt><dd><p>
    939     When using only one log file for more then one forked <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>-process there may be hard to follow which process outputs which
     1075</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329516"></a>
     1076
     1077debug pid (G)
     1078</h3></div></div></div><a class="indexterm" name="id329517"></a><a name="DEBUGPID"></a><div class="variablelist"><dl><dt></dt><dd><p>
     1079    When using only one log file for more then one forked <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>-process there may be hard to follow which process outputs which
    9401080    message. This boolean parameter is adds the process-id to the timestamp message headers in the
    9411081    logfile when turned on.
    9421082    </p><p>
    943     Note that the parameter <a class="indexterm" name="id305504"></a>debug timestamp must be on for this to have an effect.
     1083    Note that the parameter <a class="link" href="smb.conf.5.html#DEBUGTIMESTAMP">debug timestamp</a> must be on for this to have an effect.
    9441084    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>debug pid</code></em> = <code class="literal">no</code>
    9451085</em></span>
    946 </p></dd><dt><span class="term"><a name="DEBUGPREFIXTIMESTAMP"></a>debug prefix timestamp (G)</span></dt><dd><p>
     1086</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329573"></a>
     1087
     1088debug prefix timestamp (G)
     1089</h3></div></div></div><a class="indexterm" name="id329574"></a><a name="DEBUGPREFIXTIMESTAMP"></a><div class="variablelist"><dl><dt></dt><dd><p>
    9471090    With this option enabled, the timestamp message header is prefixed to the debug message without the
    948     filename and function information that is included with the <a class="indexterm" name="id305552"></a>debug timestamp
     1091    filename and function information that is included with the <a class="link" href="smb.conf.5.html#DEBUGTIMESTAMP">debug timestamp</a>
    9491092    parameter. This gives timestamps to the messages without adding an additional line.
    9501093    </p><p>
    951     Note that this parameter overrides the <a class="indexterm" name="id305563"></a>debug timestamp parameter.
     1094    Note that this parameter overrides the <a class="link" href="smb.conf.5.html#DEBUGTIMESTAMP">debug timestamp</a> parameter.
    9521095    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>debug prefix timestamp</code></em> = <code class="literal">no</code>
    9531096</em></span>
    954 </p></dd><dt><span class="term"><a name="TIMESTAMPLOGS"></a>timestamp logs</span></dt><dd><p>This parameter is a synonym for debug timestamp.</p></dd><dt><span class="term"><a name="DEBUGTIMESTAMP"></a>debug timestamp (G)</span></dt><dd><p>
     1097</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329630"></a><a name="TIMESTAMPLOGS"></a>timestamp logs</h3></div></div></div><a class="indexterm" name="id329631"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#DEBUGTIMESTAMP">debug timestamp</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329655"></a>
     1098
     1099debug timestamp (G)
     1100</h3></div></div></div><a class="indexterm" name="id329656"></a><a name="DEBUGTIMESTAMP"></a><div class="variablelist"><dl><dt></dt><dd><p>
    9551101    Samba debug log messages are timestamped by default. If you are running at a high
    956     <a class="indexterm" name="id305630"></a>debug level these timestamps can be distracting. This
     1102    <a class="link" href="smb.conf.5.html#DEBUGLEVEL">debug level</a> these timestamps can be distracting. This
    9571103    boolean parameter allows timestamping to be turned off.
    9581104        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>debug timestamp</code></em> = <code class="literal">yes</code>
    9591105</em></span>
    960 </p></dd><dt><span class="term"><a name="DEBUGUID"></a>debug uid (G)</span></dt><dd><p>
     1106</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329701"></a>
     1107
     1108debug uid (G)
     1109</h3></div></div></div><a class="indexterm" name="id329702"></a><a name="DEBUGUID"></a><div class="variablelist"><dl><dt></dt><dd><p>
    9611110    Samba is sometimes run as root and sometime run as the connected user, this boolean parameter inserts the
    9621111    current euid, egid, uid and gid to the timestamp message headers in the log file if turned on.
    9631112    </p><p>
    964     Note that the parameter <a class="indexterm" name="id305681"></a>debug timestamp must be on for this to have an effect.
     1113    Note that the parameter <a class="link" href="smb.conf.5.html#DEBUGTIMESTAMP">debug timestamp</a> must be on for this to have an effect.
    9651114    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>debug uid</code></em> = <code class="literal">no</code>
    9661115</em></span>
    967 </p></dd><dt><span class="term"><a name="DEFAULTCASE"></a>default case (S)</span></dt><dd><p>See the section on <a class="indexterm" name="id305726"></a>name mangling.
    968         Also note the <a class="indexterm" name="id305734"></a>short preserve case parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>default case</code></em> = <code class="literal">lower</code>
    969 </em></span>
    970 </p></dd><dt><span class="term"><a name="DEFAULTDEVMODE"></a>default devmode (S)</span></dt><dd><p>This parameter is only applicable to <a class="indexterm" name="id305779"></a>printable services.
     1116</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329750"></a>
     1117
     1118default case (S)
     1119</h3></div></div></div><a class="indexterm" name="id329751"></a><a name="DEFAULTCASE"></a><div class="variablelist"><dl><dt></dt><dd><p>See the section on <a class="link" href="smb.conf.5.html#NAMEMANGLING">name mangling</a>.
     1120        Also note the <a class="link" href="smb.conf.5.html#SHORTPRESERVECASE">short preserve case</a> parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>default case</code></em> = <code class="literal">lower</code>
     1121</em></span>
     1122</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329801"></a>
     1123
     1124default devmode (S)
     1125</h3></div></div></div><a class="indexterm" name="id329802"></a><a name="DEFAULTDEVMODE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is only applicable to <a class="link" href="smb.conf.5.html#PRINTABLE">printable</a> services.
    9711126    When smbd is serving Printer Drivers to Windows NT/2k/XP clients, each printer on the Samba
    9721127    server has a Device Mode which defines things such as paper size and
    … …  
    9881143    will instruct smbd to generate a default one.
    9891144    </p><p>For more information on Windows NT/2k printing and Device Modes,
    990     see the <a href="http://msdn.microsoft.com/" target="_top">MSDN documentation</a>.
     1145    see the <a class="ulink" href="http://msdn.microsoft.com/" target="_top">MSDN documentation</a>.
    9911146</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>default devmode</code></em> = <code class="literal">yes</code>
    9921147</em></span>
    993 </p></dd><dt><span class="term"><a name="DEFAULT"></a>default</span></dt><dd><p>This parameter is a synonym for default service.</p></dd><dt><span class="term"><a name="DEFAULTSERVICE"></a>default service (G)</span></dt><dd><p>This parameter specifies the name of a service
     1148</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329880"></a><a name="DEFAULT"></a>default</h3></div></div></div><a class="indexterm" name="id329881"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#DEFAULTSERVICE">default service</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329905"></a>
     1149
     1150default service (G)
     1151</h3></div></div></div><a class="indexterm" name="id329906"></a><a name="DEFAULTSERVICE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the name of a service
    9941152        which will be connected to if the service actually requested cannot
    9951153        be found. Note that the square brackets are <span class="emphasis"><em>NOT</em></span>
    … …  
    9971155        parameter is not given, attempting to connect to a nonexistent
    9981156        service results in an error.</p><p>
    999         Typically the default service would be a <a class="indexterm" name="id305892"></a>guest ok, <a class="indexterm" name="id305899"></a>read-only service.</p><p>Also note that the apparent service name will be changed to equal
     1157        Typically the default service would be a <a class="link" href="smb.conf.5.html#GUESTOK">guest ok</a>, <a class="link" href="smb.conf.5.html#READ-ONLY">read-only</a> service.</p><p>Also note that the apparent service name will be changed to equal
    10001158        that of the requested service, this is very useful as it allows you to use macros like <em class="parameter"><code>%S</code></em> to make a wildcard service.
    10011159        </p><p>Note also that any "_" characters in the name of the service
    … …  
    10051163</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>default service</code></em> = <code class="literal">pub</code>
    10061164</em></span>
    1007 </p></dd><dt><span class="term"><a name="DEFERSHARINGVIOLATIONS"></a>defer sharing violations (G)</span></dt><dd><p>
     1165</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id329998"></a>
     1166
     1167defer sharing violations (G)
     1168</h3></div></div></div><a class="indexterm" name="id329999"></a><a name="DEFERSHARINGVIOLATIONS"></a><div class="variablelist"><dl><dt></dt><dd><p>
    10081169        Windows allows specifying how a file will be shared with
    10091170        other processes when it is opened. Sharing violations occur when
    … …  
    10181179        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>defer sharing violations</code></em> = <code class="literal">True</code>
    10191180</em></span>
    1020 </p></dd><dt><span class="term"><a name="DELETEGROUPSCRIPT"></a>delete group script (G)</span></dt><dd><p>This is the full pathname to a script that will
    1021         be run <span class="emphasis"><em>AS ROOT</em></span> <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when a group is requested to be deleted.
     1181</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330046"></a>
     1182
     1183delete group script (G)
     1184</h3></div></div></div><a class="indexterm" name="id330048"></a><a name="DELETEGROUPSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>This is the full pathname to a script that will
     1185        be run <span class="emphasis"><em>AS ROOT</em></span> <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when a group is requested to be deleted.
    10221186        It will expand any <em class="parameter"><code>%g</code></em> to the group name passed. 
    10231187        This script is only useful for installations using the Windows NT domain administration tools.
    10241188        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>delete group script</code></em> = <code class="literal"></code>
    10251189</em></span>
    1026 </p></dd><dt><span class="term"><a name="DELETEPRINTERCOMMAND"></a>deleteprinter command (G)</span></dt><dd><p>With the introduction of MS-RPC based printer
     1190</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330101"></a>
     1191
     1192deleteprinter command (G)
     1193</h3></div></div></div><a class="indexterm" name="id330102"></a><a name="DELETEPRINTERCOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>With the introduction of MS-RPC based printer
    10271194    support for Windows NT/2000 clients in Samba 2.2, it is now
    10281195    possible to delete printer at run time by issuing the
    10291196    DeletePrinter() RPC call.</p><p>For a Samba host this means that the printer must be
    10301197    physically deleted from underlying printing system.  The
    1031     <a class="indexterm" name="id306089"></a>deleteprinter command defines a script to be run which
     1198    <a class="link" href="smb.conf.5.html#DELETEPRINTERCOMMAND">deleteprinter command</a> defines a script to be run which
    10321199    will perform the necessary operations for removing the printer
    10331200    from the print system and from <code class="filename">smb.conf</code>.
    1034     </p><p>The <a class="indexterm" name="id306106"></a>deleteprinter command is
    1035     automatically called with only one parameter: <a class="indexterm" name="id306114"></a>printer name.
    1036         </p><p>Once the <a class="indexterm" name="id306124"></a>deleteprinter command has
     1201    </p><p>The <a class="link" href="smb.conf.5.html#DELETEPRINTERCOMMAND">deleteprinter command</a> is
     1202    automatically called with only one parameter: <a class="link" href="smb.conf.5.html#PRINTERNAME">printer name</a>.
     1203        </p><p>Once the <a class="link" href="smb.conf.5.html#DELETEPRINTERCOMMAND">deleteprinter command</a> has
    10371204    been executed, <code class="literal">smbd</code> will reparse the <code class="filename">
    10381205    smb.conf</code> to associated printer no longer exists. 
    … …  
    10421209</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>deleteprinter command</code></em> = <code class="literal">/usr/bin/removeprinter</code>
    10431210</em></span>
    1044 </p></dd><dt><span class="term"><a name="DELETEREADONLY"></a>delete readonly (S)</span></dt><dd><p>This parameter allows readonly files to be deleted. 
     1211</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330216"></a>
     1212
     1213delete readonly (S)
     1214</h3></div></div></div><a class="indexterm" name="id330217"></a><a name="DELETEREADONLY"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter allows readonly files to be deleted. 
    10451215        This is not normal DOS semantics, but is allowed by UNIX.</p><p>This option may be useful for running applications such
    10461216        as rcs, where UNIX file ownership prevents changing file
    10471217        permissions, and DOS semantics prevent deletion of a read only file.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>delete readonly</code></em> = <code class="literal">no</code>
    10481218</em></span>
    1049 </p></dd><dt><span class="term"><a name="DELETESHARECOMMAND"></a>delete share command (G)</span></dt><dd><p>Samba 2.2.0 introduced the ability to dynamically
    1050         add and delete shares via the Windows NT 4.0 Server Manager.  The
    1051         <em class="parameter"><code>delete share command</code></em> is used to define an
    1052         external program or script which will remove an existing service
    1053         definition from <code class="filename">smb.conf</code>.  In order to successfully
    1054         execute the <em class="parameter"><code>delete share command</code></em>, <code class="literal">smbd</code>
    1055         requires that the administrator be connected using a root account (i.e.
    1056         uid == 0).
    1057         </p><p>
    1058         When executed, <code class="literal">smbd</code> will automatically invoke the
     1219</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330259"></a>
     1220
     1221delete share command (G)
     1222</h3></div></div></div><a class="indexterm" name="id330260"></a><a name="DELETESHARECOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>
     1223        Samba 2.2.0 introduced the ability to dynamically add and delete shares via the Windows NT 4.0 Server
     1224        Manager.  The <em class="parameter"><code>delete share command</code></em> is used to define an external
     1225        program or script which will remove an existing service definition from
     1226        <code class="filename">smb.conf</code>.  In order to successfully execute the
     1227        <em class="parameter"><code>delete share command</code></em>, <code class="literal">smbd</code>
     1228        requires that the administrator be connected using a root account (i.e.  uid == 0).
     1229        </p><p>
     1230    If the connected account has <code class="literal">SeDiskOperatorPrivilege</code>, scripts defined in
     1231    <em class="parameter"><code>change share</code></em> parameter are executed as root.
     1232    </p><p>
     1233        When executed, <code class="literal">smbd</code> will automatically invoke the
    10591234        <em class="parameter"><code>delete share command</code></em> with two parameters.
    1060         </p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>configFile</code></em> - the location 
    1061                         of the global <code class="filename">smb.conf</code> file. 
    1062                         </p></li><li><p><em class="parameter"><code>shareName</code></em> - the name of 
     1235        </p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>configFile</code></em> - the location
     1236                        of the global <code class="filename">smb.conf</code> file.
     1237                        </p></li><li><p><em class="parameter"><code>shareName</code></em> - the name of
    10631238                        the existing service.
    10641239                        </p></li></ul></div><p>
    1065         This parameter is only used to remove file shares.  To delete printer shares, 
    1066         see the <a class="indexterm" name="id306327"></a>deleteprinter command.
     1240        This parameter is only used to remove file shares.  To delete printer shares,
     1241        see the <a class="link" href="smb.conf.5.html#DELETEPRINTERCOMMAND">deleteprinter command</a>.
    10671242        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>delete share command</code></em> = <code class="literal"></code>
    10681243</em></span>
    10691244</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>delete share command</code></em> = <code class="literal">/usr/local/bin/delshare</code>
    10701245</em></span>
    1071 </p></dd><dt><span class="term"><a name="DELETEUSERFROMGROUPSCRIPT"></a>delete user from group script (G)</span></dt><dd><p>Full path to the script that will be called when
     1246</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330402"></a>
     1247
     1248delete user from group script (G)
     1249</h3></div></div></div><a class="indexterm" name="id330403"></a><a name="DELETEUSERFROMGROUPSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>Full path to the script that will be called when
    10721250        a user is removed from a group using the Windows NT domain administration
    1073         tools. It will be run by <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> <span class="emphasis"><em>AS ROOT</em></span>.
     1251        tools. It will be run by <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> <span class="emphasis"><em>AS ROOT</em></span>.
    10741252        Any <em class="parameter"><code>%g</code></em> will be replaced with the group name and
    10751253        any <em class="parameter"><code>%u</code></em> will be replaced with the user name.
    … …  
    10781256</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>delete user from group script</code></em> = <code class="literal">/usr/sbin/deluser %u %g</code>
    10791257</em></span>
    1080 </p></dd><dt><span class="term"><a name="DELETEUSERSCRIPT"></a>delete user script (G)</span></dt><dd><p>This is the full pathname to a script that will
    1081         be run by <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when managing users
     1258</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330476"></a>
     1259
     1260delete user script (G)
     1261</h3></div></div></div><a class="indexterm" name="id330477"></a><a name="DELETEUSERSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>This is the full pathname to a script that will
     1262        be run by <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when managing users
    10821263        with remote RPC (NT) tools.
    10831264        </p><p>This script is called when a remote client removes a user
    … …  
    10871268</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>delete user script</code></em> = <code class="literal">/usr/local/samba/bin/del_user %u</code>
    10881269</em></span>
    1089 </p></dd><dt><span class="term"><a name="DELETEVETOFILES"></a>delete veto files (S)</span></dt><dd><p>This option is used when Samba is attempting to
     1270</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330549"></a>
     1271
     1272delete veto files (S)
     1273</h3></div></div></div><a class="indexterm" name="id330550"></a><a name="DELETEVETOFILES"></a><div class="variablelist"><dl><dt></dt><dd><p>This option is used when Samba is attempting to
    10901274        delete a directory that contains one or more vetoed directories
    1091         (see the <a class="indexterm" name="id306545"></a>veto files
     1275        (see the <a class="link" href="smb.conf.5.html#VETOFILES">veto files</a>
    10921276        option).  If this option is set to <code class="constant">no</code> (the default) then if a vetoed
    10931277        directory contains any non-vetoed files or directories then the
    … …  
    10971281        serving systems such as NetAtalk which create meta-files within
    10981282        directories you might normally veto DOS/Windows users from seeing
    1099         (e.g. <code class="filename">.AppleDouble</code>)</p><p>Setting <a class="indexterm" name="id306576"></a>delete veto files = yes allows these
     1283        (e.g. <code class="filename">.AppleDouble</code>)</p><p>Setting <a class="link" href="smb.conf.5.html#DELETEVETOFILES">delete veto files = yes</a> allows these
    11001284        directories to be  transparently deleted when the parent directory
    11011285        is deleted (so long as the user has permissions to do so).</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>delete veto files</code></em> = <code class="literal">no</code>
    11021286</em></span>
    1103 </p></dd><dt><span class="term"><a name="DFREECACHETIME"></a>dfree cache time (S)</span></dt><dd><p>
     1287</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330624"></a>
     1288
     1289dfree cache time (S)
     1290</h3></div></div></div><a class="indexterm" name="id330626"></a><a name="DFREECACHETIME"></a><div class="variablelist"><dl><dt></dt><dd><p>
    11041291        The <em class="parameter"><code>dfree cache time</code></em> should only be used on systems where a problem
    11051292        occurs with the internal disk space calculations. This has been known to happen with Ultrix, but may occur
    … …  
    11091296        This is a new parameter introduced in Samba version 3.0.21.  It specifies in seconds the time that smbd will
    11101297        cache the output of a disk free query. If set to zero (the default) no caching is done. This allows a heavily
    1111         loaded server to prevent rapid spawning of <a class="indexterm" name="id306636"></a>dfree command scripts increasing the load.
     1298        loaded server to prevent rapid spawning of <a class="link" href="smb.conf.5.html#DFREECOMMAND">dfree command</a> scripts increasing the load.
    11121299        </p><p>
    11131300        By default this parameter is zero, meaning no caching will be done.
    11141301        </p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>dfree cache time</code></em> = <code class="literal">dfree cache time = 60</code>
    11151302</em></span>
    1116 </p></dd><dt><span class="term"><a name="DFREECOMMAND"></a>dfree command (S)</span></dt><dd><p>
     1303</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330690"></a>
     1304
     1305dfree command (S)
     1306</h3></div></div></div><a class="indexterm" name="id330691"></a><a name="DFREECOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>
    11171307        The <em class="parameter"><code>dfree command</code></em> setting should only be used on systems where a
    11181308        problem occurs with the internal disk space calculations. This has been known to happen with Ultrix, but may
    … …  
    11251315        </p><p>
    11261316        In Samba version 3.0.21 this parameter has been changed to be a per-share parameter, and in addition the
    1127         parameter <a class="indexterm" name="id306708"></a>dfree cache time was added to allow the output of this script to be cached
     1317        parameter <a class="link" href="smb.conf.5.html#DFREECACHETIME">dfree cache time</a> was added to allow the output of this script to be cached
    11281318        for systems under heavy load.
    11291319        </p><p>
    … …  
    11401330</p><pre class="programlisting">
    11411331#!/bin/sh
    1142 df $1 | tail -1 | awk '{print $2" "$4}'
     1332df $1 | tail -1 | awk '{print $(NF-4),$(NF-2)}'
    11431333</pre><p>
    11441334        or perhaps (on Sys V based systems):
    … …  
    11521342        </p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>dfree command</code></em> = <code class="literal">/usr/local/samba/bin/dfree</code>
    11531343</em></span>
    1154 </p></dd><dt><span class="term"><a name="DIRECTORYMODE"></a>directory mode</span></dt><dd><p>This parameter is a synonym for directory mask.</p></dd><dt><span class="term"><a name="DIRECTORYMASK"></a>directory mask (S)</span></dt><dd><p>This parameter is the octal modes which are
     1344</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330797"></a><a name="DIRECTORYMODE"></a>directory mode</h3></div></div></div><a class="indexterm" name="id330798"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#DIRECTORYMASK">directory mask</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330822"></a>
     1345
     1346directory mask (S)
     1347</h3></div></div></div><a class="indexterm" name="id330823"></a><a name="DIRECTORYMASK"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is the octal modes which are
    11551348    used when converting DOS modes to UNIX modes when creating UNIX
    11561349    directories.</p><p>When a directory is created, the necessary permissions are
    … …  
    11631356    and 'other' write bits from the UNIX mode, allowing only the
    11641357    user who owns the directory to modify it.</p><p>Following this Samba will bit-wise 'OR' the UNIX mode
    1165     created from this parameter with the value of the <a class="indexterm" name="id306842"></a>force directory mode parameter.
     1358    created from this parameter with the value of the <a class="link" href="smb.conf.5.html#FORCEDIRECTORYMODE">force directory mode</a> parameter.
    11661359    This parameter is set to 000 by default (i.e. no extra mode bits are added).</p><p>Note that this parameter does not apply to permissions
    11671360    set by Windows NT/2000 ACL editors. If the administrator wishes to enforce
    1168     a mask on access control lists also, they need to set the <a class="indexterm" name="id306854"></a>directory security mask.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>directory mask</code></em> = <code class="literal">0755</code>
     1361    a mask on access control lists also, they need to set the <a class="link" href="smb.conf.5.html#DIRECTORYSECURITYMASK">directory security mask</a>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>directory mask</code></em> = <code class="literal">0755</code>
    11691362</em></span>
    11701363</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>directory mask</code></em> = <code class="literal">0775</code>
    11711364</em></span>
    1172 </p></dd><dt><span class="term"><a name="DIRECTORYSECURITYMASK"></a>directory security mask (S)</span></dt><dd><p>This parameter controls what UNIX permission bits
    1173     can be modified when a Windows NT client is manipulating the UNIX
    1174     permission on a directory using the native NT security dialog
     1365</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id330915"></a>
     1366
     1367directory security mask (S)
     1368</h3></div></div></div><a class="indexterm" name="id330916"></a><a name="DIRECTORYSECURITYMASK"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls what UNIX permission bits
     1369    will be set when a Windows NT client is manipulating the UNIX
     1370    permission on a directory using the native NT security dialog
    11751371    box.</p><p>
    1176         This parameter is applied as a mask (AND'ed with) to the changed permission bits, thus preventing any bits not
    1177         in this mask from being modified.  Make sure not to mix up this parameter with <a class="indexterm" name="id306924"></a>force  directory security mode, which works similar like this one but uses logical OR instead of AND.
    1178         Essentially, zero bits in this mask may be treated as a set of bits the user is not allowed to change.
    1179         </p><p>If not set explicitly this parameter is set to 0777
    1180     meaning a user is allowed to modify all the user/group/world
     1372        This parameter is applied as a mask (AND'ed with) to the incoming permission bits, thus resetting
     1373        any bits not in this mask.  Make sure not to mix up this parameter with <a class="link" href="smb.conf.5.html#FORCEDIRECTORYSECURITYMODE">force  directory security mode</a>, which works similar like this one but uses logical OR instead of AND.
     1374        Essentially, zero bits in this mask are a set of bits that will always be set to zero.
     1375        </p><p>
     1376        Essentially, all bits set to zero in this mask will result in setting to zero the corresponding bits on the
     1377        file permissions regardless of the previous status of this bits on the file.
     1378    </p><p>If not set explicitly this parameter is set to 0777
     1379    meaning a user is allowed to set all the user/group/world
    11811380    permissions on a directory.</p><p><span class="emphasis"><em>Note</em></span> that users who can access the
    11821381    Samba server through other means can easily bypass this restriction,
    … …  
    11871386</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>directory security mask</code></em> = <code class="literal">0700</code>
    11881387</em></span>
    1189 </p></dd><dt><span class="term"><a name="DISABLENETBIOS"></a>disable netbios (G)</span></dt><dd><p>Enabling this parameter will disable netbios support
     1388</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331003"></a>
     1389
     1390disable netbios (G)
     1391</h3></div></div></div><a class="indexterm" name="id331004"></a><a name="DISABLENETBIOS"></a><div class="variablelist"><dl><dt></dt><dd><p>Enabling this parameter will disable netbios support
    11901392    in Samba. Netbios is the only available form of browsing in
    11911393    all windows versions except for 2000 and XP. </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Clients that only support netbios won't be able to
    … …  
    11931395        </p></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>disable netbios</code></em> = <code class="literal">no</code>
    11941396</em></span>
    1195 </p></dd><dt><span class="term"><a name="DISABLESPOOLSS"></a>disable spoolss (G)</span></dt><dd><p>Enabling this parameter will disable Samba's support
     1397</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331047"></a>
     1398
     1399disable spoolss (G)
     1400</h3></div></div></div><a class="indexterm" name="id331048"></a><a name="DISABLESPOOLSS"></a><div class="variablelist"><dl><dt></dt><dd><p>Enabling this parameter will disable Samba's support
    11961401    for the SPOOLSS set of MS-RPC's and will yield identical behavior
    11971402    as Samba 2.0.x.  Windows NT/2000 clients will downgrade to using
    … …  
    12051410</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>disable spoolss</code></em> = <code class="literal">no</code>
    12061411</em></span>
    1207 </p></dd><dt><span class="term"><a name="DISPLAYCHARSET"></a>display charset (G)</span></dt><dd><p>
     1412</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331092"></a>
     1413
     1414display charset (G)
     1415</h3></div></div></div><a class="indexterm" name="id331093"></a><a name="DISPLAYCHARSET"></a><div class="variablelist"><dl><dt></dt><dd><p>
    12081416        Specifies the charset that samba will use to print messages to stdout and stderr.
    12091417        The default value is "LOCALE", which means automatically set, depending on the
    12101418        current locale. The value should generally be the same as the value of the parameter
    1211         <a class="indexterm" name="id258203"></a>unix charset.
     1419        <a class="link" href="smb.conf.5.html#UNIXCHARSET">unix charset</a>.
    12121420        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>display charset</code></em> = <code class="literal">"LOCALE" or "ASCII" (depending on the system)</code>
    12131421</em></span>
    12141422</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>display charset</code></em> = <code class="literal">UTF8</code>
    12151423</em></span>
    1216 </p></dd><dt><span class="term"><a name="DMAPISUPPORT"></a>dmapi support (S)</span></dt><dd><p>This parameter specifies whether Samba should use DMAPI to
     1424</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331154"></a>
     1425
     1426dmapi support (S)
     1427</h3></div></div></div><a class="indexterm" name="id331155"></a><a name="DMAPISUPPORT"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies whether Samba should use DMAPI to
    12171428        determine whether a file is offline or not. This would typically
    12181429        be used in conjunction with a hierarchical storage system that
    … …  
    12291440        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>dmapi support</code></em> = <code class="literal">no</code>
    12301441</em></span>
    1231 </p></dd><dt><span class="term"><a name="DNSPROXY"></a>dns proxy (G)</span></dt><dd><p>Specifies that <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> when acting as a WINS server and
     1442</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331207"></a>
     1443
     1444dns proxy (G)
     1445</h3></div></div></div><a class="indexterm" name="id331208"></a><a name="DNSPROXY"></a><div class="variablelist"><dl><dt></dt><dd><p>Specifies that <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> when acting as a WINS server and
    12321446        finding that a NetBIOS name has not been registered, should treat the
    12331447        NetBIOS name word-for-word as a DNS name and do a lookup with the DNS server
    … …  
    12381452        action.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>dns proxy</code></em> = <code class="literal">yes</code>
    12391453</em></span>
    1240 </p></dd><dt><span class="term"><a name="DOMAINLOGONS"></a>domain logons (G)</span></dt><dd><p>
     1454</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331266"></a>
     1455
     1456domain logons (G)
     1457</h3></div></div></div><a class="indexterm" name="id331267"></a><a name="DOMAINLOGONS"></a><div class="variablelist"><dl><dt></dt><dd><p>
    12411458        If set to <code class="constant">yes</code>, the Samba server will
    12421459        provide the netlogon service for Windows 9X network logons for the
    1243         <a class="indexterm" name="id307348"></a>workgroup it is in.
     1460        <a class="link" href="smb.conf.5.html#WORKGROUP">workgroup</a> it is in.
    12441461        This will also cause the Samba server to act as a domain
    12451462        controller for NT4 style domain services. For more details on
    … …  
    12481465        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>domain logons</code></em> = <code class="literal">no</code>
    12491466</em></span>
    1250 </p></dd><dt><span class="term"><a name="DOMAINMASTER"></a>domain master (G)</span></dt><dd><p>
    1251         Tell <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> to enable
     1467</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331316"></a>
     1468
     1469domain master (G)
     1470</h3></div></div></div><a class="indexterm" name="id331317"></a><a name="DOMAINMASTER"></a><div class="variablelist"><dl><dt></dt><dd><p>
     1471        Tell <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> to enable
    12521472        WAN-wide browse list collation. Setting this option causes <code class="literal">nmbd</code> to claim a
    12531473        special domain specific NetBIOS name that identifies it as a domain master browser for its given
    1254         <a class="indexterm" name="id307410"></a>workgroup. Local master browsers in the same <a class="indexterm" name="id307417"></a>workgroup on
     1474        <a class="link" href="smb.conf.5.html#WORKGROUP">workgroup</a>. Local master browsers in the same <a class="link" href="smb.conf.5.html#WORKGROUP">workgroup</a> on
    12551475        broadcast-isolated subnets will give this <code class="literal">nmbd</code> their local browse lists,
    1256         and then ask <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> for a
     1476        and then ask <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> for a
    12571477        complete copy of the browse list for the whole wide area network.  Browser clients will then contact their
    12581478        local master browser, and will receive the domain-wide browse list, instead of just the list for their
    12591479        broadcast-isolated subnet.
    12601480        </p><p>
    1261         Note that Windows NT Primary Domain Controllers expect to be able to claim this <a class="indexterm" name="id307445"></a>workgroup specific special NetBIOS name that identifies them as domain master browsers for that
    1262         <a class="indexterm" name="id307453"></a>workgroup by default (i.e. there is no way to prevent a Windows NT PDC from attempting
     1481        Note that Windows NT Primary Domain Controllers expect to be able to claim this <a class="link" href="smb.conf.5.html#WORKGROUP">workgroup</a> specific special NetBIOS name that identifies them as domain master browsers for that
     1482        <a class="link" href="smb.conf.5.html#WORKGROUP">workgroup</a> by default (i.e. there is no way to prevent a Windows NT PDC from attempting
    12631483        to do this). This means that if this parameter is set and <code class="literal">nmbd</code> claims the
    1264         special name for a <a class="indexterm" name="id307467"></a>workgroup before a Windows NT PDC is able to do so then cross
     1484        special name for a <a class="link" href="smb.conf.5.html#WORKGROUP">workgroup</a> before a Windows NT PDC is able to do so then cross
    12651485        subnet browsing will behave strangely and may fail.
    12661486        </p><p>
    1267         If <a class="indexterm" name="id307478"></a>domain logons = yes, then the default behavior is to enable the
    1268         <a class="indexterm" name="id307486"></a>domain master parameter.  If <a class="indexterm" name="id307493"></a>domain logons is not enabled (the
    1269         default setting), then neither will <a class="indexterm" name="id307501"></a>domain master be enabled by default.
    1270         </p><p>
    1271         When <a class="indexterm" name="id307511"></a>domain logons = Yes the default setting for this parameter is
    1272         Yes, with the result that Samba will be a PDC. If <a class="indexterm" name="id307519"></a>domain master = No,
     1487        If <a class="link" href="smb.conf.5.html#DOMAINLOGONS">domain logons = yes</a>, then the default behavior is to enable the
     1488        <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master</a> parameter.  If <a class="link" href="smb.conf.5.html#DOMAINLOGONS">domain logons</a> is not enabled (the
     1489        default setting), then neither will <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master</a> be enabled by default.
     1490        </p><p>
     1491        When <a class="link" href="smb.conf.5.html#DOMAINLOGONS">domain logons = Yes</a> the default setting for this parameter is
     1492        Yes, with the result that Samba will be a PDC. If <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = No</a>,
    12731493        Samba will function as a BDC. In general, this parameter should be set to 'No' only on a BDC.
    12741494        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>domain master</code></em> = <code class="literal">auto</code>
    12751495</em></span>
    1276 </p></dd><dt><span class="term"><a name="DONTDESCEND"></a>dont descend (S)</span></dt><dd><p>There are certain directories on some systems
     1496</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331483"></a>
     1497
     1498dont descend (S)
     1499</h3></div></div></div><a class="indexterm" name="id331484"></a><a name="DONTDESCEND"></a><div class="variablelist"><dl><dt></dt><dd><p>There are certain directories on some systems
    12771500        (e.g., the <code class="filename">/proc</code> tree under Linux) that are either not
    12781501        of interest to clients or are infinitely deep (recursive). This
    … …  
    12851508</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>dont descend</code></em> = <code class="literal">/proc,/dev</code>
    12861509</em></span>
    1287 </p></dd><dt><span class="term"><a name="DOSCHARSET"></a>dos charset (G)</span></dt><dd><p>DOS SMB clients assume the server has
     1510</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331557"></a>
     1511
     1512dos charset (G)
     1513</h3></div></div></div><a class="indexterm" name="id331558"></a><a name="DOSCHARSET"></a><div class="variablelist"><dl><dt></dt><dd><p>DOS SMB clients assume the server has
    12881514        the same charset as they do. This option specifies which
    12891515        charset Samba should talk to DOS clients.
    12901516        </p><p>The default depends on which charsets you have installed.
    12911517        Samba tries to use charset 850 but falls back to ASCII in
    1292         case it is not available. Run <a href="testparm.1.html"><span class="citerefentry"><span class="refentrytitle">testparm</span>(1)</span></a> to check the default on your system.</p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="DOSFILEMODE"></a>dos filemode (S)</span></dt><dd><p> The default behavior in Samba is to provide
     1518        case it is not available. Run <a class="citerefentry" href="testparm.1.html"><span class="citerefentry"><span class="refentrytitle">testparm</span>(1)</span></a> to check the default on your system.</p><p><span class="emphasis"><em>No default</em></span></p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331596"></a>
     1519
     1520dos filemode (S)
     1521</h3></div></div></div><a class="indexterm" name="id331597"></a><a name="DOSFILEMODE"></a><div class="variablelist"><dl><dt></dt><dd><p> The default behavior in Samba is to provide
    12931522        UNIX-like behavior where only the owner of a file/directory is
    12941523        able to change the permissions on it.  However, this behavior
    … …  
    13001529        Ownership of the file/directory may also be changed.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>dos filemode</code></em> = <code class="literal">no</code>
    13011530</em></span>
    1302 </p></dd><dt><span class="term"><a name="DOSFILETIMERESOLUTION"></a>dos filetime resolution (S)</span></dt><dd><p>Under the DOS and Windows FAT filesystem, the finest
     1531</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331637"></a>
     1532
     1533dos filetime resolution (S)
     1534</h3></div></div></div><a class="indexterm" name="id331638"></a><a name="DOSFILETIMERESOLUTION"></a><div class="variablelist"><dl><dt></dt><dd><p>Under the DOS and Windows FAT filesystem, the finest
    13031535        granularity on time resolution is two seconds. Setting this parameter
    13041536        for a share causes Samba to round the reported time down to the
    13051537        nearest two second boundary when a query call that requires one second
    1306         resolution is made to <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>.</p><p>This option is mainly used as a compatibility option for Visual
     1538        resolution is made to <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>.</p><p>This option is mainly used as a compatibility option for Visual
    13071539        C++ when used against Samba shares. If oplocks are enabled on a
    13081540        share, Visual C++ uses two different time reading calls to check if a
    … …  
    13151547        happy.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>dos filetime resolution</code></em> = <code class="literal">no</code>
    13161548</em></span>
    1317 </p></dd><dt><span class="term"><a name="DOSFILETIMES"></a>dos filetimes (S)</span></dt><dd><p>Under DOS and Windows, if a user can write to a
     1549</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331693"></a>
     1550
     1551dos filetimes (S)
     1552</h3></div></div></div><a class="indexterm" name="id331694"></a><a name="DOSFILETIMES"></a><div class="variablelist"><dl><dt></dt><dd><p>Under DOS and Windows, if a user can write to a
    13181553        file they can change the timestamp on it. Under POSIX semantics,
    13191554        only the owner of the file or root may change the timestamp. By
    … …  
    13211556        timestamp on a file if the user <code class="literal">smbd</code> is acting
    13221557        on behalf of is not the file owner. Setting this option to <code class="constant">
    1323         yes</code> allows DOS semantics and <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will change the file
     1558        yes</code> allows DOS semantics and <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will change the file
    13241559        timestamp as DOS requires. Due to changes in Microsoft Office 2000 and beyond,
    13251560        the default for this parameter has been changed from "no" to "yes" in Samba 3.0.14
    … …  
    13291564        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>dos filetimes</code></em> = <code class="literal">yes</code>
    13301565</em></span>
    1331 </p></dd><dt><span class="term"><a name="EASUPPORT"></a>ea support (S)</span></dt><dd><p>This boolean parameter controls whether <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will allow clients to attempt to store OS/2 style Extended
     1566</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331752"></a>
     1567
     1568ea support (S)
     1569</h3></div></div></div><a class="indexterm" name="id331753"></a><a name="EASUPPORT"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean parameter controls whether <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will allow clients to attempt to store OS/2 style Extended
    13321570    attributes on a share. In order to enable this parameter the underlying filesystem exported by
    13331571    the share must support extended attributes (such as provided on XFS and EXT3 on Linux, with the
    … …  
    13361574                extended attributes must be compiled into the Linux kernel.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ea support</code></em> = <code class="literal">no</code>
    13371575</em></span>
    1338 </p></dd><dt><span class="term"><a name="ENABLEASUSUPPORT"></a>enable asu support (G)</span></dt><dd><p>Hosts running the "Advanced Server for Unix (ASU)" product
     1576</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331800"></a>
     1577
     1578enable asu support (G)
     1579</h3></div></div></div><a class="indexterm" name="id331801"></a><a name="ENABLEASUSUPPORT"></a><div class="variablelist"><dl><dt></dt><dd><p>Hosts running the "Advanced Server for Unix (ASU)" product
    13391580    require some special accomodations such as creating a builting [ADMIN$]
    13401581    share that only supports IPC connections.  The has been the default
    … …  
    13441585    an [ADMIN$] file share in smb.conf.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>enable asu support</code></em> = <code class="literal">no</code>
    13451586</em></span>
    1346 </p></dd><dt><span class="term"><a name="ENABLEPRIVILEGES"></a>enable privileges (G)</span></dt><dd><p>
     1587</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331841"></a>
     1588
     1589enable privileges (G)
     1590</h3></div></div></div><a class="indexterm" name="id331842"></a><a name="ENABLEPRIVILEGES"></a><div class="variablelist"><dl><dt></dt><dd><p>
    13471591        This parameter controls whether or not smbd will honor privileges assigned to specific SIDs via either
    13481592         <code class="literal">net rpc rights</code> or one of the Windows user and group manager tools.  This parameter is
    … …  
    13571601        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>enable privileges</code></em> = <code class="literal">yes</code>
    13581602</em></span>
    1359 </p></dd><dt><span class="term"><a name="ENCRYPTPASSWORDS"></a>encrypt passwords (G)</span></dt><dd><p>This boolean controls whether encrypted passwords
     1603</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331896"></a>
     1604
     1605encrypt passwords (G)
     1606</h3></div></div></div><a class="indexterm" name="id331897"></a><a name="ENCRYPTPASSWORDS"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean controls whether encrypted passwords
    13601607    will be negotiated with the client. Note that Windows NT 4.0 SP3 and
    13611608    above and also Windows 98 will by default expect encrypted passwords
    … …  
    13741621    plain text passwords you must set this parameter to no.
    13751622    </p><p>In order for encrypted passwords to work correctly
    1376     <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> must either
    1377     have access to a local <a href="smbpasswd.5.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(5)</span></a> file (see the <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a> program for information on how to set up
    1378     and maintain this file), or set the <a class="indexterm" name="id308038"></a>security = [server|domain|ads] parameter which
     1623    <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> must either
     1624    have access to a local <a class="citerefentry" href="smbpasswd.5.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(5)</span></a> file (see the <a class="citerefentry" href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a> program for information on how to set up
     1625    and maintain this file), or set the <a class="link" href="smb.conf.5.html#SECURITY">security = [server|domain|ads]</a> parameter which
    13791626    causes <code class="literal">smbd</code> to authenticate against another
    13801627        server.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>encrypt passwords</code></em> = <code class="literal">yes</code>
    13811628</em></span>
    1382 </p></dd><dt><span class="term"><a name="ENHANCEDBROWSING"></a>enhanced browsing (G)</span></dt><dd><p>This option enables a couple of enhancements to
     1629</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331987"></a>
     1630
     1631enhanced browsing (G)
     1632</h3></div></div></div><a class="indexterm" name="id331988"></a><a name="ENHANCEDBROWSING"></a><div class="variablelist"><dl><dt></dt><dd><p>This option enables a couple of enhancements to
    13831633        cross-subnet browse propagation that have been added in Samba
    13841634        but which are not standard in Microsoft implementations. 
    … …  
    13931643        cross-subnet browse propagation much more reliable.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>enhanced browsing</code></em> = <code class="literal">yes</code>
    13941644</em></span>
    1395 </p></dd><dt><span class="term"><a name="ENUMPORTSCOMMAND"></a>enumports command (G)</span></dt><dd><p>The concept of a "port" is fairly foreign
     1645</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332041"></a>
     1646
     1647enumports command (G)
     1648</h3></div></div></div><a class="indexterm" name="id332042"></a><a name="ENUMPORTSCOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>The concept of a "port" is fairly foreign
    13961649    to UNIX hosts.  Under Windows NT/2000 print servers, a port
    13971650    is associated with a port monitor and generally takes the form of
    … …  
    14101663</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>enumports command</code></em> = <code class="literal">/usr/bin/listports</code>
    14111664</em></span>
    1412 </p></dd><dt><span class="term"><a name="EVENTLOGLIST"></a>eventlog list (G)</span></dt><dd><p>This option defines a list of log names that Samba will
     1665</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332116"></a>
     1666
     1667eventlog list (G)
     1668</h3></div></div></div><a class="indexterm" name="id332117"></a><a name="EVENTLOGLIST"></a><div class="variablelist"><dl><dt></dt><dd><p>This option defines a list of log names that Samba will
    14131669    report to the Microsoft EventViewer utility.  The listed
    14141670    eventlogs will be associated with tdb file on disk in the
    … …  
    14231679</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>eventlog list</code></em> = <code class="literal">Security Application Syslog Apache</code>
    14241680</em></span>
    1425 </p></dd><dt><span class="term"><a name="FAKEDIRECTORYCREATETIMES"></a>fake directory create times (S)</span></dt><dd><p>NTFS and Windows VFAT file systems keep a create
     1681</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332185"></a>
     1682
     1683fake directory create times (S)
     1684</h3></div></div></div><a class="indexterm" name="id332186"></a><a name="FAKEDIRECTORYCREATETIMES"></a><div class="variablelist"><dl><dt></dt><dd><p>NTFS and Windows VFAT file systems keep a create
    14261685        time for all files and directories. This is not the same as the
    14271686        ctime - status change time - that Unix keeps, so Samba by default
    … …  
    14451704        will proceed as expected.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>fake directory create times</code></em> = <code class="literal">no</code>
    14461705</em></span>
    1447 </p></dd><dt><span class="term"><a name="FAKEOPLOCKS"></a>fake oplocks (S)</span></dt><dd><p>Oplocks are the way that SMB clients get permission
     1706</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332240"></a>
     1707
     1708fake oplocks (S)
     1709</h3></div></div></div><a class="indexterm" name="id332241"></a><a name="FAKEOPLOCKS"></a><div class="variablelist"><dl><dt></dt><dd><p>Oplocks are the way that SMB clients get permission
    14481710        from a server to locally cache file operations. If a server grants
    14491711        an oplock (opportunistic lock) then the client is free to assume
    … …  
    14511713        cache file data. With some oplock types the client may even cache
    14521714        file open/close operations. This can give enormous performance benefits.
    1453         </p><p>When you set <code class="literal">fake oplocks = yes</code>, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will
    1454         always grant oplock requests no matter how many clients are using the file.</p><p>It is generally much better to use the real <a class="indexterm" name="id308378"></a>oplocks support rather
     1715        </p><p>When you set <code class="literal">fake oplocks = yes</code>, <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will
     1716        always grant oplock requests no matter how many clients are using the file.</p><p>It is generally much better to use the real <a class="link" href="smb.conf.5.html#OPLOCKS">oplocks</a> support rather
    14551717        than this parameter.</p><p>If you enable this option on all read-only shares or
    14561718        shares that you know will only be accessed from one client at a
    … …  
    14611723        this option carefully!</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>fake oplocks</code></em> = <code class="literal">no</code>
    14621724</em></span>
    1463 </p></dd><dt><span class="term"><a name="FOLLOWSYMLINKS"></a>follow symlinks (S)</span></dt><dd><p>
    1464         This parameter allows the Samba administrator to stop <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>    from following symbolic links in a particular share. Setting this
     1725</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332314"></a>
     1726
     1727follow symlinks (S)
     1728</h3></div></div></div><a class="indexterm" name="id332315"></a><a name="FOLLOWSYMLINKS"></a><div class="variablelist"><dl><dt></dt><dd><p>
     1729        This parameter allows the Samba administrator to stop <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>       from following symbolic links in a particular share. Setting this
    14651730        parameter to <code class="constant">no</code> prevents any file or directory that is a symbolic link from being
    14661731        followed (the user will get an  error).  This option is very useful to stop users from adding a symbolic
    … …  
    14711736        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>follow symlinks</code></em> = <code class="literal">yes</code>
    14721737</em></span>
    1473 </p></dd><dt><span class="term"><a name="FORCECREATEMODE"></a>force create mode (S)</span></dt><dd><p>This parameter specifies a set of UNIX mode bit
     1738</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332379"></a>
     1739
     1740force create mode (S)
     1741</h3></div></div></div><a class="indexterm" name="id332380"></a><a name="FORCECREATEMODE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies a set of UNIX mode bit
    14741742    permissions that will <span class="emphasis"><em>always</em></span> be set on a
    14751743    file created by Samba. This is done by bitwise 'OR'ing these bits onto
    … …  
    14841752</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>force create mode</code></em> = <code class="literal">0755</code>
    14851753</em></span>
    1486 </p></dd><dt><span class="term"><a name="FORCEDIRECTORYMODE"></a>force directory mode (S)</span></dt><dd><p>This parameter specifies a set of UNIX mode bit
     1754</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332448"></a>
     1755
     1756force directory mode (S)
     1757</h3></div></div></div><a class="indexterm" name="id332450"></a><a name="FORCEDIRECTORYMODE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies a set of UNIX mode bit
    14871758    permissions that will <span class="emphasis"><em>always</em></span> be set on a directory
    14881759    created by Samba. This is done by bitwise 'OR'ing these bits onto the
    … …  
    14971768</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>force directory mode</code></em> = <code class="literal">0755</code>
    14981769</em></span>
    1499 </p></dd><dt><span class="term"><a name="FORCEDIRECTORYSECURITYMODE"></a>force directory security mode (S)</span></dt><dd><p>
     1770</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332518"></a>
     1771
     1772force directory security mode (S)
     1773</h3></div></div></div><a class="indexterm" name="id332519"></a><a name="FORCEDIRECTORYSECURITYMODE"></a><div class="variablelist"><dl><dt></dt><dd><p>
    15001774        This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating
    15011775        the UNIX permission on a directory using the native NT security dialog box.
    15021776        </p><p>
    15031777        This parameter is applied as a mask (OR'ed with) to the changed permission bits, thus forcing any bits in this
    1504         mask that the user may have modified to be on.  Make sure not to mix up this parameter with <a class="indexterm" name="id308652"></a>directory security mask, which works in a similar manner to this one, but uses a logical AND instead
     1778        mask that the user may have modified to be on.  Make sure not to mix up this parameter with <a class="link" href="smb.conf.5.html#DIRECTORYSECURITYMASK">directory security mask</a>, which works in a similar manner to this one, but uses a logical AND instead
    15051779        of an OR.
    15061780        </p><p>
    … …  
    15181792</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>force directory security mode</code></em> = <code class="literal">700</code>
    15191793</em></span>
    1520 </p></dd><dt><span class="term"><a name="GROUP"></a>group</span></dt><dd><p>This parameter is a synonym for force group.</p></dd><dt><span class="term"><a name="FORCEGROUP"></a>force group (S)</span></dt><dd><p>This specifies a UNIX group name that will be
     1794</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332602"></a><a name="GROUP"></a>group</h3></div></div></div><a class="indexterm" name="id332603"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#FORCEGROUP">force group</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332627"></a>
     1795
     1796force group (S)
     1797</h3></div></div></div><a class="indexterm" name="id332628"></a><a name="FORCEGROUP"></a><div class="variablelist"><dl><dt></dt><dd><p>This specifies a UNIX group name that will be
    15211798    assigned as the default primary group for all users connecting
    15221799    to this service. This is useful for sharing files by ensuring
    … …  
    15361813    primary group assigned to sys when accessing this Samba share. All
    15371814    other users will retain their ordinary primary group.</p><p>
    1538         If the <a class="indexterm" name="id308775"></a>force user parameter is also set the group specified in
     1815        If the <a class="link" href="smb.conf.5.html#FORCEUSER">force user</a> parameter is also set the group specified in
    15391816    <em class="parameter"><code>force group</code></em> will override the primary group
    15401817    set in <em class="parameter"><code>force user</code></em>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>force group</code></em> = <code class="literal"></code>
    … …  
    15421819</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>force group</code></em> = <code class="literal">agroup</code>
    15431820</em></span>
    1544 </p></dd><dt><span class="term"><a name="FORCEPRINTERNAME"></a>force printername (S)</span></dt><dd><p>When printing from Windows NT (or later),
     1821</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332718"></a>
     1822
     1823force printername (S)
     1824</h3></div></div></div><a class="indexterm" name="id332719"></a><a name="FORCEPRINTERNAME"></a><div class="variablelist"><dl><dt></dt><dd><p>When printing from Windows NT (or later),
    15451825    each printer in <code class="filename">smb.conf</code> has two
    15461826    associated names which can be used by the client.  The first
    … …  
    15651845    folder.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>force printername</code></em> = <code class="literal">no</code>
    15661846</em></span>
    1567 </p></dd><dt><span class="term"><a name="FORCESECURITYMODE"></a>force security mode (S)</span></dt><dd><p>
     1847</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332792"></a>
     1848
     1849force security mode (S)
     1850</h3></div></div></div><a class="indexterm" name="id332793"></a><a name="FORCESECURITYMODE"></a><div class="variablelist"><dl><dt></dt><dd><p>
    15681851        This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating
    15691852    the UNIX permission on a file using the native NT security dialog box.
    15701853        </p><p>
    15711854        This parameter is applied as a mask (OR'ed with) to the changed permission bits, thus forcing any bits in this
    1572         mask that the user may have modified to be on.  Make sure not to mix up this parameter with <a class="indexterm" name="id308932"></a>security mask, which works similar like this one but uses logical AND instead of OR.
     1855        mask that the user may have modified to be on.  Make sure not to mix up this parameter with <a class="link" href="smb.conf.5.html#SECURITYMASK">security mask</a>, which works similar like this one but uses logical AND instead of OR.
    15731856        </p><p>
    15741857        Essentially, one bits in this mask may be treated as a set of bits that, when modifying security on a file,
    … …  
    15851868</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>force security mode</code></em> = <code class="literal">700</code>
    15861869</em></span>
    1587 </p></dd><dt><span class="term"><a name="FORCEUNKNOWNACLUSER"></a>force unknown acl user (S)</span></dt><dd><p>
     1870</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332876"></a>
     1871
     1872force unknown acl user (S)
     1873</h3></div></div></div><a class="indexterm" name="id332877"></a><a name="FORCEUNKNOWNACLUSER"></a><div class="variablelist"><dl><dt></dt><dd><p>
    15881874    If this parameter is set, a Windows NT ACL that contains an unknown SID (security descriptor, or
    15891875    representation of a user or group id) as the owner or group owner of the file will be silently
    … …  
    15991885    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>force unknown acl user</code></em> = <code class="literal">no</code>
    16001886</em></span>
    1601 </p></dd><dt><span class="term"><a name="FORCEUSER"></a>force user (S)</span></dt><dd><p>This specifies a UNIX user name that will be
     1887</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332929"></a>
     1888
     1889force user (S)
     1890</h3></div></div></div><a class="indexterm" name="id332930"></a><a name="FORCEUSER"></a><div class="variablelist"><dl><dt></dt><dd><p>This specifies a UNIX user name that will be
    16021891    assigned as the default user for all users connecting to this service.
    16031892    This is useful for sharing files. You should also use it carefully
    … …  
    16131902</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>force user</code></em> = <code class="literal">auser</code>
    16141903</em></span>
    1615 </p></dd><dt><span class="term"><a name="FSTYPE"></a>fstype (S)</span></dt><dd><p>
     1904</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id332994"></a>
     1905
     1906fstype (S)
     1907</h3></div></div></div><a class="indexterm" name="id332995"></a><a name="FSTYPE"></a><div class="variablelist"><dl><dt></dt><dd><p>
    16161908        This parameter allows the administrator to configure the string that specifies the type of filesystem a share
    1617         is using that is reported by <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>
     1909        is using that is reported by <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>
    16181910        when a client queries the filesystem type for a share. The default type is <code class="constant">NTFS</code> for compatibility
    16191911        with Windows NT but this can be changed to other strings such as <code class="constant">Samba</code> or <code class="constant">FAT</code>
    … …  
    16231915</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>fstype</code></em> = <code class="literal">Samba</code>
    16241916</em></span>
    1625 </p></dd><dt><span class="term"><a name="GETQUOTACOMMAND"></a>get quota command (G)</span></dt><dd><p>The <code class="literal">get quota command</code> should only be used
     1917</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333067"></a>
     1918
     1919get quota command (G)
     1920</h3></div></div></div><a class="indexterm" name="id333068"></a><a name="GETQUOTACOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>The <code class="literal">get quota command</code> should only be used
    16261921        whenever there is no operating system API available from the OS that
    16271922        samba can use.</p><p>This option is only available with <code class="literal">./configure --with-sys-quotas</code>.
    … …  
    16351930</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>get quota command</code></em> = <code class="literal">/usr/local/sbin/query_quota</code>
    16361931</em></span>
    1637 </p></dd><dt><span class="term"><a name="GETWDCACHE"></a>getwd cache (G)</span></dt><dd><p>This is a tuning option. When this is enabled a
     1932</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333230"></a>
     1933
     1934getwd cache (G)
     1935</h3></div></div></div><a class="indexterm" name="id333231"></a><a name="GETWDCACHE"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a tuning option. When this is enabled a
    16381936    caching algorithm will be used to reduce the time taken for getwd()
    16391937    calls. This can have a significant impact on performance, especially
    1640     when the <a class="indexterm" name="id309382"></a>wide smbconfoptions parameter is set to <code class="constant">no</code>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>getwd cache</code></em> = <code class="literal">yes</code>
    1641 </em></span>
    1642 </p></dd><dt><span class="term"><a name="GUESTACCOUNT"></a>guest account (G)</span></dt><dd><p>This is a username which will be used for access
    1643     to services which are specified as <a class="indexterm" name="id309432"></a>guest ok (see below). Whatever privileges this
     1938    when the <a class="link" href="smb.conf.5.html#WIDESMBCONFOPTIONS">wide smbconfoptions</a> parameter is set to <code class="constant">no</code>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>getwd cache</code></em> = <code class="literal">yes</code>
     1939</em></span>
     1940</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333279"></a>
     1941
     1942guest account (G)
     1943</h3></div></div></div><a class="indexterm" name="id333280"></a><a name="GUESTACCOUNT"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a username which will be used for access
     1944    to services which are specified as <a class="link" href="smb.conf.5.html#GUESTOK">guest ok</a> (see below). Whatever privileges this
    16441945    user has will be available to any client connecting to the guest service.
    16451946    This user must exist in the password file, but does not require
    … …  
    16581959</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>guest account</code></em> = <code class="literal">ftp</code>
    16591960</em></span>
    1660 </p></dd><dt><span class="term"><a name="PUBLIC"></a>public</span></dt><dd><p>This parameter is a synonym for guest ok.</p></dd><dt><span class="term"><a name="GUESTOK"></a>guest ok (S)</span></dt><dd><p>If this parameter is <code class="constant">yes</code> for
     1961</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333368"></a><a name="PUBLIC"></a>public</h3></div></div></div><a class="indexterm" name="id333369"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#GUESTOK">guest ok</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333393"></a>
     1962
     1963guest ok (S)
     1964</h3></div></div></div><a class="indexterm" name="id333394"></a><a name="GUESTOK"></a><div class="variablelist"><dl><dt></dt><dd><p>If this parameter is <code class="constant">yes</code> for
    16611965    a service, then no password is required to connect to the service.
    1662     Privileges will be those of the <a class="indexterm" name="id309550"></a>guest account.</p><p>This paramater nullifies the benifits of setting
    1663     <a class="indexterm" name="id309561"></a>restrict anonymous = 2
    1664         </p><p>See the section below on <a class="indexterm" name="id309572"></a>security for more information about this option.
     1966    Privileges will be those of the <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account</a>.</p><p>This paramater nullifies the benifits of setting
     1967    <a class="link" href="smb.conf.5.html#RESTRICTANONYMOUS">restrict anonymous = 2</a>
     1968        </p><p>See the section below on <a class="link" href="smb.conf.5.html#SECURITY">security</a> for more information about this option.
    16651969        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>guest ok</code></em> = <code class="literal">no</code>
    16661970</em></span>
    1667 </p></dd><dt><span class="term"><a name="ONLYGUEST"></a>only guest</span></dt><dd><p>This parameter is a synonym for guest only.</p></dd><dt><span class="term"><a name="GUESTONLY"></a>guest only (S)</span></dt><dd><p>If this parameter is <code class="constant">yes</code> for
     1971</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333462"></a><a name="ONLYGUEST"></a>only guest</h3></div></div></div><a class="indexterm" name="id333463"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#GUESTONLY">guest only</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333487"></a>
     1972
     1973guest only (S)
     1974</h3></div></div></div><a class="indexterm" name="id333488"></a><a name="GUESTONLY"></a><div class="variablelist"><dl><dt></dt><dd><p>If this parameter is <code class="constant">yes</code> for
    16681975    a service, then only guest connections to the service are permitted.
    1669     This parameter will have no effect if <a class="indexterm" name="id309642"></a>guest ok is not set for the service.</p><p>See the section below on <a class="indexterm" name="id309653"></a>security for more information about this option.
     1976    This parameter will have no effect if <a class="link" href="smb.conf.5.html#GUESTOK">guest ok</a> is not set for the service.</p><p>See the section below on <a class="link" href="smb.conf.5.html#SECURITY">security</a> for more information about this option.
    16701977        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>guest only</code></em> = <code class="literal">no</code>
    16711978</em></span>
    1672 </p></dd><dt><span class="term"><a name="HIDEDOTFILES"></a>hide dot files (S)</span></dt><dd><p>This is a boolean parameter that controls whether
     1979</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333546"></a>
     1980
     1981hide dot files (S)
     1982</h3></div></div></div><a class="indexterm" name="id333547"></a><a name="HIDEDOTFILES"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a boolean parameter that controls whether
    16731983        files starting with a dot appear as hidden files.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>hide dot files</code></em> = <code class="literal">yes</code>
    16741984</em></span>
    1675 </p></dd><dt><span class="term"><a name="HIDEFILES"></a>hide files (S)</span></dt><dd><p>This is a list of files or directories that are not
     1985</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333584"></a>
     1986
     1987hide files (S)
     1988</h3></div></div></div><a class="indexterm" name="id333585"></a><a name="HIDEFILES"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a list of files or directories that are not
    16761989        visible but are accessible.  The DOS 'hidden' attribute is applied
    16771990        to any files or directories that match.</p><p>Each entry in the list must be separated by a '/',
    … …  
    16841997        as they are scanned.</p><p>
    16851998        The example shown above is based on files that the Macintosh
    1686         SMB client (DAVE) available from <a href="http://www.thursby.com" target="_top">
     1999        SMB client (DAVE) available from <a class="ulink" href="http://www.thursby.com" target="_top">
    16872000        Thursby</a> creates for internal use, and also still hides
    16882001        all files beginning with a dot.
    … …  
    16952008# no file are hidden</code>
    16962009</em></span>
    1697 </p></dd><dt><span class="term"><a name="HIDESPECIALFILES"></a>hide special files (S)</span></dt><dd><p>
     2010</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333659"></a>
     2011
     2012hide special files (S)
     2013</h3></div></div></div><a class="indexterm" name="id333660"></a><a name="HIDESPECIALFILES"></a><div class="variablelist"><dl><dt></dt><dd><p>
    16982014        This parameter prevents clients from seeing special files such as sockets, devices and
    16992015        fifo's in directory listings.
    17002016        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>hide special files</code></em> = <code class="literal">no</code>
    17012017</em></span>
    1702 </p></dd><dt><span class="term"><a name="HIDEUNREADABLE"></a>hide unreadable (S)</span></dt><dd><p>This parameter prevents clients from seeing the
     2018</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333697"></a>
     2019
     2020hide unreadable (S)
     2021</h3></div></div></div><a class="indexterm" name="id333698"></a><a name="HIDEUNREADABLE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter prevents clients from seeing the
    17032022                existance of files that cannot be read. Defaults to off.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>hide unreadable</code></em> = <code class="literal">no</code>
    17042023</em></span>
    1705 </p></dd><dt><span class="term"><a name="HIDEUNWRITEABLEFILES"></a>hide unwriteable files (S)</span></dt><dd><p>
     2024</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333735"></a>
     2025
     2026hide unwriteable files (S)
     2027</h3></div></div></div><a class="indexterm" name="id333736"></a><a name="HIDEUNWRITEABLEFILES"></a><div class="variablelist"><dl><dt></dt><dd><p>
    17062028    This parameter prevents clients from seeing the existance of files that cannot be written to.
    17072029    Defaults to off. Note that unwriteable directories are shown as usual.
    17082030    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>hide unwriteable files</code></em> = <code class="literal">no</code>
    17092031</em></span>
    1710 </p></dd><dt><span class="term"><a name="HOMEDIRMAP"></a>homedir map (G)</span></dt><dd><p>
    1711         If <a class="indexterm" name="id309932"></a>nis homedir is <code class="constant">yes</code>, and <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> is also acting         as a Win95/98 <em class="parameter"><code>logon server</code></em>
     2032</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333773"></a>
     2033
     2034homedir map (G)
     2035</h3></div></div></div><a class="indexterm" name="id333774"></a><a name="HOMEDIRMAP"></a><div class="variablelist"><dl><dt></dt><dd><p>
     2036        If <a class="link" href="smb.conf.5.html#NISHOMEDIR">nis homedir</a> is <code class="constant">yes</code>, and <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> is also acting       as a Win95/98 <em class="parameter"><code>logon server</code></em>
    17122037        then this parameter specifies the NIS (or YP) map from which the server for the user's  home directory should be extracted. 
    17132038        At present, only the Sun auto.home map format is understood. The form of the map is:
    … …  
    17232048</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>homedir map</code></em> = <code class="literal">amd.homedir</code>
    17242049</em></span>
    1725 </p></dd><dt><span class="term"><a name="HOSTMSDFS"></a>host msdfs (G)</span></dt><dd><p>
     2050</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333870"></a>
     2051
     2052host msdfs (G)
     2053</h3></div></div></div><a class="indexterm" name="id333871"></a><a name="HOSTMSDFS"></a><div class="variablelist"><dl><dt></dt><dd><p>
    17262054        If set to <code class="constant">yes</code>, Samba will act as a Dfs server, and allow Dfs-aware clients to browse
    17272055        Dfs trees hosted on the server.
    17282056        </p><p>
    1729         See also the <a class="indexterm" name="id310039"></a>msdfs root share  level  parameter.  For more  information  on
     2057        See also the <a class="link" href="smb.conf.5.html#MSDFSROOT">msdfs root</a> share  level  parameter.  For more  information  on
    17302058        setting  up a Dfs tree on Samba, refer to the MSFDS chapter in the book Samba3-HOWTO.
    17312059        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>host msdfs</code></em> = <code class="literal">yes</code>
    17322060</em></span>
    1733 </p></dd><dt><span class="term"><a name="HOSTNAMELOOKUPS"></a>hostname lookups (G)</span></dt><dd><p>Specifies whether samba should use (expensive)
     2061</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id333932"></a>
     2062
     2063hostname lookups (G)
     2064</h3></div></div></div><a class="indexterm" name="id333933"></a><a name="HOSTNAMELOOKUPS"></a><div class="variablelist"><dl><dt></dt><dd><p>Specifies whether samba should use (expensive)
    17342065    hostname lookups or use the ip addresses instead. An example place
    17352066    where hostname lookups are currently used is when checking
    … …  
    17392070</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>hostname lookups</code></em> = <code class="literal">yes</code>
    17402071</em></span>
    1741 </p></dd><dt><span class="term"><a name="ALLOWHOSTS"></a>allow hosts</span></dt><dd><p>This parameter is a synonym for hosts allow.</p></dd><dt><span class="term"><a name="HOSTSALLOW"></a>hosts allow (S)</span></dt><dd><p>A synonym for this parameter is <a class="indexterm" name="id310176"></a>allow hosts.</p><p>This parameter is a comma, space, or tab delimited
     2072</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334002"></a><a name="ALLOWHOSTS"></a>allow hosts</h3></div></div></div><a class="indexterm" name="id334003"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#HOSTSALLOW">hosts allow</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334033"></a>
     2073
     2074hosts allow (S)
     2075</h3></div></div></div><a class="indexterm" name="id334034"></a><a name="HOSTSALLOW"></a><div class="variablelist"><dl><dt></dt><dd><p>A synonym for this parameter is <a class="link" href="smb.conf.5.html#ALLOWHOSTS">allow hosts</a>.</p><p>This parameter is a comma, space, or tab delimited
    17422076    set of hosts which are permitted to access a service.</p><p>If specified in the [global] section then it will
    17432077    apply to all services, regardless of whether the individual
    … …  
    17492083    page may not be present on your system, so a brief description will
    17502084    be given here also.</p><p>Note that the localhost address 127.0.0.1 will always
    1751     be allowed access unless specifically denied by a <a class="indexterm" name="id310214"></a>hosts deny option.</p><p>You can also specify hosts by network/netmask pairs and
     2085    be allowed access unless specifically denied by a <a class="link" href="smb.conf.5.html#HOSTSDENY">hosts deny</a> option.</p><p>You can also specify hosts by network/netmask pairs and
    17522086    by netgroup names if your system supports netgroups. The
    17532087    <span class="emphasis"><em>EXCEPT</em></span> keyword can also be used to limit a
    17542088    wildcard list. The following examples may provide some help:</p><p>Example 1: allow all IPs in 150.203.*.*; except one</p><p><code class="literal">hosts allow = 150.203. EXCEPT 150.203.6.66</code></p><p>Example 2: allow hosts that match the given network/netmask</p><p><code class="literal">hosts allow = 150.203.15.0/255.255.255.0</code></p><p>Example 3: allow a couple of hosts</p><p><code class="literal">hosts allow = lapland, arvidsjaur</code></p><p>Example 4: allow only hosts in NIS netgroup "foonet", but
    1755     deny access from one particular host</p><p><code class="literal">hosts allow = @foonet</code></p><p><code class="literal">hosts deny = pirate</code></p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Note that access still requires suitable user-level passwords.</p></div><p>See <a href="testparm.1.html"><span class="citerefentry"><span class="refentrytitle">testparm</span>(1)</span></a> for a way of testing your host access
     2089    deny access from one particular host</p><p><code class="literal">hosts allow = @foonet</code></p><p><code class="literal">hosts deny = pirate</code></p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Note that access still requires suitable user-level passwords.</p></div><p>See <a class="citerefentry" href="testparm.1.html"><span class="citerefentry"><span class="refentrytitle">testparm</span>(1)</span></a> for a way of testing your host access
    17562090    to see if it does what you expect.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>hosts allow</code></em> = <code class="literal">
    17572091# none (i.e., all hosts permitted access)</code>
    … …  
    17592093</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>hosts allow</code></em> = <code class="literal">150.203.5. myhost.mynet.edu.au</code>
    17602094</em></span>
    1761 </p></dd><dt><span class="term"><a name="DENYHOSTS"></a>deny hosts</span></dt><dd><p>This parameter is a synonym for hosts deny.</p></dd><dt><span class="term"><a name="HOSTSDENY"></a>hosts deny (S)</span></dt><dd><p>The opposite of <em class="parameter"><code>hosts allow</code></em>
     2095</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334221"></a><a name="DENYHOSTS"></a>deny hosts</h3></div></div></div><a class="indexterm" name="id334222"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#HOSTSDENY">hosts deny</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334251"></a>
     2096
     2097hosts deny (S)
     2098</h3></div></div></div><a class="indexterm" name="id334252"></a><a name="HOSTSDENY"></a><div class="variablelist"><dl><dt></dt><dd><p>The opposite of <em class="parameter"><code>hosts allow</code></em>
    17622099    - hosts listed here are <span class="emphasis"><em>NOT</em></span> permitted access to
    17632100    services unless the specific services have their own lists to override
    … …  
    17662103        In the event that it is necessary to deny all by default, use the keyword
    17672104        ALL (or the netmask <code class="literal">0.0.0.0/0</code>) and then explicitly specify
    1768         to the <a class="indexterm" name="id310401"></a>hosts allow = hosts allow parameter those hosts
     2105        to the <a class="link" href="smb.conf.5.html#HOSTSALLOW">hosts allow = hosts allow</a> parameter those hosts
    17692106        that should be permitted access.
    17702107        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>hosts deny</code></em> = <code class="literal">
    … …  
    17732110</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>hosts deny</code></em> = <code class="literal">150.203.4. badhost.mynet.edu.au</code>
    17742111</em></span>
    1775 </p></dd><dt><span class="term"><a name="IDMAPALLOCBACKEND"></a>idmap alloc backend (G)</span></dt><dd><p>
     2112</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334347"></a>
     2113
     2114idmap alloc backend (G)
     2115</h3></div></div></div><a class="indexterm" name="id334348"></a><a name="IDMAPALLOCBACKEND"></a><div class="variablelist"><dl><dt></dt><dd><p>
    17762116        The idmap alloc backend provides a plugin interface for Winbind to use
    17772117        when allocating Unix uids/gids for Windows SIDs.  This option is
    1778         to be used in conjunction with the <a class="indexterm" name="id310466"></a>idmap domains
     2118        to be used in conjunction with the <a class="link" href="smb.conf.5.html#IDMAPDOMAINS">idmap domains</a>
    17792119        parameter and refers to the name of the idmap module which will provide
    17802120        the id allocation functionality.  Please refer to the man page
    17812121        for each idmap plugin to determine whether or not the module implements
    1782         the allocation feature.  The most common plugins are the tdb (<a href="idmap_tdb.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_tdb</span>(8)</span></a>)
    1783         and ldap (<a href="idmap_ldap.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_ldap</span>(8)</span></a>) libraries.
    1784         </p><p>Also refer to the <a class="indexterm" name="id310495"></a>idmap alloc config option.
     2122        the allocation feature.  The most common plugins are the tdb (<a class="citerefentry" href="idmap_tdb.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_tdb</span>(8)</span></a>)
     2123        and ldap (<a class="citerefentry" href="idmap_ldap.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_ldap</span>(8)</span></a>) libraries.
     2124        </p><p>Also refer to the <a class="link" href="smb.conf.5.html#IDMAPALLOCCONFIG">idmap alloc config</a> option.
    17852125        </p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>idmap alloc backend</code></em> = <code class="literal">tdb</code>
    17862126</em></span>
    1787 </p></dd><dt><span class="term"><a name="IDMAPALLOCCONFIG"></a>idmap alloc config (G)</span></dt><dd><p>
     2127</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334438"></a>
     2128
     2129idmap alloc config (G)
     2130</h3></div></div></div><a class="indexterm" name="id334439"></a><a name="IDMAPALLOCCONFIG"></a><div class="variablelist"><dl><dt></dt><dd><p>
    17882131        The idmap alloc config prefix provides a means of managing settings
    1789         for the backend defined by the <a class="indexterm" name="id310546"></a>idmap alloc backend
     2132        for the backend defined by the <a class="link" href="smb.conf.5.html#IDMAPALLOCBACKEND">idmap alloc backend</a>
    17902133        parameter.  Refer to the man page for each idmap plugin regarding
    17912134        specific configuration details.
    1792         </p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="IDMAPBACKEND"></a>idmap backend (G)</span></dt><dd><p>
     2135        </p><p><span class="emphasis"><em>No default</em></span></p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334478"></a>
     2136
     2137idmap backend (G)
     2138</h3></div></div></div><a class="indexterm" name="id334479"></a><a name="IDMAPBACKEND"></a><div class="variablelist"><dl><dt></dt><dd><p>
    17932139        The idmap backend provides a plugin interface for Winbind to use
    17942140        varying backends to store SID/uid/gid mapping tables.  This
    17952141        option is mutually exclusive with the newer and more flexible
    1796         <a class="indexterm" name="id310581"></a>idmap domains parameter.  The main difference
     2142        <a class="link" href="smb.conf.5.html#IDMAPDOMAINS">idmap domains</a> parameter.  The main difference
    17972143        between the "idmap backend" and the "idmap domains"
    17982144        is that the former only allows on backend for all domains while the
    17992145        latter supports configuring backends on a per domain basis.
    1800         </p><p>Examples of SID/uid/gid backends include tdb (<a href="idmap_tdb.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_tdb</span>(8)</span></a>),
    1801         ldap (<a href="idmap_ldap.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_ldap</span>(8)</span></a>), rid (<a href="idmap_rid.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_rid</span>(8)</span></a>),
    1802         and ad (<a href="idmap_tdb.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_tdb</span>(8)</span></a>).
     2146        </p><p>Examples of SID/uid/gid backends include tdb (<a class="citerefentry" href="idmap_tdb.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_tdb</span>(8)</span></a>),
     2147        ldap (<a class="citerefentry" href="idmap_ldap.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_ldap</span>(8)</span></a>), rid (<a class="citerefentry" href="idmap_rid.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_rid</span>(8)</span></a>),
     2148        and ad (<a class="citerefentry" href="idmap_tdb.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_tdb</span>(8)</span></a>).
    18032149        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>idmap backend</code></em> = <code class="literal">tdb</code>
    18042150</em></span>
    1805 </p></dd><dt><span class="term"><a name="IDMAPCACHETIME"></a>idmap cache time (G)</span></dt><dd><p>This parameter specifies the number of seconds that Winbind's
     2151</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334568"></a>
     2152
     2153idmap cache time (G)
     2154</h3></div></div></div><a class="indexterm" name="id334569"></a><a name="IDMAPCACHETIME"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the number of seconds that Winbind's
    18062155        idmap interface will cache positive SID/uid/gid query results.
    18072156        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>idmap cache time</code></em> = <code class="literal">900</code>
    18082157</em></span>
    1809 </p></dd><dt><span class="term"><a name="IDMAPCONFIG"></a>idmap config (G)</span></dt><dd><p>
     2158</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334609"></a>
     2159
     2160idmap config (G)
     2161</h3></div></div></div><a class="indexterm" name="id334610"></a><a name="IDMAPCONFIG"></a><div class="variablelist"><dl><dt></dt><dd><p>
    18102162        The idmap config prefix provides a means of managing each domain
    1811         defined by the <a class="indexterm" name="id310703"></a>idmap domains option using Samba's
     2163        defined by the <a class="link" href="smb.conf.5.html#IDMAPDOMAINS">idmap domains</a> option using Samba's
    18122164        parameteric option support.  The idmap config prefix should be
    18132165        followed by the name of the domain, a colon, and a setting specific to
    … …  
    18232175                </p></dd><dt><span class="term">readonly = [yes|no]</span></dt><dd><p>
    18242176                        Mark the domain as readonly which means that no attempts to
    1825                         allocate a uid or gid (by the <a class="indexterm" name="id310750"></a>idmap alloc     backend) for any user or group in that domain
     2177                        allocate a uid or gid (by the <a class="link" href="smb.conf.5.html#IDMAPALLOCBACKEND">idmap alloc     backend</a>) for any user or group in that domain
    18262178                        will be attempted.
    18272179                </p></dd></dl></div><p>
    1828         The following example illustrates how to configure the <a href="idmap_ad.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_ad</span>(8)</span></a>
    1829         for the CORP domain and the <a href="idmap_tdb.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_tdb</span>(8)</span></a> backend for all other domains.  The
     2180        The following example illustrates how to configure the <a class="citerefentry" href="idmap_ad.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_ad</span>(8)</span></a>
     2181        for the CORP domain and the <a class="citerefentry" href="idmap_tdb.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_tdb</span>(8)</span></a> backend for all other domains.  The
    18302182        TRUSTEDDOMAINS string is simply a key used to reference the "idmap
    18312183        config" settings and does not represent the actual name of a domain.
    … …  
    18392191        idmap config TRUSTEDDOMAINS:default = yes
    18402192        idmap config TRUSTEDDOMAINS:range   = 1000 - 9999
    1841         </pre><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="IDMAPDOMAINS"></a>idmap domains (G)</span></dt><dd><p>
     2193        </pre><p><span class="emphasis"><em>No default</em></span></p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334730"></a>
     2194
     2195idmap domains (G)
     2196</h3></div></div></div><a class="indexterm" name="id334731"></a><a name="IDMAPDOMAINS"></a><div class="variablelist"><dl><dt></dt><dd><p>
    18422197        The idmap domains option defines a list of Windows domains which will each
    18432198        have a separately configured backend for managing Winbind's SID/uid/gid
    1844         tables.  This parameter is mutually exclusive with the older <a class="indexterm" name="id310818"></a>idmap backend option.
     2199        tables.  This parameter is mutually exclusive with the older <a class="link" href="smb.conf.5.html#IDMAPBACKEND">idmap backend</a> option.
    18452200        </p><p>
    18462201        Values consist of the short domain name for Winbind's primary or collection
    … …  
    18482203        domain backend for any domain not explicitly listed.
    18492204        </p><p>
    1850         Refer to the <a class="indexterm" name="id310834"></a>idmap config for details about
     2205        Refer to the <a class="link" href="smb.conf.5.html#IDMAPCONFIG">idmap config</a> for details about
    18512206        managing the SID/uid/gid backend for each domain.
    18522207        </p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>idmap domains</code></em> = <code class="literal">default AD CORP</code>
    18532208</em></span>
    1854 </p></dd><dt><span class="term"><a name="WINBINDGID"></a>winbind gid</span></dt><dd><p>This parameter is a synonym for idmap gid.</p></dd><dt><span class="term"><a name="IDMAPGID"></a>idmap gid (G)</span></dt><dd><p>The idmap gid parameter specifies the range of group ids
     2209</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334808"></a><a name="WINBINDGID"></a>winbind gid</h3></div></div></div><a class="indexterm" name="id334809"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#IDMAPGID">idmap gid</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334838"></a>
     2210
     2211idmap gid (G)
     2212</h3></div></div></div><a class="indexterm" name="id334839"></a><a name="IDMAPGID"></a><div class="variablelist"><dl><dt></dt><dd><p>The idmap gid parameter specifies the range of group ids
    18552213        that are allocated for the purpose of mapping UNX groups to NT group
    18562214        SIDs. This range of group ids should have no
    18572215        existing local or NIS groups within it as strange conflicts can
    1858         occur otherwise.</p><p>See also the <a class="indexterm" name="id310911"></a>idmap backend, <a class="indexterm" name="id310918"></a>idmap domains, and <a class="indexterm" name="id310925"></a>idmap config options.
     2216        occur otherwise.</p><p>See also the <a class="link" href="smb.conf.5.html#IDMAPBACKEND">idmap backend</a>, <a class="link" href="smb.conf.5.html#IDMAPDOMAINS">idmap domains</a>, and <a class="link" href="smb.conf.5.html#IDMAPCONFIG">idmap config</a> options.
    18592217        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>idmap gid</code></em> = <code class="literal"></code>
    18602218</em></span>
    18612219</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>idmap gid</code></em> = <code class="literal">10000-20000</code>
    18622220</em></span>
    1863 </p></dd><dt><span class="term"><a name="IDMAPNEGATIVECACHETIME"></a>idmap negative cache time (G)</span></dt><dd><p>This parameter specifies the number of seconds that Winbind's
     2221</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334932"></a>
     2222
     2223idmap negative cache time (G)
     2224</h3></div></div></div><a class="indexterm" name="id334933"></a><a name="IDMAPNEGATIVECACHETIME"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the number of seconds that Winbind's
    18642225        idmap interface will cache negative SID/uid/gid query results.
    18652226        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>idmap negative cache time</code></em> = <code class="literal">120</code>
    18662227</em></span>
    1867 </p></dd><dt><span class="term"><a name="WINBINDUID"></a>winbind uid</span></dt><dd><p>This parameter is a synonym for idmap uid.</p></dd><dt><span class="term"><a name="IDMAPUID"></a>idmap uid (G)</span></dt><dd><p>
     2228</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id334974"></a><a name="WINBINDUID"></a>winbind uid</h3></div></div></div><a class="indexterm" name="id334975"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#IDMAPUID">idmap uid</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335004"></a>
     2229
     2230idmap uid (G)
     2231</h3></div></div></div><a class="indexterm" name="id335005"></a><a name="IDMAPUID"></a><div class="variablelist"><dl><dt></dt><dd><p>
    18682232        The idmap uid parameter specifies the range of user ids that are
    18692233        allocated for use in mapping UNIX users to NT user SIDs. This
    18702234        range of ids should have no existing local
    1871         or NIS users within it as strange conflicts can occur otherwise.</p><p>See also the <a class="indexterm" name="id311053"></a>idmap backend, <a class="indexterm" name="id311060"></a>idmap domains, and <a class="indexterm" name="id311067"></a>idmap config options.
     2235        or NIS users within it as strange conflicts can occur otherwise.</p><p>See also the <a class="link" href="smb.conf.5.html#IDMAPBACKEND">idmap backend</a>, <a class="link" href="smb.conf.5.html#IDMAPDOMAINS">idmap domains</a>, and <a class="link" href="smb.conf.5.html#IDMAPCONFIG">idmap config</a> options.
    18722236        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>idmap uid</code></em> = <code class="literal"></code>
    18732237</em></span>
    18742238</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>idmap uid</code></em> = <code class="literal">10000-20000</code>
    18752239</em></span>
    1876 </p></dd><dt><span class="term"><a name="INCLUDE"></a>include (G)</span></dt><dd><p>
     2240</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335097"></a>
     2241
     2242include (G)
     2243</h3></div></div></div><a class="indexterm" name="id335098"></a><a name="INCLUDE"></a><div class="variablelist"><dl><dt></dt><dd><p>
    18772244        This allows you to include one config file inside another.  The file is included literally, as though typed
    18782245        in place.
    … …  
    18842251</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>include</code></em> = <code class="literal">/usr/local/samba/lib/admin_smb.conf</code>
    18852252</em></span>
    1886 </p></dd><dt><span class="term"><a name="INHERITACLS"></a>inherit acls (S)</span></dt><dd><p>This parameter can be used to ensure that if default acls
     2253</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335174"></a>
     2254
     2255inherit acls (S)
     2256</h3></div></div></div><a class="indexterm" name="id335176"></a><a name="INHERITACLS"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter can be used to ensure that if default acls
    18872257    exist on parent directories, they are always honored when creating a
    18882258    new file or subdirectory in these parent directories. The default
    … …  
    18922262</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>inherit acls</code></em> = <code class="literal">no</code>
    18932263</em></span>
    1894 </p></dd><dt><span class="term"><a name="INHERITOWNER"></a>inherit owner (S)</span></dt><dd><p>The ownership of new files and directories
     2264</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335218"></a>
     2265
     2266inherit owner (S)
     2267</h3></div></div></div><a class="indexterm" name="id335219"></a><a name="INHERITOWNER"></a><div class="variablelist"><dl><dt></dt><dd><p>The ownership of new files and directories
    18952268        is normally governed by effective uid of the connected user.
    18962269        This option allows the Samba administrator to specify that
    … …  
    19012274        roaming profile directory are actually owner by the user.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>inherit owner</code></em> = <code class="literal">no</code>
    19022275</em></span>
    1903 </p></dd><dt><span class="term"><a name="INHERITPERMISSIONS"></a>inherit permissions (S)</span></dt><dd><p>
    1904         The permissions on new files and directories are normally governed by <a class="indexterm" name="id311291"></a>create mask,
    1905         <a class="indexterm" name="id311298"></a>directory mask, <a class="indexterm" name="id311305"></a>force create mode and <a class="indexterm" name="id311312"></a>force directory mode but the boolean inherit permissions parameter overrides this.
     2276</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335266"></a>
     2277
     2278inherit permissions (S)
     2279</h3></div></div></div><a class="indexterm" name="id335267"></a><a name="INHERITPERMISSIONS"></a><div class="variablelist"><dl><dt></dt><dd><p>
     2280        The permissions on new files and directories are normally governed by <a class="link" href="smb.conf.5.html#CREATEMASK">create mask</a>,
     2281        <a class="link" href="smb.conf.5.html#DIRECTORYMASK">directory mask</a>, <a class="link" href="smb.conf.5.html#FORCECREATEMODE">force create mode</a> and <a class="link" href="smb.conf.5.html#FORCEDIRECTORYMODE">force directory mode</a> but the boolean inherit permissions parameter overrides this.
    19062282        </p><p>New directories inherit the mode of the parent directory,
    19072283    including bits such as setgid.</p><p>
    19082284        New files inherit their read/write bits from the parent directory.  Their execute bits continue to be
    1909         determined by <a class="indexterm" name="id311328"></a>map archive, <a class="indexterm" name="id311335"></a>map hidden and <a class="indexterm" name="id311342"></a>map system as usual.
     2285        determined by <a class="link" href="smb.conf.5.html#MAPARCHIVE">map archive</a>, <a class="link" href="smb.conf.5.html#MAPHIDDEN">map hidden</a> and <a class="link" href="smb.conf.5.html#MAPSYSTEM">map system</a> as usual.
    19102286        </p><p>Note that the setuid bit is <span class="emphasis"><em>never</em></span> set via
    19112287    inheritance (the code explicitly prohibits this).</p><p>This can be particularly useful on large systems with
    … …  
    19132289    share to be used flexibly by each user.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>inherit permissions</code></em> = <code class="literal">no</code>
    19142290</em></span>
    1915 </p></dd><dt><span class="term"><a name="INTERFACES"></a>interfaces (G)</span></dt><dd><p>This option allows you to override the default
     2291</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335403"></a>
     2292
     2293interfaces (G)
     2294</h3></div></div></div><a class="indexterm" name="id335404"></a><a name="INTERFACES"></a><div class="variablelist"><dl><dt></dt><dd><p>This option allows you to override the default
    19162295        network interfaces list that Samba will use for browsing, name
    19172296        registration and other NBT traffic. By default Samba will query
    … …  
    19372316</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>interfaces</code></em> = <code class="literal">eth0 192.168.2.10/24 192.168.3.10/255.255.255.0</code>
    19382317</em></span>
    1939 </p></dd><dt><span class="term"><a name="INVALIDUSERS"></a>invalid users (S)</span></dt><dd><p>This is a list of users that should not be allowed
     2318</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335508"></a>
     2319
     2320invalid users (S)
     2321</h3></div></div></div><a class="indexterm" name="id335509"></a><a name="INVALIDUSERS"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a list of users that should not be allowed
    19402322    to login to this service. This is really a <span class="emphasis"><em>paranoid</em></span>
    19412323    check to absolutely ensure an improper setting does not breach
    … …  
    19572339</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>invalid users</code></em> = <code class="literal">root fred admin @wheel</code>
    19582340</em></span>
    1959 </p></dd><dt><span class="term"><a name="IPRINTSERVER"></a>iprint server (G)</span></dt><dd><p>
    1960     This parameter is only applicable if <a class="indexterm" name="id311602"></a>printing is set to <code class="constant">iprint</code>.
     2341</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335608"></a>
     2342
     2343iprint server (G)
     2344</h3></div></div></div><a class="indexterm" name="id335609"></a><a name="IPRINTSERVER"></a><div class="variablelist"><dl><dt></dt><dd><p>
     2345    This parameter is only applicable if <a class="link" href="smb.conf.5.html#PRINTING">printing</a> is set to <code class="constant">iprint</code>.
    19612346    </p><p>
    19622347   If set, this option overrides the ServerName option in the CUPS <code class="filename">client.conf</code>. This is
    … …  
    19662351</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>iprint server</code></em> = <code class="literal">MYCUPSSERVER</code>
    19672352</em></span>
    1968 </p></dd><dt><span class="term"><a name="KEEPALIVE"></a>keepalive (G)</span></dt><dd><p>The value of the parameter (an integer) represents
     2353</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335690"></a>
     2354
     2355keepalive (G)
     2356</h3></div></div></div><a class="indexterm" name="id335692"></a><a name="KEEPALIVE"></a><div class="variablelist"><dl><dt></dt><dd><p>The value of the parameter (an integer) represents
    19692357    the number of seconds between <em class="parameter"><code>keepalive</code></em>
    19702358    packets. If this parameter is zero, no keepalive packets will be
    19712359    sent. Keepalive packets, if sent, allow the server to tell whether
    19722360    a client is still present and responding.</p><p>Keepalives should, in general, not be needed if the socket
    1973     has the SO_KEEPALIVE attribute set on it by default. (see <a class="indexterm" name="id311691"></a>socket options).
     2361    has the SO_KEEPALIVE attribute set on it by default. (see <a class="link" href="smb.conf.5.html#SOCKETOPTIONS">socket options</a>).
    19742362Basically you should only use this option if you strike difficulties.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>keepalive</code></em> = <code class="literal">300</code>
    19752363</em></span>
    19762364</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>keepalive</code></em> = <code class="literal">600</code>
    19772365</em></span>
    1978 </p></dd><dt><span class="term"><a name="KERNELCHANGENOTIFY"></a>kernel change notify (S)</span></dt><dd><p>This parameter specifies whether Samba should ask the
     2366</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335772"></a>
     2367
     2368kernel change notify (S)
     2369</h3></div></div></div><a class="indexterm" name="id335773"></a><a name="KERNELCHANGENOTIFY"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies whether Samba should ask the
    19792370        kernel for change notifications in directories so that
    19802371        SMB clients can refresh whenever the data on the server changes.
    … …  
    19832374        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>kernel change notify</code></em> = <code class="literal">yes</code>
    19842375</em></span>
    1985 </p></dd><dt><span class="term"><a name="KERNELOPLOCKS"></a>kernel oplocks (G)</span></dt><dd><p>For UNIXes that support kernel based <a class="indexterm" name="id311797"></a>oplocks
     2376</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335818"></a>
     2377
     2378kernel oplocks (G)
     2379</h3></div></div></div><a class="indexterm" name="id335819"></a><a name="KERNELOPLOCKS"></a><div class="variablelist"><dl><dt></dt><dd><p>For UNIXes that support kernel based <a class="link" href="smb.conf.5.html#OPLOCKS">oplocks</a>
    19862380        (currently only IRIX and the Linux 2.4 kernel), this parameter
    19872381        allows the use of them to be turned on or off.</p><p>Kernel oplocks support allows Samba <em class="parameter"><code>oplocks
    19882382        </code></em> to be broken whenever a local UNIX process or NFS operation
    1989         accesses a file that <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> has oplocked. This allows complete
     2383        accesses a file that <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> has oplocked. This allows complete
    19902384        data consistency between SMB/CIFS, NFS and local file access (and is
    19912385        a <span class="emphasis"><em>very</em></span> cool feature :-).</p><p>This parameter defaults to <code class="constant">on</code>, but is translated
    … …  
    19932387        You should never need to touch this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>kernel oplocks</code></em> = <code class="literal">yes</code>
    19942388</em></span>
    1995 </p></dd><dt><span class="term"><a name="LANMANAUTH"></a>lanman auth (G)</span></dt><dd><p>This parameter determines whether or not <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will attempt to
     2389</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335900"></a>
     2390
     2391lanman auth (G)
     2392</h3></div></div></div><a class="indexterm" name="id335901"></a><a name="LANMANAUTH"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter determines whether or not <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will attempt to
    19962393    authenticate users or permit password changes
    19972394    using the LANMAN password hash. If disabled, only clients which support NT
    … …  
    20102407    special configuration to use it.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lanman auth</code></em> = <code class="literal">yes</code>
    20112408</em></span>
    2012 </p></dd><dt><span class="term"><a name="LARGEREADWRITE"></a>large readwrite (G)</span></dt><dd><p>This parameter determines whether or not
    2013     <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> supports the new 64k
     2409</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id335983"></a>
     2410
     2411large readwrite (G)
     2412</h3></div></div></div><a class="indexterm" name="id335984"></a><a name="LARGEREADWRITE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter determines whether or not
     2413    <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> supports the new 64k
    20142414    streaming read and write varient SMB requests introduced with
    20152415    Windows 2000. Note that due to Windows 2000 client redirector bugs
    … …  
    20192419        tested as some other Samba code paths.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>large readwrite</code></em> = <code class="literal">yes</code>
    20202420</em></span>
    2021 </p></dd><dt><span class="term"><a name="LDAPADMINDN"></a>ldap admin dn (G)</span></dt><dd><p>
    2022         The <a class="indexterm" name="id312005"></a>ldap admin dn defines the Distinguished  Name (DN) name used by Samba to contact
    2023         the ldap server when retreiving  user account information. The <a class="indexterm" name="id312013"></a>ldap admin dn is used
     2421</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336035"></a>
     2422
     2423ldap admin dn (G)
     2424</h3></div></div></div><a class="indexterm" name="id336036"></a><a name="LDAPADMINDN"></a><div class="variablelist"><dl><dt></dt><dd><p>
     2425        The <a class="link" href="smb.conf.5.html#LDAPADMINDN">ldap admin dn</a> defines the Distinguished  Name (DN) name used by Samba to contact
     2426        the ldap server when retreiving  user account information. The <a class="link" href="smb.conf.5.html#LDAPADMINDN">ldap admin dn</a> is used
    20242427        in conjunction with the admin dn password stored in the <code class="filename">private/secrets.tdb</code>
    2025         file.  See the <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>
     2428        file.  See the <a class="citerefentry" href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>
    20262429        man page for more information on how  to accomplish this.
    20272430        </p><p>
    2028         The <a class="indexterm" name="id312038"></a>ldap admin dn requires a fully specified DN. The <a class="indexterm" name="id312046"></a>ldap  suffix is not appended to the <a class="indexterm" name="id312053"></a>ldap admin dn.
    2029         </p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="LDAPDELETEDN"></a>ldap delete dn (G)</span></dt><dd><p> This parameter specifies whether a delete
     2431        The <a class="link" href="smb.conf.5.html#LDAPADMINDN">ldap admin dn</a> requires a fully specified DN. The <a class="link" href="smb.conf.5.html#LDAPSUFFIX">ldap  suffix</a> is not appended to the <a class="link" href="smb.conf.5.html#LDAPADMINDN">ldap admin dn</a>.
     2432        </p><p><span class="emphasis"><em>No default</em></span></p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336136"></a>
     2433
     2434ldap delete dn (G)
     2435</h3></div></div></div><a class="indexterm" name="id336137"></a><a name="LDAPDELETEDN"></a><div class="variablelist"><dl><dt></dt><dd><p> This parameter specifies whether a delete
    20302436        operation in the ldapsam deletes the complete entry or only the attributes
    20312437        specific to Samba.
    20322438        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap delete dn</code></em> = <code class="literal">no</code>
    20332439</em></span>
    2034 </p></dd><dt><span class="term"><a name="LDAPGROUPSUFFIX"></a>ldap group suffix (G)</span></dt><dd><p>This parameter specifies the suffix that is
     2440</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336178"></a>
     2441
     2442ldap group suffix (G)
     2443</h3></div></div></div><a class="indexterm" name="id336179"></a><a name="LDAPGROUPSUFFIX"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the suffix that is
    20352444        used for groups when these are added to the LDAP directory.
    2036         If this parameter is unset, the value of <a class="indexterm" name="id312126"></a>ldap suffix will be used instead.  The suffix string is pre-pended to the
    2037         <a class="indexterm" name="id312134"></a>ldap suffix string so use a partial DN.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap group suffix</code></em> = <code class="literal"></code>
     2445        If this parameter is unset, the value of <a class="link" href="smb.conf.5.html#LDAPSUFFIX">ldap suffix</a> will be used instead.  The suffix string is pre-pended to the
     2446        <a class="link" href="smb.conf.5.html#LDAPSUFFIX">ldap suffix</a> string so use a partial DN.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap group suffix</code></em> = <code class="literal"></code>
    20382447</em></span>
    20392448</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>ldap group suffix</code></em> = <code class="literal">ou=Groups</code>
    20402449</em></span>
    2041 </p></dd><dt><span class="term"><a name="LDAPIDMAPSUFFIX"></a>ldap idmap suffix (G)</span></dt><dd><p>
     2450</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336256"></a>
     2451
     2452ldap idmap suffix (G)
     2453</h3></div></div></div><a class="indexterm" name="id336258"></a><a name="LDAPIDMAPSUFFIX"></a><div class="variablelist"><dl><dt></dt><dd><p>
    20422454        This parameters specifies the suffix that is used when storing idmap mappings. If this parameter
    2043         is unset, the value of <a class="indexterm" name="id312196"></a>ldap suffix will be used instead.  The suffix
    2044         string is pre-pended to the <a class="indexterm" name="id312204"></a>ldap suffix string so use a partial DN.
     2455        is unset, the value of <a class="link" href="smb.conf.5.html#LDAPSUFFIX">ldap suffix</a> will be used instead.  The suffix
     2456        string is pre-pended to the <a class="link" href="smb.conf.5.html#LDAPSUFFIX">ldap suffix</a> string so use a partial DN.
    20452457        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap idmap suffix</code></em> = <code class="literal"></code>
    20462458</em></span>
    20472459</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>ldap idmap suffix</code></em> = <code class="literal">ou=Idmap</code>
    20482460</em></span>
    2049 </p></dd><dt><span class="term"><a name="LDAPMACHINESUFFIX"></a>ldap machine suffix (G)</span></dt><dd><p>
     2461</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336336"></a>
     2462
     2463ldap machine suffix (G)
     2464</h3></div></div></div><a class="indexterm" name="id336337"></a><a name="LDAPMACHINESUFFIX"></a><div class="variablelist"><dl><dt></dt><dd><p>
    20502465        It specifies where machines should be added to the ldap tree.  If this parameter is unset, the value of
    2051         <a class="indexterm" name="id312266"></a>ldap suffix will be used instead.  The suffix string is pre-pended to the
    2052         <a class="indexterm" name="id312274"></a>ldap suffix string so use a partial DN.
     2466        <a class="link" href="smb.conf.5.html#LDAPSUFFIX">ldap suffix</a> will be used instead.  The suffix string is pre-pended to the
     2467        <a class="link" href="smb.conf.5.html#LDAPSUFFIX">ldap suffix</a> string so use a partial DN.
    20532468        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap machine suffix</code></em> = <code class="literal"></code>
    20542469</em></span>
    20552470</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>ldap machine suffix</code></em> = <code class="literal">ou=Computers</code>
    20562471</em></span>
    2057 </p></dd><dt><span class="term"><a name="LDAPPASSWDSYNC"></a>ldap passwd sync (G)</span></dt><dd><p>
     2472</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336414"></a>
     2473
     2474ldap passwd sync (G)
     2475</h3></div></div></div><a class="indexterm" name="id336415"></a><a name="LDAPPASSWDSYNC"></a><div class="variablelist"><dl><dt></dt><dd><p>
    20582476        This option is used to define whether or not Samba should sync the LDAP password with the NT
    20592477        and LM hashes for normal accounts (NOT for workstation, server or domain trusts) on a password
    20602478        change via SAMBA. 
    20612479        </p><p>
    2062         The <a class="indexterm" name="id312340"></a>ldap passwd sync can be set to one of three values:
     2480        The <a class="link" href="smb.conf.5.html#LDAPPASSWDSYNC">ldap passwd sync</a> can be set to one of three values:
    20632481        </p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>Yes</code></em>  =  Try
    20642482                        to update the LDAP, NT and LM passwords and update the pwdLastSet time.</p></li><li><p><em class="parameter"><code>No</code></em> = Update NT and
    … …  
    20662484                        the LDAP password and let the LDAP server do the rest.</p></li></ul></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap passwd sync</code></em> = <code class="literal">no</code>
    20672485</em></span>
    2068 </p></dd><dt><span class="term"><a name="LDAPREPLICATIONSLEEP"></a>ldap replication sleep (G)</span></dt><dd><p>
     2486</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336509"></a>
     2487
     2488ldap replication sleep (G)
     2489</h3></div></div></div><a class="indexterm" name="id336510"></a><a name="LDAPREPLICATIONSLEEP"></a><div class="variablelist"><dl><dt></dt><dd><p>
    20692490        When Samba is asked to write to a read-only LDAP replica, we are redirected to talk to the read-write master server.
    20702491        This server then replicates our changes back to the 'local' server, however the replication might take some seconds,
    … …  
    20792500        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap replication sleep</code></em> = <code class="literal">1000</code>
    20802501</em></span>
    2081 </p></dd><dt><span class="term"><a name="LDAPSAM:EDITPOSIX"></a>ldapsam:editposix (G)</span></dt><dd><p>
     2502</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336564"></a>
     2503
     2504ldapsam:editposix (G)
     2505</h3></div></div></div><a class="indexterm" name="id336565"></a><a name="LDAPSAM:EDITPOSIX"></a><div class="variablelist"><dl><dt></dt><dd><p>
    20822506        Editposix is an option that leverages ldapsam:trusted to make it simpler to manage a domain controller
    20832507        eliminating the need to set up custom scripts to add and manage the posix users and groups. This option
    … …  
    20922516        the smb.conf ldap options must be properly configured.
    20932517
    2094         The typical ldap setup used with the <a class="indexterm" name="id312494"></a>ldapsam:trusted = yes option
    2095         is usually sufficient to use <a class="indexterm" name="id312501"></a>ldapsam:editposix = yes as well.
     2518        The typical ldap setup used with the <a class="link" href="smb.conf.5.html#LDAPSAM:TRUSTED">ldapsam:trusted = yes</a> option
     2519        is usually sufficient to use <a class="link" href="smb.conf.5.html#LDAPSAM:EDITPOSIX">ldapsam:editposix = yes</a> as well.
    20962520        </p><p>
    20972521        An example configuration can be the following:
    … …  
    21582582        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldapsam:editposix</code></em> = <code class="literal">no</code>
    21592583</em></span>
    2160 </p></dd><dt><span class="term"><a name="LDAPSAM:TRUSTED"></a>ldapsam:trusted (G)</span></dt><dd><p>
     2584</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336673"></a>
     2585
     2586ldapsam:trusted (G)
     2587</h3></div></div></div><a class="indexterm" name="id336674"></a><a name="LDAPSAM:TRUSTED"></a><div class="variablelist"><dl><dt></dt><dd><p>
    21612588        By default, Samba as a Domain Controller with an LDAP backend needs to use the Unix-style NSS subsystem to
    21622589        access user and group information. Due to the way Unix stores user information in /etc/passwd and /etc/group
    … …  
    21662593        are used to deal with user and group attributes lack such optimization.
    21672594        </p><p>
    2168         To make Samba scale well in large environments, the <a class="indexterm" name="id312581"></a>ldapsam:trusted = yes
     2595        To make Samba scale well in large environments, the <a class="link" href="smb.conf.5.html#LDAPSAM:TRUSTED">ldapsam:trusted = yes</a>
    21692596        option assumes that the complete user and group database that is relevant to Samba is stored in LDAP with the
    21702597        standard posixAccount/posixGroup attributes. It further assumes that the Samba auxiliary object classes are
    21712598        stored together with the POSIX data in the same LDAP object. If these assumptions are met,
    2172         <a class="indexterm" name="id312590"></a>ldapsam:trusted = yes can be activated and Samba can bypass the
     2599        <a class="link" href="smb.conf.5.html#LDAPSAM:TRUSTED">ldapsam:trusted = yes</a> can be activated and Samba can bypass the
    21732600        NSS system to query user group memberships. Optimized LDAP queries can greatly speed up domain logon and
    21742601        administration tasks. Depending on the size of the LDAP database a factor of 100 or more for common queries
    … …  
    21762603        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldapsam:trusted</code></em> = <code class="literal">no</code>
    21772604</em></span>
    2178 </p></dd><dt><span class="term"><a name="LDAPSSL"></a>ldap ssl (G)</span></dt><dd><p>This option is used to define whether or not Samba should
     2605</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336748"></a>
     2606
     2607ldap ssl (G)
     2608</h3></div></div></div><a class="indexterm" name="id336750"></a><a name="LDAPSSL"></a><div class="variablelist"><dl><dt></dt><dd><p>This option is used to define whether or not Samba should
    21792609        use SSL when connecting to the ldap server
    21802610        This is <span class="emphasis"><em>NOT</em></span> related to
    21812611        Samba's previous SSL support which was enabled by specifying the
    21822612         <code class="literal">--with-ssl</code> option to the <code class="filename">configure</code>
    2183         script.</p><p>The <a class="indexterm" name="id312659"></a>ldap ssl can be set to one of three values:</p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>Off</code></em> = Never
     2613        script.</p><p>The <a class="link" href="smb.conf.5.html#LDAPSSL">ldap ssl</a> can be set to one of three values:</p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>Off</code></em> = Never
    21842614                        use SSL when querying the directory.</p></li><li><p><em class="parameter"><code>Start_tls</code></em> = Use
    21852615                        the LDAPv3 StartTLS extended operation (RFC2830) for
    … …  
    21872617                        on the ldaps port when contacting the <em class="parameter"><code>ldap server</code></em>. Only available when the
    21882618                        backwards-compatiblity <code class="literal">--with-ldapsam</code> option is specified
    2189                 to configure. See <a class="indexterm" name="id312714"></a>passdb backend</p>.
     2619                to configure. See <a class="link" href="smb.conf.5.html#PASSDBBACKEND">passdb backend</a></p>.
    21902620                </li></ul></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap ssl</code></em> = <code class="literal">start_tls</code>
    21912621</em></span>
    2192 </p></dd><dt><span class="term"><a name="LDAPSUFFIX"></a>ldap suffix (G)</span></dt><dd><p>Specifies the base for all ldap suffixes and for storing the sambaDomain object.</p><p>
    2193         The ldap suffix will be appended to the values specified for the <a class="indexterm" name="id312767"></a>ldap user suffix,
    2194          <a class="indexterm" name="id312774"></a>ldap group suffix, <a class="indexterm" name="id312781"></a>ldap machine suffix, and the
    2195          <a class="indexterm" name="id312788"></a>ldap idmap suffix. Each of these should be given only a DN relative to the
    2196          <a class="indexterm" name="id312796"></a>ldap suffix.
     2622</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336881"></a>
     2623
     2624ldap suffix (G)
     2625</h3></div></div></div><a class="indexterm" name="id336882"></a><a name="LDAPSUFFIX"></a><div class="variablelist"><dl><dt></dt><dd><p>Specifies the base for all ldap suffixes and for storing the sambaDomain object.</p><p>
     2626        The ldap suffix will be appended to the values specified for the <a class="link" href="smb.conf.5.html#LDAPUSERSUFFIX">ldap user suffix</a>,
     2627         <a class="link" href="smb.conf.5.html#LDAPGROUPSUFFIX">ldap group suffix</a>, <a class="link" href="smb.conf.5.html#LDAPMACHINESUFFIX">ldap machine suffix</a>, and the
     2628         <a class="link" href="smb.conf.5.html#LDAPIDMAPSUFFIX">ldap idmap suffix</a>. Each of these should be given only a DN relative to the
     2629         <a class="link" href="smb.conf.5.html#LDAPSUFFIX">ldap suffix</a>.
    21972630        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap suffix</code></em> = <code class="literal"></code>
    21982631</em></span>
    21992632</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>ldap suffix</code></em> = <code class="literal">dc=samba,dc=org</code>
    22002633</em></span>
    2201 </p></dd><dt><span class="term"><a name="LDAPTIMEOUT"></a>ldap timeout (G)</span></dt><dd><p>
     2634</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id336997"></a>
     2635
     2636ldap timeout (G)
     2637</h3></div></div></div><a class="indexterm" name="id336998"></a><a name="LDAPTIMEOUT"></a><div class="variablelist"><dl><dt></dt><dd><p>
    22022638        When Samba connects to an ldap server that servermay be down or unreachable. To prevent Samba from hanging whilst
    22032639        waiting for the connection this parameter specifies in seconds how long Samba should wait before failing the
    … …  
    22052641        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap timeout</code></em> = <code class="literal">15</code>
    22062642</em></span>
    2207 </p></dd><dt><span class="term"><a name="LDAPUSERSUFFIX"></a>ldap user suffix (G)</span></dt><dd><p>
     2643</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337040"></a>
     2644
     2645ldap user suffix (G)
     2646</h3></div></div></div><a class="indexterm" name="id337041"></a><a name="LDAPUSERSUFFIX"></a><div class="variablelist"><dl><dt></dt><dd><p>
    22082647        This parameter specifies where users are added to the tree. If this parameter is unset,
    2209         the value of <a class="indexterm" name="id312898"></a>ldap suffix will be used instead.  The suffix
    2210         string is pre-pended to the  <a class="indexterm" name="id312906"></a>ldap suffix string so use a partial DN.
     2648        the value of <a class="link" href="smb.conf.5.html#LDAPSUFFIX">ldap suffix</a> will be used instead.  The suffix
     2649        string is pre-pended to the  <a class="link" href="smb.conf.5.html#LDAPSUFFIX">ldap suffix</a> string so use a partial DN.
    22112650        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap user suffix</code></em> = <code class="literal"></code>
    22122651</em></span>
    22132652</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>ldap user suffix</code></em> = <code class="literal">ou=people</code>
    22142653</em></span>
    2215 </p></dd><dt><span class="term"><a name="LEVEL2OPLOCKS"></a>level2 oplocks (S)</span></dt><dd><p>This parameter controls whether Samba supports
     2654</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337118"></a>
     2655
     2656level2 oplocks (S)
     2657</h3></div></div></div><a class="indexterm" name="id337119"></a><a name="LEVEL2OPLOCKS"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls whether Samba supports
    22162658        level2 (read-only) oplocks on a share.</p><p>Level2, or read-only oplocks allow Windows NT clients
    22172659        that have an oplock on a file to downgrade from a read-write oplock
    … …  
    22272669        delete any read-ahead caches.</p><p>It is recommended that this parameter be turned on to
    22282670        speed access to shared executables.</p><p>For more discussions on level2 oplocks see the CIFS spec.</p><p>
    2229         Currently, if <a class="indexterm" name="id312993"></a>kernel oplocks are supported then
     2671        Currently, if <a class="link" href="smb.conf.5.html#KERNELOPLOCKS">kernel oplocks</a> are supported then
    22302672        level2 oplocks are not granted (even if this parameter is set to
    2231         <code class="constant">yes</code>).  Note also, the <a class="indexterm" name="id313004"></a>oplocks
     2673        <code class="constant">yes</code>).  Note also, the <a class="link" href="smb.conf.5.html#OPLOCKS">oplocks</a>
    22322674        parameter must be set to <code class="constant">yes</code> on this share in order for
    22332675        this parameter to have any effect.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>level2 oplocks</code></em> = <code class="literal">yes</code>
    22342676</em></span>
    2235 </p></dd><dt><span class="term"><a name="LMANNOUNCE"></a>lm announce (G)</span></dt><dd><p>This parameter determines if <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> will produce Lanman announce
     2677</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337214"></a>
     2678
     2679lm announce (G)
     2680</h3></div></div></div><a class="indexterm" name="id337215"></a><a name="LMANNOUNCE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter determines if <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> will produce Lanman announce
    22362681        broadcasts that are needed by OS/2 clients in order for them to see
    22372682        the Samba server in their browse list. This parameter can have three
    … …  
    22412686        broadcasts. If set to <code class="constant">yes</code> Samba will produce
    22422687        Lanman announce broadcasts at a frequency set by the parameter
    2243         <a class="indexterm" name="id313085"></a>lm interval. If set to <code class="constant">auto</code>
     2688        <a class="link" href="smb.conf.5.html#LMINTERVAL">lm interval</a>. If set to <code class="constant">auto</code>
    22442689        Samba will not send Lanman announce broadcasts by default but will
    22452690        listen for them. If it hears such a broadcast on the wire it will
    22462691        then start sending them at a frequency set by the parameter
    2247         <a class="indexterm" name="id313097"></a>lm interval.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lm announce</code></em> = <code class="literal">auto</code>
     2692        <a class="link" href="smb.conf.5.html#LMINTERVAL">lm interval</a>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lm announce</code></em> = <code class="literal">auto</code>
    22482693</em></span>
    22492694</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>lm announce</code></em> = <code class="literal">yes</code>
    22502695</em></span>
    2251 </p></dd><dt><span class="term"><a name="LMINTERVAL"></a>lm interval (G)</span></dt><dd><p>If Samba is set to produce Lanman announce
     2696</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337329"></a>
     2697
     2698lm interval (G)
     2699</h3></div></div></div><a class="indexterm" name="id337330"></a><a name="LMINTERVAL"></a><div class="variablelist"><dl><dt></dt><dd><p>If Samba is set to produce Lanman announce
    22522700        broadcasts needed by OS/2 clients (see the
    2253                 <a class="indexterm" name="id313160"></a>lm announce parameter) then this
     2701                <a class="link" href="smb.conf.5.html#LMANNOUNCE">lm announce</a> parameter) then this
    22542702        parameter defines the frequency in seconds with which they will be
    22552703        made.  If this is set to zero then no Lanman announcements will be
    2256         made despite the setting of the <a class="indexterm" name="id313168"></a>lm announce
     2704        made despite the setting of the <a class="link" href="smb.conf.5.html#LMANNOUNCE">lm announce</a>
    22572705        parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lm interval</code></em> = <code class="literal">60</code>
    22582706</em></span>
    22592707</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>lm interval</code></em> = <code class="literal">120</code>
    22602708</em></span>
    2261 </p></dd><dt><span class="term"><a name="LOADPRINTERS"></a>load printers (G)</span></dt><dd><p>A boolean variable that controls whether all
     2709</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337410"></a>
     2710
     2711load printers (G)
     2712</h3></div></div></div><a class="indexterm" name="id337411"></a><a name="LOADPRINTERS"></a><div class="variablelist"><dl><dt></dt><dd><p>A boolean variable that controls whether all
    22622713    printers in the printcap will be loaded for browsing by default.
    2263     See the <a class="indexterm" name="id313232"></a>printers section for
     2714    See the <a class="link" href="smb.conf.5.html#PRINTERS">printers</a> section for
    22642715    more details.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>load printers</code></em> = <code class="literal">yes</code>
    22652716</em></span>
    2266 </p></dd><dt><span class="term"><a name="LOCALMASTER"></a>local master (G)</span></dt><dd><p>This option allows <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> to try and become a local master browser
     2717</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337463"></a>
     2718
     2719local master (G)
     2720</h3></div></div></div><a class="indexterm" name="id337464"></a><a name="LOCALMASTER"></a><div class="variablelist"><dl><dt></dt><dd><p>This option allows <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> to try and become a local master browser
    22672721        on a subnet. If set to <code class="constant">no</code> then <code class="literal">
    22682722        nmbd</code> will not attempt to become a local master browser
    … …  
    22742728master browser.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>local master</code></em> = <code class="literal">yes</code>
    22752729</em></span>
    2276 </p></dd><dt><span class="term"><a name="LOCKDIR"></a>lock dir</span></dt><dd><p>This parameter is a synonym for lock directory.</p></dd><dt><span class="term"><a name="LOCKDIRECTORY"></a>lock directory (G)</span></dt><dd><p>This option specifies the directory where lock
     2730</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337560"></a><a name="LOCKDIR"></a>lock dir</h3></div></div></div><a class="indexterm" name="id337561"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#LOCKDIRECTORY">lock directory</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337590"></a>
     2731
     2732lock directory (G)
     2733</h3></div></div></div><a class="indexterm" name="id337591"></a><a name="LOCKDIRECTORY"></a><div class="variablelist"><dl><dt></dt><dd><p>This option specifies the directory where lock
    22772734        files will be placed.  The lock files are used to implement the
    2278         <a class="indexterm" name="id313394"></a>max connections option.
     2735        <a class="link" href="smb.conf.5.html#MAXCONNECTIONS">max connections</a> option.
    22792736        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lock directory</code></em> = <code class="literal">${prefix}/var/locks</code>
    22802737</em></span>
    22812738</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>lock directory</code></em> = <code class="literal">/var/run/samba/locks</code>
    22822739</em></span>
    2283 </p></dd><dt><span class="term"><a name="LOCKING"></a>locking (S)</span></dt><dd><p>This controls whether or not locking will be
     2740</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337660"></a>
     2741
     2742locking (S)
     2743</h3></div></div></div><a class="indexterm" name="id337662"></a><a name="LOCKING"></a><div class="variablelist"><dl><dt></dt><dd><p>This controls whether or not locking will be
    22842744        performed by the server in response to lock requests from the
    22852745        client.</p><p>If <code class="literal">locking = no</code>, all lock and unlock
    … …  
    22912751        is not really recommended even in this case.</p><p>Be careful about disabling locking either globally or in a
    22922752        specific service, as lack of locking may result in data corruption.
    2293         You should never need to set this parameter.</p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="LOCKSPINCOUNT"></a>lock spin count (G)</span></dt><dd><p>This parameter has been made inoperative in Samba 3.0.24.
     2753        You should never need to set this parameter.</p><p><span class="emphasis"><em>No default</em></span></p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337730"></a>
     2754
     2755lock spin count (G)
     2756</h3></div></div></div><a class="indexterm" name="id337731"></a><a name="LOCKSPINCOUNT"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter has been made inoperative in Samba 3.0.24.
    22942757        The functionality it contolled is now controlled by the parameter
    2295         <a class="indexterm" name="id313524"></a>lock spin time.
     2758        <a class="link" href="smb.conf.5.html#LOCKSPINTIME">lock spin time</a>.
    22962759        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lock spin count</code></em> = <code class="literal">0</code>
    22972760</em></span>
    2298 </p></dd><dt><span class="term"><a name="LOCKSPINTIME"></a>lock spin time (G)</span></dt><dd><p>The time in microseconds that smbd should
     2761</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337782"></a>
     2762
     2763lock spin time (G)
     2764</h3></div></div></div><a class="indexterm" name="id337783"></a><a name="LOCKSPINTIME"></a><div class="variablelist"><dl><dt></dt><dd><p>The time in microseconds that smbd should
    22992765        keep waiting to see if a failed lock request can
    23002766        be granted. This parameter has changed in default
    23012767        value from Samba 3.0.23 from 10 to 200. The associated
    2302         <a class="indexterm" name="id313571"></a>lock spin count parameter is
     2768        <a class="link" href="smb.conf.5.html#LOCKSPINCOUNT">lock spin count</a> parameter is
    23032769        no longer used in Samba 3.0.24. You should not need
    23042770        to change the value of this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lock spin time</code></em> = <code class="literal">200</code>
    23052771</em></span>
    2306 </p></dd><dt><span class="term"><a name="LOGFILE"></a>log file (G)</span></dt><dd><p>
     2772</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337837"></a>
     2773
     2774log file (G)
     2775</h3></div></div></div><a class="indexterm" name="id337838"></a><a name="LOGFILE"></a><div class="variablelist"><dl><dt></dt><dd><p>
    23072776    This option allows you to override the name of the Samba log file (also known as the debug file).
    23082777    </p><p>
    … …  
    23102779    </p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>log file</code></em> = <code class="literal">/usr/local/samba/var/log.%m</code>
    23112780</em></span>
    2312 </p></dd><dt><span class="term"><a name="DEBUGLEVEL"></a>debuglevel</span></dt><dd><p>This parameter is a synonym for log level.</p></dd><dt><span class="term"><a name="LOGLEVEL"></a>log level (G)</span></dt><dd><p>
     2781</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337887"></a><a name="DEBUGLEVEL"></a>debuglevel</h3></div></div></div><a class="indexterm" name="id337888"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#LOGLEVEL">log level</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id337916"></a>
     2782
     2783log level (G)
     2784</h3></div></div></div><a class="indexterm" name="id337918"></a><a name="LOGLEVEL"></a><div class="variablelist"><dl><dt></dt><dd><p>
    23132785    The value of the parameter (a astring) allows the debug level (logging level) to be specified in the
    2314     <code class="filename">smb.conf</code> file. This parameter has been extended since the 2.2.x
    2315     series, now it allow to specify the debug level for multiple debug classes. This is to give greater
    2316     flexibility in the configuration of the system.
    2317     </p><p>
    2318     The default will be the log level specified on the command line or level zero if none was specified.
    2319     </p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>log level</code></em> = <code class="literal">3 passdb:5 auth:10 winbind:2</code>
    2320 </em></span>
    2321 </p></dd><dt><span class="term"><a name="LOGONDRIVE"></a>logon drive (G)</span></dt><dd><p>
     2786    <code class="filename">smb.conf</code> file.
     2787    </p><p>This parameter has been extended since the 2.2.x
     2788    series, now it allows to specify the debug level for multiple
     2789    debug classes. This is to give greater flexibility in the configuration
     2790    of the system. The following debug classes are currently implemented:
     2791    </p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>all</code></em></p></li><li><p><em class="parameter"><code>tdb</code></em></p></li><li><p><em class="parameter"><code>printdrivers</code></em></p></li><li><p><em class="parameter"><code>lanman</code></em></p></li><li><p><em class="parameter"><code>smb</code></em></p></li><li><p><em class="parameter"><code>rpc_parse</code></em></p></li><li><p><em class="parameter"><code>rpc_srv</code></em></p></li><li><p><em class="parameter"><code>rpc_cli</code></em></p></li><li><p><em class="parameter"><code>passdb</code></em></p></li><li><p><em class="parameter"><code>sam</code></em></p></li><li><p><em class="parameter"><code>auth</code></em></p></li><li><p><em class="parameter"><code>winbind</code></em></p></li><li><p><em class="parameter"><code>vfs</code></em></p></li><li><p><em class="parameter"><code>idmap</code></em></p></li><li><p><em class="parameter"><code>quota</code></em></p></li><li><p><em class="parameter"><code>acls</code></em></p></li><li><p><em class="parameter"><code>locking</code></em></p></li><li><p><em class="parameter"><code>msdfs</code></em></p></li><li><p><em class="parameter"><code>dmapi</code></em></p></li><li><p><em class="parameter"><code>registry</code></em></p></li></ul></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>log level</code></em> = <code class="literal">0</code>
     2792</em></span>
     2793</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>log level</code></em> = <code class="literal">3 passdb:5 auth:10 winbind:2</code>
     2794</em></span>
     2795</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id338145"></a>
     2796
     2797logon drive (G)
     2798</h3></div></div></div><a class="indexterm" name="id338146"></a><a name="LOGONDRIVE"></a><div class="variablelist"><dl><dt></dt><dd><p>
    23222799        This parameter specifies the local path to which the home directory will be
    2323         connected (see <a class="indexterm" name="id313742"></a>logon home) and is only used by NT
     2800        connected (see <a class="link" href="smb.conf.5.html#LOGONHOME">logon home</a>) and is only used by NT
    23242801        Workstations.
    23252802        </p><p>
    … …  
    23292806</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>logon drive</code></em> = <code class="literal">h:</code>
    23302807</em></span>
    2331 </p></dd><dt><span class="term"><a name="LOGONHOME"></a>logon home (G)</span></dt><dd><p>
     2808</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id338218"></a>
     2809
     2810logon home (G)
     2811</h3></div></div></div><a class="indexterm" name="id338219"></a><a name="LOGONHOME"></a><div class="variablelist"><dl><dt></dt><dd><p>
    23322812        This parameter specifies the home directory location when a Win95/98 or NT Workstation logs into a Samba PDC. 
    23332813        It allows you to do
    … …  
    23482828         <code class="literal">net use /home</code> but use the whole string when dealing with profiles.
    23492829        </p><p>
    2350         Note that in prior versions of Samba, the <a class="indexterm" name="id313860"></a>logon path was returned rather than
     2830        Note that in prior versions of Samba, the <a class="link" href="smb.conf.5.html#LOGONPATH">logon path</a> was returned rather than
    23512831        <em class="parameter"><code>logon home</code></em>.  This broke <code class="literal">net use /home</code>
    23522832        but allowed profiles outside the home directory. The current implementation is correct, and can be used for
    23532833        profiles if you use the above trick.
    23542834        </p><p>
    2355         Disable this feature by setting <a class="indexterm" name="id313884"></a>logon home = "" - using the empty string.
     2835        Disable this feature by setting <a class="link" href="smb.conf.5.html#LOGONHOME">logon home = ""</a> - using the empty string.
    23562836        </p><p>
    23572837        This option is only useful if Samba is set up as a logon server.
    … …  
    23602840</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>logon home</code></em> = <code class="literal">\\remote_smb_server\%U</code>
    23612841</em></span>
    2362 </p></dd><dt><span class="term"><a name="LOGONPATH"></a>logon path (G)</span></dt><dd><p>
     2842</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id338370"></a>
     2843
     2844logon path (G)
     2845</h3></div></div></div><a class="indexterm" name="id338371"></a><a name="LOGONPATH"></a><div class="variablelist"><dl><dt></dt><dd><p>
    23632846        This parameter specifies the directory where roaming profiles (Desktop, NTuser.dat, etc) are
    23642847        stored.  Contrary to previous versions of these manual pages, it has nothing to do with Win 9X roaming
    23652848        profiles.  To find out how to handle roaming profiles for Win 9X system, see the
    2366         <a class="indexterm" name="id313953"></a>logon home parameter.
     2849        <a class="link" href="smb.conf.5.html#LOGONHOME">logon home</a> parameter.
    23672850        </p><p>
    23682851        This option takes the standard substitutions, allowing you to have separate logon scripts for each user or
    … …  
    23932876        </p></div><p>Note that this option is only useful if Samba is set up as a domain controller.</p><p>
    23942877        Disable the use of roaming profiles by setting the value of this parameter to the empty string. For
    2395         example, <a class="indexterm" name="id314030"></a>logon path = "". Take note that even if the default setting
     2878        example, <a class="link" href="smb.conf.5.html#LOGONPATH">logon path = ""</a>. Take note that even if the default setting
    23962879        in the smb.conf file is the empty string, any value specified in the user account settings in the passdb
    23972880        backend will over-ride the effect of setting this parameter to null. Disabling of all roaming profile use
    … …  
    24042887        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>logon path</code></em> = <code class="literal">\\%N\%U\profile</code>
    24052888</em></span>
    2406 </p></dd><dt><span class="term"><a name="LOGONSCRIPT"></a>logon script (G)</span></dt><dd><p>
     2889</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id338516"></a>
     2890
     2891logon script (G)
     2892</h3></div></div></div><a class="indexterm" name="id338517"></a><a name="LOGONSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>
    24072893        This parameter specifies the batch file (<code class="filename">.bat</code>) or NT command file
    24082894        (<code class="filename">.cmd</code>) to be downloaded and run on a machine when a user successfully logs in.  The file
    … …  
    24102896        </p><p>
    24112897        The script must be a relative path to the <em class="parameter"><code>[netlogon]</code></em> service.  If the [netlogon]
    2412         service specifies a <a class="indexterm" name="id314112"></a>path of <code class="filename">/usr/local/samba/netlogon</code>, and <a class="indexterm" name="id314125"></a>logon  script = STARTUP.BAT, then the file that will be downloaded is:
     2898        service specifies a <a class="link" href="smb.conf.5.html#PATH">path</a> of <code class="filename">/usr/local/samba/netlogon</code>, and <a class="link" href="smb.conf.5.html#LOGONSCRIPT">logon  script = STARTUP.BAT</a>, then the file that will be downloaded is:
    24132899</p><pre class="programlisting">
    24142900        /usr/local/samba/netlogon/STARTUP.BAT
    … …  
    24352921</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>logon script</code></em> = <code class="literal">scripts\%U.bat</code>
    24362922</em></span>
    2437 </p></dd><dt><span class="term"><a name="LPPAUSECOMMAND"></a>lppause command (S)</span></dt><dd><p>This parameter specifies the command to be
     2923</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id338674"></a>
     2924
     2925lppause command (S)
     2926</h3></div></div></div><a class="indexterm" name="id338675"></a><a name="LPPAUSECOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the command to be
    24382927    executed on the server host in order to stop printing or spooling
    24392928    a specific print job.</p><p>This command should be a program or script which takes
    … …  
    24502939    in the lppause command as the PATH may not be available to the server.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lppause command</code></em> = <code class="literal">
    24512940# Currently no default value is given to
    2452     this string, unless the value of the <a class="indexterm" name="id314292"></a>printing
     2941    this string, unless the value of the <a class="link" href="smb.conf.5.html#PRINTING">printing</a>
    24532942    parameter is <code class="constant">SYSV</code>, in which case the default is :
    24542943    <code class="literal">lp -i %p-%j -H hold</code> or if the value of the
    … …  
    24592948</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>lppause command</code></em> = <code class="literal">/usr/bin/lpalt %p-%j -p0</code>
    24602949</em></span>
    2461 </p></dd><dt><span class="term"><a name="LPQCACHETIME"></a>lpq cache time (G)</span></dt><dd><p>This controls how long lpq info will be cached
     2950</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id338810"></a>
     2951
     2952lpq cache time (G)
     2953</h3></div></div></div><a class="indexterm" name="id338811"></a><a name="LPQCACHETIME"></a><div class="variablelist"><dl><dt></dt><dd><p>This controls how long lpq info will be cached
    24622954        for to prevent the <code class="literal">lpq</code> command being called too
    24632955        often. A separate cache is kept for each variation of the <code class="literal">
    … …  
    24722964</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>lpq cache time</code></em> = <code class="literal">10</code>
    24732965</em></span>
    2474 </p></dd><dt><span class="term"><a name="LPQCOMMAND"></a>lpq command (S)</span></dt><dd><p>This parameter specifies the command to be
     2966</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id338922"></a>
     2967
     2968lpq command (S)
     2969</h3></div></div></div><a class="indexterm" name="id338923"></a><a name="LPQCOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the command to be
    24752970    executed on the server host in order to obtain <code class="literal">lpq
    24762971    </code>-style printer status information.</p><p>This command should be a program or script which
    … …  
    24942989</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>lpq command</code></em> = <code class="literal">/usr/bin/lpq -P%p</code>
    24952990</em></span>
    2496 </p></dd><dt><span class="term"><a name="LPRESUMECOMMAND"></a>lpresume command (S)</span></dt><dd><p>This parameter specifies the command to be
     2991</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339038"></a>
     2992
     2993lpresume command (S)
     2994</h3></div></div></div><a class="indexterm" name="id339039"></a><a name="LPRESUMECOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the command to be
    24972995    executed on the server host in order to restart or continue
    24982996    printing or spooling a specific print job.</p><p>This command should be a program or script which takes
    24992997    a printer name and job number to resume the print job. See
    2500     also the <a class="indexterm" name="id314599"></a>lppause command parameter.</p><p>If a <em class="parameter"><code>%p</code></em> is given then the printer name
     2998    also the <a class="link" href="smb.conf.5.html#LPPAUSECOMMAND">lppause command</a> parameter.</p><p>If a <em class="parameter"><code>%p</code></em> is given then the printer name
    25012999    is put in its place. A <em class="parameter"><code>%j</code></em> is replaced with
    25023000    the job number (an integer).</p><p>Note that it is good practice to include the absolute path
    25033001    in the <em class="parameter"><code>lpresume command</code></em> as the PATH may not
    2504     be available to the server.</p><p>See also the <a class="indexterm" name="id314635"></a>printing parameter.</p><p>Default: Currently no default value is given
     3002    be available to the server.</p><p>See also the <a class="link" href="smb.conf.5.html#PRINTING">printing</a> parameter.</p><p>Default: Currently no default value is given
    25053003    to this string, unless the value of the <em class="parameter"><code>printing</code></em>
    2506     parameter is <code class="constant">SYSV</code>, in which case the default is :</p><p><code class="literal">lp -i %p-%j -H resume</code></p><p>or if the value of the <em class="parameter"><code>printing</code></em> parameter
    2507     is <code class="constant">SOFTQ</code>, then the default is:</p><p><code class="literal">qstat -s -j%j -r</code></p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lpresume command</code></em> = <code class="literal">lpresume command = /usr/bin/lpalt %p-%j -p2</code>
    2508 </em></span>
    2509 </p></dd><dt><span class="term"><a name="LPRMCOMMAND"></a>lprm command (S)</span></dt><dd><p>This parameter specifies the command to be
     3004    parameter is <code class="constant">SYSV</code>, in which case the default is:</p><p><code class="literal">lp -i %p-%j -H resume</code></p><p>or if the value of the <em class="parameter"><code>printing</code></em> parameter
     3005    is <code class="constant">SOFTQ</code>, then the default is:</p><p><code class="literal">qstat -s -j%j -r</code></p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>lpresume command</code></em> = <code class="literal">/usr/bin/lpalt %p-%j -p2</code>
     3006</em></span>
     3007</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339181"></a>
     3008
     3009lprm command (S)
     3010</h3></div></div></div><a class="indexterm" name="id339182"></a><a name="LPRMCOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the command to be
    25103011    executed on the server host in order to delete a print job.</p><p>This command should be a program or script which takes
    25113012    a printer name and job number, and deletes the print job.</p><p>If a <em class="parameter"><code>%p</code></em> is given then the printer name
    … …  
    25243025        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lprm command</code></em> = <code class="literal"> determined by printing parameter</code>
    25253026</em></span>
    2526 </p></dd><dt><span class="term"><a name="MACHINEPASSWORDTIMEOUT"></a>machine password timeout (G)</span></dt><dd><p>
    2527         If a Samba server is a member of a Windows NT Domain (see the <a class="indexterm" name="id314802"></a>security = domain parameter) then periodically a running smbd process will try and change
     3027</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339263"></a>
     3028
     3029machine password timeout (G)
     3030</h3></div></div></div><a class="indexterm" name="id339264"></a><a name="MACHINEPASSWORDTIMEOUT"></a><div class="variablelist"><dl><dt></dt><dd><p>
     3031        If a Samba server is a member of a Windows NT Domain (see the <a class="link" href="smb.conf.5.html#SECURITY">security = domain</a> parameter) then periodically a running smbd process will try and change
    25283032        the MACHINE ACCOUNT PASSWORD stored in the TDB called <code class="filename">private/secrets.tdb
    25293033        </code>.  This parameter specifies how often this password will be changed, in seconds. The default is one
    25303034        week (expressed in seconds), the same as a Windows NT Domain member server.
    25313035        </p><p>
    2532         See also <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>,
    2533         and the <a class="indexterm" name="id314828"></a>security = domain parameter.
     3036        See also <a class="citerefentry" href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>,
     3037        and the <a class="link" href="smb.conf.5.html#SECURITY">security = domain</a> parameter.
    25343038        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>machine password timeout</code></em> = <code class="literal">604800</code>
    25353039</em></span>
    2536 </p></dd><dt><span class="term"><a name="MAGICOUTPUT"></a>magic output (S)</span></dt><dd><p>
     3040</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339345"></a>
     3041
     3042magic output (S)
     3043</h3></div></div></div><a class="indexterm" name="id339346"></a><a name="MAGICOUTPUT"></a><div class="variablelist"><dl><dt></dt><dd><p>
    25373044        This parameter specifies the name of a file which will contain output created by a magic script (see the
    2538         <a class="indexterm" name="id314875"></a>magic script parameter below).
     3045        <a class="link" href="smb.conf.5.html#MAGICSCRIPT">magic script</a> parameter below).
    25393046        </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>If two clients use the same <em class="parameter"><code>magic script
    25403047        </code></em> in the same directory the output file content is undefined.
    … …  
    25433050</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>magic output</code></em> = <code class="literal">myfile.txt</code>
    25443051</em></span>
    2545 </p></dd><dt><span class="term"><a name="MAGICSCRIPT"></a>magic script (S)</span></dt><dd><p>This parameter specifies the name of a file which,
     3052</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339425"></a>
     3053
     3054magic script (S)
     3055</h3></div></div></div><a class="indexterm" name="id339426"></a><a name="MAGICSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the name of a file which,
    25463056        if opened, will be executed by the server when the file is closed.
    25473057        This allows a UNIX script to be sent to the Samba host and
    … …  
    25493059        completion assuming that the user has the appropriate level
    25503060        of privilege and the file permissions allow the deletion.</p><p>If the script generates output, output will be sent to
    2551         the file specified by the <a class="indexterm" name="id314959"></a>magic output
     3061        the file specified by the <a class="link" href="smb.conf.5.html#MAGICOUTPUT">magic output</a>
    25523062        parameter (see above).</p><p>Note that some shells are unable to interpret scripts
    25533063        containing CR/LF instead of CR as
    … …  
    25593069</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>magic script</code></em> = <code class="literal">user.csh</code>
    25603070</em></span>
    2561 </p></dd><dt><span class="term"><a name="MANGLEDMAP"></a>mangled map (S)</span></dt><dd><p>
     3071</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339523"></a>
     3072
     3073mangled map (S)
     3074</h3></div></div></div><a class="indexterm" name="id339524"></a><a name="MANGLEDMAP"></a><div class="variablelist"><dl><dt></dt><dd><p>
    25623075        This is for those who want to directly map UNIX file names which cannot be represented on
    25633076        Windows/DOS.  The mangling of names is not always what is needed.  In particular you may have
    … …  
    25703083        you would use:
    25713084        </p><p>
    2572         <a class="indexterm" name="id315073"></a>mangled map = (*.html *.htm).
     3085        <a class="link" href="smb.conf.5.html#MANGLEDMAP">mangled map = (*.html *.htm)</a>.
    25733086        </p><p>
    25743087        One very useful case is to remove the annoying <code class="filename">;1</code> off
    … …  
    25803093</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>mangled map</code></em> = <code class="literal">(*;1 *;)</code>
    25813094</em></span>
    2582 </p></dd><dt><span class="term"><a name="MANGLEDNAMES"></a>mangled names (S)</span></dt><dd><p>This controls whether non-DOS names under UNIX
     3095</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339635"></a>
     3096
     3097mangled names (S)
     3098</h3></div></div></div><a class="indexterm" name="id339636"></a><a name="MANGLEDNAMES"></a><div class="variablelist"><dl><dt></dt><dd><p>This controls whether non-DOS names under UNIX
    25833099        should be mapped to DOS-compatible names ("mangled") and made visible,
    2584         or whether non-DOS names should simply be ignored.</p><p>See the section on <a class="indexterm" name="id315151"></a>name mangling for
     3100        or whether non-DOS names should simply be ignored.</p><p>See the section on <a class="link" href="smb.conf.5.html#NAMEMANGLING">name mangling</a> for
    25853101        details on how to control the mangling process.</p><p>If mangling is used then the mangling algorithm is as follows:</p><div class="itemizedlist"><ul type="disc"><li><p>The first (up to) five alphanumeric characters
    25863102                        before the rightmost dot of the filename are preserved, forced
    … …  
    25923108                        only if it contains any upper case characters or is longer than three
    25933109                        characters.</p><p>Note that the character to use may be specified using
    2594                                 the <a class="indexterm" name="id315185"></a>mangling char
     3110                                the <a class="link" href="smb.conf.5.html#MANGLINGCHAR">mangling char</a>
    25953111                        option, if you don't like '~'.</p></li><li><p>Files whose UNIX name begins with a dot will be
    25963112                        presented as DOS hidden files. The mangled name will be created as
    … …  
    26053121        do not change between sessions.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>mangled names</code></em> = <code class="literal">yes</code>
    26063122</em></span>
    2607 </p></dd><dt><span class="term"><a name="MANGLEPREFIX"></a>mangle prefix (G)</span></dt><dd><p> controls the number of prefix
     3123</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339754"></a>
     3124
     3125mangle prefix (G)
     3126</h3></div></div></div><a class="indexterm" name="id339756"></a><a name="MANGLEPREFIX"></a><div class="variablelist"><dl><dt></dt><dd><p> controls the number of prefix
    26083127        characters from the original name used when generating
    26093128        the mangled names. A larger value will give a weaker
    … …  
    26153134</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>mangle prefix</code></em> = <code class="literal">4</code>
    26163135</em></span>
    2617 </p></dd><dt><span class="term"><a name="MANGLINGCHAR"></a>mangling char (S)</span></dt><dd><p>This controls what character is used as
    2618         the <span class="emphasis"><em>magic</em></span> character in <a class="indexterm" name="id315321"></a>name mangling. The
     3136</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339818"></a>
     3137
     3138mangling char (S)
     3139</h3></div></div></div><a class="indexterm" name="id339819"></a><a name="MANGLINGCHAR"></a><div class="variablelist"><dl><dt></dt><dd><p>This controls what character is used as
     3140        the <span class="emphasis"><em>magic</em></span> character in <a class="link" href="smb.conf.5.html#NAMEMANGLING">name mangling</a>. The
    26193141        default is a '~' but this may interfere with some software. Use this option to set
    26203142        it to whatever you prefer. This is effective only when mangling method is hash.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>mangling char</code></em> = <code class="literal">~</code>
    … …  
    26223144</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>mangling char</code></em> = <code class="literal">^</code>
    26233145</em></span>
    2624 </p></dd><dt><span class="term"><a name="MANGLINGMETHOD"></a>mangling method (G)</span></dt><dd><p> controls the algorithm used for the generating
     3146</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339891"></a>
     3147
     3148mangling method (G)
     3149</h3></div></div></div><a class="indexterm" name="id339892"></a><a name="MANGLINGMETHOD"></a><div class="variablelist"><dl><dt></dt><dd><p> controls the algorithm used for the generating
    26253150        the mangled names. Can take two different values, "hash" and
    26263151        "hash2". "hash" is the algorithm that was used
    … …  
    26333158</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>mangling method</code></em> = <code class="literal">hash</code>
    26343159</em></span>
    2635 </p></dd><dt><span class="term"><a name="MAPACLINHERIT"></a>map acl inherit (S)</span></dt><dd><p>This boolean parameter controls whether <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will attempt to map the 'inherit' and 'protected'
     3160</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id339952"></a>
     3161
     3162map acl inherit (S)
     3163</h3></div></div></div><a class="indexterm" name="id339954"></a><a name="MAPACLINHERIT"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean parameter controls whether <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will attempt to map the 'inherit' and 'protected'
    26363164    access control entry flags stored in Windows ACLs into an extended attribute
    26373165    called user.SAMBA_PAI. This parameter only takes effect if Samba is being run
    … …  
    26413169    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>map acl inherit</code></em> = <code class="literal">no</code>
    26423170</em></span>
    2643 </p></dd><dt><span class="term"><a name="MAPARCHIVE"></a>map archive (S)</span></dt><dd><p>
     3171</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340005"></a>
     3172
     3173map archive (S)
     3174</h3></div></div></div><a class="indexterm" name="id340006"></a><a name="MAPARCHIVE"></a><div class="variablelist"><dl><dt></dt><dd><p>
    26443175        This controls whether the DOS archive attribute
    26453176        should be mapped to the UNIX owner execute bit.  The DOS archive bit
    … …  
    26493180        be quite annoying for shared source code, documents, etc...
    26503181        </p><p>
    2651         Note that this requires the <a class="indexterm" name="id315501"></a>create mask        parameter to be set such that owner
     3182        Note that this requires the <a class="link" href="smb.conf.5.html#CREATEMASK">create mask</a>   parameter to be set such that owner
    26523183        execute bit is not masked out (i.e. it must include 100). See the parameter
    2653         <a class="indexterm" name="id315509"></a>create mask for details.
     3184        <a class="link" href="smb.conf.5.html#CREATEMASK">create mask</a> for details.
    26543185        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>map archive</code></em> = <code class="literal">yes</code>
    26553186</em></span>
    2656 </p></dd><dt><span class="term"><a name="MAPHIDDEN"></a>map hidden (S)</span></dt><dd><p>
     3187</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340074"></a>
     3188
     3189map hidden (S)
     3190</h3></div></div></div><a class="indexterm" name="id340075"></a><a name="MAPHIDDEN"></a><div class="variablelist"><dl><dt></dt><dd><p>
    26573191        This controls whether DOS style hidden files should be mapped to the UNIX world execute bit.
    26583192        </p><p>
    2659         Note that this requires the <a class="indexterm" name="id315559"></a>create mask to be set such that the world execute
    2660         bit is not masked out (i.e. it must include 001). See the parameter <a class="indexterm" name="id315567"></a>create mask
     3193        Note that this requires the <a class="link" href="smb.conf.5.html#CREATEMASK">create mask</a> to be set such that the world execute
     3194        bit is not masked out (i.e. it must include 001). See the parameter <a class="link" href="smb.conf.5.html#CREATEMASK">create mask</a>
    26613195        for details.
    2662         </p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="MAPREADONLY"></a>map read only (S)</span></dt><dd><p>
     3196        </p><p><span class="emphasis"><em>No default</em></span></p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340128"></a>
     3197
     3198map read only (S)
     3199</h3></div></div></div><a class="indexterm" name="id340129"></a><a name="MAPREADONLY"></a><div class="variablelist"><dl><dt></dt><dd><p>
    26633200        This controls how the DOS read only attribute should be mapped from a UNIX filesystem.
    26643201        </p><p>
    2665         This parameter can take three different values, which tell <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> how to display the read only attribute on files, where either
    2666         <a class="indexterm" name="id315613"></a>store dos attributes is set to <code class="constant">No</code>, or no extended attribute is
    2667         present. If <a class="indexterm" name="id315624"></a>store dos attributes is set to <code class="constant">yes</code> then this
     3202        This parameter can take three different values, which tell <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> how to display the read only attribute on files, where either
     3203        <a class="link" href="smb.conf.5.html#STOREDOSATTRIBUTES">store dos attributes</a> is set to <code class="constant">No</code>, or no extended attribute is
     3204        present. If <a class="link" href="smb.conf.5.html#STOREDOSATTRIBUTES">store dos attributes</a> is set to <code class="constant">yes</code> then this
    26683205        parameter is <span class="emphasis"><em>ignored</em></span>. This is a new parameter introduced in Samba version 3.0.21.
    26693206        </p><p>The three settings are :</p><div class="itemizedlist"><ul type="disc"><li><p>
    … …  
    26733210                </p></li><li><p>
    26743211                <code class="constant">Permissions</code> - The read only DOS attribute is mapped to the effective permissions of
    2675                 the connecting user, as evaluated by <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> by reading the unix permissions and POSIX ACL (if present).
     3212                the connecting user, as evaluated by <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> by reading the unix permissions and POSIX ACL (if present).
    26763213                If the connecting user does not have permission to modify the file, the read only attribute
    26773214                is reported as being set on the file.
    26783215                </p></li><li><p>
    26793216                <code class="constant">No</code> - The read only DOS attribute is unaffected by permissions, and can only be set by
    2680                 the <a class="indexterm" name="id315681"></a>store dos attributes method. This may be useful for exporting mounted CDs.
     3217                the <a class="link" href="smb.conf.5.html#STOREDOSATTRIBUTES">store dos attributes</a> method. This may be useful for exporting mounted CDs.
    26813218                </p></li></ul></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>map read only</code></em> = <code class="literal">yes</code>
    26823219</em></span>
    2683 </p></dd><dt><span class="term"><a name="MAPSYSTEM"></a>map system (S)</span></dt><dd><p>
     3220</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340269"></a>
     3221
     3222map system (S)
     3223</h3></div></div></div><a class="indexterm" name="id340270"></a><a name="MAPSYSTEM"></a><div class="variablelist"><dl><dt></dt><dd><p>
    26843224        This controls whether DOS style system files should be mapped to the UNIX group execute bit.
    26853225        </p><p>
    2686         Note that this requires the <a class="indexterm" name="id315731"></a>create mask        to be set such that the group
     3226        Note that this requires the <a class="link" href="smb.conf.5.html#CREATEMASK">create mask</a>   to be set such that the group
    26873227        execute bit is not masked out (i.e. it must include 010). See the parameter
    2688         <a class="indexterm" name="id315739"></a>create mask for details.
     3228        <a class="link" href="smb.conf.5.html#CREATEMASK">create mask</a> for details.
    26893229        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>map system</code></em> = <code class="literal">no</code>
    26903230</em></span>
    2691 </p></dd><dt><span class="term"><a name="MAPTOGUEST"></a>map to guest (G)</span></dt><dd><p>This parameter is only useful in <a class="indexterm" name="id315785"></a>SECURITY =
    2692     security modes other than <em class="parameter"><code>security = share</code></em>
     3231</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340335"></a>
     3232
     3233map to guest (G)
     3234</h3></div></div></div><a class="indexterm" name="id340336"></a><a name="MAPTOGUEST"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is only useful in <a class="link" href="smb.conf.5.html#SECURITY">SECURITY =
     3235    security</a> modes other than <em class="parameter"><code>security = share</code></em>
    26933236    and <em class="parameter"><code>security = server</code></em>
    26943237    - i.e. <code class="constant">user</code>, and <code class="constant">domain</code>.</p><p>This parameter can take four different values, which tell
    2695     <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> what to do with user
     3238    <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> what to do with user
    26963239    login requests that don't match a valid UNIX user in some way.</p><p>The four settings are :</p><div class="itemizedlist"><ul type="disc"><li><p><code class="constant">Never</code> - Means user login
    26973240            requests with an invalid password are rejected. This is the
    … …  
    26993242            logins with an invalid password are rejected, unless the username
    27003243            does not exist, in which case it is treated as a guest login and
    2701             mapped into the <a class="indexterm" name="id315849"></a>guest account.</p></li><li><p><code class="constant">Bad Password</code> - Means user logins
     3244            mapped into the <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account</a>.</p></li><li><p><code class="constant">Bad Password</code> - Means user logins
    27023245            with an invalid password are treated as a guest login and mapped
    2703             into the <a class="indexterm" name="id315866"></a>guest account. Note that
     3246            into the <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account</a>. Note that
    27043247            this can cause problems as it means that any user incorrectly typing
    27053248            their password will be silently logged on as "guest" - and
    … …  
    27313274</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>map to guest</code></em> = <code class="literal">Bad User</code>
    27323275</em></span>
    2733 </p></dd><dt><span class="term"><a name="MAXCONNECTIONS"></a>max connections (S)</span></dt><dd><p>This option allows the number of simultaneous connections to a service to be limited.
     3276</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340551"></a>
     3277
     3278max connections (S)
     3279</h3></div></div></div><a class="indexterm" name="id340552"></a><a name="MAXCONNECTIONS"></a><div class="variablelist"><dl><dt></dt><dd><p>This option allows the number of simultaneous connections to a service to be limited.
    27343280    If <em class="parameter"><code>max connections</code></em> is greater than 0 then connections
    27353281    will be refused if this number of connections to the service are already open. A value
    27363282    of zero mean an unlimited number of connections may be made.</p><p>Record lock files are used to implement this feature. The lock files will be stored in
    2737     the directory specified by the <a class="indexterm" name="id316002"></a>lock directory option.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max connections</code></em> = <code class="literal">0</code>
     3283    the directory specified by the <a class="link" href="smb.conf.5.html#LOCKDIRECTORY">lock directory</a> option.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max connections</code></em> = <code class="literal">0</code>
    27383284</em></span>
    27393285</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>max connections</code></em> = <code class="literal">10</code>
    27403286</em></span>
    2741 </p></dd><dt><span class="term"><a name="MAXDISKSIZE"></a>max disk size (G)</span></dt><dd><p>This option allows you to put an upper limit
     3287</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340632"></a>
     3288
     3289max disk size (G)
     3290</h3></div></div></div><a class="indexterm" name="id340633"></a><a name="MAXDISKSIZE"></a><div class="variablelist"><dl><dt></dt><dd><p>This option allows you to put an upper limit
    27423291    on the apparent size of disks. If you set this option to 100
    27433292    then all shares will appear to be not larger than 100 MB in
    … …  
    27533302</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>max disk size</code></em> = <code class="literal">1000</code>
    27543303</em></span>
    2755 </p></dd><dt><span class="term"><a name="MAXLOGSIZE"></a>max log size (G)</span></dt><dd><p>
     3304</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340717"></a>
     3305
     3306max log size (G)
     3307</h3></div></div></div><a class="indexterm" name="id340718"></a><a name="MAXLOGSIZE"></a><div class="variablelist"><dl><dt></dt><dd><p>
    27563308    This option (an integer in kilobytes) specifies the max size the log file should grow to.
    27573309    Samba periodically checks the size and if it is exceeded it will rename the file, adding
    … …  
    27623314</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>max log size</code></em> = <code class="literal">1000</code>
    27633315</em></span>
    2764 </p></dd><dt><span class="term"><a name="MAXMUX"></a>max mux (G)</span></dt><dd><p>This option controls the maximum number of
     3316</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340785"></a>
     3317
     3318max mux (G)
     3319</h3></div></div></div><a class="indexterm" name="id340786"></a><a name="MAXMUX"></a><div class="variablelist"><dl><dt></dt><dd><p>This option controls the maximum number of
    27653320    outstanding simultaneous SMB operations that Samba tells the client
    27663321        it will allow. You should never need to set this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max mux</code></em> = <code class="literal">50</code>
    27673322</em></span>
    2768 </p></dd><dt><span class="term"><a name="MAXOPENFILES"></a>max open files (G)</span></dt><dd><p>This parameter limits the maximum number of
    2769     open files that one <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> file
     3323</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340827"></a>
     3324
     3325max open files (G)
     3326</h3></div></div></div><a class="indexterm" name="id340828"></a><a name="MAXOPENFILES"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter limits the maximum number of
     3327    open files that one <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> file
    27703328    serving process may have open for a client at any one time. The
    27713329    default for this parameter is set very high (10,000) as Samba uses
    … …  
    27743332    this parameter so you should never need to touch this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max open files</code></em> = <code class="literal">10000</code>
    27753333</em></span>
    2776 </p></dd><dt><span class="term"><a name="MAXPRINTJOBS"></a>max print jobs (S)</span></dt><dd><p>This parameter limits the maximum number of
     3334</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340882"></a>
     3335
     3336max print jobs (S)
     3337</h3></div></div></div><a class="indexterm" name="id340884"></a><a name="MAXPRINTJOBS"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter limits the maximum number of
    27773338    jobs allowable in a Samba printer queue at any given moment.
    2778     If this number is exceeded, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will remote "Out of Space" to the client.
     3339    If this number is exceeded, <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will remote "Out of Space" to the client.
    27793340        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max print jobs</code></em> = <code class="literal">1000</code>
    27803341</em></span>
    27813342</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>max print jobs</code></em> = <code class="literal">5000</code>
    27823343</em></span>
    2783 </p></dd><dt><span class="term"><a name="PROTOCOL"></a>protocol</span></dt><dd><p>This parameter is a synonym for max protocol.</p></dd><dt><span class="term"><a name="MAXPROTOCOL"></a>max protocol (G)</span></dt><dd><p>The value of the parameter (a string) is the highest
     3344</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340950"></a><a name="PROTOCOL"></a>protocol</h3></div></div></div><a class="indexterm" name="id340951"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#MAXPROTOCOL">max protocol</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340980"></a>
     3345
     3346max protocol (G)
     3347</h3></div></div></div><a class="indexterm" name="id340982"></a><a name="MAXPROTOCOL"></a><div class="variablelist"><dl><dt></dt><dd><p>The value of the parameter (a string) is the highest
    27843348    protocol level that will be supported by the server.</p><p>Possible values are :</p><div class="itemizedlist"><ul type="disc"><li><p><code class="constant">CORE</code>: Earliest version. No
    27853349            concept of user names.</p></li><li><p><code class="constant">COREPLUS</code>: Slight improvements on
    … …  
    27933357</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>max protocol</code></em> = <code class="literal">LANMAN1</code>
    27943358</em></span>
    2795 </p></dd><dt><span class="term"><a name="MAXREPORTEDPRINTJOBS"></a>max reported print jobs (S)</span></dt><dd><p>
     3359</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341100"></a>
     3360
     3361max reported print jobs (S)
     3362</h3></div></div></div><a class="indexterm" name="id341101"></a><a name="MAXREPORTEDPRINTJOBS"></a><div class="variablelist"><dl><dt></dt><dd><p>
    27963363    This parameter limits the maximum number of jobs displayed in a port monitor for
    27973364    Samba printer queue at any given moment. If this number is exceeded, the excess
    … …  
    28023369</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>max reported print jobs</code></em> = <code class="literal">1000</code>
    28033370</em></span>
    2804 </p></dd><dt><span class="term"><a name="MAXSMBDPROCESSES"></a>max smbd processes (G)</span></dt><dd><p>This parameter limits the maximum number of <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> processes concurrently running on a system and is intended
     3371</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341159"></a>
     3372
     3373max smbd processes (G)
     3374</h3></div></div></div><a class="indexterm" name="id341160"></a><a name="MAXSMBDPROCESSES"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter limits the maximum number of <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> processes concurrently running on a system and is intended
    28053375    as a stopgap to prevent degrading service to clients in the event that the server has insufficient
    28063376    resources to handle more than this number of connections.  Remember that under normal operating
    2807     conditions, each user will have an <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> associated with him or her to handle connections to all
     3377    conditions, each user will have an <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> associated with him or her to handle connections to all
    28083378    shares from a given host.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max smbd processes</code></em> = <code class="literal">0</code>
    28093379</em></span>
    28103380</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>max smbd processes</code></em> = <code class="literal">1000</code>
    28113381</em></span>
    2812 </p></dd><dt><span class="term"><a name="MAXSTATCACHESIZE"></a>max stat cache size (G)</span></dt><dd><p>This parameter limits the size in memory of any
    2813          <em class="parameter"><code>stat cache</code></em> being used
    2814         to speed up case insensitive name mappings. This parameter is
    2815         the number of kilobyte (1024) units the stat cache can use.
    2816         A value of zero means unlimited which is not advised a&#1109; it can
    2817         use a lot of memory.
    2818         You should not need to change this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max stat cache size</code></em> = <code class="literal">1024</code>
     3382</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341236"></a>
     3383
     3384max stat cache size (G)
     3385</h3></div></div></div><a class="indexterm" name="id341237"></a><a name="MAXSTATCACHESIZE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter limits the size in memory of any
     3386          <em class="parameter"><code>stat cache</code></em> being used
     3387          to speed up case insensitive name mappings. It represents
     3388          the number of kilobyte (1024) units the stat cache can use.
     3389          A value of zero, meaning unlimited, is not advisable due to
     3390          increased memory useage.  You should not need to change this
     3391          parameter.
     3392        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max stat cache size</code></em> = <code class="literal">256</code>
    28193393</em></span>
    28203394</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>max stat cache size</code></em> = <code class="literal">100</code>
    28213395</em></span>
    2822 </p></dd><dt><span class="term"><a name="MAXTTL"></a>max ttl (G)</span></dt><dd><p>This option tells <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> what the default 'time to live'
     3396</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341302"></a>
     3397
     3398max ttl (G)
     3399</h3></div></div></div><a class="indexterm" name="id341303"></a><a name="MAXTTL"></a><div class="variablelist"><dl><dt></dt><dd><p>This option tells <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> what the default 'time to live'
    28233400    of NetBIOS names should be (in seconds) when <code class="literal">nmbd</code> is
    28243401    requesting a name using either a broadcast packet or from a WINS server. You should
    28253402        never need to change this parameter. The default is 3 days.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max ttl</code></em> = <code class="literal">259200</code>
    28263403</em></span>
    2827 </p></dd><dt><span class="term"><a name="MAXWINSTTL"></a>max wins ttl (G)</span></dt><dd><p>This option tells <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when acting as a WINS server
    2828         (<a class="indexterm" name="id316771"></a>wins support = yes) what the maximum
     3404</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341358"></a>
     3405
     3406max wins ttl (G)
     3407</h3></div></div></div><a class="indexterm" name="id341359"></a><a name="MAXWINSTTL"></a><div class="variablelist"><dl><dt></dt><dd><p>This option tells <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when acting as a WINS server
     3408        (<a class="link" href="smb.conf.5.html#WINSSUPPORT">wins support = yes</a>) what the maximum
    28293409    'time to live' of NetBIOS names that <code class="literal">nmbd</code>
    28303410    will grant will be (in seconds). You should never need to change this
    28313411        parameter.  The default is 6 days (518400 seconds).</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max wins ttl</code></em> = <code class="literal">518400</code>
    28323412</em></span>
    2833 </p></dd><dt><span class="term"><a name="MAXXMIT"></a>max xmit (G)</span></dt><dd><p>This option controls the maximum packet size
     3413</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341426"></a>
     3414
     3415max xmit (G)
     3416</h3></div></div></div><a class="indexterm" name="id341427"></a><a name="MAXXMIT"></a><div class="variablelist"><dl><dt></dt><dd><p>This option controls the maximum packet size
    28343417    that will be negotiated by Samba. The default is 16644, which
    28353418    matches the behavior of Windows 2000.  A value below 2048 is likely to cause problems.
    … …  
    28393422</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>max xmit</code></em> = <code class="literal">8192</code>
    28403423</em></span>
    2841 </p></dd><dt><span class="term"><a name="MESSAGECOMMAND"></a>message command (G)</span></dt><dd><p>This specifies what command to run when the
     3424</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341486"></a>
     3425
     3426message command (G)
     3427</h3></div></div></div><a class="indexterm" name="id341487"></a><a name="MESSAGECOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>This specifies what command to run when the
    28423428        server receives a WinPopup style message.</p><p>This would normally be a command that would
    28433429        deliver the message somehow. How this is to be done is
    … …  
    28783464</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>message command</code></em> = <code class="literal">csh -c 'xedit %s; rm %s' &amp;</code>
    28793465</em></span>
    2880 </p></dd><dt><span class="term"><a name="MINPRINTSPACE"></a>min print space (S)</span></dt><dd><p>This sets the minimum amount of free disk
     3466</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341678"></a>
     3467
     3468min print space (S)
     3469</h3></div></div></div><a class="indexterm" name="id341679"></a><a name="MINPRINTSPACE"></a><div class="variablelist"><dl><dt></dt><dd><p>This sets the minimum amount of free disk
    28813470    space that must be available before a user will be able to spool
    28823471    a print job. It is specified in kilobytes. The default is 0, which
    … …  
    28853474</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>min print space</code></em> = <code class="literal">2000</code>
    28863475</em></span>
    2887 </p></dd><dt><span class="term"><a name="MINPROTOCOL"></a>min protocol (G)</span></dt><dd><p>The value of the parameter (a string) is the
     3476</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341738"></a>
     3477
     3478min protocol (G)
     3479</h3></div></div></div><a class="indexterm" name="id341739"></a><a name="MINPROTOCOL"></a><div class="variablelist"><dl><dt></dt><dd><p>The value of the parameter (a string) is the
    28883480    lowest SMB protocol dialect than Samba will support.  Please refer
    2889     to the <a class="indexterm" name="id317130"></a>max protocol
     3481    to the <a class="link" href="smb.conf.5.html#MAXPROTOCOL">max protocol</a>
    28903482    parameter for a list of valid protocol names and a brief description
    28913483    of each.  You may also wish to refer to the C source code in
    28923484    <code class="filename">source/smbd/negprot.c</code> for a listing of known protocol
    28933485    dialects supported by clients.</p><p>If you are viewing this parameter as a security measure, you should
    2894     also refer to the <a class="indexterm" name="id317149"></a>lanman auth parameter.  Otherwise, you should never need
     3486    also refer to the <a class="link" href="smb.conf.5.html#LANMANAUTH">lanman auth</a> parameter.  Otherwise, you should never need
    28953487    to change this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>min protocol</code></em> = <code class="literal">CORE</code>
    28963488</em></span>
    28973489</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>min protocol</code></em> = <code class="literal">NT1</code>
    28983490</em></span>
    2899 </p></dd><dt><span class="term"><a name="MINWINSTTL"></a>min wins ttl (G)</span></dt><dd><p>This option tells <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a>
    2900     when acting as a WINS server (<a class="indexterm" name="id317220"></a>wins support = yes) what the minimum 'time to live'
     3491</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341830"></a>
     3492
     3493min wins ttl (G)
     3494</h3></div></div></div><a class="indexterm" name="id341831"></a><a name="MINWINSTTL"></a><div class="variablelist"><dl><dt></dt><dd><p>This option tells <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a>
     3495    when acting as a WINS server (<a class="link" href="smb.conf.5.html#WINSSUPPORT">wins support = yes</a>) what the minimum 'time to live'
    29013496    of NetBIOS names that <code class="literal">nmbd</code> will grant will be (in
    29023497    seconds). You should never need to change this parameter.  The default
    29033498    is 6 hours (21600 seconds).</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>min wins ttl</code></em> = <code class="literal">21600</code>
    29043499</em></span>
    2905 </p></dd><dt><span class="term"><a name="MSDFSPROXY"></a>msdfs proxy (S)</span></dt><dd><p>This parameter indicates that the share is a
     3500</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341896"></a>
     3501
     3502msdfs proxy (S)
     3503</h3></div></div></div><a class="indexterm" name="id341897"></a><a name="MSDFSPROXY"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter indicates that the share is a
    29063504        stand-in for another CIFS share whose location is specified by
    29073505        the value of the parameter. When clients attempt to connect to
    29083506        this share, they are redirected to the proxied share using
    29093507        the SMB-Dfs protocol.</p><p>Only Dfs roots can act as proxy shares. Take a look at the
    2910         <a class="indexterm" name="id317279"></a>msdfs root and <a class="indexterm" name="id317286"></a>host msdfs
    2911         options to find out how to set up a Dfs root share.</p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>msdfs proxy</code></em> = <code class="literal">\\otherserver\someshare</code>
    2912 </em></span>
    2913 </p></dd><dt><span class="term"><a name="MSDFSROOT"></a>msdfs root (S)</span></dt><dd><p>If set to <code class="constant">yes</code>, Samba treats the
     3508        <a class="link" href="smb.conf.5.html#MSDFSROOT">msdfs root</a> and <a class="link" href="smb.conf.5.html#HOSTMSDFS">host msdfs</a>
     3509        options to find out how to set up a Dfs root share.</p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>msdfs proxy</code></em> = <code class="literal">\otherserver\someshare</code>
     3510</em></span>
     3511</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341969"></a>
     3512
     3513msdfs root (S)
     3514</h3></div></div></div><a class="indexterm" name="id341970"></a><a name="MSDFSROOT"></a><div class="variablelist"><dl><dt></dt><dd><p>If set to <code class="constant">yes</code>, Samba treats the
    29143515        share as a Dfs root and allows clients to browse the
    29153516        distributed file system tree rooted at the share directory.
    … …  
    29193520        Samba, refer to the MSDFS chapter in the Samba3-HOWTO book.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>msdfs root</code></em> = <code class="literal">no</code>
    29203521</em></span>
    2921 </p></dd><dt><span class="term"><a name="NAMECACHETIMEOUT"></a>name cache timeout (G)</span></dt><dd><p>Specifies the number of seconds it takes before
     3522</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342022"></a>
     3523
     3524name cache timeout (G)
     3525</h3></div></div></div><a class="indexterm" name="id342023"></a><a name="NAMECACHETIMEOUT"></a><div class="variablelist"><dl><dt></dt><dd><p>Specifies the number of seconds it takes before
    29223526    entries in samba's hostname resolve cache time out. If
    29233527    the timeout is set to 0. the caching is disabled.
    … …  
    29263530</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>name cache timeout</code></em> = <code class="literal">0</code>
    29273531</em></span>
    2928 </p></dd><dt><span class="term"><a name="NAMERESOLVEORDER"></a>name resolve order (G)</span></dt><dd><p>This option is used by the programs in the Samba
     3532</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342080"></a>
     3533
     3534name resolve order (G)
     3535</h3></div></div></div><a class="indexterm" name="id342081"></a><a name="NAMERESOLVEORDER"></a><div class="variablelist"><dl><dt></dt><dd><p>This option is used by the programs in the Samba
    29293536    suite to determine what naming services to use and in what order
    29303537    to resolve host names to IP addresses. Its main purpose to is to
    … …  
    29443551                _ldap._tcp.domain.
    29453552        </p></li><li><p><code class="constant">wins</code> : Query a name with
    2946             the IP address listed in the <a class="indexterm" name="id317498"></a>WINSSERVER parameter.  If no WINS server has
     3553            the IP address listed in the <a class="link" href="smb.conf.5.html#WINSSERVER">WINSSERVER</a> parameter.  If no WINS server has
    29473554            been specified this method will be ignored.</p></li><li><p><code class="constant">bcast</code> : Do a broadcast on
    2948             each of the known local interfaces listed in the <a class="indexterm" name="id317515"></a>interfaces
     3555            each of the known local interfaces listed in the <a class="link" href="smb.conf.5.html#INTERFACES">interfaces</a>
    29493556            parameter. This is the least reliable of the name resolution
    29503557            methods as it depends on the target host being on a locally
    … …  
    29573564</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>name resolve order</code></em> = <code class="literal">lmhosts bcast host</code>
    29583565</em></span>
    2959 </p></dd><dt><span class="term"><a name="NETBIOSALIASES"></a>netbios aliases (G)</span></dt><dd><p>This is a list of NetBIOS names that nmbd will
     3566</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342261"></a>
     3567
     3568netbios aliases (G)
     3569</h3></div></div></div><a class="indexterm" name="id342262"></a><a name="NETBIOSALIASES"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a list of NetBIOS names that nmbd will
    29603570        advertise as additional names by which the Samba server is known. This allows one machine
    29613571        to appear in browse lists under multiple names. If a machine is acting as a browse server
    … …  
    29673577</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>netbios aliases</code></em> = <code class="literal">TEST TEST1 TEST2</code>
    29683578</em></span>
    2969 </p></dd><dt><span class="term"><a name="NETBIOSNAME"></a>netbios name (G)</span></dt><dd><p>
     3579</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342322"></a>
     3580
     3581netbios name (G)
     3582</h3></div></div></div><a class="indexterm" name="id342323"></a><a name="NETBIOSNAME"></a><div class="variablelist"><dl><dt></dt><dd><p>
    29703583                This sets the NetBIOS name by which a Samba server is known. By default it is the same as the first component
    29713584                of the host's DNS name. If a machine is a browse server or logon server this name (or the first component of
    … …  
    29803593</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>netbios name</code></em> = <code class="literal">MYNAME</code>
    29813594</em></span>
    2982 </p></dd><dt><span class="term"><a name="NETBIOSSCOPE"></a>netbios scope (G)</span></dt><dd><p>This sets the NetBIOS scope that Samba will
     3595</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342399"></a>
     3596
     3597netbios scope (G)
     3598</h3></div></div></div><a class="indexterm" name="id342400"></a><a name="NETBIOSSCOPE"></a><div class="variablelist"><dl><dt></dt><dd><p>This sets the NetBIOS scope that Samba will
    29833599        operate under. This should not be set unless every machine
    29843600        on your LAN also sets this value.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>netbios scope</code></em> = <code class="literal"></code>
    29853601</em></span>
    2986 </p></dd><dt><span class="term"><a name="NISHOMEDIR"></a>nis homedir (G)</span></dt><dd><p>Get the home share server from a NIS map. For
     3602</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342440"></a>
     3603
     3604nis homedir (G)
     3605</h3></div></div></div><a class="indexterm" name="id342441"></a><a name="NISHOMEDIR"></a><div class="variablelist"><dl><dt></dt><dd><p>Get the home share server from a NIS map. For
    29873606        UNIX systems that use an automounter, the user's home directory
    29883607        will often be mounted on a workstation on demand from a remote
    … …  
    29983617        server. When Samba is returning the home share to the client, it
    29993618        will consult the NIS map specified in
    3000         <a class="indexterm" name="id317804"></a>homedir map and return the server
     3619        <a class="link" href="smb.conf.5.html#HOMEDIRMAP">homedir map</a> and return the server
    30013620        listed there.</p><p>Note that for this option to work there must be a working
    30023621        NIS system and the Samba server with this option must also
    30033622        be a logon server.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>nis homedir</code></em> = <code class="literal">no</code>
    30043623</em></span>
    3005 </p></dd><dt><span class="term"><a name="NTACLSUPPORT"></a>nt acl support (S)</span></dt><dd><p>This boolean parameter controls whether <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will attempt to map
     3624</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342511"></a>
     3625
     3626nt acl support (S)
     3627</h3></div></div></div><a class="indexterm" name="id342512"></a><a name="NTACLSUPPORT"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean parameter controls whether <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will attempt to map
    30063628    UNIX permissions into Windows NT access control lists.  The UNIX
    30073629    permissions considered are the the traditional UNIX owner and
    … …  
    30103632    releases prior to 2.2.2.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>nt acl support</code></em> = <code class="literal">yes</code>
    30113633</em></span>
    3012 </p></dd><dt><span class="term"><a name="NTLMAUTH"></a>ntlm auth (G)</span></dt><dd><p>This parameter determines whether or not <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will attempt to
     3634</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342562"></a>
     3635
     3636ntlm auth (G)
     3637</h3></div></div></div><a class="indexterm" name="id342563"></a><a name="NTLMAUTH"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter determines whether or not <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will attempt to
    30133638    authenticate users using the NTLM encrypted password response.
    30143639    If disabled, either the lanman password hash or an NTLMv2 response
    … …  
    30183643        special configuration to us it.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ntlm auth</code></em> = <code class="literal">yes</code>
    30193644</em></span>
    3020 </p></dd><dt><span class="term"><a name="NTPIPESUPPORT"></a>nt pipe support (G)</span></dt><dd><p>This boolean parameter controls whether
    3021     <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will allow Windows NT
     3645</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342622"></a>
     3646
     3647nt pipe support (G)
     3648</h3></div></div></div><a class="indexterm" name="id342623"></a><a name="NTPIPESUPPORT"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean parameter controls whether
     3649    <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will allow Windows NT
    30223650    clients to connect to the NT SMB specific <code class="constant">IPC$</code>
    30233651    pipes. This is a developer debugging option and can be left
    30243652        alone.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>nt pipe support</code></em> = <code class="literal">yes</code>
    30253653</em></span>
    3026 </p></dd><dt><span class="term"><a name="NTSTATUSSUPPORT"></a>nt status support (G)</span></dt><dd><p>This boolean parameter controls whether <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will negotiate NT specific status
     3654</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342676"></a>
     3655
     3656nt status support (G)
     3657</h3></div></div></div><a class="indexterm" name="id342677"></a><a name="NTSTATUSSUPPORT"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean parameter controls whether <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will negotiate NT specific status
    30273658    support with Windows NT/2k/XP clients. This is a developer debugging option and should be left alone.
    30283659    If this option is set to <code class="constant">no</code> then Samba offers
    … …  
    30303661    reported.</p><p>You should not need to ever disable this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>nt status support</code></em> = <code class="literal">yes</code>
    30313662</em></span>
    3032 </p></dd><dt><span class="term"><a name="NULLPASSWORDS"></a>null passwords (G)</span></dt><dd><p>Allow or disallow client access to accounts that have null passwords. </p><p>See also <a href="smbpasswd.5.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(5)</span></a>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>null passwords</code></em> = <code class="literal">no</code>
    3033 </em></span>
    3034 </p></dd><dt><span class="term"><a name="OBEYPAMRESTRICTIONS"></a>obey pam restrictions (G)</span></dt><dd><p>When Samba 3.0 is configured to enable PAM support
     3663</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342734"></a>
     3664
     3665null passwords (G)
     3666</h3></div></div></div><a class="indexterm" name="id342735"></a><a name="NULLPASSWORDS"></a><div class="variablelist"><dl><dt></dt><dd><p>Allow or disallow client access to accounts that have null passwords. </p><p>See also <a class="citerefentry" href="smbpasswd.5.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(5)</span></a>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>null passwords</code></em> = <code class="literal">no</code>
     3667</em></span>
     3668</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342785"></a>
     3669
     3670obey pam restrictions (G)
     3671</h3></div></div></div><a class="indexterm" name="id342786"></a><a name="OBEYPAMRESTRICTIONS"></a><div class="variablelist"><dl><dt></dt><dd><p>When Samba 3.0 is configured to enable PAM support
    30353672    (i.e. --with-pam), this parameter will control whether or not Samba
    30363673    should obey PAM's account and session management directives.  The
    30373674    default behavior is to use PAM for clear text authentication only
    30383675    and to ignore any account or session management.  Note that Samba
    3039     always ignores PAM for authentication in the case of <a class="indexterm" name="id318122"></a>encrypt passwords = yes.  The reason
     3676    always ignores PAM for authentication in the case of <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS">encrypt passwords = yes</a>.  The reason
    30403677    is that PAM modules cannot support the challenge/response
    30413678    authentication mechanism needed in the presence of SMB password encryption.
    30423679</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>obey pam restrictions</code></em> = <code class="literal">no</code>
    30433680</em></span>
    3044 </p></dd><dt><span class="term"><a name="ONLYUSER"></a>only user (S)</span></dt><dd><p>This is a boolean option that controls whether
     3681</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342841"></a>
     3682
     3683only user (S)
     3684</h3></div></div></div><a class="indexterm" name="id342842"></a><a name="ONLYUSER"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a boolean option that controls whether
    30453685    connections with usernames not in the <em class="parameter"><code>user</code></em>
    30463686    list will be allowed. By default this option is disabled so that a
    … …  
    30483688    this parameter will force the server to only use the login
    30493689    names from the <em class="parameter"><code>user</code></em> list and is only really
    3050     useful in <a class="indexterm" name="id318183"></a>security = share level security.</p><p>Note that this also means Samba won't try to deduce
     3690    useful in <a class="link" href="smb.conf.5.html#SECURITY">security = share</a> level security.</p><p>Note that this also means Samba won't try to deduce
    30513691    usernames from the service name. This can be annoying for
    30523692    the [homes] section. To get around this you could use <code class="literal">user =
    … …  
    30553695    name of the user.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>only user</code></em> = <code class="literal">no</code>
    30563696</em></span>
    3057 </p></dd><dt><span class="term"><a name="OPENFILESDATABASEHASHSIZE"></a>open files database hash size (G)</span></dt><dd><p>This parameter was added in Samba 3.0.23. This is an internal tuning parameter that sets
     3697</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342924"></a>
     3698
     3699open files database hash size (G)
     3700</h3></div></div></div><a class="indexterm" name="id342925"></a><a name="OPENFILESDATABASEHASHSIZE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter was added in Samba 3.0.23. This is an internal tuning parameter that sets
    30583701        the hash size of the tdb used for the open file databases. The presence of this parameter
    30593702        allows tuning of the system for very large (thousands of concurrent users) Samba setups.
    … …  
    30633706</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>open files database hash size</code></em> = <code class="literal">1338457</code>
    30643707</em></span>
    3065 </p></dd><dt><span class="term"><a name="OPLOCKBREAKWAITTIME"></a>oplock break wait time (G)</span></dt><dd><p>
     3708</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id342986"></a>
     3709
     3710oplock break wait time (G)
     3711</h3></div></div></div><a class="indexterm" name="id342988"></a><a name="OPLOCKBREAKWAITTIME"></a><div class="variablelist"><dl><dt></dt><dd><p>
    30663712        This is a tuning parameter added due to bugs in both Windows 9x and WinNT. If Samba responds to a client too
    30673713        quickly when that client issues an SMB that can cause an oplock break request, then the network client can
    … …  
    30723718        </p></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>oplock break wait time</code></em> = <code class="literal">0</code>
    30733719</em></span>
    3074 </p></dd><dt><span class="term"><a name="OPLOCKCONTENTIONLIMIT"></a>oplock contention limit (S)</span></dt><dd><p>
    3075         This is a <span class="emphasis"><em>very</em></span> advanced <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> tuning option to improve the efficiency of the
     3720</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343035"></a>
     3721
     3722oplock contention limit (S)
     3723</h3></div></div></div><a class="indexterm" name="id343036"></a><a name="OPLOCKCONTENTIONLIMIT"></a><div class="variablelist"><dl><dt></dt><dd><p>
     3724        This is a <span class="emphasis"><em>very</em></span> advanced <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> tuning option to improve the efficiency of the
    30763725        granting of oplocks under multiple client contention for the same file.
    30773726        </p><p>
    3078         In brief it specifies a number, which causes <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>not to grant an oplock even when requested if the
     3727        In brief it specifies a number, which causes <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>not to grant an oplock even when requested if the
    30793728        approximate number of clients contending for an oplock on the same file goes over this
    30803729        limit. This causes <code class="literal">smbd</code> to behave in a similar
    … …  
    30843733        </p></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>oplock contention limit</code></em> = <code class="literal">2</code>
    30853734</em></span>
    3086 </p></dd><dt><span class="term"><a name="OPLOCKS"></a>oplocks (S)</span></dt><dd><p>
     3735</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343113"></a>
     3736
     3737oplocks (S)
     3738</h3></div></div></div><a class="indexterm" name="id343114"></a><a name="OPLOCKS"></a><div class="variablelist"><dl><dt></dt><dd><p>
    30873739        This boolean option tells <code class="literal">smbd</code> whether to
    30883740        issue oplocks (opportunistic locks) to file open requests on this
    … …  
    30963748        </p><p>
    30973749        Oplocks may be selectively turned off on certain files with a share. See
    3098         the <a class="indexterm" name="id318454"></a>veto oplock files parameter. On some systems
     3750        the <a class="link" href="smb.conf.5.html#VETOOPLOCKFILES">veto oplock files</a> parameter. On some systems
    30993751        oplocks are recognized by the underlying operating system. This
    31003752        allows data synchronization between all access to oplocked files,
    31013753        whether it be via Samba or NFS or a local UNIX process. See the
    3102         <a class="indexterm" name="id318463"></a>kernel oplocks parameter for details.
     3754        <a class="link" href="smb.conf.5.html#KERNELOPLOCKS">kernel oplocks</a> parameter for details.
    31033755        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>oplocks</code></em> = <code class="literal">yes</code>
    31043756</em></span>
    3105 </p></dd><dt><span class="term"><a name="OS2DRIVERMAP"></a>os2 driver map (G)</span></dt><dd><p>The parameter is used to define the absolute
     3757</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343203"></a>
     3758
     3759os2 driver map (G)
     3760</h3></div></div></div><a class="indexterm" name="id343204"></a><a name="OS2DRIVERMAP"></a><div class="variablelist"><dl><dt></dt><dd><p>The parameter is used to define the absolute
    31063761    path to a file containing a mapping of Windows NT printer driver
    31073762    names to OS/2 printer driver names.  The format is:</p><p>&lt;nt driver name&gt; = &lt;os2 driver name&gt;.&lt;device name&gt;</p><p>For example, a valid entry using the HP LaserJet 5
    … …  
    31133768    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>os2 driver map</code></em> = <code class="literal"></code>
    31143769</em></span>
    3115 </p></dd><dt><span class="term"><a name="OSLEVEL"></a>os level (G)</span></dt><dd><p>
     3770</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343264"></a>
     3771
     3772os level (G)
     3773</h3></div></div></div><a class="indexterm" name="id343265"></a><a name="OSLEVEL"></a><div class="variablelist"><dl><dt></dt><dd><p>
    31163774        This integer value controls what level Samba advertises itself as for browse elections. The value of this
    3117         parameter determines whether <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> has a chance of becoming a local master browser for the <a class="indexterm" name="id318576"></a>workgroup in the local broadcast area.
     3775        parameter determines whether <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> has a chance of becoming a local master browser for the <a class="link" href="smb.conf.5.html#WORKGROUP">workgroup</a> in the local broadcast area.
    31183776</p><p><span class="emphasis"><em>
    3119         Note :</em></span>By default, Samba will win a local master browsing election over all Microsoft operating
    3120         systems except a Windows NT 4.0/2000 Domain Controller.  This means that a misconfigured Samba host can
     3777        Note:</em></span> By default, Samba will win a local master browsing election over all Microsoft operating
     3778        systems except a Windows NT 4.0/2000 Domain Controller. This means that a misconfigured Samba host can
    31213779        effectively isolate a subnet for browsing purposes. This parameter is largely auto-configured in the Samba-3
    3122         release series and it is seldom necessary to manually over-ride the default setting. Please refer to
     3780        release series and it is seldom necessary to manually override the default setting. Please refer to
    31233781        chapter 9 of the Samba-3 HOWTO document for further information regarding the use of this parameter.
     3782        <span class="emphasis"><em>Note:</em></span> The maximum value for this parameter is 255. If you use higher values, counting
     3783        will start at 0!
    31243784        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>os level</code></em> = <code class="literal">20</code>
    31253785</em></span>
    31263786</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>os level</code></em> = <code class="literal">65</code>
    31273787</em></span>
    3128 </p></dd><dt><span class="term"><a name="PAMPASSWORDCHANGE"></a>pam password change (G)</span></dt><dd><p>With the addition of better PAM support in Samba 2.2,
     3788</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343355"></a>
     3789
     3790pam password change (G)
     3791</h3></div></div></div><a class="indexterm" name="id343356"></a><a name="PAMPASSWORDCHANGE"></a><div class="variablelist"><dl><dt></dt><dd><p>With the addition of better PAM support in Samba 2.2,
    31293792    this parameter, it is possible to use PAM's password change control
    31303793    flag for Samba.  If enabled, then PAM will be used for password
    31313794    changes when requested by an SMB client instead of the program listed in
    3132     <a class="indexterm" name="id318651"></a>passwd program.
     3795    <a class="link" href="smb.conf.5.html#PASSWDPROGRAM">passwd program</a>.
    31333796    It should be possible to enable this without changing your
    3134     <a class="indexterm" name="id318658"></a>passwd chat parameter for most setups.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>pam password change</code></em> = <code class="literal">no</code>
    3135 </em></span>
    3136 </p></dd><dt><span class="term"><a name="PANICACTION"></a>panic action (G)</span></dt><dd><p>This is a Samba developer option that allows a
    3137         system command to be called when either <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> or <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>        crashes. This is usually used to
     3797    <a class="link" href="smb.conf.5.html#PASSWDCHAT">passwd chat</a> parameter for most setups.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>pam password change</code></em> = <code class="literal">no</code>
     3798</em></span>
     3799</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343424"></a>
     3800
     3801panic action (G)
     3802</h3></div></div></div><a class="indexterm" name="id343425"></a><a name="PANICACTION"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a Samba developer option that allows a
     3803        system command to be called when either <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> or <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a>      crashes. This is usually used to
    31383804        draw attention to the fact that a problem occurred.
    31393805        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>panic action</code></em> = <code class="literal"></code>
    … …  
    31413807</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>panic action</code></em> = <code class="literal">"/bin/sleep 90000"</code>
    31423808</em></span>
    3143 </p></dd><dt><span class="term"><a name="PARANOIDSERVERSECURITY"></a>paranoid server security (G)</span></dt><dd><p>Some version of NT 4.x allow non-guest
     3809</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343498"></a>
     3810
     3811paranoid server security (G)
     3812</h3></div></div></div><a class="indexterm" name="id343499"></a><a name="PARANOIDSERVERSECURITY"></a><div class="variablelist"><dl><dt></dt><dd><p>Some version of NT 4.x allow non-guest
    31443813    users with a bad passowrd. When this option is enabled, samba will not
    31453814    use a broken NT 4.x server as password server, but instead complain
    … …  
    31493818    bad logon to the remote server.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>paranoid server security</code></em> = <code class="literal">yes</code>
    31503819</em></span>
    3151 </p></dd><dt><span class="term"><a name="PASSDBBACKEND"></a>passdb backend (G)</span></dt><dd><p>This option allows the administrator to chose which backend
     3820</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343545"></a>
     3821
     3822passdb backend (G)
     3823</h3></div></div></div><a class="indexterm" name="id343546"></a><a name="PASSDBBACKEND"></a><div class="variablelist"><dl><dt></dt><dd><p>This option allows the administrator to chose which backend
    31523824    will be used for storing user and possibly group information.  This allows
    3153     you to swap between dfferent storage mechanisms without recompile. </p><p>The parameter value is divided into two parts, the backend's name, and a 'location'
     3825    you to swap between different storage mechanisms without recompile. </p><p>The parameter value is divided into two parts, the backend's name, and a 'location'
    31543826    string that has meaning only to that particular backed.  These are separated
    31553827    by a : character.</p><p>Available backends can include:
    … …  
    31583830                </p></li><li><p><code class="literal">tdbsam</code> - The TDB based password storage
    31593831                backend.  Takes a path to the TDB as an optional argument (defaults to passdb.tdb
    3160                 in the <a class="indexterm" name="id318855"></a>private dir directory.</p></li><li><p><code class="literal">ldapsam</code> - The LDAP based passdb
     3832                in the <a class="link" href="smb.conf.5.html#PRIVATEDIR">private dir</a> directory.</p></li><li><p><code class="literal">ldapsam</code> - The LDAP based passdb
    31613833                backend.  Takes an LDAP URL as an optional argument (defaults to
    31623834                <code class="literal">ldap://localhost</code>)</p><p>LDAP connections should be secured where possible.  This may be done using either
    3163                 Start-TLS (see <a class="indexterm" name="id318885"></a>ldap ssl) or by
     3835                Start-TLS (see <a class="link" href="smb.conf.5.html#LDAPSSL">ldap ssl</a>) or by
    31643836                specifying <em class="parameter"><code>ldaps://</code></em> in
    3165                 the URL argument. </p><p>Multiple servers may also be specified in double-quotes, if your
    3166                 LDAP libraries supports the LDAP URL notation.
    3167                 (OpenLDAP does).   
     3837                the URL argument. </p><p>Multiple servers may also be specified in double-quotes.
     3838                Whether multiple servers are supported or not and the exact
     3839                syntax depends on the LDAP library you use.
    31683840                </p></li></ul></div><p>
    31693841
    … …  
    31733845passdb backend = tdbsam:/etc/samba/private/passdb.tdb
    31743846
    3175 or
     3847or multi server LDAP URL with OpenLDAP library:
    31763848
    31773849passdb backend = ldapsam:"ldap://ldap-1.example.com ldap://ldap-2.example.com"
     3850
     3851or multi server LDAP URL with Netscape based LDAP library:
     3852
     3853passdb backend = ldapsam:"ldap://ldap-1.example.com ldap-2.example.com"
    31783854</pre><p>Default: <span class="emphasis"><em><em class="parameter"><code>passdb backend</code></em> = <code class="literal">smbpasswd</code>
    31793855</em></span>
    3180 </p></dd><dt><span class="term"><a name="PASSDBEXPANDEXPLICIT"></a>passdb expand explicit (G)</span></dt><dd><p>
     3856</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343687"></a>
     3857
     3858passdb expand explicit (G)
     3859</h3></div></div></div><a class="indexterm" name="id343688"></a><a name="PASSDBEXPANDEXPLICIT"></a><div class="variablelist"><dl><dt></dt><dd><p>
    31813860        This parameter controls whether Samba substitutes %-macros in the passdb fields if they are explicitly set. We
    31823861        used to expand macros here, but this turned out to be a bug because the Windows client can expand a variable
    … …  
    31843863    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>passdb expand explicit</code></em> = <code class="literal">no</code>
    31853864</em></span>
    3186 </p></dd><dt><span class="term"><a name="PASSWDCHAT"></a>passwd chat (G)</span></dt><dd><p>This string controls the <span class="emphasis"><em>"chat"</em></span>
    3187     conversation that takes places between <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> and the local password changing
    3188     program to change the user's password. The string describes a
    3189     sequence of response-receive pairs that <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> uses to determine what to send to the
    3190     <a class="indexterm" name="id319013"></a>passwd program and what to expect back. If the expected output is not
    3191     received then the password is not changed.</p><p>This chat sequence is often quite site specific, depending
    3192     on what local methods are used for password control (such as NIS
    3193     etc).</p><p>Note that this parameter only is only used if the <a class="indexterm" name="id319030"></a>unix password sync parameter is set  to <code class="constant">yes</code>. This sequence is
    3194     then called <span class="emphasis"><em>AS ROOT</em></span> when the SMB password  in the
    3195     smbpasswd file is being changed, without access to the old password
    3196     cleartext. This means that root must be able to reset the user's password without
    3197     knowing the text of the previous password. In the presence of
    3198     NIS/YP,  this means that the <a class="indexterm" name="id319046"></a>passwd program must
    3199     be executed on the NIS master.
    3200     </p><p>The string can contain the macro <em class="parameter"><code>%n</code></em> which is substituted
    3201     for the new password.  The chat sequence can also contain the standard
    3202     macros \n, \r, \t and \s to
    3203     give line-feed, carriage-return, tab and space.  The chat sequence string can also contain
    3204     a '*' which matches any sequence of characters. Double quotes can be used to collect strings with spaces
    3205     in them into a single string.</p><p>If the send string in any part of the chat sequence  is a full
    3206     stop ".",  then no string is sent. Similarly,  if the
    3207     expect string is a full stop then no string is expected.</p><p>If the <a class="indexterm" name="id319074"></a>pam password change parameter is set to <code class="constant">yes</code>, the
    3208         chat pairs may be matched in any order, and success is determined by the PAM result, not any particular
    3209         output. The \n macro is ignored for PAM conversions.
    3210     </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>passwd chat</code></em> = <code class="literal">*new*password* %n\n*new*password* %n\n *changed*</code>
    3211 </em></span>
    3212 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>passwd chat</code></em> = <code class="literal">"*Enter OLD password*" %o\n "*Enter NEW password*" %n\n "*Reenter NEW password*" %n\n "*Password changed*"</code>
    3213 </em></span>
    3214 </p></dd><dt><span class="term"><a name="PASSWDCHATDEBUG"></a>passwd chat debug (G)</span></dt><dd><p>This boolean specifies if the passwd chat script
     3865</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343730"></a>
     3866
     3867passwd chat debug (G)
     3868</h3></div></div></div><a class="indexterm" name="id343731"></a><a name="PASSWDCHATDEBUG"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean specifies if the passwd chat script
    32153869    parameter is run in <span class="emphasis"><em>debug</em></span> mode. In this mode the
    32163870    strings passed to and received from the passwd chat are printed
    3217     in the <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> log with a
    3218     <a class="indexterm" name="id319156"></a>debug level
     3871    in the <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> log with a
     3872    <a class="link" href="smb.conf.5.html#DEBUGLEVEL">debug level</a>
    32193873    of 100. This is a dangerous option as it will allow plaintext passwords
    32203874    to be seen in the <code class="literal">smbd</code> log. It is available to help
    … …  
    32223876    when calling the <em class="parameter"><code>passwd program</code></em> and should
    32233877    be turned off after this has been done. This option has no effect if the
    3224     <a class="indexterm" name="id319184"></a>pam password change
    3225         paramter is set. This parameter is off by default.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>passwd chat debug</code></em> = <code class="literal">no</code>
    3226 </em></span>
    3227 </p></dd><dt><span class="term"><a name="PASSWDCHATTIMEOUT"></a>passwd chat timeout (G)</span></dt><dd><p>This integer specifies the number of seconds smbd will wait for an initial
     3878    <a class="link" href="smb.conf.5.html#PAMPASSWORDCHANGE">pam password change</a>
     3879        parameter is set. This parameter is off by default.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>passwd chat debug</code></em> = <code class="literal">no</code>
     3880</em></span>
     3881</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343826"></a>
     3882
     3883passwd chat timeout (G)
     3884</h3></div></div></div><a class="indexterm" name="id343827"></a><a name="PASSWDCHATTIMEOUT"></a><div class="variablelist"><dl><dt></dt><dd><p>This integer specifies the number of seconds smbd will wait for an initial
    32283885    answer from a passwd chat script being run. Once the initial answer is received
    32293886    the subsequent answers must be received in one tenth of this time. The default it
    32303887    two seconds.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>passwd chat timeout</code></em> = <code class="literal">2</code>
    32313888</em></span>
    3232 </p></dd><dt><span class="term"><a name="PASSWDPROGRAM"></a>passwd program (G)</span></dt><dd><p>The name of a program that can be used to set
     3889</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id343869"></a>
     3890
     3891passwd chat (G)
     3892</h3></div></div></div><a class="indexterm" name="id343870"></a><a name="PASSWDCHAT"></a><div class="variablelist"><dl><dt></dt><dd><p>This string controls the <span class="emphasis"><em>"chat"</em></span>
     3893    conversation that takes places between <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> and the local password changing
     3894    program to change the user's password. The string describes a
     3895    sequence of response-receive pairs that <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> uses to determine what to send to the
     3896    <a class="link" href="smb.conf.5.html#PASSWDPROGRAM">passwd program</a> and what to expect back. If the expected output is not
     3897    received then the password is not changed.</p><p>This chat sequence is often quite site specific, depending
     3898    on what local methods are used for password control (such as NIS
     3899    etc).</p><p>Note that this parameter only is only used if the <a class="link" href="smb.conf.5.html#UNIXPASSWORDSYNC">unix password sync</a> parameter is set  to <code class="constant">yes</code>. This sequence is
     3900    then called <span class="emphasis"><em>AS ROOT</em></span> when the SMB password  in the
     3901    smbpasswd file is being changed, without access to the old password
     3902    cleartext. This means that root must be able to reset the user's password without
     3903    knowing the text of the previous password. In the presence of
     3904    NIS/YP,  this means that the <a class="link" href="smb.conf.5.html#PASSWDPROGRAM">passwd program</a> must
     3905    be executed on the NIS master.
     3906    </p><p>The string can contain the macro <em class="parameter"><code>%n</code></em> which is substituted
     3907    for the new password.  The old passsword (<em class="parameter"><code>%o</code></em>) is only available when
     3908    <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS">encrypt passwords</a> has been disabled.
     3909    The chat sequence can also contain the standard macros
     3910    \n, \r, \t and \s to give line-feed, carriage-return, tab
     3911    and space.  The chat sequence string can also contain
     3912    a '*' which matches any sequence of characters. Double quotes can
     3913    be used to collect strings with spaces in them into a single
     3914    string.</p><p>If the send string in any part of the chat sequence  is a full
     3915    stop ".",  then no string is sent. Similarly,  if the
     3916    expect string is a full stop then no string is expected.</p><p>If the <a class="link" href="smb.conf.5.html#PAMPASSWORDCHANGE">pam password change</a> parameter is set to <code class="constant">yes</code>, the
     3917        chat pairs may be matched in any order, and success is determined by the PAM result, not any particular
     3918        output. The \n macro is ignored for PAM conversions.
     3919    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>passwd chat</code></em> = <code class="literal">*new*password* %n\n*new*password* %n\n *changed*</code>
     3920</em></span>
     3921</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>passwd chat</code></em> = <code class="literal">"*Enter NEW password*" %n\n "*Reenter NEW password*" %n\n "*Password changed*"</code>
     3922</em></span>
     3923</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344052"></a>
     3924
     3925passwd program (G)
     3926</h3></div></div></div><a class="indexterm" name="id344053"></a><a name="PASSWDPROGRAM"></a><div class="variablelist"><dl><dt></dt><dd><p>The name of a program that can be used to set
    32333927    UNIX user passwords.  Any occurrences of <em class="parameter"><code>%u</code></em>
    32343928    will be replaced with the user name. The user name is checked for
    … …  
    32513945</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>passwd program</code></em> = <code class="literal">/bin/passwd %u</code>
    32523946</em></span>
    3253 </p></dd><dt><span class="term"><a name="PASSWORDLEVEL"></a>password level (G)</span></dt><dd><p>Some client/server combinations have difficulty
     3947</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344178"></a>
     3948
     3949password level (G)
     3950</h3></div></div></div><a class="indexterm" name="id344179"></a><a name="PASSWORDLEVEL"></a><div class="variablelist"><dl><dt></dt><dd><p>Some client/server combinations have difficulty
    32543951    with mixed-case passwords.  One offending client is Windows for
    32553952    Workgroups, which for some reason forces passwords to upper
    … …  
    32693966    made - the password as is and the password in all-lower case.</p><p>This parameter is used only when using plain-text passwords. It is
    32703967    not at all used when encrypted passwords as in use (that is the default
    3271     since samba-3.0.0). Use this only when <a class="indexterm" name="id319448"></a>encrypt passwords = No.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>password level</code></em> = <code class="literal">0</code>
     3968    since samba-3.0.0). Use this only when <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS">encrypt passwords = No</a>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>password level</code></em> = <code class="literal">0</code>
    32723969</em></span>
    32733970</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>password level</code></em> = <code class="literal">4</code>
    32743971</em></span>
    3275 </p></dd><dt><span class="term"><a name="PASSWORDSERVER"></a>password server (G)</span></dt><dd><p>By specifying the name of another SMB server
     3972</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344300"></a>
     3973
     3974password server (G)
     3975</h3></div></div></div><a class="indexterm" name="id344301"></a><a name="PASSWORDSERVER"></a><div class="variablelist"><dl><dt></dt><dd><p>By specifying the name of another SMB server
    32763976    or Active Directory domain controller with this option,
    32773977    and using <code class="literal">security = [ads|domain|server]</code>
    … …  
    32853985    have no effect on password servers for Windows NT 4.0 domains or netbios
    32863986    connections.</p><p>If parameter is a name, it is looked up using the
    3287     parameter <a class="indexterm" name="id319530"></a>name resolve order and so may resolved
     3987    parameter <a class="link" href="smb.conf.5.html#NAMERESOLVEORDER">name resolve order</a> and so may resolved
    32883988    by any method and order described in that parameter.</p><p>The password server must be a machine capable of using
    32893989    the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in
    … …  
    33354035</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>password server</code></em> = <code class="literal">*</code>
    33364036</em></span>
    3337 </p></dd><dt><span class="term"><a name="DIRECTORY"></a>directory</span></dt><dd><p>This parameter is a synonym for path.</p></dd><dt><span class="term"><a name="PATH"></a>path (S)</span></dt><dd><p>This parameter specifies a directory to which
     4037</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344580"></a><a name="DIRECTORY"></a>directory</h3></div></div></div><a class="indexterm" name="id344581"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#PATH">path</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344610"></a>
     4038
     4039path (S)
     4040</h3></div></div></div><a class="indexterm" name="id344611"></a><a name="PATH"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies a directory to which
    33384041        the user of the service is to be given access. In the case of
    33394042        printable services, this is where print data will spool prior to
    … …  
    33474050        will be replaced by the NetBIOS name of the machine they are
    33484051        connecting from. These replacements are very useful for setting
    3349         up pseudo home directories for users.</p><p>Note that this path will be based on <a class="indexterm" name="id319834"></a>root dir
     4052        up pseudo home directories for users.</p><p>Note that this path will be based on <a class="link" href="smb.conf.5.html#ROOTDIR">root dir</a>
    33504053         if one was specified.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>path</code></em> = <code class="literal"></code>
    33514054</em></span>
    33524055</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>path</code></em> = <code class="literal">/home/fred</code>
    33534056</em></span>
    3354 </p></dd><dt><span class="term"><a name="PIDDIRECTORY"></a>pid directory (G)</span></dt><dd><p>
     4057</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344706"></a>
     4058
     4059pid directory (G)
     4060</h3></div></div></div><a class="indexterm" name="id344707"></a><a name="PIDDIRECTORY"></a><div class="variablelist"><dl><dt></dt><dd><p>
    33554061        This option specifies the directory where pid files will be placed. 
    33564062        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>pid directory</code></em> = <code class="literal">${prefix}/var/locks</code>
    … …  
    33584064</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>pid directory</code></em> = <code class="literal">pid directory = /var/run/</code>
    33594065</em></span>
    3360 </p></dd><dt><span class="term"><a name="POSIXLOCKING"></a>posix locking (S)</span></dt><dd><p>
    3361         The <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>
     4066</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344764"></a>
     4067
     4068posix locking (S)
     4069</h3></div></div></div><a class="indexterm" name="id344765"></a><a name="POSIXLOCKING"></a><div class="variablelist"><dl><dt></dt><dd><p>
     4070        The <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>
    33624071        daemon maintains an database of file locks obtained by SMB clients. The default behavior is
    33634072        to map this internal database to POSIX locks. This means that file locks obtained by SMB clients are
    … …  
    33664075        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>posix locking</code></em> = <code class="literal">yes</code>
    33674076</em></span>
    3368 </p></dd><dt><span class="term"><a name="POSTEXEC"></a>postexec (S)</span></dt><dd><p>This option specifies a command to be run
     4077</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344819"></a>
     4078
     4079postexec (S)
     4080</h3></div></div></div><a class="indexterm" name="id344820"></a><a name="POSTEXEC"></a><div class="variablelist"><dl><dt></dt><dd><p>This option specifies a command to be run
    33694081        whenever the service is disconnected. It takes the usual
    33704082        substitutions. The command may be run as the root on some
    … …  
    33744086</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>postexec</code></em> = <code class="literal">echo \"%u disconnected from %S from %m (%I)\" &gt;&gt; /tmp/log</code>
    33754087</em></span>
    3376 </p></dd><dt><span class="term"><a name="EXEC"></a>exec</span></dt><dd><p>This parameter is a synonym for preexec.</p></dd><dt><span class="term"><a name="PREEXEC"></a>preexec (S)</span></dt><dd><p>This option specifies a command to be run whenever
     4088</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344888"></a>
     4089
     4090preexec close (S)
     4091</h3></div></div></div><a class="indexterm" name="id344889"></a><a name="PREEXECCLOSE"></a><div class="variablelist"><dl><dt></dt><dd><p>
     4092        This boolean option controls whether a non-zero return code from <a class="link" href="smb.conf.5.html#PREEXEC">preexec</a>
     4093        should close the service being connected to.
     4094        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preexec close</code></em> = <code class="literal">no</code>
     4095</em></span>
     4096</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344940"></a><a name="EXEC"></a>exec</h3></div></div></div><a class="indexterm" name="id344941"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#PREEXEC">preexec</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344970"></a>
     4097
     4098preexec (S)
     4099</h3></div></div></div><a class="indexterm" name="id344971"></a><a name="PREEXEC"></a><div class="variablelist"><dl><dt></dt><dd><p>This option specifies a command to be run whenever
    33774100        the service is connected to. It takes the usual substitutions.</p><p>An interesting example is to send the users a welcome
    33784101        message every time they log in. Maybe a message of the day? Here
    … …  
    33814104        /usr/local/samba/bin/smbclient -M %m -I %I' &amp; </code>
    33824105        </p><p>Of course, this could get annoying after a while :-)</p><p>
    3383         See also <a class="indexterm" name="id320111"></a>preexec close and <a class="indexterm" name="id320118"></a>postexec.
     4106        See also <a class="link" href="smb.conf.5.html#PREEXECCLOSE">preexec close</a> and <a class="link" href="smb.conf.5.html#POSTEXEC">postexec</a>.
    33844107        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preexec</code></em> = <code class="literal"></code>
    33854108</em></span>
    33864109</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>preexec</code></em> = <code class="literal">echo \"%u connected to %S from %m (%I)\" &gt;&gt; /tmp/log</code>
    33874110</em></span>
    3388 </p></dd><dt><span class="term"><a name="PREEXECCLOSE"></a>preexec close (S)</span></dt><dd><p>
    3389         This boolean option controls whether a non-zero return code from <a class="indexterm" name="id320180"></a>preexec
    3390         should close the service being connected to.
    3391         </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preexec close</code></em> = <code class="literal">no</code>
    3392 </em></span>
    3393 </p></dd><dt><span class="term"><a name="PREFEREDMASTER"></a>prefered master</span></dt><dd><p>This parameter is a synonym for preferred master.</p></dd><dt><span class="term"><a name="PREFERREDMASTER"></a>preferred master (G)</span></dt><dd><p>
    3394         This boolean parameter controls if <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> is a preferred master browser  for its workgroup.
     4111</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345071"></a><a name="PREFEREDMASTER"></a>prefered master</h3></div></div></div><a class="indexterm" name="id345072"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#PREFERREDMASTER">preferred master</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345101"></a>
     4112
     4113preferred master (G)
     4114</h3></div></div></div><a class="indexterm" name="id345102"></a><a name="PREFERREDMASTER"></a><div class="variablelist"><dl><dt></dt><dd><p>
     4115        This boolean parameter controls if <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> is a preferred master browser  for its workgroup.
    33954116        </p><p>
    33964117        If this is set to <code class="constant">yes</code>, on startup, <code class="literal">nmbd</code> will force
    33974118        an election, and it will have a slight advantage in winning the election.  It is recommended that this
    3398         parameter is used in conjunction with <a class="indexterm" name="id320270"></a>domain master = yes, so that
     4119        parameter is used in conjunction with <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = yes</a>, so that
    33994120        <code class="literal">nmbd</code> can guarantee becoming a domain master.
    34004121        </p><p>
    … …  
    34054126        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preferred master</code></em> = <code class="literal">auto</code>
    34064127</em></span>
    3407 </p></dd><dt><span class="term"><a name="AUTOSERVICES"></a>auto services</span></dt><dd><p>This parameter is a synonym for preload.</p></dd><dt><span class="term"><a name="PRELOAD"></a>preload (G)</span></dt><dd><p>This is a list of services that you want to be
     4128</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345188"></a>
     4129
     4130preload modules (G)
     4131</h3></div></div></div><a class="indexterm" name="id345189"></a><a name="PRELOADMODULES"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a list of paths to modules that should
     4132        be loaded into smbd before a client connects. This improves
     4133        the speed of smbd when reacting to new connections somewhat. </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preload modules</code></em> = <code class="literal"></code>
     4134</em></span>
     4135</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>preload modules</code></em> = <code class="literal">/usr/lib/samba/passdb/mysql.so</code>
     4136</em></span>
     4137</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345245"></a><a name="AUTOSERVICES"></a>auto services</h3></div></div></div><a class="indexterm" name="id345246"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#PRELOAD">preload</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345276"></a>
     4138
     4139preload (G)
     4140</h3></div></div></div><a class="indexterm" name="id345277"></a><a name="PRELOAD"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a list of services that you want to be
    34084141        automatically added to the browse lists. This is most useful
    34094142        for homes and printers services that would otherwise not be
    34104143        visible.</p><p>
    34114144        Note that if you just want all printers in your
    3412         printcap file loaded then the <a class="indexterm" name="id320355"></a>load printers
     4145        printcap file loaded then the <a class="link" href="smb.conf.5.html#LOADPRINTERS">load printers</a>
    34134146         option is easier.
    34144147        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preload</code></em> = <code class="literal"></code>
    … …  
    34164149</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>preload</code></em> = <code class="literal">fred lp colorlp</code>
    34174150</em></span>
    3418 </p></dd><dt><span class="term"><a name="PRELOADMODULES"></a>preload modules (G)</span></dt><dd><p>This is a list of paths to modules that should
    3419         be loaded into smbd before a client connects. This improves
    3420         the speed of smbd when reacting to new connections somewhat. </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preload modules</code></em> = <code class="literal"></code>
    3421 </em></span>
    3422 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>preload modules</code></em> = <code class="literal">/usr/lib/samba/passdb/mysql.so</code>
    3423 </em></span>
    3424 </p></dd><dt><span class="term"><a name="PRESERVECASE"></a>preserve case (S)</span></dt><dd><p>
     4151</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345350"></a>
     4152
     4153preserve case (S)
     4154</h3></div></div></div><a class="indexterm" name="id345351"></a><a name="PRESERVECASE"></a><div class="variablelist"><dl><dt></dt><dd><p>
    34254155        This controls if new filenames are created with the case that the client passes, or if
    3426         they are forced to be the <a class="indexterm" name="id320472"></a>default case.
    3427         </p><p>
    3428         See the section on <a href="#NAMEMANGLINGSECT" title="NAME MANGLING">NAME MANGLING</a> for a fuller discussion.
     4156        they are forced to be the <a class="link" href="smb.conf.5.html#DEFAULTCASE">default case</a>.
     4157        </p><p>
     4158        See the section on <a class="link" href="#NAMEMANGLINGSECT" title="NAME MANGLING">NAME MANGLING</a> for a fuller discussion.
    34294159        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preserve case</code></em> = <code class="literal">yes</code>
    34304160</em></span>
    3431 </p></dd><dt><span class="term"><a name="PRINTOK"></a>print ok</span></dt><dd><p>This parameter is a synonym for printable.</p></dd><dt><span class="term"><a name="PRINTABLE"></a>printable (S)</span></dt><dd><p>If this parameter is <code class="constant">yes</code>, then
     4161</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345413"></a><a name="PRINTOK"></a>print ok</h3></div></div></div><a class="indexterm" name="id345414"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#PRINTABLE">printable</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345443"></a>
     4162
     4163printable (S)
     4164</h3></div></div></div><a class="indexterm" name="id345444"></a><a name="PRINTABLE"></a><div class="variablelist"><dl><dt></dt><dd><p>If this parameter is <code class="constant">yes</code>, then
    34324165    clients may open, write to and submit spool files on the directory
    34334166    specified for the service. </p><p>Note that a printable service will ALWAYS allow writing
    34344167    to the service path (user privileges permitting) via the spooling
    3435     of print data. The <a class="indexterm" name="id320662"></a>read only parameter controls only non-printing access to
     4168    of print data. The <a class="link" href="smb.conf.5.html#READONLY">read only</a> parameter controls only non-printing access to
    34364169    the resource.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>printable</code></em> = <code class="literal">no</code>
    34374170</em></span>
    3438 </p></dd><dt><span class="term"><a name="PRINTCAPCACHETIME"></a>printcap cache time (G)</span></dt><dd><p>This option specifies the number of seconds before the printing
     4171</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345503"></a>
     4172
     4173printcap cache time (G)
     4174</h3></div></div></div><a class="indexterm" name="id345504"></a><a name="PRINTCAPCACHETIME"></a><div class="variablelist"><dl><dt></dt><dd><p>This option specifies the number of seconds before the printing
    34394175    subsystem is again asked for the known printers.  If the value
    34404176    is greater than 60 the initial waiting time is set to 60 seconds
    … …  
    34464182</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>printcap cache time</code></em> = <code class="literal">600</code>
    34474183</em></span>
    3448 </p></dd><dt><span class="term"><a name="PRINTCAP"></a>printcap</span></dt><dd><p>This parameter is a synonym for printcap name.</p></dd><dt><span class="term"><a name="PRINTCAPNAME"></a>printcap name (S)</span></dt><dd><p>
     4184</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345567"></a><a name="PRINTCAP"></a>printcap</h3></div></div></div><a class="indexterm" name="id345568"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#PRINTCAPNAME">printcap name</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345598"></a>
     4185
     4186printcap name (S)
     4187</h3></div></div></div><a class="indexterm" name="id345599"></a><a name="PRINTCAPNAME"></a><div class="variablelist"><dl><dt></dt><dd><p>
    34494188        This parameter may be used to override the compiled-in default printcap name used by the server (usually
    3450         <code class="filename"> /etc/printcap</code>). See the discussion of the <a href="#PRINTERSSECT" title="The [printers] section">[printers]</a> section above for reasons why you might want to do this.
     4189        <code class="filename"> /etc/printcap</code>). See the discussion of the <a class="link" href="#PRINTERSSECT" title="The [printers] section">[printers]</a> section above for reasons why you might want to do this.
    34514190        </p><p>
    34524191        To use the CUPS printing interface set <code class="literal">printcap name = cups </code>. This should
    3453         be supplemented by an addtional setting <a class="indexterm" name="id320815"></a>printing = cups in the [global]
     4192        be supplemented by an addtional setting <a class="link" href="smb.conf.5.html#PRINTING">printing = cups</a> in the [global]
    34544193        section.  <code class="literal">printcap name = cups</code> will use the  "dummy" printcap
    34554194        created by CUPS, as specified in your CUPS configuration file.
    … …  
    34814220</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>printcap name</code></em> = <code class="literal">/etc/myprintcap</code>
    34824221</em></span>
    3483 </p></dd><dt><span class="term"><a name="PRINTCOMMAND"></a>print command (S)</span></dt><dd><p>After a print job has finished spooling to
     4222</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345769"></a>
     4223
     4224print command (S)
     4225</h3></div></div></div><a class="indexterm" name="id345770"></a><a name="PRINTCOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>After a print job has finished spooling to
    34844226    a service, this command will be used via a <code class="literal">system()</code>
    34854227    call to process the spool file. Typically the command specified will
    … …  
    35044246    be created but not processed and (most importantly) not removed.</p><p>Note that printing may fail on some UNIXes from the
    35054247    <code class="constant">nobody</code> account. If this happens then create
    3506     an alternative guest account that can print and set the <a class="indexterm" name="id321038"></a>guest account
     4248    an alternative guest account that can print and set the <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account</a>
    35074249    in the [global] section.</p><p>You can form quite complex print commands by realizing
    35084250    that they are just passed to a shell. For example the following
    … …  
    35114253    /tmp/print.log; lpr -P %p %s; rm %s</code></p><p>You may have to vary this command considerably depending
    35124254    on how you normally print files on your system. The default for
    3513     the parameter varies depending on the setting of the <a class="indexterm" name="id321064"></a>printing
     4255    the parameter varies depending on the setting of the <a class="link" href="smb.conf.5.html#PRINTING">printing</a>
    35144256        parameter.</p><p>Default: For <code class="literal">printing = BSD, AIX, QNX, LPRNG
    35154257    or PLP :</code></p><p><code class="literal">print command = lpr -r -P%p %s</code></p><p>For <code class="literal">printing = SYSV or HPUX :</code></p><p><code class="literal">print command = lp -c -d%p %s; rm %s</code></p><p>For <code class="literal">printing = SOFTQ :</code></p><p><code class="literal">print command = lp -d%p -s %s; rm %s</code></p><p>For printing = CUPS :   If SAMBA is compiled against
    3516     libcups, then <a class="indexterm" name="id321121"></a>printcap = cups
     4258    libcups, then <a class="link" href="smb.conf.5.html#PRINTCAP">printcap = cups</a>
    35174259    uses the CUPS API to
    35184260    submit jobs, etc.  Otherwise it maps to the System V
    … …  
    35234265        set print command will be ignored.</p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>print command</code></em> = <code class="literal">/usr/local/samba/bin/myprintscript %p %s</code>
    35244266</em></span>
    3525 </p></dd><dt><span class="term"><a name="PRINTERADMIN"></a>printer admin (S)</span></dt><dd><p>
     4267</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346012"></a>
     4268
     4269printer admin (S)
     4270</h3></div></div></div><a class="indexterm" name="id346013"></a><a name="PRINTERADMIN"></a><div class="variablelist"><dl><dt></dt><dd><p>
    35264271        This lists users who can do anything to printers
    35274272        via the remote administration interfaces offered
    … …  
    35394284</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>printer admin</code></em> = <code class="literal">admin, @staff</code>
    35404285</em></span>
    3541 </p></dd><dt><span class="term"><a name="PRINTER"></a>printer</span></dt><dd><p>This parameter is a synonym for printer name.</p></dd><dt><span class="term"><a name="PRINTERNAME"></a>printer name (S)</span></dt><dd><p>
     4286</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346076"></a><a name="PRINTER"></a>printer</h3></div></div></div><a class="indexterm" name="id346077"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#PRINTERNAME">printer name</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346105"></a>
     4287
     4288printer name (S)
     4289</h3></div></div></div><a class="indexterm" name="id346106"></a><a name="PRINTERNAME"></a><div class="variablelist"><dl><dt></dt><dd><p>
    35424290        This parameter specifies the name of the printer to which print jobs spooled through a printable service
    35434291        will be sent.
    … …  
    35464294        does not have its own printer name specified.
    35474295        </p><p>
    3548         The default value of the <a class="indexterm" name="id321277"></a>printer name may be <code class="literal">lp</code> on many
     4296        The default value of the <a class="link" href="smb.conf.5.html#PRINTERNAME">printer name</a> may be <code class="literal">lp</code> on many
    35494297        systems.
    35504298        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>printer name</code></em> = <code class="literal">none</code>
    … …  
    35524300</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>printer name</code></em> = <code class="literal">laserwriter</code>
    35534301</em></span>
    3554 </p></dd><dt><span class="term"><a name="PRINTING"></a>printing (S)</span></dt><dd><p>This parameters controls how printer status  information is
     4302</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346189"></a>
     4303
     4304printing (S)
     4305</h3></div></div></div><a class="indexterm" name="id346190"></a><a name="PRINTING"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameters controls how printer status  information is
    35554306    interpreted on your system. It also affects the  default values for
    35564307    the <em class="parameter"><code>print command</code></em>,  <em class="parameter"><code>lpq command</code></em>, <em class="parameter"><code>lppause command </code></em>, <em class="parameter"><code>lpresume command</code></em>, and  <em class="parameter"><code>lprm command</code></em> if specified in the
    … …  
    35614312    <code class="constant">QNX</code>, <code class="constant">SOFTQ</code>,
    35624313    and <code class="constant">CUPS</code>.</p><p>To see what the defaults are for the other print
    3563     commands when using the various options use the <a href="testparm.1.html"><span class="citerefentry"><span class="refentrytitle">testparm</span>(1)</span></a> program.</p><p>This option can be set on a per printer basis.  Please be
     4314    commands when using the various options use the <a class="citerefentry" href="testparm.1.html"><span class="citerefentry"><span class="refentrytitle">testparm</span>(1)</span></a> program.</p><p>This option can be set on a per printer basis.  Please be
    35644315    aware however, that you must place any of the various printing
    35654316    commands (e.g. print command, lpq command, etc...) after defining
    35664317    the value for the <em class="parameter"><code>printing</code></em> option since it will
    3567     reset the printing commands to default values.</p><p>See also the discussion in the <a href="#PRINTERSSECT" title="The [printers] section">
    3568     [printers]</a> section.</p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="PRINTJOBUSERNAME"></a>printjob username (S)</span></dt><dd><p>This parameter specifies which user information will be
     4318    reset the printing commands to default values.</p><p>See also the discussion in the <a class="link" href="#PRINTERSSECT" title="The [printers] section">
     4319    [printers]</a> section.</p><p><span class="emphasis"><em>No default</em></span></p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346318"></a>
     4320
     4321printjob username (S)
     4322</h3></div></div></div><a class="indexterm" name="id346319"></a><a name="PRINTJOBUSERNAME"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies which user information will be
    35694323    passed to the printing system. Usually, the username is sent,
    35704324    but in some cases, e.g. the domain prefix is useful, too.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>printjob username</code></em> = <code class="literal">%U</code>
    … …  
    35724326</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>printjob username</code></em> = <code class="literal">%D\%U</code>
    35734327</em></span>
    3574 </p></dd><dt><span class="term"><a name="PRIVATEDIR"></a>private dir (G)</span></dt><dd><p>This parameters defines the directory
     4328</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346376"></a>
     4329
     4330private dir (G)
     4331</h3></div></div></div><a class="indexterm" name="id346377"></a><a name="PRIVATEDIR"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameters defines the directory
    35754332    smbd will use for storing such files as <code class="filename">smbpasswd</code>
    35764333    and <code class="filename">secrets.tdb</code>.
    35774334</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>private dir</code></em> = <code class="literal">${prefix}/private</code>
    35784335</em></span>
    3579 </p></dd><dt><span class="term"><a name="PROFILEACLS"></a>profile acls (S)</span></dt><dd><p>
     4336</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346429"></a>
     4337
     4338profile acls (S)
     4339</h3></div></div></div><a class="indexterm" name="id346430"></a><a name="PROFILEACLS"></a><div class="variablelist"><dl><dt></dt><dd><p>
    35804340        This boolean parameter was added to fix the problems that people have been
    35814341        having with storing user profiles on Samba shares from Windows 2000 or
    … …  
    36054365        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>profile acls</code></em> = <code class="literal">no</code>
    36064366</em></span>
    3607 </p></dd><dt><span class="term"><a name="QUEUEPAUSECOMMAND"></a>queuepause command (S)</span></dt><dd><p>This parameter specifies the command to be
     4367</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346489"></a>
     4368
     4369queuepause command (S)
     4370</h3></div></div></div><a class="indexterm" name="id346490"></a><a name="QUEUEPAUSECOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the command to be
    36084371    executed on the server host in order to pause the printer queue.</p><p>This command should be a program or script which takes
    36094372    a printer name as its only parameter and stops the printer queue,
    … …  
    36164379        server.</p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>queuepause command</code></em> = <code class="literal">disable %p</code>
    36174380</em></span>
    3618 </p></dd><dt><span class="term"><a name="QUEUERESUMECOMMAND"></a>queueresume command (S)</span></dt><dd><p>This parameter specifies the command to be
     4381</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346559"></a>
     4382
     4383queueresume command (S)
     4384</h3></div></div></div><a class="indexterm" name="id346560"></a><a name="QUEUERESUMECOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the command to be
    36194385    executed on the server host in order to resume the printer queue. It
    36204386    is the command to undo the behavior that is caused by the
    3621     previous parameter (<a class="indexterm" name="id321707"></a>queuepause command).</p><p>This command should be a program or script which takes
     4387    previous parameter (<a class="link" href="smb.conf.5.html#QUEUEPAUSECOMMAND">queuepause command</a>).</p><p>This command should be a program or script which takes
    36224388    a printer name as its only parameter and resumes the printer queue,
    36234389    such that queued jobs are resubmitted to the printer.</p><p>This command is not supported by Windows for Workgroups,
    … …  
    36314397</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>queueresume command</code></em> = <code class="literal">enable %p</code>
    36324398</em></span>
    3633 </p></dd><dt><span class="term"><a name="READBMPX"></a>read bmpx (G)</span></dt><dd><p>This boolean parameter controls whether
    3634     <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will support the "Read
     4399</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346651"></a>
     4400
     4401read bmpx (G)
     4402</h3></div></div></div><a class="indexterm" name="id346652"></a><a name="READBMPX"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean parameter controls whether
     4403    <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will support the "Read
    36354404    Block Multiplex" SMB. This is now rarely used and defaults to
    36364405    <code class="constant">no</code>. You should never need to set this
    36374406        parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>read bmpx</code></em> = <code class="literal">no</code>
    36384407</em></span>
    3639 </p></dd><dt><span class="term"><a name="READLIST"></a>read list (S)</span></dt><dd><p>
     4408</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346704"></a>
     4409
     4410read list (S)
     4411</h3></div></div></div><a class="indexterm" name="id346705"></a><a name="READLIST"></a><div class="variablelist"><dl><dt></dt><dd><p>
    36404412        This is a list of users that are given read-only access to a service. If the connecting user is in this list
    3641         then they will not be given write access, no matter what the <a class="indexterm" name="id321844"></a>read only option is set
    3642         to. The list can include group names using the syntax described in the <a class="indexterm" name="id321852"></a>invalid users
     4413        then they will not be given write access, no matter what the <a class="link" href="smb.conf.5.html#READONLY">read only</a> option is set
     4414        to. The list can include group names using the syntax described in the <a class="link" href="smb.conf.5.html#INVALIDUSERS">invalid users</a>
    36434415        parameter.
    3644         </p><p>This parameter will not work with the <a class="indexterm" name="id321862"></a>security = share in
     4416        </p><p>This parameter will not work with the <a class="link" href="smb.conf.5.html#SECURITY">security = share</a> in
    36454417    Samba 3.0.  This is by design.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>read list</code></em> = <code class="literal"></code>
    36464418</em></span>
    36474419</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>read list</code></em> = <code class="literal">mary, @students</code>
    36484420</em></span>
    3649 </p></dd><dt><span class="term"><a name="READONLY"></a>read only (S)</span></dt><dd><p>An inverted synonym is <a class="indexterm" name="id321924"></a>writeable.</p><p>If this parameter is <code class="constant">yes</code>, then users
     4421</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346798"></a>
     4422
     4423read only (S)
     4424</h3></div></div></div><a class="indexterm" name="id346799"></a><a name="READONLY"></a><div class="variablelist"><dl><dt></dt><dd><p>An inverted synonym is <a class="link" href="smb.conf.5.html#WRITEABLE">writeable</a>.</p><p>If this parameter is <code class="constant">yes</code>, then users
    36504425    of a service may not create or modify files in the service's
    36514426    directory.</p><p>Note that a printable service (<code class="literal">printable = yes</code>)
    … …  
    36534428    (user privileges permitting), but only via spooling operations.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>read only</code></em> = <code class="literal">yes</code>
    36544429</em></span>
    3655 </p></dd><dt><span class="term"><a name="READRAW"></a>read raw (G)</span></dt><dd><p>This parameter controls whether or not the server
     4430</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346871"></a>
     4431
     4432read raw (G)
     4433</h3></div></div></div><a class="indexterm" name="id346872"></a><a name="READRAW"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls whether or not the server
    36564434    will support the raw read SMB requests when transferring data
    36574435    to clients.</p><p>If enabled, raw reads allow reads of 65535 bytes in
    … …  
    36624440        tool and left severely alone.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>read raw</code></em> = <code class="literal">yes</code>
    36634441</em></span>
    3664 </p></dd><dt><span class="term"><a name="REALM"></a>realm (G)</span></dt><dd><p>This option specifies the kerberos realm to use. The realm is
     4442</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346926"></a>
     4443
     4444realm (G)
     4445</h3></div></div></div><a class="indexterm" name="id346927"></a><a name="REALM"></a><div class="variablelist"><dl><dt></dt><dd><p>This option specifies the kerberos realm to use. The realm is
    36654446        used as the ADS equivalent of the NT4 <code class="literal">domain</code>. It
    36664447        is usually set to the DNS name of the kerberos server.
    … …  
    36694450</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>realm</code></em> = <code class="literal">mysambabox.mycompany.com</code>
    36704451</em></span>
    3671 </p></dd><dt><span class="term"><a name="REMOTEANNOUNCE"></a>remote announce (G)</span></dt><dd><p>
    3672         This option allows you to setup <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a>to periodically announce itself
     4452</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346989"></a>
     4453
     4454remote announce (G)
     4455</h3></div></div></div><a class="indexterm" name="id346990"></a><a name="REMOTEANNOUNCE"></a><div class="variablelist"><dl><dt></dt><dd><p>
     4456        This option allows you to setup <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a>to periodically announce itself
    36734457        to arbitrary IP addresses with an arbitrary workgroup name.
    36744458        </p><p>
    … …  
    36834467        the above line would cause <code class="literal">nmbd</code> to announce itself
    36844468        to the two given IP addresses using the given workgroup names. If you leave out the
    3685         workgroup name then the one given in the <a class="indexterm" name="id322141"></a>workgroup parameter
     4469        workgroup name then the one given in the <a class="link" href="smb.conf.5.html#WORKGROUP">workgroup</a> parameter
    36864470        is used instead.
    36874471        </p><p>
    … …  
    36934477        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>remote announce</code></em> = <code class="literal"></code>
    36944478</em></span>
    3695 </p></dd><dt><span class="term"><a name="REMOTEBROWSESYNC"></a>remote browse sync (G)</span></dt><dd><p>
    3696         This option allows you to setup <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> to periodically request
     4479</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347085"></a>
     4480
     4481remote browse sync (G)
     4482</h3></div></div></div><a class="indexterm" name="id347086"></a><a name="REMOTEBROWSESYNC"></a><div class="variablelist"><dl><dt></dt><dd><p>
     4483        This option allows you to setup <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> to periodically request
    36974484        synchronization of browse lists with the master browser of a Samba
    36984485        server that is on a remote segment. This option will allow you to
    … …  
    37204507        is in fact the browse master on its segment.
    37214508        </p><p>
    3722         The <a class="indexterm" name="id322243"></a>remote browse sync may be used on networks
     4509        The <a class="link" href="smb.conf.5.html#REMOTEBROWSESYNC">remote browse sync</a> may be used on networks
    37234510        where there is no WINS server, and may be used on disjoint networks where
    37244511        each network has its own WINS server.
    37254512        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>remote browse sync</code></em> = <code class="literal"></code>
    37264513</em></span>
    3727 </p></dd><dt><span class="term"><a name="RENAMEUSERSCRIPT"></a>rename user script (G)</span></dt><dd><p>
    3728         This is the full pathname to a script that will be run as root by <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> under special circumstances described below.
     4514</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347185"></a>
     4515
     4516rename user script (G)
     4517</h3></div></div></div><a class="indexterm" name="id347186"></a><a name="RENAMEUSERSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>
     4518        This is the full pathname to a script that will be run as root by <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> under special circumstances described below.
    37294519        </p><p>
    37304520        When a user with admin authority or SeAddUserPrivilege rights renames a user (e.g.: from the NT4 User Manager
    … …  
    37434533        </p></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>rename user script</code></em> = <code class="literal">no</code>
    37444534</em></span>
    3745 </p></dd><dt><span class="term"><a name="RESETONZEROVC"></a>reset on zero vc (G)</span></dt><dd><p>
     4535</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347264"></a>
     4536
     4537reset on zero vc (G)
     4538</h3></div></div></div><a class="indexterm" name="id347265"></a><a name="RESETONZEROVC"></a><div class="variablelist"><dl><dt></dt><dd><p>
    37464539        This boolean option controls whether an incoming session setup
    37474540        should kill other connections coming from the same IP. This matches
    … …  
    37624555        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>reset on zero vc</code></em> = <code class="literal">no</code>
    37634556</em></span>
    3764 </p></dd><dt><span class="term"><a name="RESTRICTANONYMOUS"></a>restrict anonymous (G)</span></dt><dd><p>The setting of this parameter determines whether user and
     4557</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347310"></a>
     4558
     4559restrict anonymous (G)
     4560</h3></div></div></div><a class="indexterm" name="id347311"></a><a name="RESTRICTANONYMOUS"></a><div class="variablelist"><dl><dt></dt><dd><p>The setting of this parameter determines whether user and
    37654561    group list information is returned for an anonymous connection.
    37664562    and mirrors the effects of the
    … …  
    37824578        </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
    37834579    The security advantage of using restrict anonymous = 2 is removed
    3784     by setting <a class="indexterm" name="id322431"></a>guest ok = yes on any share.
     4580    by setting <a class="link" href="smb.conf.5.html#GUESTOK">guest ok = yes</a> on any share.
    37854581        </p></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>restrict anonymous</code></em> = <code class="literal">0</code>
    37864582</em></span>
    3787 </p></dd><dt><span class="term"><a name="ROOT"></a>root</span></dt><dd><p>This parameter is a synonym for root directory.</p></dd><dt><span class="term"><a name="ROOTDIR"></a>root dir</span></dt><dd><p>This parameter is a synonym for root directory.</p></dd><dt><span class="term"><a name="ROOTDIRECTORY"></a>root directory (G)</span></dt><dd><p>The server will <code class="literal">chroot()</code> (i.e.
     4583</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347384"></a><a name="ROOT"></a>root</h3></div></div></div><a class="indexterm" name="id347385"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#ROOTDIRECTORY">root directory</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347415"></a><a name="ROOTDIR"></a>root dir</h3></div></div></div><a class="indexterm" name="id347416"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#ROOTDIRECTORY">root directory</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347444"></a>
     4584
     4585root directory (G)
     4586</h3></div></div></div><a class="indexterm" name="id347446"></a><a name="ROOTDIRECTORY"></a><div class="variablelist"><dl><dt></dt><dd><p>The server will <code class="literal">chroot()</code> (i.e.
    37884587    Change its root directory) to this directory on startup. This is
    37894588    not strictly necessary for secure operation. Even without it the
    … …  
    37924591    parts of the filesystem, or attempts to use ".." in file names
    37934592    to access other directories (depending on the setting of the
    3794         <a class="indexterm" name="id322529"></a>wide smbconfoptions parameter).
     4593        <a class="link" href="smb.conf.5.html#WIDESMBCONFOPTIONS">wide smbconfoptions</a> parameter).
    37954594    </p><p>Adding a <em class="parameter"><code>root directory</code></em> entry other
    37964595    than "/" adds an extra level of security, but at a price. It
    … …  
    38084607</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>root directory</code></em> = <code class="literal">/homes/smb</code>
    38094608</em></span>
    3810 </p></dd><dt><span class="term"><a name="ROOTPOSTEXEC"></a>root postexec (S)</span></dt><dd><p>
     4609</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347557"></a>
     4610
     4611root postexec (S)
     4612</h3></div></div></div><a class="indexterm" name="id347558"></a><a name="ROOTPOSTEXEC"></a><div class="variablelist"><dl><dt></dt><dd><p>
    38114613        This is the same as the <em class="parameter"><code>postexec</code></em>
    38124614        parameter except that the command is run as root. This is useful for
    … …  
    38144616        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>root postexec</code></em> = <code class="literal"></code>
    38154617</em></span>
    3816 </p></dd><dt><span class="term"><a name="ROOTPREEXEC"></a>root preexec (S)</span></dt><dd><p>
     4618</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347604"></a>
     4619
     4620root preexec close (S)
     4621</h3></div></div></div><a class="indexterm" name="id347605"></a><a name="ROOTPREEXECCLOSE"></a><div class="variablelist"><dl><dt></dt><dd><p>This is the same as the <em class="parameter"><code>preexec close
     4622        </code></em> parameter except that the command is run as root.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>root preexec close</code></em> = <code class="literal">no</code>
     4623</em></span>
     4624</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347652"></a>
     4625
     4626root preexec (S)
     4627</h3></div></div></div><a class="indexterm" name="id347653"></a><a name="ROOTPREEXEC"></a><div class="variablelist"><dl><dt></dt><dd><p>
    38174628        This is the same as the <em class="parameter"><code>preexec</code></em>
    38184629        parameter except that the command is run as root. This is useful for
    … …  
    38204631        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>root preexec</code></em> = <code class="literal"></code>
    38214632</em></span>
    3822 </p></dd><dt><span class="term"><a name="ROOTPREEXECCLOSE"></a>root preexec close (S)</span></dt><dd><p>This is the same as the <em class="parameter"><code>preexec close
    3823         </code></em> parameter except that the command is run as root.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>root preexec close</code></em> = <code class="literal">no</code>
    3824 </em></span>
    3825 </p></dd><dt><span class="term"><a name="SECURITY"></a>security (G)</span></dt><dd><p>This option affects how clients respond to
     4633</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347698"></a>
     4634
     4635security mask (S)
     4636</h3></div></div></div><a class="indexterm" name="id347699"></a><a name="SECURITYMASK"></a><div class="variablelist"><dl><dt></dt><dd><p>
     4637        This parameter controls what UNIX permission bits will be set when a Windows NT client is manipulating the
     4638        UNIX permission on a file using the native NT security dialog box.
     4639        </p><p>
     4640        This parameter is applied as a mask (AND'ed with) to the incoming permission bits, thus resetting
     4641        any bits not in this mask. Make sure not to mix up this parameter with <a class="link" href="smb.conf.5.html#FORCESECURITYMODE">force  security mode</a>, which works in a manner similar to this one but uses a logical OR instead of an AND.
     4642        </p><p>
     4643        Essentially, all bits set to zero in this mask will result in setting to zero the corresponding bits on the
     4644        file permissions regardless of the previous status of this bits on the file.
     4645    </p><p>
     4646        If not set explicitly this parameter is 0777, allowing a user to set all the user/group/world permissions on a file.
     4647    </p><p><span class="emphasis"><em>
     4648        Note</em></span> that users who can access the Samba server through other means can easily bypass this
     4649    restriction, so it is primarily useful for standalone "appliance" systems.  Administrators of
     4650        most normal systems will probably want to leave it set to <code class="constant">0777</code>.
     4651        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>security mask</code></em> = <code class="literal">0777</code>
     4652</em></span>
     4653</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>security mask</code></em> = <code class="literal">0770</code>
     4654</em></span>
     4655</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347793"></a>
     4656
     4657security (G)
     4658</h3></div></div></div><a class="indexterm" name="id347794"></a><a name="SECURITY"></a><div class="variablelist"><dl><dt></dt><dd><p>This option affects how clients respond to
    38264659    Samba and is one of the most important settings in the <code class="filename">
    38274660    smb.conf</code> file.</p><p>The option sets the "security mode bit" in replies to
    3828     protocol negotiations with <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> to turn share level security on or off. Clients decide
     4661    protocol negotiations with <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> to turn share level security on or off. Clients decide
    38294662    based on this bit whether (and how) to transfer user and password
    38304663    information to the server.</p><p>The default is <code class="literal">security = user</code>, as this is
    … …  
    38474680    is commonly used for a shared printer server. It is more difficult
    38484681    to setup guest shares with <code class="literal">security = user</code>, see
    3849     the <a class="indexterm" name="id322862"></a>map to guestparameter for details.</p><p>It is possible to use <code class="literal">smbd</code> in a <span class="emphasis"><em>
     4682    the <a class="link" href="smb.conf.5.html#MAPTOGUEST">map to guest</a>parameter for details.</p><p>It is possible to use <code class="literal">smbd</code> in a <span class="emphasis"><em>
    38504683    hybrid mode</em></span> where it is offers both user and share
    3851     level security under different <a class="indexterm" name="id322883"></a>NetBIOS aliases. </p><p>The different settings will now be explained.</p><p><a name="SECURITYEQUALSSHARE"></a><span class="emphasis"><em>SECURITY = SHARE</em></span></p><p>When clients connect to a share level security server they
     4684    level security under different <a class="link" href="smb.conf.5.html#NETBIOSALIASES">NetBIOS aliases</a>. </p><p>The different settings will now be explained.</p><p><a name="SECURITYEQUALSSHARE"></a><span class="emphasis"><em>SECURITY = SHARE</em></span></p><p>When clients connect to a share level security server they
    38524685    need not log onto the server with a valid username and password before
    38534686    attempting to connect to a shared resource (although modern clients
    … …  
    38624695    techniques to determine the correct UNIX user to use on behalf
    38634696    of the client.</p><p>A list of possible UNIX usernames to match with the given
    3864     client password is constructed using the following methods :</p><div class="itemizedlist"><ul type="disc"><li><p>If the <a class="indexterm" name="id322959"></a>guest only parameter is set, then all the other
    3865             stages are missed and only the <a class="indexterm" name="id322966"></a>guest account username is checked.
     4697    client password is constructed using the following methods :</p><div class="itemizedlist"><ul type="disc"><li><p>If the <a class="link" href="smb.conf.5.html#GUESTONLY">guest only</a> parameter is set, then all the other
     4698            stages are missed and only the <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account</a> username is checked.
    38664699            </p></li><li><p>Is a username is sent with the share connection
    3867             request, then this username (after mapping - see <a class="indexterm" name="id322981"></a>username map),
     4700            request, then this username (after mapping - see <a class="link" href="smb.conf.5.html#USERNAMEMAP">username map</a>),
    38684701            is added as a potential username.
    38694702            </p></li><li><p>If the client did a previous <span class="emphasis"><em>logon
    … …  
    38744707            </p></li><li><p>The NetBIOS name of the client is added to
    38754708            the list as a potential username.
    3876             </p></li><li><p>Any users on the <a class="indexterm" name="id323021"></a>user list are added as potential usernames.
     4709            </p></li><li><p>Any users on the <a class="link" href="smb.conf.5.html#USER">user</a> list are added as potential usernames.
    38774710            </p></li></ul></div><p>If the <em class="parameter"><code>guest only</code></em> parameter is
    38784711    not set, then this list is then tried with the supplied password.
    … …  
    38834716    guest user will be used, otherwise access is denied.</p><p>Note that it can be <span class="emphasis"><em>very</em></span> confusing
    38844717    in share-level security as to which UNIX username will eventually
    3885     be used in granting access.</p><p>See also the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">
     4718    be used in granting access.</p><p>See also the section <a class="link" href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">
    38864719    NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p><a name="SECURITYEQUALSUSER"></a><span class="emphasis"><em>SECURITY = USER</em></span></p><p>This is the default security setting in Samba 3.0.
    38874720    With user-level security a client must first "log-on" with a
    3888     valid username and password (which can be mapped using the <a class="indexterm" name="id323090"></a>username map
    3889     parameter). Encrypted passwords (see the <a class="indexterm" name="id323098"></a>encrypted passwords parameter) can also
    3890     be used in this security mode. Parameters such as <a class="indexterm" name="id323106"></a>user and <a class="indexterm" name="id323113"></a>guest only if set      are then applied and
     4721    valid username and password (which can be mapped using the <a class="link" href="smb.conf.5.html#USERNAMEMAP">username map</a>
     4722    parameter). Encrypted passwords (see the <a class="link" href="smb.conf.5.html#ENCRYPTEDPASSWORDS">encrypted passwords</a> parameter) can also
     4723    be used in this security mode. Parameters such as <a class="link" href="smb.conf.5.html#USER">user</a> and <a class="link" href="smb.conf.5.html#GUESTONLY">guest only</a> if set   are then applied and
    38914724    may change the UNIX user to use on this connection, but only after
    38924725    the user has been successfully authenticated.</p><p><span class="emphasis"><em>Note</em></span> that the name of the resource being
    … …  
    38944727    the server has successfully authenticated the client. This is why
    38954728    guest shares don't work in user level security without allowing
    3896     the server to automatically map unknown users into the <a class="indexterm" name="id323132"></a>guest account.
    3897     See the <a class="indexterm" name="id323140"></a>map to guest parameter for details on doing this.</p><p>See also the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p><a name="SECURITYEQUALSDOMAIN"></a><span class="emphasis"><em>SECURITY = DOMAIN</em></span></p><p>This mode will only work correctly if <a href="net.8.html"><span class="citerefentry"><span class="refentrytitle">net</span>(8)</span></a> has been used to add this
    3898     machine into a Windows NT Domain. It expects the <a class="indexterm" name="id323178"></a>encrypted passwords
     4729    the server to automatically map unknown users into the <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account</a>.
     4730    See the <a class="link" href="smb.conf.5.html#MAPTOGUEST">map to guest</a> parameter for details on doing this.</p><p>See also the section <a class="link" href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p><a name="SECURITYEQUALSDOMAIN"></a><span class="emphasis"><em>SECURITY = DOMAIN</em></span></p><p>This mode will only work correctly if <a class="citerefentry" href="net.8.html"><span class="citerefentry"><span class="refentrytitle">net</span>(8)</span></a> has been used to add this
     4731    machine into a Windows NT Domain. It expects the <a class="link" href="smb.conf.5.html#ENCRYPTEDPASSWORDS">encrypted passwords</a>
    38994732        parameter to be set to <code class="constant">yes</code>. In this
    39004733    mode Samba will try to validate the username/password by passing
    … …  
    39104743    the server has successfully authenticated the client. This is why
    39114744    guest shares don't work in user level security without allowing
    3912     the server to automatically map unknown users into the <a class="indexterm" name="id323228"></a>guest account.
    3913     See the <a class="indexterm" name="id323235"></a>map to guest parameter for details on doing this.</p><p>See also the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">
    3914     NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p>See also the <a class="indexterm" name="id323256"></a>password server parameter and
    3915          the <a class="indexterm" name="id323264"></a>encrypted passwords parameter.</p><p><a name="SECURITYEQUALSSERVER"></a><span class="emphasis"><em>SECURITY = SERVER</em></span></p><p>
     4745    the server to automatically map unknown users into the <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account</a>.
     4746    See the <a class="link" href="smb.conf.5.html#MAPTOGUEST">map to guest</a> parameter for details on doing this.</p><p>See also the section <a class="link" href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">
     4747    NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p>See also the <a class="link" href="smb.conf.5.html#PASSWORDSERVER">password server</a> parameter and
     4748         the <a class="link" href="smb.conf.5.html#ENCRYPTEDPASSWORDS">encrypted passwords</a> parameter.</p><p><a name="SECURITYEQUALSSERVER"></a><span class="emphasis"><em>SECURITY = SERVER</em></span></p><p>
    39164749        In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an
    39174750        NT box. If this fails it will revert to <code class="literal">security = user</code>. It expects the
    3918         <a class="indexterm" name="id323290"></a>encrypted passwords parameter to be set to <code class="constant">yes</code>, unless the remote
     4751        <a class="link" href="smb.conf.5.html#ENCRYPTEDPASSWORDS">encrypted passwords</a> parameter to be set to <code class="constant">yes</code>, unless the remote
    39194752        server does not support them.  However note that if encrypted passwords have been negotiated then Samba cannot
    39204753        revert back to checking the UNIX password file, it must have a valid <code class="filename">smbpasswd</code> file to check users against. See the chapter about the User Database in
    … …  
    39364769    the server has successfully authenticated the client. This is why
    39374770    guest shares don't work in user level security without allowing
    3938     the server to automatically map unknown users into the <a class="indexterm" name="id323348"></a>guest account.
    3939     See the <a class="indexterm" name="id323355"></a>map to guest parameter for details on doing this.</p><p>See also the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">
    3940     NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p>See also the <a class="indexterm" name="id323376"></a>password server parameter and the
    3941         <a class="indexterm" name="id323383"></a>encrypted passwords parameter.</p><p><a name="SECURITYEQUALSADS"></a><span class="emphasis"><em>SECURITY = ADS</em></span></p><p>In this mode, Samba will act as a domain member in an ADS realm. To operate
     4771    the server to automatically map unknown users into the <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account</a>.
     4772    See the <a class="link" href="smb.conf.5.html#MAPTOGUEST">map to guest</a> parameter for details on doing this.</p><p>See also the section <a class="link" href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">
     4773    NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p>See also the <a class="link" href="smb.conf.5.html#PASSWORDSERVER">password server</a> parameter and the
     4774        <a class="link" href="smb.conf.5.html#ENCRYPTEDPASSWORDS">encrypted passwords</a> parameter.</p><p><a name="SECURITYEQUALSADS"></a><span class="emphasis"><em>SECURITY = ADS</em></span></p><p>In this mode, Samba will act as a domain member in an ADS realm. To operate
    39424775                in this mode, the machine running Samba will need to have Kerberos installed
    39434776                and configured and Samba will need to be joined to the ADS realm using the
    … …  
    39474780</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>security</code></em> = <code class="literal">DOMAIN</code>
    39484781</em></span>
    3949 </p></dd><dt><span class="term"><a name="SECURITYMASK"></a>security mask (S)</span></dt><dd><p>
    3950         This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the
    3951         UNIX permission on a file using the native NT security dialog box.
    3952         </p><p>
    3953         This parameter is applied as a mask (AND'ed with) to the changed permission bits, thus preventing any bits not
    3954         in this mask from being modified.  Make sure not to mix up this parameter with <a class="indexterm" name="id323475"></a>force  security mode, which works in a manner similar to this one but uses a logical OR instead of an AND.
    3955         </p><p>
    3956         Essentially, zero bits in this mask may be treated as a set of bits the user is not allowed to change.
    3957         </p><p>
    3958         If not set explicitly this parameter is 0777, allowing a user to modify all the user/group/world permissions on a file.
    3959     </p><p><span class="emphasis"><em>
    3960         Note</em></span> that users who can access the Samba server through other means can easily bypass this
    3961     restriction, so it is primarily useful for standalone "appliance" systems.  Administrators of
    3962         most normal systems will probably want to leave it set to <code class="constant">0777</code>.
    3963         </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>security mask</code></em> = <code class="literal">0777</code>
    3964 </em></span>
    3965 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>security mask</code></em> = <code class="literal">0770</code>
    3966 </em></span>
    3967 </p></dd><dt><span class="term"><a name="SERVERSCHANNEL"></a>server schannel (G)</span></dt><dd><p>
     4782</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id348581"></a>
     4783
     4784server schannel (G)
     4785</h3></div></div></div><a class="indexterm" name="id348582"></a><a name="SERVERSCHANNEL"></a><div class="variablelist"><dl><dt></dt><dd><p>
    39684786        This controls whether the server offers or even demands the use of the netlogon schannel.
    3969         <a class="indexterm" name="id323559"></a>server schannel = no does not offer the schannel, <a class="indexterm" name="id323566"></a>server schannel = auto offers the schannel but does not enforce it, and <a class="indexterm" name="id323574"></a>server schannel = yes denies access if the client is not able to speak netlogon schannel.
     4787        <a class="link" href="smb.conf.5.html#SERVERSCHANNEL">server schannel = no</a> does not offer the schannel, <a class="link" href="smb.conf.5.html#SERVERSCHANNEL">server schannel = auto</a> offers the schannel but does not enforce it, and <a class="link" href="smb.conf.5.html#SERVERSCHANNEL">server schannel = yes</a> denies access if the client is not able to speak netlogon schannel.
    39704788        This is only the case for Windows NT4 before SP4.
    39714789        </p><p>
    … …  
    39764794</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>server schannel</code></em> = <code class="literal">yes</code>
    39774795</em></span>
    3978 </p></dd><dt><span class="term"><a name="SERVERSIGNING"></a>server signing (G)</span></dt><dd><p>This controls whether the server offers or requires
     4796</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id348689"></a>
     4797
     4798server signing (G)
     4799</h3></div></div></div><a class="indexterm" name="id348690"></a><a name="SERVERSIGNING"></a><div class="variablelist"><dl><dt></dt><dd><p>This controls whether the server offers or requires
    39794800    the client it talks to to use SMB signing. Possible values
    39804801    are <span class="emphasis"><em>auto</em></span>, <span class="emphasis"><em>mandatory</em></span>
    … …  
    39844805        to disabled, SMB signing is not offered either.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>server signing</code></em> = <code class="literal">Disabled</code>
    39854806</em></span>
    3986 </p></dd><dt><span class="term"><a name="SERVERSTRING"></a>server string (G)</span></dt><dd><p>This controls what string will show up in the printer comment box in print
     4807</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id348746"></a>
     4808
     4809server string (G)
     4810</h3></div></div></div><a class="indexterm" name="id348747"></a><a name="SERVERSTRING"></a><div class="variablelist"><dl><dt></dt><dd><p>This controls what string will show up in the printer comment box in print
    39874811        manager and next to the IPC connection in <code class="literal">net view</code>. It
    39884812        can be any string that you wish to show to your users.</p><p>It also sets what will appear in browse lists next
    … …  
    39934817</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>server string</code></em> = <code class="literal">University of GNUs Samba Server</code>
    39944818</em></span>
    3995 </p></dd><dt><span class="term"><a name="SETDIRECTORY"></a>set directory (S)</span></dt><dd><p>
     4819</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id348834"></a>
     4820
     4821set directory (S)
     4822</h3></div></div></div><a class="indexterm" name="id348835"></a><a name="SETDIRECTORY"></a><div class="variablelist"><dl><dt></dt><dd><p>
    39964823        If <code class="literal">set directory = no</code>, then        users of the
    39974824        service may not use the setdir command to change directory.
    … …  
    40024829        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>set directory</code></em> = <code class="literal">no</code>
    40034830</em></span>
    4004 </p></dd><dt><span class="term"><a name="SETPRIMARYGROUPSCRIPT"></a>set primary group script (G)</span></dt><dd><p>Thanks to the Posix subsystem in NT a Windows User has a
     4831</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id348891"></a>
     4832
     4833set primary group script (G)
     4834</h3></div></div></div><a class="indexterm" name="id348892"></a><a name="SETPRIMARYGROUPSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>Thanks to the Posix subsystem in NT a Windows User has a
    40054835        primary group in addition to the auxiliary groups.  This script
    40064836        sets the primary group in the unix userdatase when an
    … …  
    40144844</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>set primary group script</code></em> = <code class="literal">/usr/sbin/usermod -g '%g' '%u'</code>
    40154845</em></span>
    4016 </p></dd><dt><span class="term"><a name="SETQUOTACOMMAND"></a>set quota command (G)</span></dt><dd><p>The <code class="literal">set quota command</code> should only be used
     4846</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id348968"></a>
     4847
     4848set quota command (G)
     4849</h3></div></div></div><a class="indexterm" name="id348969"></a><a name="SETQUOTACOMMAND"></a><div class="variablelist"><dl><dt></dt><dd><p>The <code class="literal">set quota command</code> should only be used
    40174850        whenever there is no operating system API available from the OS that
    40184851        samba can use.</p><p>This option is only available if Samba was configured with the argument <code class="literal">--with-sys-quotas</code> or
    … …  
    40204853        was found in the system. Most packages are configured with these options already.</p><p>This parameter should specify the path to a script that
    40214854        can set quota for the specified arguments.</p><p>The specified script should take the following arguments:</p><div class="itemizedlist"><ul type="disc"><li><p>1 - quota type
    4022                         </p><div class="itemizedlist"><ul type="circle"><li><p>1 - user quotas</p></li><li><p>2 - user default quotas (uid = -1)</p></li><li><p>3 - group quotas</p></li><li><p>4 - group default quotas (gid = -1)</p></li></ul></div><p>
    4023                         </p></li><li><p>2 - id (uid for user, gid for group, -1 if N/A)</p></li><li><p>3 - quota state (0 = disable, 1 = enable, 2 = enable and enforce)</p></li><li><p>4 - block softlimit</p></li><li><p>5 - block hardlimit</p></li><li><p>6 - inode softlimit</p></li><li><p>7 - inode hardlimit</p></li><li><p>8(optional) - block size, defaults to 1024</p></li></ul></div><p>The script should output at least one line of data on success. And nothing on failure.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>set quota command</code></em> = <code class="literal"></code>
     4855                        </p><div class="itemizedlist"><ul type="circle"><li><p>1 - user quotas</p></li><li><p>2 - user default quotas (uid = -1)</p></li><li><p>3 - group quotas</p></li><li><p>4 - group default quotas (gid = -1)</p></li></ul></div></li><li><p>2 - id (uid for user, gid for group, -1 if N/A)</p></li><li><p>3 - quota state (0 = disable, 1 = enable, 2 = enable and enforce)</p></li><li><p>4 - block softlimit</p></li><li><p>5 - block hardlimit</p></li><li><p>6 - inode softlimit</p></li><li><p>7 - inode hardlimit</p></li><li><p>8(optional) - block size, defaults to 1024</p></li></ul></div><p>The script should output at least one line of data on success. And nothing on failure.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>set quota command</code></em> = <code class="literal"></code>
    40244856</em></span>
    40254857</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>set quota command</code></em> = <code class="literal">/usr/local/sbin/set_quota</code>
    40264858</em></span>
    4027 </p></dd><dt><span class="term"><a name="SHAREMODES"></a>share modes (S)</span></dt><dd><p>This enables or disables the honoring of
     4859</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349122"></a>
     4860
     4861share modes (S)
     4862</h3></div></div></div><a class="indexterm" name="id349123"></a><a name="SHAREMODES"></a><div class="variablelist"><dl><dt></dt><dd><p>This enables or disables the honoring of
    40284863        the <em class="parameter"><code>share modes</code></em> during a file open. These
    40294864        modes are used by clients to gain exclusive read or write access
    … …  
    40384873        off as many Windows applications will break if you do so.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>share modes</code></em> = <code class="literal">yes</code>
    40394874</em></span>
    4040 </p></dd><dt><span class="term"><a name="SHORTPRESERVECASE"></a>short preserve case (S)</span></dt><dd><p>
     4875</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349210"></a>
     4876
     4877short preserve case (S)
     4878</h3></div></div></div><a class="indexterm" name="id349211"></a><a name="SHORTPRESERVECASE"></a><div class="variablelist"><dl><dt></dt><dd><p>
    40414879        This boolean parameter controls if new files which conform to 8.3 syntax, that is all in upper case and of
    4042         suitable length, are created upper case, or if they are forced to be the <a class="indexterm" name="id324165"></a>default case.
    4043         This  option can be use with <a class="indexterm" name="id324172"></a>preserve case = yes to permit long filenames
     4880        suitable length, are created upper case, or if they are forced to be the <a class="link" href="smb.conf.5.html#DEFAULTCASE">default case</a>.
     4881        This  option can be use with <a class="link" href="smb.conf.5.html#PRESERVECASE">preserve case = yes</a> to permit long filenames
    40444882        to retain their case, while short names are lowered.
    4045         </p><p>See the section on <a href="#NAMEMANGLINGSECT" title="NAME MANGLING">NAME MANGLING</a>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>short preserve case</code></em> = <code class="literal">yes</code>
    4046 </em></span>
    4047 </p></dd><dt><span class="term"><a name="SHOWADDPRINTERWIZARD"></a>show add printer wizard (G)</span></dt><dd><p>With the introduction of MS-RPC based printing support
     4883        </p><p>See the section on <a class="link" href="#NAMEMANGLINGSECT" title="NAME MANGLING">NAME MANGLING</a>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>short preserve case</code></em> = <code class="literal">yes</code>
     4884</em></span>
     4885</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349284"></a>
     4886
     4887show add printer wizard (G)
     4888</h3></div></div></div><a class="indexterm" name="id349285"></a><a name="SHOWADDPRINTERWIZARD"></a><div class="variablelist"><dl><dt></dt><dd><p>With the introduction of MS-RPC based printing support
    40484889    for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will
    40494890    appear on Samba hosts in the share listing.  Normally this folder will
    … …  
    40634904                administrative privilege on an individual printer.</p></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>show add printer wizard</code></em> = <code class="literal">yes</code>
    40644905</em></span>
    4065 </p></dd><dt><span class="term"><a name="SHUTDOWNSCRIPT"></a>shutdown script (G)</span></dt><dd><p>This a full path name to a script called by
    4066          <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> that should
     4906</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349357"></a>
     4907
     4908shutdown script (G)
     4909</h3></div></div></div><a class="indexterm" name="id349358"></a><a name="SHUTDOWNSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>This a full path name to a script called by
     4910         <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> that should
    40674911        start a shutdown procedure.</p><p>If the connected user posseses the <code class="constant">SeRemoteShutdownPrivilege</code>,
    40684912        right, this command will be run as user.</p><p>The %z %t %r %f variables are expanded as follows:</p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>%z</code></em> will be substituted with the
    … …  
    40884932</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>shutdown script</code></em> = <code class="literal">/usr/local/samba/sbin/shutdown %m %t %r %f</code>
    40894933</em></span>
    4090 </p></dd><dt><span class="term"><a name="SMBPASSWDFILE"></a>smb passwd file (G)</span></dt><dd><p>This option sets the path to the encrypted smbpasswd file. By
     4934</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349502"></a>
     4935
     4936smb passwd file (G)
     4937</h3></div></div></div><a class="indexterm" name="id349503"></a><a name="SMBPASSWDFILE"></a><div class="variablelist"><dl><dt></dt><dd><p>This option sets the path to the encrypted smbpasswd file. By
    40914938    default the path to the smbpasswd file  is compiled into Samba.</p><p>
    40924939    An example of use is:
    … …  
    40964943    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>smb passwd file</code></em> = <code class="literal">${prefix}/private/smbpasswd</code>
    40974944</em></span>
    4098 </p></dd><dt><span class="term"><a name="SMBPORTS"></a>smb ports (G)</span></dt><dd><p>Specifies which ports the server should listen on for SMB traffic.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>smb ports</code></em> = <code class="literal">445 139</code>
    4099 </em></span>
    4100 </p></dd><dt><span class="term"><a name="SOCKETADDRESS"></a>socket address (G)</span></dt><dd><p>This option allows you to control what
     4945</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349554"></a>
     4946
     4947smb ports (G)
     4948</h3></div></div></div><a class="indexterm" name="id349555"></a><a name="SMBPORTS"></a><div class="variablelist"><dl><dt></dt><dd><p>Specifies which ports the server should listen on for SMB traffic.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>smb ports</code></em> = <code class="literal">445 139</code>
     4949</em></span>
     4950</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349595"></a>
     4951
     4952socket address (G)
     4953</h3></div></div></div><a class="indexterm" name="id349596"></a><a name="SOCKETADDRESS"></a><div class="variablelist"><dl><dt></dt><dd><p>This option allows you to control what
    41014954        address Samba will listen for connections on. This is used to
    41024955        support multiple virtual interfaces on the one server, each
    … …  
    41064959</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>socket address</code></em> = <code class="literal">192.168.2.20</code>
    41074960</em></span>
    4108 </p></dd><dt><span class="term"><a name="SOCKETOPTIONS"></a>socket options (G)</span></dt><dd><p>This option allows you to set socket options
     4961</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349657"></a>
     4962
     4963socket options (G)
     4964</h3></div></div></div><a class="indexterm" name="id349658"></a><a name="SOCKETOPTIONS"></a><div class="variablelist"><dl><dt></dt><dd><p>This option allows you to set socket options
    41094965    to be used when talking with the client.</p><p>Socket options are controls on the networking layer
    41104966    of the operating systems which allow the connection to be
    … …  
    41194975    either incorrectly  typed it or you need to add an include file
    41204976    to includes.h for your OS.  If the latter is the case please
    4121     send the patch to <a href="mailto:samba-technical@samba.org" target="_top">
     4977    send the patch to <a class="ulink" href="mailto:samba-technical@samba.org" target="_top">
    41224978    samba-technical@samba.org</a>.</p><p>Any of the supported socket options may be combined
    41234979    in any way you like, as long as your OS allows it.</p><p>This is the list of socket options currently settable
    … …  
    41344990</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>socket options</code></em> = <code class="literal">IPTOS_LOWDELAY</code>
    41354991</em></span>
    4136 </p></dd><dt><span class="term"><a name="STATCACHE"></a>stat cache (G)</span></dt><dd><p>This parameter determines if <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will use a cache in order to
     4992</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349850"></a>
     4993
     4994stat cache (G)
     4995</h3></div></div></div><a class="indexterm" name="id349851"></a><a name="STATCACHE"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter determines if <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will use a cache in order to
    41374996        speed up case insensitive name mappings. You should never need
    41384997        to change this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>stat cache</code></em> = <code class="literal">yes</code>
    41394998</em></span>
    4140 </p></dd><dt><span class="term"><a name="STOREDOSATTRIBUTES"></a>store dos attributes (S)</span></dt><dd><p>
     4999</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349899"></a>
     5000
     5001store dos attributes (S)
     5002</h3></div></div></div><a class="indexterm" name="id349900"></a><a name="STOREDOSATTRIBUTES"></a><div class="variablelist"><dl><dt></dt><dd><p>
    41415003        If this parameter is set Samba attempts to first read DOS attributes (SYSTEM, HIDDEN, ARCHIVE or
    41425004        READ-ONLY) from a filesystem extended attribute, before mapping DOS attributes to UNIX permission bits (such
    4143         as occurs with <a class="indexterm" name="id324831"></a>map hidden and <a class="indexterm" name="id324838"></a>map readonly).  When set, DOS
     5005        as occurs with <a class="link" href="smb.conf.5.html#MAPHIDDEN">map hidden</a> and <a class="link" href="smb.conf.5.html#MAPREADONLY">map readonly</a>).  When set, DOS
    41445006        attributes will be stored onto an extended attribute in the UNIX filesystem, associated with the file or
    4145         directory.  For no other mapping to occur as a fall-back, the parameters <a class="indexterm" name="id324846"></a>map hidden,
    4146         <a class="indexterm" name="id324854"></a>map system, <a class="indexterm" name="id324861"></a>map archive and <a class="indexterm" name="id324868"></a>map  readonly must be set to off.  This parameter writes the DOS attributes as a string into the extended
     5007        directory.  For no other mapping to occur as a fall-back, the parameters <a class="link" href="smb.conf.5.html#MAPHIDDEN">map hidden</a>,
     5008        <a class="link" href="smb.conf.5.html#MAPSYSTEM">map system</a>, <a class="link" href="smb.conf.5.html#MAPARCHIVE">map archive</a> and <a class="link" href="smb.conf.5.html#MAPREADONLY">map  readonly</a> must be set to off.  This parameter writes the DOS attributes as a string into the extended
    41475009        attribute named "user.DOSATTRIB". This extended attribute is explicitly hidden from smbd clients requesting an
    41485010        EA list. On Linux the filesystem must have been mounted with the mount option user_xattr in order for
    … …  
    41505012        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>store dos attributes</code></em> = <code class="literal">no</code>
    41515013</em></span>
    4152 </p></dd><dt><span class="term"><a name="STRICTALLOCATE"></a>strict allocate (S)</span></dt><dd><p>This is a boolean that controls the handling of
     5014</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350009"></a>
     5015
     5016strict allocate (S)
     5017</h3></div></div></div><a class="indexterm" name="id350010"></a><a name="STRICTALLOCATE"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a boolean that controls the handling of
    41535018    disk space allocation in the server. When this is set to <code class="constant">yes</code>
    41545019    the server will change from UNIX behaviour of not committing real
    … …  
    41625027    of users.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>strict allocate</code></em> = <code class="literal">no</code>
    41635028</em></span>
    4164 </p></dd><dt><span class="term"><a name="STRICTLOCKING"></a>strict locking (S)</span></dt><dd><p>
     5029</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350073"></a>
     5030
     5031strict locking (S)
     5032</h3></div></div></div><a class="indexterm" name="id350074"></a><a name="STRICTLOCKING"></a><div class="variablelist"><dl><dt></dt><dd><p>
    41655033        This is an enumerated type that controls the handling of file locking in the server. When this is set to <code class="constant">yes</code>,
    41665034        the server will check every read and write access for file locks, and deny access if locks exist. This can be slow on
    … …  
    41785046        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>strict locking</code></em> = <code class="literal">Auto</code>
    41795047</em></span>
    4180 </p></dd><dt><span class="term"><a name="STRICTSYNC"></a>strict sync (S)</span></dt><dd><p>Many Windows applications (including the Windows 98 explorer
     5048</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350145"></a>
     5049
     5050strict sync (S)
     5051</h3></div></div></div><a class="indexterm" name="id350146"></a><a name="STRICTSYNC"></a><div class="variablelist"><dl><dt></dt><dd><p>Many Windows applications (including the Windows 98 explorer
    41815052    shell) seem to confuse flushing buffer contents to disk with doing
    41825053    a sync to disk. Under UNIX, a sync call forces the process to be
    … …  
    41855056    This is very slow and should only be done rarely. Setting this
    41865057    parameter to <code class="constant">no</code> (the default) means that
    4187     <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> ignores the Windows
     5058    <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> ignores the Windows
    41885059    applications requests for a sync call. There is only a possibility
    41895060    of losing data if the operating system itself that Samba is running
    … …  
    41925063    reported with the new Windows98 explorer shell file copies.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>strict sync</code></em> = <code class="literal">no</code>
    41935064</em></span>
    4194 </p></dd><dt><span class="term"><a name="SVCCTLLIST"></a>svcctl list (G)</span></dt><dd><p>This option defines a list of init scripts that smbd
     5065</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350206"></a>
     5066
     5067svcctl list (G)
     5068</h3></div></div></div><a class="indexterm" name="id350207"></a><a name="SVCCTLLIST"></a><div class="variablelist"><dl><dt></dt><dd><p>This option defines a list of init scripts that smbd
    41955069    will use for starting and stopping Unix services via the Win32
    41965070    ServiceControl API.  This allows Windows administrators to
    … …  
    42055079</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>svcctl list</code></em> = <code class="literal">cups postfix portmap httpd</code>
    42065080</em></span>
    4207 </p></dd><dt><span class="term"><a name="SYNCALWAYS"></a>sync always (S)</span></dt><dd><p>This is a boolean parameter that controls
     5081</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350287"></a>
     5082
     5083sync always (S)
     5084</h3></div></div></div><a class="indexterm" name="id350288"></a><a name="SYNCALWAYS"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a boolean parameter that controls
    42085085    whether writes will always be written to stable storage before
    42095086    the write call returns. If this is <code class="constant">no</code> then the server will be
    … …  
    42165093    any affect.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>sync always</code></em> = <code class="literal">no</code>
    42175094</em></span>
    4218 </p></dd><dt><span class="term"><a name="SYSLOG"></a>syslog (G)</span></dt><dd><p>
     5095</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350353"></a>
     5096
     5097syslog only (G)
     5098</h3></div></div></div><a class="indexterm" name="id350354"></a><a name="SYSLOGONLY"></a><div class="variablelist"><dl><dt></dt><dd><p>
     5099    If this parameter is set then Samba debug messages are logged into the system
     5100    syslog only, and not to the debug log files. There still will be some
     5101        logging to log.[sn]mbd even if <span class="emphasis"><em>syslog only</em></span> is enabled.
     5102    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>syslog only</code></em> = <code class="literal">no</code>
     5103</em></span>
     5104</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350399"></a>
     5105
     5106syslog (G)
     5107</h3></div></div></div><a class="indexterm" name="id350400"></a><a name="SYSLOG"></a><div class="variablelist"><dl><dt></dt><dd><p>
    42195108    This parameter maps how Samba debug messages are logged onto the system syslog logging levels.
    42205109    Samba debug level zero maps onto syslog <code class="constant">LOG_ERR</code>, debug level one maps onto
    … …  
    42235112    </p><p>
    42245113    This parameter sets the threshold for sending messages to syslog.  Only messages with debug
    4225     level less than this value will be sent to syslog.
     5114    level less than this value will be sent to syslog. There still will be some
     5115    logging to log.[sn]mbd even if <span class="emphasis"><em>syslog only</em></span> is enabled.
    42265116    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>syslog</code></em> = <code class="literal">1</code>
    42275117</em></span>
    4228 </p></dd><dt><span class="term"><a name="SYSLOGONLY"></a>syslog only (G)</span></dt><dd><p>
    4229     If this parameter is set then Samba debug messages are logged into the system
    4230     syslog only, and not to the debug log files.
    4231     </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>syslog only</code></em> = <code class="literal">no</code>
    4232 </em></span>
    4233 </p></dd><dt><span class="term"><a name="TEMPLATEHOMEDIR"></a>template homedir (G)</span></dt><dd><p>When filling out the user information for a Windows NT
    4234         user, the <a href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> daemon  uses this
     5118</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350465"></a>
     5119
     5120template homedir (G)
     5121</h3></div></div></div><a class="indexterm" name="id350466"></a><a name="TEMPLATEHOMEDIR"></a><div class="variablelist"><dl><dt></dt><dd><p>When filling out the user information for a Windows NT
     5122        user, the <a class="citerefentry" href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> daemon  uses this
    42355123        parameter to fill in the home directory for that user. If the
    42365124        string <em class="parameter"><code>%D</code></em> is present it
    … …  
    42395127        is substituted with the user's Windows  NT user name.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>template homedir</code></em> = <code class="literal">/home/%D/%U</code>
    42405128</em></span>
    4241 </p></dd><dt><span class="term"><a name="TEMPLATESHELL"></a>template shell (G)</span></dt><dd><p>When filling out the user information for a Windows NT
    4242         user, the <a href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> daemon uses this
    4243         parameter to fill in the login shell for that user.</p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="TIMEOFFSET"></a>time offset (G)</span></dt><dd><p>This parameter is a setting in minutes to add
     5129</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350528"></a>
     5130
     5131template shell (G)
     5132</h3></div></div></div><a class="indexterm" name="id350529"></a><a name="TEMPLATESHELL"></a><div class="variablelist"><dl><dt></dt><dd><p>When filling out the user information for a Windows NT
     5133        user, the <a class="citerefentry" href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> daemon uses this
     5134        parameter to fill in the login shell for that user.</p><p><span class="emphasis"><em>No default</em></span></p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350564"></a>
     5135
     5136time offset (G)
     5137</h3></div></div></div><a class="indexterm" name="id350565"></a><a name="TIMEOFFSET"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a setting in minutes to add
    42445138        to the normal GMT to local time conversion. This is useful if
    42455139        you are serving a lot of PCs that have incorrect daylight
    … …  
    42485142</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>time offset</code></em> = <code class="literal">60</code>
    42495143</em></span>
    4250 </p></dd><dt><span class="term"><a name="TIMESERVER"></a>time server (G)</span></dt><dd><p>This parameter determines if <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> advertises itself as a time server to Windows
     5144</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350623"></a>
     5145
     5146time server (G)
     5147</h3></div></div></div><a class="indexterm" name="id350624"></a><a name="TIMESERVER"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter determines if <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> advertises itself as a time server to Windows
    42515148clients.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>time server</code></em> = <code class="literal">no</code>
    42525149</em></span>
    4253 </p></dd><dt><span class="term"><a name="UNIXCHARSET"></a>unix charset (G)</span></dt><dd><p>Specifies the charset the unix machine
     5150</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350672"></a>
     5151
     5152unix charset (G)
     5153</h3></div></div></div><a class="indexterm" name="id350674"></a><a name="UNIXCHARSET"></a><div class="variablelist"><dl><dt></dt><dd><p>Specifies the charset the unix machine
    42545154                Samba runs on uses. Samba needs to know this in order to be able to
    42555155                convert text to the charsets other SMB clients use.
    … …  
    42605160</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>unix charset</code></em> = <code class="literal">ASCII</code>
    42615161</em></span>
    4262 </p></dd><dt><span class="term"><a name="UNIXEXTENSIONS"></a>unix extensions (G)</span></dt><dd><p>This boolean parameter controls whether Samba
     5162</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350736"></a>
     5163
     5164unix extensions (G)
     5165</h3></div></div></div><a class="indexterm" name="id350737"></a><a name="UNIXEXTENSIONS"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean parameter controls whether Samba
    42635166    implments the CIFS UNIX extensions, as defined by HP.
    42645167    These extensions enable Samba to better serve UNIX CIFS clients
    … …  
    42675170    no current use to Windows clients.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>unix extensions</code></em> = <code class="literal">yes</code>
    42685171</em></span>
    4269 </p></dd><dt><span class="term"><a name="UNIXPASSWORDSYNC"></a>unix password sync (G)</span></dt><dd><p>This boolean parameter controls whether Samba
     5172</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350779"></a>
     5173
     5174unix password sync (G)
     5175</h3></div></div></div><a class="indexterm" name="id350780"></a><a name="UNIXPASSWORDSYNC"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean parameter controls whether Samba
    42705176    attempts to synchronize the UNIX password with the SMB password
    42715177    when the encrypted SMB password in the smbpasswd file is changed.
    … …  
    42765182        access to the old password cleartext, only the new).</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>unix password sync</code></em> = <code class="literal">no</code>
    42775183</em></span>
    4278 </p></dd><dt><span class="term"><a name="UPDATEENCRYPTED"></a>update encrypted (G)</span></dt><dd><p>
     5184</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350836"></a>
     5185
     5186update encrypted (G)
     5187</h3></div></div></div><a class="indexterm" name="id350837"></a><a name="UPDATEENCRYPTED"></a><div class="variablelist"><dl><dt></dt><dd><p>
    42795188        This boolean parameter allows a user logging on with a plaintext password to have their encrypted (hashed)
    42805189        password in the smbpasswd file to be updated automatically as they log on. This option allows a site to
    … …  
    42865195        in the smbpasswd file this parameter should be set to <code class="constant">no</code>.
    42875196        </p><p>
    4288         In order for this parameter to be operative the <a class="indexterm" name="id325719"></a>encrypt passwords parameter must
    4289     be set to <code class="constant">no</code>. The default value of <a class="indexterm" name="id325730"></a>encrypt  passwords = Yes. Note: This must be set to <code class="constant">no</code> for this <a class="indexterm" name="id325741"></a>update encrypted to work.
     5197        In order for this parameter to be operative the <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS">encrypt passwords</a> parameter must
     5198    be set to <code class="constant">no</code>. The default value of <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS">encrypt  passwords = Yes</a>. Note: This must be set to <code class="constant">no</code> for this <a class="link" href="smb.conf.5.html#UPDATEENCRYPTED">update encrypted</a> to work.
    42905199        </p><p>
    42915200        Note that even when this parameter is set a user authenticating to <code class="literal">smbd</code>
    … …  
    42945203        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>update encrypted</code></em> = <code class="literal">no</code>
    42955204</em></span>
    4296 </p></dd><dt><span class="term"><a name="USECLIENTDRIVER"></a>use client driver (S)</span></dt><dd><p>This parameter applies only to Windows NT/2000
     5205</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id350941"></a>
     5206
     5207use client driver (S)
     5208</h3></div></div></div><a class="indexterm" name="id350942"></a><a name="USECLIENTDRIVER"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter applies only to Windows NT/2000
    42975209    clients.  It has no effect on Windows 95/98/ME clients.  When
    42985210    serving a printer to Windows NT/2000 clients without first installing
    … …  
    43195231        server.</em></span></p><p>Default: <span class="emphasis"><em><em class="parameter"><code>use client driver</code></em> = <code class="literal">no</code>
    43205232</em></span>
    4321 </p></dd><dt><span class="term"><a name="USEKERBEROSKEYTAB"></a>use kerberos keytab (G)</span></dt><dd><p>
     5233</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351010"></a>
     5234
     5235use kerberos keytab (G)
     5236</h3></div></div></div><a class="indexterm" name="id351011"></a><a name="USEKERBEROSKEYTAB"></a><div class="variablelist"><dl><dt></dt><dd><p>
    43225237        Specifies whether Samba should attempt to maintain service principals in the systems
    43235238        keytab file for <code class="constant">host/FQDN</code> and <code class="constant">cifs/FQDN</code>.
    … …  
    43315246        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>use kerberos keytab</code></em> = <code class="literal">False</code>
    43325247</em></span>
    4333 </p></dd><dt><span class="term"><a name="USEMMAP"></a>use mmap (G)</span></dt><dd><p>This global parameter determines if the tdb internals of Samba can
     5248</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351074"></a>
     5249
     5250use mmap (G)
     5251</h3></div></div></div><a class="indexterm" name="id351075"></a><a name="USEMMAP"></a><div class="variablelist"><dl><dt></dt><dd><p>This global parameter determines if the tdb internals of Samba can
    43345252    depend on mmap working correctly on the running system. Samba requires a coherent
    43355253    mmap/read-write system memory cache. Currently only HPUX does not have such a
    … …  
    43405258    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>use mmap</code></em> = <code class="literal">yes</code>
    43415259</em></span>
    4342 </p></dd><dt><span class="term"><a name="USER"></a>user</span></dt><dd><p>This parameter is a synonym for username.</p></dd><dt><span class="term"><a name="USERS"></a>users</span></dt><dd><p>This parameter is a synonym for username.</p></dd><dt><span class="term"><a name="USERNAME"></a>username (S)</span></dt><dd><p>Multiple users may be specified in a comma-delimited
     5260</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351122"></a>
     5261
     5262username level (G)
     5263</h3></div></div></div><a class="indexterm" name="id351123"></a><a name="USERNAMELEVEL"></a><div class="variablelist"><dl><dt></dt><dd><p>This option helps Samba to try and 'guess' at
     5264    the real UNIX username, as many DOS clients send an all-uppercase
     5265    username. By default Samba tries all lowercase, followed by the
     5266    username with the first letter capitalized, and fails if the
     5267    username is not found on the UNIX machine.</p><p>If this parameter is set to non-zero the behavior changes.
     5268    This parameter is a number that specifies the number of uppercase
     5269    combinations to try while trying to determine the UNIX user name. The
     5270    higher the number the more combinations will be tried, but the slower
     5271    the discovery of usernames will be. Use this parameter when you have
     5272    strange usernames on your UNIX machine, such as <code class="constant">AstrangeUser
     5273    </code>.</p><p>This parameter is needed only on UNIX systems that have case
     5274    sensitive usernames.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>username level</code></em> = <code class="literal">0</code>
     5275</em></span>
     5276</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>username level</code></em> = <code class="literal">5</code>
     5277</em></span>
     5278</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351196"></a>
     5279
     5280username map script (G)
     5281</h3></div></div></div><a class="indexterm" name="id351197"></a><a name="USERNAMEMAPSCRIPT"></a><div class="variablelist"><dl><dt></dt><dd><p>This script is a mutually exclusive alternative to the
     5282        <a class="link" href="smb.conf.5.html#USERNAMEMAP">username map</a> parameter.  This parameter
     5283        specifies and external program or script that must accept a single
     5284        command line option (the username transmitted in the authentication
     5285        request) and return a line line on standard output (the name to which
     5286        the account should mapped).  In this way, it is possible to store
     5287        username map tables in an LDAP or NIS directory services.
     5288        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>username map script</code></em> = <code class="literal"></code>
     5289</em></span>
     5290</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>username map script</code></em> = <code class="literal">/etc/samba/scripts/mapusers.sh</code>
     5291</em></span>
     5292</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351267"></a>
     5293
     5294username map (G)
     5295</h3></div></div></div><a class="indexterm" name="id351268"></a><a name="USERNAMEMAP"></a><div class="variablelist"><dl><dt></dt><dd><p>
     5296        This option allows you to specify a file containing a mapping of usernames from the clients to the server.
     5297        This can be used for several purposes. The most common is to map usernames that users use on DOS or Windows
     5298        machines to those that the UNIX box uses. The other is to map multiple users to a single username so that they
     5299        can more easily share files.
     5300        </p><p>
     5301        Please note that for user or share mode security, the username map is applied prior to validating the user
     5302        credentials.  Domain member servers (domain or ads) apply the username map after the user has been
     5303        successfully authenticated by the domain controller and require fully qualified enties in the map table (e.g.
     5304        biddle = <code class="literal">DOMAIN\foo</code>).
     5305        </p><p>
     5306        The map file is parsed line by line. Each line should contain a single UNIX username on the left then a '='
     5307        followed by a list of usernames on the right. The list of usernames on the right may contain names of the form
     5308        @group in which case they will match any UNIX username in that group. The special client name '*' is a
     5309        wildcard and matches any name. Each line of the map file may be up to 1023 characters long.
     5310        </p><p>
     5311        The file is processed on each line by taking the supplied username and comparing it with each username on the
     5312        right hand side of the '=' signs. If the supplied name matches any of the names on the right hand side then it
     5313        is replaced with the name on the left. Processing then continues with the next line.
     5314        </p><p>
     5315        If any line begins with a '#' or a ';' then it is ignored.
     5316        </p><p>
     5317        If any line begins with an '!' then the processing will stop after that line if a mapping was done by the
     5318        line.  Otherwise mapping continues with every line being processed.  Using '!' is most useful when you have a
     5319        wildcard mapping line later in the file.
     5320        </p><p>
     5321        For example to map from the name <code class="constant">admin</code> or <code class="constant">administrator</code> to the UNIX
     5322        name <code class="constant"> root</code> you would use:
     5323</p><pre class="programlisting">
     5324<code class="literal">root = admin administrator</code>
     5325</pre><p>
     5326        Or to map anyone in the UNIX group <code class="constant">system</code> to the UNIX name <code class="constant">sys</code> you would use:
     5327</p><pre class="programlisting">
     5328<code class="literal">sys = @system</code>
     5329</pre><p>
     5330        </p><p>
     5331        You can have as many mappings as you like in a username map file.
     5332        </p><p>
     5333        If your system supports the NIS NETGROUP option then the netgroup database is checked before the <code class="filename">/etc/group </code> database for matching groups.
     5334        </p><p>
     5335        You can map Windows usernames that have spaces in them by using double quotes around the name. For example:
     5336</p><pre class="programlisting">
     5337<code class="literal">tridge = "Andrew Tridgell"</code>
     5338</pre><p>
     5339    would map the windows username "Andrew Tridgell" to the unix username "tridge".
     5340        </p><p>
     5341        The following example would map mary and fred to the unix user sys, and map the rest to guest. Note the use of the
     5342    '!' to tell Samba to stop processing if it gets a match on that line:
     5343</p><pre class="programlisting">
     5344!sys = mary fred
     5345guest = *
     5346</pre><p>
     5347    </p><p>
     5348        Note that the remapping is applied to all occurrences of usernames.  Thus if you connect to \\server\fred and
     5349        <code class="constant">fred</code> is remapped to <code class="constant">mary</code> then you will actually be connecting to
     5350        \\server\mary and will need to supply a password suitable for <code class="constant">mary</code> not
     5351        <code class="constant">fred</code>. The only exception to this is the username passed to the <a class="link" href="smb.conf.5.html#PASSWORDSERVER">password server</a> (if you have one). The password server will receive whatever username the client
     5352        supplies without  modification.
     5353    </p><p>
     5354        Also note that no reverse mapping is done. The main effect this has is with printing. Users who have been
     5355        mapped may have trouble deleting print jobs as PrintManager under WfWg will think they don't own the print
     5356        job.
     5357        </p><p>
     5358        Samba versions prior to 3.0.8 would only support reading the fully qualified username
     5359        (e.g.: <code class="literal">DOMAIN\user</code>) from
     5360        the username map when performing a kerberos login from a client.  However, when looking up a map entry for a
     5361        user authenticated by NTLM[SSP], only the login name would be used for matches.  This resulted in inconsistent
     5362        behavior sometimes even on the same server.
     5363   </p><p>
     5364   The following functionality is obeyed in version 3.0.8 and later:
     5365   </p><p>
     5366    When performing local authentication, the username map is applied to the login name before attempting to authenticate
     5367    the connection.
     5368    </p><p>
     5369    When relying upon a external domain controller for validating authentication requests, smbd will apply the username map
     5370    to the fully qualified username (i.e. <code class="literal">DOMAIN\user</code>) only after the user has been successfully authenticated.
     5371    </p><p>
     5372    An example of use is:
     5373</p><pre class="programlisting">
     5374username map = /usr/local/samba/lib/users.map
     5375</pre><p>
     5376    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>username map</code></em> = <code class="literal">
     5377# no username map</code>
     5378</em></span>
     5379</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351509"></a><a name="USER"></a>user</h3></div></div></div><a class="indexterm" name="id351510"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#USERNAME">username</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351540"></a><a name="USERS"></a>users</h3></div></div></div><a class="indexterm" name="id351541"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#USERNAME">username</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351570"></a>
     5380
     5381username (S)
     5382</h3></div></div></div><a class="indexterm" name="id351571"></a><a name="USERNAME"></a><div class="variablelist"><dl><dt></dt><dd><p>Multiple users may be specified in a comma-delimited
    43435383    list, in which case the supplied password will be tested against
    43445384    each username in turn (left to right).</p><p>The <em class="parameter"><code>username</code></em> line is needed only when
    … …  
    43595399    telnet session. The daemon runs as the user that they log in as,
    43605400    so they cannot do anything that user cannot do.</p><p>To restrict a service to a particular set of users you
    4361     can use the <a class="indexterm" name="id326066"></a>valid users parameter.</p><p>If any of the usernames begin with a '@' then the name
     5401    can use the <a class="link" href="smb.conf.5.html#VALIDUSERS">valid users</a> parameter.</p><p>If any of the usernames begin with a '@' then the name
    43625402    will be looked up first in the NIS netgroups list (if Samba
    43635403    is compiled with netgroup support), followed by a lookup in
    … …  
    43705410    of all users in the netgroup group of that name.</p><p>Note that searching though a groups database can take
    43715411    quite some time, and some clients may time out during the
    4372     search.</p><p>See the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">NOTE ABOUT
     5412    search.</p><p>See the section <a class="link" href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">NOTE ABOUT
    43735413        USERNAME/PASSWORD VALIDATION</a> for more information on how
    43745414        this parameter determines access to the services.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>username</code></em> = <code class="literal">
    … …  
    43785418</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>username</code></em> = <code class="literal">fred, mary, jack, jane, @users, @pcgroup</code>
    43795419</em></span>
    4380 </p></dd><dt><span class="term"><a name="USERNAMELEVEL"></a>username level (G)</span></dt><dd><p>This option helps Samba to try and 'guess' at
    4381     the real UNIX username, as many DOS clients send an all-uppercase
    4382     username. By default Samba tries all lowercase, followed by the
    4383     username with the first letter capitalized, and fails if the
    4384     username is not found on the UNIX machine.</p><p>If this parameter is set to non-zero the behavior changes.
    4385     This parameter is a number that specifies the number of uppercase
    4386     combinations to try while trying to determine the UNIX user name. The
    4387     higher the number the more combinations will be tried, but the slower
    4388     the discovery of usernames will be. Use this parameter when you have
    4389     strange usernames on your UNIX machine, such as <code class="constant">AstrangeUser
    4390     </code>.</p><p>This parameter is needed only on UNIX systems that have case
    4391     sensitive usernames.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>username level</code></em> = <code class="literal">0</code>
    4392 </em></span>
    4393 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>username level</code></em> = <code class="literal">5</code>
    4394 </em></span>
    4395 </p></dd><dt><span class="term"><a name="USERNAMEMAP"></a>username map (G)</span></dt><dd><p>
    4396         This option allows you to specify a file containing a mapping of usernames from the clients to the server.
    4397         This can be used for several purposes. The most common is to map usernames that users use on DOS or Windows
    4398         machines to those that the UNIX box uses. The other is to map multiple users to a single username so that they
    4399         can more easily share files.
    4400         </p><p>
    4401         Please note that for user or share mode security, the username map is applied prior to validating the user
    4402         credentials.  Domain member servers (domain or ads) apply the username map after the user has been
    4403         successfully authenticated by the domain controller and require fully qualified enties in the map table (e.g.
    4404         biddle = DOMAIN\foo).
    4405         </p><p>
    4406         The map file is parsed line by line. Each line should contain a single UNIX username on the left then a '='
    4407         followed by a list of usernames on the right. The list of usernames on the right may contain names of the form
    4408         @group in which case they will match any UNIX username in that group. The special client name '*' is a
    4409         wildcard and matches any name. Each line of the map file may be up to 1023 characters long.
    4410         </p><p>
    4411         The file is processed on each line by taking the supplied username and comparing it with each username on the
    4412         right hand side of the '=' signs. If the supplied name matches any of the names on the right hand side then it
    4413         is replaced with the name on the left. Processing then continues with the next line.
    4414         </p><p>
    4415         If any line begins with a '#' or a ';' then it is ignored.
    4416         </p><p>
    4417         If any line begins with an '!' then the processing will stop after that line if a mapping was done by the
    4418         line.  Otherwise mapping continues with every line being processed.  Using '!' is most useful when you have a
    4419         wildcard mapping line later in the file.
    4420         </p><p>
    4421         For example to map from the name <code class="constant">admin</code> or <code class="constant">administrator</code> to the UNIX
    4422         name <code class="constant"> root</code> you would use:
    4423 </p><pre class="programlisting">
    4424 <code class="literal">root = admin administrator</code>
    4425 </pre><p>
    4426         Or to map anyone in the UNIX group <code class="constant">system</code> to the UNIX name <code class="constant">sys</code> you would use:
    4427 </p><pre class="programlisting">
    4428 <code class="literal">sys = @system</code>
    4429 </pre><p>
    4430         </p><p>
    4431         You can have as many mappings as you like in a username map file.
    4432         </p><p>
    4433         If your system supports the NIS NETGROUP option then the netgroup database is checked before the <code class="filename">/etc/group </code> database for matching groups.
    4434         </p><p>
    4435         You can map Windows usernames that have spaces in them by using double quotes around the name. For example:
    4436 </p><pre class="programlisting">
    4437 <code class="literal">tridge = "Andrew Tridgell"</code>
    4438 </pre><p>
    4439     would map the windows username "Andrew Tridgell" to the unix username "tridge".
    4440         </p><p>
    4441         The following example would map mary and fred to the unix user sys, and map the rest to guest. Note the use of the
    4442     '!' to tell Samba to stop processing if it gets a match on that line:
    4443 </p><pre class="programlisting">
    4444 !sys = mary fred
    4445 guest = *
    4446 </pre><p>
    4447     </p><p>
    4448         Note that the remapping is applied to all occurrences of usernames.  Thus if you connect to \\server\fred and
    4449         <code class="constant">fred</code> is remapped to <code class="constant">mary</code> then you will actually be connecting to
    4450         \\server\mary and will need to supply a password suitable for <code class="constant">mary</code> not
    4451         <code class="constant">fred</code>. The only exception to this is the username passed to the <a class="indexterm" name="id326373"></a>password server (if you have one). The password server will receive whatever username the client
    4452         supplies without  modification.
    4453     </p><p>
    4454         Also note that no reverse mapping is done. The main effect this has is with printing. Users who have been
    4455         mapped may have trouble deleting print jobs as PrintManager under WfWg will think they don't own the print
    4456         job.
    4457         </p><p>
    4458         Samba versions prior to 3.0.8 would only support reading the fully qualified username (e.g.: DOMAIN\user) from
    4459         the username map when performing a kerberos login from a client.  However, when looking up a map entry for a
    4460         user authenticated by NTLM[SSP], only the login name would be used for matches.  This resulted in inconsistent
    4461         behavior sometimes even on the same server.
    4462    </p><p>
    4463    The following functionality is obeyed in version 3.0.8 and later:
    4464    </p><p>
    4465     When performing local authentication, the username map is applied to the login name before attempting to authenticate
    4466     the connection.
    4467     </p><p>
    4468     When relying upon a external domain controller for validating authentication requests, smbd will apply the username map
    4469     to the fully qualified username (i.e. DOMAIN\user) only after the user has been successfully authenticated.
    4470     </p><p>
    4471     An example of use is:
    4472 </p><pre class="programlisting">
    4473 username map = /usr/local/samba/lib/users.map
    4474 </pre><p>
    4475     </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>username map</code></em> = <code class="literal">
    4476 # no username map</code>
    4477 </em></span>
    4478 </p></dd><dt><span class="term"><a name="USERNAMEMAPSCRIPT"></a>username map script (G)</span></dt><dd><p>This script is a mutually exclusive alternative to the
    4479         <a class="indexterm" name="id326456"></a>username map parameter.  This parameter
    4480         specifies and external program or script that must accept a single
    4481         command line option (the username transmitted in the authentication
    4482         request) and return a line line on standard output (the name to which
    4483         the account should mapped).  In this way, it is possible to store
    4484         username map tables in an LDAP or NIS directory services.
    4485         </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>username map script</code></em> = <code class="literal"></code>
    4486 </em></span>
    4487 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>username map script</code></em> = <code class="literal">/etc/samba/scripts/mapusers.sh</code>
    4488 </em></span>
    4489 </p></dd><dt><span class="term"><a name="USERSHAREALLOWGUESTS"></a>usershare allow guests (G)</span></dt><dd><p>This parameter controls whether user defined shares are allowed
     5420</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351716"></a>
     5421
     5422usershare allow guests (G)
     5423</h3></div></div></div><a class="indexterm" name="id351717"></a><a name="USERSHAREALLOWGUESTS"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls whether user defined shares are allowed
    44905424        to be accessed by non-authenticated users or not. It is the equivalent
    44915425        of allowing people who can create a share the option of setting
    … …  
    44945428        is set to off.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>usershare allow guests</code></em> = <code class="literal">no</code>
    44955429</em></span>
    4496 </p></dd><dt><span class="term"><a name="USERSHAREMAXSHARES"></a>usershare max shares (G)</span></dt><dd><p>This parameter specifies the number of user defined shares
     5430</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351765"></a>
     5431
     5432usershare max shares (G)
     5433</h3></div></div></div><a class="indexterm" name="id351766"></a><a name="USERSHAREMAXSHARES"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the number of user defined shares
    44975434        that are allowed to be created by users belonging to the group owning the
    44985435        usershare directory. If set to zero (the default) user defined shares are ignored.
    44995436        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>usershare max shares</code></em> = <code class="literal">0</code>
    45005437</em></span>
    4501 </p></dd><dt><span class="term"><a name="USERSHAREOWNERONLY"></a>usershare owner only (G)</span></dt><dd><p>This parameter controls whether the pathname exported by
     5438</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351807"></a>
     5439
     5440usershare owner only (G)
     5441</h3></div></div></div><a class="indexterm" name="id351808"></a><a name="USERSHAREOWNERONLY"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls whether the pathname exported by
    45025442        a user defined shares must be owned by the user creating the
    45035443        user defined share or not. If set to True (the default) then
    … …  
    45095449        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>usershare owner only</code></em> = <code class="literal">True</code>
    45105450</em></span>
    4511 </p></dd><dt><span class="term"><a name="USERSHAREPATH"></a>usershare path (G)</span></dt><dd><p>This parameter specifies the absolute path of the directory on the
     5451</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351851"></a>
     5452
     5453usershare path (G)
     5454</h3></div></div></div><a class="indexterm" name="id351852"></a><a name="USERSHAREPATH"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the absolute path of the directory on the
    45125455        filesystem used to store the user defined share definition files.
    45135456        This directory must be owned by root, and have no access for
    … …  
    45305473        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>usershare path</code></em> = <code class="literal">NULL</code>
    45315474</em></span>
    4532 </p></dd><dt><span class="term"><a name="USERSHAREPREFIXALLOWLIST"></a>usershare prefix allow list (G)</span></dt><dd><p>This parameter specifies a list of absolute pathnames
     5475</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351915"></a>
     5476
     5477usershare prefix allow list (G)
     5478</h3></div></div></div><a class="indexterm" name="id351916"></a><a name="USERSHAREPREFIXALLOWLIST"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies a list of absolute pathnames
    45335479        the root of which are allowed to be exported by user defined share definitions.
    45345480        If the pathname exported doesn't start with one of the strings in this
    … …  
    45455491</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>usershare prefix allow list</code></em> = <code class="literal">/home /data /space</code>
    45465492</em></span>
    4547 </p></dd><dt><span class="term"><a name="USERSHAREPREFIXDENYLIST"></a>usershare prefix deny list (G)</span></dt><dd><p>This parameter specifies a list of absolute pathnames
     5493</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id351982"></a>
     5494
     5495usershare prefix deny list (G)
     5496</h3></div></div></div><a class="indexterm" name="id351983"></a><a name="USERSHAREPREFIXDENYLIST"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies a list of absolute pathnames
    45485497        the root of which are NOT allowed to be exported by user defined share definitions.
    45495498        If the pathname exported starts with one of the strings in this
    … …  
    45615510</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>usershare prefix deny list</code></em> = <code class="literal">/etc /dev /private</code>
    45625511</em></span>
    4563 </p></dd><dt><span class="term"><a name="USERSHARETEMPLATESHARE"></a>usershare template share (G)</span></dt><dd><p>User defined shares only have limited possible parameters
     5512</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352053"></a>
     5513
     5514usershare template share (G)
     5515</h3></div></div></div><a class="indexterm" name="id352054"></a><a name="USERSHARETEMPLATESHARE"></a><div class="variablelist"><dl><dt></dt><dd><p>User defined shares only have limited possible parameters
    45645516        such as path, guest ok etc. This parameter allows usershares to
    45655517        "cloned" from an existing share. If "usershare template share"
    … …  
    45765528</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>usershare template share</code></em> = <code class="literal">template_share</code>
    45775529</em></span>
    4578 </p></dd><dt><span class="term"><a name="USESENDFILE"></a>use sendfile (S)</span></dt><dd><p>If this parameter is <code class="constant">yes</code>, and the <code class="constant">sendfile()</code>
     5530</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352120"></a>
     5531
     5532use sendfile (S)
     5533</h3></div></div></div><a class="indexterm" name="id352121"></a><a name="USESENDFILE"></a><div class="variablelist"><dl><dt></dt><dd><p>If this parameter is <code class="constant">yes</code>, and the <code class="constant">sendfile()</code>
    45795534    system call is supported by the underlying operating system, then some SMB read calls
    45805535    (mainly ReadAndX and ReadRaw) will use the more efficient sendfile system call for files that
    … …  
    45855540    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>use sendfile</code></em> = <code class="literal">false</code>
    45865541</em></span>
    4587 </p></dd><dt><span class="term"><a name="USESPNEGO"></a>use spnego (G)</span></dt><dd><p>This variable controls controls whether samba will try
     5542</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352172"></a>
     5543
     5544use spnego (G)
     5545</h3></div></div></div><a class="indexterm" name="id352173"></a><a name="USESPNEGO"></a><div class="variablelist"><dl><dt></dt><dd><p>This variable controls controls whether samba will try
    45885546    to use Simple and Protected NEGOciation (as specified by rfc2478) with
    45895547    WindowsXP and Windows2000 clients to agree upon an authentication mechanism.
    … …  
    45935551        disabled.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>use spnego</code></em> = <code class="literal">yes</code>
    45945552</em></span>
    4595 </p></dd><dt><span class="term"><a name="UTMP"></a>utmp (G)</span></dt><dd><p>
    4596         This boolean parameter is only available if Samba has been configured and compiled 
    4597         with the option <code class="literal">--with-utmp</code>. If set to
    4598          <code class="constant">yes</code> then Samba will attempt to add utmp or utmpx records
    4599         (depending on the UNIX system) whenever a connection is made to a Samba server.
    4600         Sites may use this to record the user connecting to a Samba share.
    4601         </p><p>
    4602         Due to the requirements of the utmp record, we  are required to create a unique
    4603         identifier for the incoming user.  Enabling this option creates an n^2  algorithm
    4604         to find this number.  This may impede performance on large installations.
    4605         </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>utmp</code></em> = <code class="literal">no</code>
    4606 </em></span>
    4607 </p></dd><dt><span class="term"><a name="UTMPDIRECTORY"></a>utmp directory (G)</span></dt><dd><p>This parameter is only available if Samba has
     5553</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352218"></a>
     5554
     5555utmp directory (G)
     5556</h3></div></div></div><a class="indexterm" name="id352219"></a><a name="UTMPDIRECTORY"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is only available if Samba has
    46085557        been configured and compiled with the option <code class="literal">
    46095558        --with-utmp</code>. It specifies a directory pathname that is
    … …  
    46175566</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>utmp directory</code></em> = <code class="literal">/var/run/utmp</code>
    46185567</em></span>
    4619 </p></dd><dt><span class="term"><a name="-VALID"></a>-valid (S)</span></dt><dd><p> This parameter indicates whether a share is
    4620         valid and thus can be used. When this parameter is set to false,
    4621         the share will be in no way visible nor accessible.
    4622         </p><p>
    4623         This option should not be
    4624         used by regular users but might be of help to developers.
    4625         Samba uses this option internally to mark shares as deleted.
    4626         </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>-valid</code></em> = <code class="literal">yes</code>
    4627 </em></span>
    4628 </p></dd><dt><span class="term"><a name="VALIDUSERS"></a>valid users (S)</span></dt><dd><p>
     5568</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352292"></a>
     5569
     5570utmp (G)
     5571</h3></div></div></div><a class="indexterm" name="id352293"></a><a name="UTMP"></a><div class="variablelist"><dl><dt></dt><dd><p>
     5572        This boolean parameter is only available if Samba has been configured and compiled 
     5573        with the option <code class="literal">--with-utmp</code>. If set to
     5574         <code class="constant">yes</code> then Samba will attempt to add utmp or utmpx records
     5575        (depending on the UNIX system) whenever a connection is made to a Samba server.
     5576        Sites may use this to record the user connecting to a Samba share.
     5577        </p><p>
     5578        Due to the requirements of the utmp record, we  are required to create a unique
     5579        identifier for the incoming user.  Enabling this option creates an n^2  algorithm
     5580        to find this number.  This may impede performance on large installations.
     5581        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>utmp</code></em> = <code class="literal">no</code>
     5582</em></span>
     5583</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352349"></a>
     5584
     5585valid users (S)
     5586</h3></div></div></div><a class="indexterm" name="id352350"></a><a name="VALIDUSERS"></a><div class="variablelist"><dl><dt></dt><dd><p>
    46295587    This is a list of users that should be allowed to login to this service. Names starting with
    46305588    '@', '+' and  '&amp;' are interpreted using the same rules as described in the
    … …  
    46425600</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>valid users</code></em> = <code class="literal">greg, @pcusers</code>
    46435601</em></span>
    4644 </p></dd><dt><span class="term"><a name="VETOFILES"></a>veto files (S)</span></dt><dd><p>
     5602</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352436"></a>
     5603
     5604-valid (S)
     5605</h3></div></div></div><a class="indexterm" name="id352437"></a><a name="-VALID"></a><div class="variablelist"><dl><dt></dt><dd><p> This parameter indicates whether a share is
     5606        valid and thus can be used. When this parameter is set to false,
     5607        the share will be in no way visible nor accessible.
     5608        </p><p>
     5609        This option should not be
     5610        used by regular users but might be of help to developers.
     5611        Samba uses this option internally to mark shares as deleted.
     5612        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>-valid</code></em> = <code class="literal">yes</code>
     5613</em></span>
     5614</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352481"></a>
     5615
     5616veto files (S)
     5617</h3></div></div></div><a class="indexterm" name="id352482"></a><a name="VETOFILES"></a><div class="variablelist"><dl><dt></dt><dd><p>
    46455618        This is a list of files and directories that are neither visible nor accessible.  Each entry in
    46465619        the list must be separated by a '/', which allows spaces to be included in the entry. '*' and '?'
    … …  
    46505623        unix directory  separator '/'.
    46515624        </p><p>
    4652         Note that the <a class="indexterm" name="id327272"></a>case sensitive option is applicable in vetoing files.
     5625        Note that the <a class="link" href="smb.conf.5.html#CASESENSITIVE">case sensitive</a> option is applicable in vetoing files.
    46535626        </p><p>
    46545627        One feature of the veto files parameter that it is important to be aware of is Samba's behaviour when
    46555628        trying to delete a directory. If a directory that is to be deleted contains nothing but veto files this
    4656         deletion will <span class="emphasis"><em>fail</em></span> unless you also set the <a class="indexterm" name="id327288"></a>delete veto files
     5629        deletion will <span class="emphasis"><em>fail</em></span> unless you also set the <a class="link" href="smb.conf.5.html#DELETEVETOFILES">delete veto files</a>
    46575630        parameter to <em class="parameter"><code>yes</code></em>.
    46585631        </p><p>
    … …  
    46735646        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>veto files</code></em> = <code class="literal">No files or directories are vetoed.</code>
    46745647</em></span>
    4675 </p></dd><dt><span class="term"><a name="VETOOPLOCKFILES"></a>veto oplock files (S)</span></dt><dd><p>
    4676         This parameter is only valid when the <a class="indexterm" name="id327357"></a>oplocks
     5648</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352588"></a>
     5649
     5650veto oplock files (S)
     5651</h3></div></div></div><a class="indexterm" name="id352589"></a><a name="VETOOPLOCKFILES"></a><div class="variablelist"><dl><dt></dt><dd><p>
     5652        This parameter is only valid when the <a class="link" href="smb.conf.5.html#OPLOCKS">oplocks</a>
    46775653        parameter is turned on for a share. It allows the Samba administrator
    46785654        to selectively turn off the granting of oplocks on selected files that
    46795655        match a wildcarded list, similar to the wildcarded list used in the
    4680         <a class="indexterm" name="id327366"></a>veto files parameter.
     5656        <a class="link" href="smb.conf.5.html#VETOFILES">veto files</a> parameter.
    46815657        </p><p>
    46825658        You might want to do this on files that you know will be heavily contended
    … …  
    46945670# No files are vetoed for oplock grants</code>
    46955671</em></span>
    4696 </p></dd><dt><span class="term"><a name="VFSOBJECT"></a>vfs object</span></dt><dd><p>This parameter is a synonym for vfs objects.</p></dd><dt><span class="term"><a name="VFSOBJECTS"></a>vfs objects (S)</span></dt><dd><p>This parameter specifies the backend names which
     5672</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352674"></a><a name="VFSOBJECT"></a>vfs object</h3></div></div></div><a class="indexterm" name="id352675"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#VFSOBJECTS">vfs objects</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352704"></a>
     5673
     5674vfs objects (S)
     5675</h3></div></div></div><a class="indexterm" name="id352705"></a><a name="VFSOBJECTS"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the backend names which
    46975676        are used for Samba VFS I/O operations.  By default, normal
    46985677        disk I/O operations are used but these can be overloaded
    … …  
    47015680</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>vfs objects</code></em> = <code class="literal">extd_audit recycle</code>
    47025681</em></span>
    4703 </p></dd><dt><span class="term"><a name="VOLUME"></a>volume (S)</span></dt><dd><p>This allows you to override the volume label
     5682</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352762"></a>
     5683
     5684volume (S)
     5685</h3></div></div></div><a class="indexterm" name="id352763"></a><a name="VOLUME"></a><div class="variablelist"><dl><dt></dt><dd><p>This allows you to override the volume label
    47045686        returned for a share. Useful for CDROMs with installation programs
    47055687        that insist on a particular volume label.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>volume</code></em> = <code class="literal">
    47065688# the name of the share</code>
    47075689</em></span>
    4708 </p></dd><dt><span class="term"><a name="WIDELINKS"></a>wide links (S)</span></dt><dd><p>This parameter controls whether or not links
     5690</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352804"></a>
     5691
     5692wide links (S)
     5693</h3></div></div></div><a class="indexterm" name="id352805"></a><a name="WIDELINKS"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls whether or not links
    47095694        in the UNIX file system may be followed by the server. Links
    47105695        that point to areas within the directory tree exported by the
    … …  
    47145699        that Samba has to  do in order to perform the link checks.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>wide links</code></em> = <code class="literal">yes</code>
    47155700</em></span>
    4716 </p></dd><dt><span class="term"><a name="WINBINDCACHETIME"></a>winbind cache time (G)</span></dt><dd><p>This parameter specifies the number of
    4717         seconds the <a href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> daemon will cache
     5701</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352852"></a>
     5702
     5703winbind cache time (G)
     5704</h3></div></div></div><a class="indexterm" name="id352853"></a><a name="WINBINDCACHETIME"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies the number of
     5705        seconds the <a class="citerefentry" href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> daemon will cache
    47185706        user and group information before querying a Windows NT server
    47195707        again.</p><p>
    47205708        This does not apply to authentication requests, these are always
    4721         evaluated in real time unless the <a class="indexterm" name="id327609"></a>winbind   offline logon option has been enabled.
     5709        evaluated in real time unless the <a class="link" href="smb.conf.5.html#WINBINDOFFLINELOGON">winbind   offline logon</a> option has been enabled.
    47225710        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>winbind cache time</code></em> = <code class="literal">300</code>
    47235711</em></span>
    4724 </p></dd><dt><span class="term"><a name="WINBINDENUMGROUPS"></a>winbind enum groups (G)</span></dt><dd><p>On large installations using <a href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> it may be necessary to suppress
     5712</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352918"></a>
     5713
     5714winbind enum groups (G)
     5715</h3></div></div></div><a class="indexterm" name="id352919"></a><a name="WINBINDENUMGROUPS"></a><div class="variablelist"><dl><dt></dt><dd><p>On large installations using <a class="citerefentry" href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> it may be necessary to suppress
    47255716        the enumeration of groups through the <code class="literal">setgrent()</code>,
    47265717        <code class="literal">getgrent()</code> and
    … …  
    47305721        call will not return any data. </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>Turning off group enumeration may cause some programs to behave oddly.  </p></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>winbind enum groups</code></em> = <code class="literal">no</code>
    47315722</em></span>
    4732 </p></dd><dt><span class="term"><a name="WINBINDENUMUSERS"></a>winbind enum users (G)</span></dt><dd><p>On large installations using <a href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> it may be
     5723</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353006"></a>
     5724
     5725winbind enum users (G)
     5726</h3></div></div></div><a class="indexterm" name="id353007"></a><a name="WINBINDENUMUSERS"></a><div class="variablelist"><dl><dt></dt><dd><p>On large installations using <a class="citerefentry" href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> it may be
    47335727        necessary to suppress the enumeration of users through the <code class="literal">setpwent()</code>,
    47345728         <code class="literal">getpwent()</code> and
    … …  
    47425736        usernames. </p></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>winbind enum users</code></em> = <code class="literal">no</code>
    47435737</em></span>
    4744 </p></dd><dt><span class="term"><a name="WINBINDEXPANDGROUPS"></a>winbind expand groups (G)</span></dt><dd><p>This option controls the maximum depth that winbindd
    4745               will traverse when flattening nested group memberships
    4746               of Windows domain groups.  This is different from the
    4747               <a class="indexterm" name="id327830"></a>winbind nested groups option
    4748               which implements the Windows NT4 model of local group
    4749               nesting.  The "winbind expand groups"
    4750               parameter specifically applies to the membership of
    4751               domain groups.</p><p>Be aware that a high value for this parameter can
    4752          result in system slowdown as the main parent winbindd daemon
    4753          must perform the group unrolling and will be unable to answer
    4754          incoming NSS or authentication requests during this time.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>winbind expand groups</code></em> = <code class="literal">1</code>
    4755 </em></span>
    4756 </p></dd><dt><span class="term"><a name="WINBINDNESTEDGROUPS"></a>winbind nested groups (G)</span></dt><dd><p>If set to yes, this parameter activates the support for nested
     5738</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353095"></a>
     5739
     5740winbind nested groups (G)
     5741</h3></div></div></div><a class="indexterm" name="id353096"></a><a name="WINBINDNESTEDGROUPS"></a><div class="variablelist"><dl><dt></dt><dd><p>If set to yes, this parameter activates the support for nested
    47575742                 groups. Nested groups are also called local groups or
    47585743                 aliases. They work like their counterparts in Windows: Nested
    … …  
    47625747                 groups, you need to run nss_winbind.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>winbind nested groups</code></em> = <code class="literal">yes</code>
    47635748</em></span>
    4764 </p></dd><dt><span class="term"><a name="WINBINDNORMALIZENAMES"></a>winbind normalize names (G)</span></dt><dd><p>This parameter controls whether winbindd will replace
     5749</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353140"></a>
     5750
     5751winbind normalize names (G)
     5752</h3></div></div></div><a class="indexterm" name="id353141"></a><a name="WINBINDNORMALIZENAMES"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls whether winbindd will replace
    47655753        whitespace in user and group names with an underscore (_) character.
    47665754        For example, whether the name "Space Kadet" should be
    … …  
    47745762</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>winbind normalize names</code></em> = <code class="literal">yes</code>
    47755763</em></span>
    4776 </p></dd><dt><span class="term"><a name="WINBINDNSSINFO"></a>winbind nss info (G)</span></dt><dd><p>This parameter is designed to control how Winbind retrieves Name
     5764</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353202"></a>
     5765
     5766winbind nss info (G)
     5767</h3></div></div></div><a class="indexterm" name="id353203"></a><a name="WINBINDNSSINFO"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is designed to control how Winbind retrieves Name
    47775768        Service Information to construct a user's home directory and login shell.
    47785769        Currently the following settings are available:
    … …  
    47815772                        - The default, using the parameters of <em class="parameter"><code>template
    47825773                        shell</code></em> and <em class="parameter"><code>template homedir</code></em>)
    4783                         </p></li><li><p><em class="parameter"><code>sfu</code></em>
     5774                        </p></li><li><p><em class="parameter"><code>&lt;sfu | rfc2307 &gt;</code></em>
    47845775                        - When Samba is running in security = ads and your Active Directory
    47855776                        Domain Controller does support the Microsoft "Services for Unix" (SFU)
    47865777                        LDAP schema, winbind can retrieve the login shell and the home
    47875778                        directory attributes directly from your Directory Server. Note that
    4788                         retrieving UID and GID from your ADS-Server requires to use
    4789                         <em class="parameter"><code>idmap backend</code></em> = idmap_ad as well.
     5779                        retrieving UID and GID from your ADS-Server requires to
     5780                        use <em class="parameter"><code>idmap backend</code></em> = ad
     5781                        or <em class="parameter"><code>idmap config DOMAIN:backend</code></em> = ad
     5782                        as well.
    47905783                        </p></li></ul></div><p>
    47915784
    … …  
    47945787</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>winbind nss info</code></em> = <code class="literal">template sfu</code>
    47955788</em></span>
    4796 </p></dd><dt><span class="term"><a name="WINBINDOFFLINELOGON"></a>winbind offline logon (G)</span></dt><dd><p>This parameter is designed to control whether Winbind should
     5789</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353314"></a>
     5790
     5791winbind offline logon (G)
     5792</h3></div></div></div><a class="indexterm" name="id353315"></a><a name="WINBINDOFFLINELOGON"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is designed to control whether Winbind should
    47975793        allow to login with the <em class="parameter"><code>pam_winbind</code></em>
    47985794        module using Cached Credentials. If enabled, winbindd will store user credentials
    … …  
    48025798</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>winbind offline logon</code></em> = <code class="literal">true</code>
    48035799</em></span>
    4804 </p></dd><dt><span class="term"><a name="WINBINDREFRESHTICKETS"></a>winbind refresh tickets (G)</span></dt><dd><p>This parameter is designed to control whether Winbind should refresh Kerberos Tickets
     5800</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353380"></a>
     5801
     5802winbind refresh tickets (G)
     5803</h3></div></div></div><a class="indexterm" name="id353381"></a><a name="WINBINDREFRESHTICKETS"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is designed to control whether Winbind should refresh Kerberos Tickets
    48055804        retrieved using the <em class="parameter"><code>pam_winbind</code></em> module.
    48065805
    … …  
    48095808</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>winbind refresh tickets</code></em> = <code class="literal">true</code>
    48105809</em></span>
    4811 </p></dd><dt><span class="term"><a name="WINBINDRPCONLY"></a>winbind rpc only (G)</span></dt><dd><p>
    4812         Setting this parameter to <code class="literal">yes</code> forces
    4813         winbindd to use RPC instead of LDAP to retrieve information from Domain
    4814         Controllers.
    4815         </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>winbind rpc only</code></em> = <code class="literal">no</code>
    4816 </em></span>
    4817 </p></dd><dt><span class="term"><a name="WINBINDSEPARATOR"></a>winbind separator (G)</span></dt><dd><p>This parameter allows an admin to define the character
     5810</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353445"></a>
     5811
     5812winbind separator (G)
     5813</h3></div></div></div><a class="indexterm" name="id353446"></a><a name="WINBINDSEPARATOR"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter allows an admin to define the character
    48185814        used when listing a username of the form of <em class="replaceable"><code>DOMAIN
    48195815        </code></em>\<em class="replaceable"><code>user</code></em>.  This parameter
    … …  
    48265822</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>winbind separator</code></em> = <code class="literal">+</code>
    48275823</em></span>
    4828 </p></dd><dt><span class="term"><a name="WINBINDTRUSTEDDOMAINSONLY"></a>winbind trusted domains only (G)</span></dt><dd><p>
     5824</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353527"></a>
     5825
     5826winbind trusted domains only (G)
     5827</h3></div></div></div><a class="indexterm" name="id353528"></a><a name="WINBINDTRUSTEDDOMAINSONLY"></a><div class="variablelist"><dl><dt></dt><dd><p>
    48295828        This parameter is designed to allow Samba servers that are members
    48305829        of a Samba controlled domain to use UNIX accounts distributed via NIS,
    … …  
    48345833        </p><p>
    48355834        This parameter is now deprecated in favor of the newer idmap_nss backend.
    4836         Refer to the <a class="indexterm" name="id328357"></a>idmap domains smb.conf option and
    4837         the <a href="idmap_nss.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_nss</span>(8)</span></a> man page for more information.
     5835        Refer to the <a class="link" href="smb.conf.5.html#IDMAPDOMAINS">idmap domains</a> smb.conf option and
     5836        the <a class="citerefentry" href="idmap_nss.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_nss</span>(8)</span></a> man page for more information.
    48385837        </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>winbind trusted domains only</code></em> = <code class="literal">no</code>
    48395838</em></span>
    4840 </p></dd><dt><span class="term"><a name="WINBINDUSEDEFAULTDOMAIN"></a>winbind use default domain (G)</span></dt><dd><p>This parameter specifies whether the
    4841          <a href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> daemon should operate on users 
     5839</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353600"></a>
     5840
     5841winbind use default domain (G)
     5842</h3></div></div></div><a class="indexterm" name="id353601"></a><a name="WINBINDUSEDEFAULTDOMAIN"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter specifies whether the
     5843         <a class="citerefentry" href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> daemon should operate on users 
    48425844        without domain component in their username. Users without a domain
    48435845        component are treated as is part of the winbindd server's own
    … …  
    48485850</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>winbind use default domain</code></em> = <code class="literal">yes</code>
    48495851</em></span>
    4850 </p></dd><dt><span class="term"><a name="WINSHOOK"></a>wins hook (G)</span></dt><dd><p>When Samba is running as a WINS server this
     5852</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353668"></a>
     5853
     5854wins hook (G)
     5855</h3></div></div></div><a class="indexterm" name="id353670"></a><a name="WINSHOOK"></a><div class="variablelist"><dl><dt></dt><dd><p>When Samba is running as a WINS server this
    48515856        allows you to call an external program for all changes to the
    48525857        WINS database. The primary use for this option is to allow the
    … …  
    48695874                        empty then the name should be deleted.</p></li></ul></div><p>An example script that calls the BIND dynamic DNS update
    48705875        program <code class="literal">nsupdate</code> is provided in the examples
    4871         directory of the Samba source code. </p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="WINSPROXY"></a>wins proxy (G)</span></dt><dd><p>This is a boolean that controls if <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> will respond to broadcast name
     5876        directory of the Samba source code. </p><p><span class="emphasis"><em>No default</em></span></p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353763"></a>
     5877
     5878wins proxy (G)
     5879</h3></div></div></div><a class="indexterm" name="id353764"></a><a name="WINSPROXY"></a><div class="variablelist"><dl><dt></dt><dd><p>This is a boolean that controls if <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> will respond to broadcast name
    48725880        queries on behalf of  other hosts. You may need to set this
    48735881        to <code class="constant">yes</code> for some older clients.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>wins proxy</code></em> = <code class="literal">no</code>
    48745882</em></span>
    4875 </p></dd><dt><span class="term"><a name="WINSSERVER"></a>wins server (G)</span></dt><dd><p>This specifies the IP address (or DNS name: IP
    4876         address for preference) of the WINS server that <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> should register with. If you have a WINS server on
     5883</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353816"></a>
     5884
     5885wins server (G)
     5886</h3></div></div></div><a class="indexterm" name="id353817"></a><a name="WINSSERVER"></a><div class="variablelist"><dl><dt></dt><dd><p>This specifies the IP address (or DNS name: IP
     5887        address for preference) of the WINS server that <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> should register with. If you have a WINS server on
    48775888        your network then you should set this to the WINS server's IP.</p><p>You should point this at your WINS server if you have a
    48785889        multi-subnetted network.</p><p>If you want to work in multiple namespaces, you can
    … …  
    48925903</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>wins server</code></em> = <code class="literal">192.9.200.1 192.168.2.61</code>
    48935904</em></span>
    4894 </p></dd><dt><span class="term"><a name="WINSSUPPORT"></a>wins support (G)</span></dt><dd><p>This boolean controls if the <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> process in Samba will act as a WINS server. You should
     5905</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353919"></a>
     5906
     5907wins support (G)
     5908</h3></div></div></div><a class="indexterm" name="id353920"></a><a name="WINSSUPPORT"></a><div class="variablelist"><dl><dt></dt><dd><p>This boolean controls if the <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> process in Samba will act as a WINS server. You should
    48955909        not set this to <code class="constant">yes</code> unless you have a multi-subnetted network and
    48965910        you wish a particular <code class="literal">nmbd</code> to be your WINS server.
    … …  
    48985912        on more than one machine in your network.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>wins support</code></em> = <code class="literal">no</code>
    48995913</em></span>
    4900 </p></dd><dt><span class="term"><a name="WORKGROUP"></a>workgroup (G)</span></dt><dd><p>This controls what workgroup your server will
     5914</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353985"></a>
     5915
     5916workgroup (G)
     5917</h3></div></div></div><a class="indexterm" name="id353986"></a><a name="WORKGROUP"></a><div class="variablelist"><dl><dt></dt><dd><p>This controls what workgroup your server will
    49015918        appear to be in when queried by clients. Note that this parameter
    49025919        also controls the Domain name used with
    4903         the <a class="indexterm" name="id328788"></a>security = domain
     5920        the <a class="link" href="smb.conf.5.html#SECURITY">security = domain</a>
    49045921                setting.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>workgroup</code></em> = <code class="literal">WORKGROUP</code>
    49055922</em></span>
    49065923</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>workgroup</code></em> = <code class="literal">MYGROUP</code>
    49075924</em></span>
    4908 </p></dd><dt><span class="term"><a name="WRITABLE"></a>writable</span></dt><dd><p>This parameter is a synonym for writeable.</p></dd><dt><span class="term"><a name="WRITEABLE"></a>writeable (S)</span></dt><dd><p>Inverted synonym for <a class="indexterm" name="id328872"></a>read only.</p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="WRITECACHESIZE"></a>write cache size (S)</span></dt><dd><p>If this integer parameter is set to non-zero value,
     5925</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id354055"></a><a name="WRITABLE"></a>writable</h3></div></div></div><a class="indexterm" name="id354056"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter is a synonym for <a class="link" href="#WRITEABLE">writeable</a>.</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id354085"></a>
     5926
     5927writeable (S)
     5928</h3></div></div></div><a class="indexterm" name="id354086"></a><a name="WRITEABLE"></a><div class="variablelist"><dl><dt></dt><dd><p>Inverted synonym for <a class="link" href="smb.conf.5.html#READONLY">read only</a>.</p><p><span class="emphasis"><em>No default</em></span></p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id354123"></a>
     5929
     5930write cache size (S)
     5931</h3></div></div></div><a class="indexterm" name="id354124"></a><a name="WRITECACHESIZE"></a><div class="variablelist"><dl><dt></dt><dd><p>If this integer parameter is set to non-zero value,
    49095932    Samba will create an in-memory cache for each oplocked file
    49105933    (it does <span class="emphasis"><em>not</em></span> do this for
    … …  
    49245947#  for a 256k cache size per file</code>
    49255948</em></span>
    4926 </p></dd><dt><span class="term"><a name="WRITELIST"></a>write list (S)</span></dt><dd><p>
     5949</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id354199"></a>
     5950
     5951write list (S)
     5952</h3></div></div></div><a class="indexterm" name="id354200"></a><a name="WRITELIST"></a><div class="variablelist"><dl><dt></dt><dd><p>
    49275953    This is a list of users that are given read-write access to a service. If the
    49285954    connecting user is in this list then they will be given write access, no matter
    4929     what the <a class="indexterm" name="id328980"></a>read only option is set to. The list can
     5955    what the <a class="link" href="smb.conf.5.html#READONLY">read only</a> option is set to. The list can
    49305956    include group names using the @group syntax.
    49315957    </p><p>
    … …  
    49345960    </p><p>
    49355961    By design, this parameter will not work with the
    4936     <a class="indexterm" name="id328995"></a>security = share in Samba 3.0.
     5962    <a class="link" href="smb.conf.5.html#SECURITY">security = share</a> in Samba 3.0.
    49375963    </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>write list</code></em> = <code class="literal"></code>
    49385964</em></span>
    49395965</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>write list</code></em> = <code class="literal">admin, root, @staff</code>
    49405966</em></span>
    4941 </p></dd><dt><span class="term"><a name="WRITERAW"></a>write raw (G)</span></dt><dd><p>This parameter controls whether or not the server
     5967</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id354286"></a>
     5968
     5969write raw (G)
     5970</h3></div></div></div><a class="indexterm" name="id354287"></a><a name="WRITERAW"></a><div class="variablelist"><dl><dt></dt><dd><p>This parameter controls whether or not the server
    49425971    will support raw write SMB's when transferring data from clients.
    49435972    You should never need to change this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>write raw</code></em> = <code class="literal">yes</code>
    49445973</em></span>
    4945 </p></dd><dt><span class="term"><a name="WTMPDIRECTORY"></a>wtmp directory (G)</span></dt><dd><p>
     5974</p></dd></dl></div></div><div class="section" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id354328"></a>
     5975
     5976wtmp directory (G)
     5977</h3></div></div></div><a class="indexterm" name="id354329"></a><a name="WTMPDIRECTORY"></a><div class="variablelist"><dl><dt></dt><dd><p>
    49465978        This parameter is only available if Samba has been configured and compiled with the option <code class="literal">
    49475979        --with-utmp</code>. It specifies a directory pathname that is used to store the wtmp or wtmpx files (depending on
    … …  
    49555987</p><p>Example: <span class="emphasis"><em><em class="parameter"><code>wtmp directory</code></em> = <code class="literal">/var/log/wtmp</code>
    49565988</em></span>
    4957 </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id329153"></a><h2>WARNINGS</h2><p>
     5989</p></dd></dl></div></div></div></div><div class="refsect1" lang="en"><a name="id354406"></a><h2>WARNINGS</h2><p>
    49585990        Although the configuration file permits service names to contain spaces, your client software may not.
    49595991        Spaces will be ignored in comparisons anyway, so it shouldn't be a problem - but be aware of the possibility.
    49605992        </p><p>
    49615993        On a similar note, many clients - especially DOS clients - limit service names to eight characters.
    4962         <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> has no such
     5994        <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> has no such
    49635995        limitation, but attempts to connect from such clients will fail if they truncate the service names.  For this
    49645996        reason you should probably keep your service names down to eight characters in length.
    … …  
    49686000        care when designing these sections. In particular, ensure that the permissions on spool directories are
    49696001        correct.
    4970         </p></div><div class="refsect1" lang="en"><a name="id329196"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba suite.</p></div><div class="refsect1" lang="en"><a name="id329207"></a><h2>SEE ALSO</h2><p>
    4971         <a href="samba.7.html"><span class="citerefentry"><span class="refentrytitle">samba</span>(7)</span></a>, <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>, <a href="swat.8.html"><span class="citerefentry"><span class="refentrytitle">swat</span>(8)</span></a>, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>, <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a>, <a href="smbclient.1.html"><span class="citerefentry"><span class="refentrytitle">smbclient</span>(1)</span></a>, <a href="nmblookup.1.html"><span class="citerefentry"><span class="refentrytitle">nmblookup</span>(1)</span></a>, <a href="testparm.1.html"><span class="citerefentry"><span class="refentrytitle">testparm</span>(1)</span></a>, <a href="testprns.1.html"><span class="citerefentry"><span class="refentrytitle">testprns</span>(1)</span></a>.</p></div><div class="refsect1" lang="en"><a name="id329286"></a><h2>AUTHOR</h2><p>
     6002        </p></div><div class="refsect1" lang="en"><a name="id354449"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba suite.</p></div><div class="refsect1" lang="en"><a name="id354460"></a><h2>SEE ALSO</h2><p>
     6003        <a class="citerefentry" href="samba.7.html"><span class="citerefentry"><span class="refentrytitle">samba</span>(7)</span></a>, <a class="citerefentry" href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>, <a class="citerefentry" href="swat.8.html"><span class="citerefentry"><span class="refentrytitle">swat</span>(8)</span></a>, <a class="citerefentry" href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>, <a class="citerefentry" href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a>, <a class="citerefentry" href="smbclient.1.html"><span class="citerefentry"><span class="refentrytitle">smbclient</span>(1)</span></a>, <a class="citerefentry" href="nmblookup.1.html"><span class="citerefentry"><span class="refentrytitle">nmblookup</span>(1)</span></a>, <a class="citerefentry" href="testparm.1.html"><span class="citerefentry"><span class="refentrytitle">testparm</span>(1)</span></a>, <a class="citerefentry" href="testprns.1.html"><span class="citerefentry"><span class="refentrytitle">testprns</span>(1)</span></a>.</p></div><div class="refsect1" lang="en"><a name="id354539"></a><h2>AUTHOR</h2><p>
    49726004        The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed
    49736005        by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.
    49746006        </p><p>
    49756007        The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another
    4976         excellent piece of Open Source software, available at <a href="ftp://ftp.icce.rug.nl/pub/unix/" target="_top">
     6008        excellent piece of Open Source software, available at <a class="ulink" href="ftp://ftp.icce.rug.nl/pub/unix/" target="_top">
    49776009        ftp://ftp.icce.rug.nl/pub/unix/</a>) and updated for the Samba 2.0 release by Jeremy Allison.  The conversion
    49786010        to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by
Note: See TracChangeset for help on using the changeset viewer.